26:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/23qlsjvno4-wq.js","/_next/static/chunks/11pkz44bx8x1b.js","/_next/static/chunks/04k_7k5p4krw4.js"],"ReportDetailWrapper"] 7c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 25:T48d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Clean — Falcon Sandbox Report 696a41b1b001… — Sample bd11fd16014c…","description":"Clean verdict for sandbox report 696a41b1b001…. 2 malicious and 15 suspicious behavioral indicators across 279 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/bd11fd16014ce10d456fda42dabc79369d15074137edbda70dbeb201212735d7/696a41b1b001adeb89022aba","keywords":["Clean","sandbox report","malware analysis","MITRE ATT\u0026CK","bd11fd16014ce10d456fda42dabc79369d15074137edbda70dbeb201212735d7"],"about":{"@type":"SoftwareApplication","name":"scp.exe","applicationCategory":"PE32 executable for MS Windows 6.00 (GUI), Intel i386 (stripped to external PDB), 9 sections","identifier":"bd11fd16014ce10d456fda42dabc79369d15074137edbda70dbeb201212735d7","additionalType":"Clean sample"},"sandboxEnvironment":"Windows 10 64 bit","behavioralIndicators":{"malicious":2,"suspicious":15,"totalSignatures":279},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAzMzMzMzMwAAAAAAAAAAAAM4iIiIiIMAAAAAAAAAAAAAMzMzMzeDAAAAAAAAAAAAAAMzMzMzgwAAAAAAAAAAAAACMzMzM4MAAAAHd3d3d3d3czMzMzODAAAAB4d3d3d3dzMzMzMzgwAAAAf4iIiHd3MzMzMzM4MAAAAH+IiIiHczMzMzMzODAAAAB/iIiIiHMzMzMzMzgwAAAAf4iIiIhzMzMzMyM4MAAAAH+IiIiIhzMzMzIAMzAAAAB/iIiIiIhzMzMgAAMwAAAAf/iIiIiIhzM3AAAAAAAAAH//iIiIiIhzdwAAAAAAAAB///iIiIiIiHcAAAAAAAAAf///iIiIiIh3AAAAAAAAAHj/////////hwAAAAAAAABmd3d3d3d3d3cAAAAGYAAGZn+HQAAAf3dwAAAABmYAZmZ/h2QAAH+HcAAAAAaGZmbuf4dmAAB/hwAAAAAGjmZu7n/3ZgAHeIcAAAAABo7m7u5/+Hd3d4h3AAAAAAaO7u7uZ/+Hd3iIdwAAAAAGju7u7uaP//+Ih3AAAAAABo7u7u5md///+HcAAAAAAAb+7u7mZgd3d3dwAAAAAAAG/u7u7mYAAAAAAAAAAAAABv7u7u7mYAAAAAAAAAAAAAb//4iIiGYAAAAAAAAAAAAGZmZmZmZmAAAAAAAAAAAAD//+AA///gAP//8AD///gA///4AP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AABj+AAA8/gAAf/4AAH/+AAB//gAAf/4AAH/+AAB/PAPg/xgB4P8AAcD/AAHB/wAAAf8AAAH/AAAD/wAAA/8AEA//AB///wAP//8AB///AAf//w==28:T62e,"scp.exe" called "FindResourceW" with parameter "123061868" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "123222860" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "131585292" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "131585260" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "131038364" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "131038404" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "131038444" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "131585100" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "131585068" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "131038484" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "131583020" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "131582988" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "131039284" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "131039324" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "131039364" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "131056340" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "130998588" - (UID: 00000000-00000876) "scp.exe" called "FindResourceW" with parameter "130998556" - (UID: 00000000-00000876)29:T68e,"scp.exe" called "LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20787024'}" (UID: 00000000-00000876) "scp.exe" called "LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20787120'}" (UID: 00000000-00000876) "scp.exe" called "LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20786848'}" (UID: 00000000-00000876) "scp.exe" called "LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782352'}" (UID: 00000000-00000876) "scp.exe" called "LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782656'}" (UID: 00000000-00000876) "scp.exe" called "LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782192'}" (UID: 00000000-00000876) "scp.exe" called "LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782800'}" (UID: 00000000-00000876) "scp.exe" called "LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782480'}" (UID: 00000000-00000876) "scp.exe" called "LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782400'}" (UID: 00000000-00000876) "scp.exe" called "LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782704'}" (UID: 00000000-00000876) "scp.exe" called "LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782240'}" (UID: 00000000-00000876) "scp.exe" called "LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782848'}" (UID: 00000000-00000876) "scp.exe" called "LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782528'}" (UID: 00000000-00000876) "scp.exe" called "LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20787232'}" (UID: 00000000-00000876)2a:Te8e,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "scp.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "scp.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "scp.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "scp.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "scp.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "scp.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "scp.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "scp.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "scp.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "scp.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "scp.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "scp.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "scp.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "scp.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "scp.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "scp.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp")2b:T55e,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "scp.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "scp.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "scp.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "scp.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "scp.exe") Found reference to API "hrdir_b.c: LoadLibrary != mmdll borlndmm failed" (Indicator: "LoadLibrary"; Source: "00000000-00000876.00000000.158908.01303000.00000004.mdmp, 00000000-00000876.00000002.162748.01303000.00000004.mdmp, 00000000-00000876.00000003.170180.01303000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp")2c:T451,Found reference to API "RegRestoreKeyW" (Indicator: "RegRestoreKey"; File: "scp.exe") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "scp.exe") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "scp.exe") Found reference to API "RegReplaceKeyW" (Indicator: "RegReplaceKey"; File: "scp.exe") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; File: "scp.exe") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "RegReplaceKeyW" (Indicator: "RegReplaceKey"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "RegRestoreKeyW" (Indicator: "RegRestoreKey"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp")2d:T49a,Found string "0123456789abcdefABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp") Found string "0123456789abcdefABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp")2e:Tb71,Found reference to "PermitRSASHA512" (Indicator: "SHA512"; File: "scp.exe") Found reference to "XSHA512" (Indicator: "SHA512"; File: "scp.exe") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00000876.00000000.158908.01147000.00000004.mdmp, 00000000-00000876.00000003.170180.01147000.00000004.mdmp") Found reference to "HMAC routines" (Indicator: "HMAC"; Source: "00000000-00000876.00000000.158908.01147000.00000004.mdmp, 00000000-00000876.00000003.170180.01147000.00000004.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.01157000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp") Found reference to "SHA512-256" (Indicator: "SHA512"; Source: "00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp") Found reference to "SHA512-224" (Indicator: "SHA512"; Source: "00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp") Found reference to "HMAC-DRBG" (Indicator: "HMAC"; Source: "00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp") Found reference to "RC2-ECB" (Indicator: "RC2"; Source: "00000000-00000876.00000003.170180.01157000.00000004.mdmp") Found reference to "RC2-CFB" (Indicator: "RC2"; Source: "00000000-00000876.00000003.170180.01157000.00000004.mdmp") Found reference to "RC2-OFB" (Indicator: "RC2"; Source: "00000000-00000876.00000003.170180.01157000.00000004.mdmp") Found reference to "PBE-SHA1-RC2-64" (Indicator: "RC2"; Source: "00000000-00000876.00000003.170180.01157000.00000004.mdmp") Found reference to "pbeWithSHA1AndRC2-CBC" (Indicator: "RC2"; Source: "00000000-00000876.00000003.170180.01157000.00000004.mdmp")2f:T59b,"scp.exe" (Access type: "OPEN"; Path: "HKCU\DIRECTORY\BROWSEINPLACE") "scp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY\BROWSEINPLACE") "scp.exe" (Access type: "OPEN"; Path: "HKCU\FOLDER") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER") "scp.exe" (Access type: "OPEN"; Path: "HKCU\FOLDER\BROWSEINPLACE") "scp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER\BROWSEINPLACE") "scp.exe" (Access type: "OPEN"; Path: "HKCU\ALLFILESYSTEMOBJECTS") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\ALLFILESYSTEMOBJECTS") "scp.exe" (Access type: "OPEN"; Path: "HKCU\ALLFILESYSTEMOBJECTS\BROWSEINPLACE") "scp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\ALLFILESYSTEMOBJECTS\BROWSEINPLACE") "scp.exe" (Access type: "OPEN"; Path: "HKCU\DIRECTORY\CLSID") "scp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY\CLSID") "scp.exe" (Access type: "OPEN"; Path: "HKCU\FOLDER\CLSID") "scp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER\CLSID") "scp.exe" (Access type: "OPEN"; Path: "HKCU\ALLFILESYSTEMOBJECTS\CLSID") "scp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\ALLFILESYSTEMOBJECTS\CLSID") "scp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY") "scp.exe" (Access type: "QUERYVAL"; Path: "HKCU\DIRECTORY") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY")30:T134c,Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "scp.exe") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "scp.exe") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "scp.exe") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "scp.exe") Found api reference "CertCreateCertificateChainEngine" (Indicator: "CertCreateCertificateChainEngine"; File: "scp.exe") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; File: "scp.exe") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "scp.exe") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChain"; File: "scp.exe") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChainEngine"; File: "scp.exe") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; File: "scp.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp") Found api reference "CertFindChainInStore" (Indicator: "CertFindChainInStore"; Source: "00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp") Found api reference "CertNameToStrW" (Indicator: "CertNameToStrW"; Source: "00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp") Found api reference "CertOpenSystemStoreW" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp") Found api reference "CryptDecodeObject" (Indicator: "CryptDecodeObject"; Source: "00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp") Found api reference "PFXImportCertStore" (Indicator: "PFXImportCertStore"; Source: "00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp") Found api reference "CertCreateCertificateChainEngine" (Indicator: "CertCreateCertificateChainEngine"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChainEngine"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp")31:T1531,Found string "Public key installation done." (Indicator: "public key"; File: "scp.exe") Found string "Install public key for authentication into the server" (Indicator: "public key"; Source: "00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp") Found string "&Install Public Key into Server..." (Indicator: "public key"; Source: "00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp") Found string "not a private key" (Indicator: "private key"; Source: "00000000-00000876.00000002.162748.011BD000.00000004.mdmp, 00000000-00000876.00000003.170180.011AA000.00000004.mdmp") Found string "not a public key" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.011BD000.00000004.mdmp, 00000000-00000876.00000003.170180.011AA000.00000004.mdmp") Found string "not a PuTTY SSH-2 private key" (Indicator: "private key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "---- BEGIN SSH2 PUBLIC KEY ----" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "invalid begin line in SSH-2 public key file" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "truncated SSH-2 public key file" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "unrecognised header in SSH-2 public key file" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "---- END SSH2 PUBLIC KEY ----" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "invalid end line in SSH-2 public key file" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "not enough data in SSH-2 public key file" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "invalid algorithm prefix in SSH-2 public key file" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "no key blob in OpenSSH public key file" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "invalid length for base64 data in OpenSSH public key file" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "key algorithms do not match in OpenSSH public key file" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "not a public key or a PuTTY SSH-2 private key" (Indicator: "private key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "not a public key or a PuTTY SSH-2 private key" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "---- BEGIN SSH2 PUBLIC KEY" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "-----BEGIN OPENSSH PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "SSH-1 public key" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "SSH-2 public key (RFC 4716 format)" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "SSH-2 public key (OpenSSH format)" (Indicator: "public key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "SSH-1 private key" (Indicator: "private key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp") Found string "PuTTY SSH-2 private key" (Indicator: "private key"; Source: "00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp")32:T6c2,Found string "GetUserNameExW" (Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found string "GetUserNameA" (Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found string "UserNameLabel" (Source: "00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.0A8D0000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.0A8D0000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.0A8D0000.00000004.mdmp") Found string "UserNameEdit" (Source: "00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.0A8D0000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.0A8D0000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.0A8D0000.00000004.mdmp") Found string "ystem.Identity.QualifiedUserName" (Source: "00000000-00000876.00000001.160828.09130000.00000002.mdmp") Found string "ystem.Identity.UserName" (Source: "00000000-00000876.00000001.160828.09130000.00000002.mdmp") Found string "ystem.UserName" (Source: "00000000-00000876.00000001.160828.09130000.00000002.mdmp") Found string "System.Identity.UserName" (Source: "00000000-00000876.00000001.160828.09190000.00000002.mdmp") Found string "System.Identity.QualifiedUserName" (Source: "00000000-00000876.00000001.160828.09190000.00000002.mdmp") Found string "System.UserName" (Source: "00000000-00000876.00000001.160828.09190000.00000002.mdmp") Found string "GetUserNameExA" (Source: "00000000-00000876.00000003.170180.01214000.00000004.mdmp")33:T7c7,Found system information discovery API: "GetEnvironmentStringsW" in file "scp.exe" Found system information discovery API: "ExpandEnvironmentStringsW" in file "scp.exe" Found system information discovery API: "GetEnvironmentStrings" in file "scp.exe" Found system information discovery API: "GetSystemInfo" in file "scp.exe" Found system information discovery API: "GetMonitorInfoW" in file "scp.exe" Found system information discovery API: "GetUserObjectInformationW" in file "scp.exe" Found system information discovery API: "GetEnvironmentStrings failed" in "00000000-00000876.00000000.158908.01303000.00000004.mdmp, 00000000-00000876.00000002.162748.01303000.00000004.mdmp, 00000000-00000876.00000003.170180.01303000.00000004.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp" Found system information discovery API: "WTSRegisterSessionNotification" in "00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00000876.00000001.160828.013A0000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00000876.00000001.160828.013A0000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00000876.00000001.160828.013A0000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00000876.00000001.160828.013A0000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00000876.00000001.160828.013A0000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00000876.00000001.160828.013A0000.00000002.mdmp"34:T606,Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "scp.exe") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; File: "scp.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "scp.exe") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "scp.exe") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "scp.exe") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "scp.exe") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp")35:T934,Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "scp.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "scp.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "scp.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "scp.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "scp.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "scp.exe") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "scp.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "scp.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "scp.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "433661481781,492,100,,FindWindowExW,user32.dll,"00:44:19.062",RX=0,PX=0" (Indicator: "findwindow"; Source: "00000000-00000876.00000003.170180.04010000.00000004.mdmp") Found reference to API "433596734404,492,110,,EnumWindows,user32.dll,"00:44:19.031",RX=0,PX=0" (Indicator: "enumwindows"; Source: "00000000-00000876.00000003.170180.04010000.00000004.mdmp")36:T30fa,"scp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000100000001000001c00000065000000000000002cfacf010000000000000000000000000000000000000000001019001e00000037064277ffffffffffffffff240109010000000000000000000000002cfacf01000000001c00000000000000acf9cf01000000001edb108c00facf0132ba447704eb3901000000000000000004eb390134facf01e0db080104eb3901fc10190048facf01cb7208016c7230010cfacf010c0000002cfacf011c00000000000000000019006cfacf010cc00801f4ea39011004000040000000acfacf01cb720801786d300148facf010c00000000000000acfacf0176252d007d252d00 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000a37b0000000044facf011000000031ad789944facf018e336174d4ca590728cb59079c336174e0010000400074007a007200650073002e0064006c006c002c002d003200310032000000000000000000000000000000000000000000000000000000000000000000000000000b0001000200000000000000000000000000400074007a007200650073002e0064006c006c002c002d0032003100310000000000000000000000000000000000000000000000000000000000000058902c0050facf0165902c0048facf0128cb590770ca590701facf01048f2d00385e0f01048f2d00f3a22c0090a23b000000000035a32c001e0000000010190016121900 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000009295a37bc3486472b8f2cf01a018667228facf01a018667266950b08feffffffdcf9cf015c7f647288f9cf010010190000800000757f6472f8f9cf01ffffffffffffffff0c00000000000000f8f9cf01000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff0c00000000000000f8f9cf010000000004000000d5982c0080345b07fd932c000100000008672c0000000000ba922c0000facf01 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000b8e0cf0138cf43777c38010424e1cf0101000000303801047c38010430380104040000000400000000e06b740010000024e1cf010100000030380104cd9743779c974377eec1108cb50f6274303801040000437700000000d4019c720000000080ee68740100000000000000f8e26b7400000000040000000000000048406a74f8e26b7428e1cf0180e88774c89d010480e8877424e1cf010000000080e887746c93cafdfeffffff000000000000000000000000130000005c4e0504020000000200000018000000304e05045c4e050400000000f5bb7899a8e3cf01ddf35f749ce1cf0100000000304e050418000000f8f35f74304e0504 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0000006f00660074005c00570069006e0064006f00770073005c0043006100630068006500730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000882e0304a02e0304 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000188150604881506040a00100000000000150000000000000090150604e07706040000000000000100feffffff000000006002010400000000000000060000000015000000000000006002010415000000150000001500000015000000000000000000000080edcf01506a4677f2d691fafeffffff20edcf01b7164377e8020000f00200000c0401040cedcf0170bf9f720000010400000000f002000000000000000000005e0000000300000000000104e8020000080010000000000040edcf01ee13437740000000ee1343770800100000000000000000000800000090edcf01a40c61740000010408001000b50c617405b7789970bf9f7204010000 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000002003293d974e4b1d5740183c65600000000680302004e00000030c0cf01240000000100000000e1cf010000000070000000ff1e30feffffffff25b0d57400000000e862730530becf010000000048bfcf01a0186672000000000000000058bfcf01222ab3738002000000000000000000000000000030bfcf011cbfcf01524346774300000070bfcf0173f65f74b2bfcf015c00000000000000fdfeff7f82f85f7400000000bc45c5fdfeffffff00000000000000000000000005000000007a0a0402000000020000000a000000f0790a04007a0a0400000000e5e57899b8c1cf01ddf35f74acbfcf0100000000f0790a040a000000f8f35f74f0790a04 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a0ff0204b4ff0204 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000090560d04000001040000010490560d04306d0104306d01047f070000c0000104d8320d0444becf01d2fb417701000000ff0700002a41000090560d04000001040000000000000000000001040000000000000000fc1d000048540d040000010400000000e8627305306d0104306d01047f070000c00001040000000000000000d2fb417701000000ff0700007341000048540d040000010400000000e8627305f8c2cf01d4c2cf0181f11177e862730510c8cf01a0c4cf01c5f11177000001049834437750540d0400c3cf011c600e7704000000f8c2cf015c837c74e0627305a090157700000000b4bfcf0100000000 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000647290800304001000000400000000600d040000000000f0010000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000e8627305000000000000000068bdcf010000000000000000000000000400000000000000ab3f000092d1a37bf8bdcf01deed4177ffffffffdcbdcf01524346774300000030becf0173f65f748ebecf015c000000000000000bffff7f82f85f7400000000d449cbfdffffffff00000000000000000000000009000000cc74040401000000010000001b00000098740404cc74040400000000a5e4789978c0cf01ddf35f746cbecf0100000000987404041b000000f8f35f7498740404 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d0670d04e8670d04 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000020022000080c10a0f0700000000000000000000000000000000000000000000000000000000010000005e030200010000003183c65600000000e8627305c0bfcf01bed3a37bb8becf01feffffff000000000000000000000b08feffffffe0bfcf01222ab37380020000000000000000000000000000b8bfcf01a4bfcf015243467743000000f8bfcf0173f65f743ac0cf015c00000000000000fdfeff7f82f85f74000000000420c2fdfeffffff0000000000000000000000000500000040a00d0402000000020000000a00000030a00d0440a00d04000000006de5789940c2cf01ddf35f7434c0cf010000000030a00d040a000000f8f35f7430a00d04 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c0010304d4010304 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000010000010000000000000001cf6d0100000000000000c0becf01854a9474df878c748c0fc3cc90800304d0910b04382c0a04a4cf7b74a4cf7b7466d2a37b00000000000000005cc2cf01a01866720e9a0b08feffffff0000cf01881a6074b31a60749080030400000000e86273050000000068c2cf018b848c74330000000000000000000000807f8c74b4858c74b8bfcf0100000000000000003187dc01202c0a04d0910b0490800304e862730580c3cf015cc3cf0181f11177e862730598c8cf0128c5cf01c5f111770000010498344377a0a80d0488c3cf011c600e770400000080c3cf015c837c74e0627305a090157700000000010000005e030200 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000060749080030480f90a04000000000000000098c1cf018b848c7433000000d470c3cc14aa0d04807f8c74b4858c74a15b6472ea61848100000000e8627305b02d0a04888e0b04908003040c0000000000000000000000000003041c0100000a00000000000000ab3f00000200000000000100000100000000000064becf015243467743000000b8becf0173f65f7416bfcf015c000000000000000bffff7f82f85f74000000009c4ecbfdffffffff000000000000000000000000090000008c70040401000000010000001b000000587004048c700404000000002de4789900c1cf01ddf35f74f4becf0100000000587004041b000000f8f35f7458700404 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000060680d0478680d04 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000020022000080a8070f07000000000000000000000000000000000000000000000000000000000100000042030200010000009982c65604becf010000000000000000e862730510becf01feffffff28bfcf01a0186672000000000000000038bfcf01222ab3738002000000000000000000000000000010bfcf01fcbecf01524346774300000050bfcf0173f65f7492bfcf015c00000000000000fdfeff7f82f85f7400000000947cc1fdfeffffff0000000000000000000000000500000008430e0402000000020000000a000000f8420e0408430e0400000000c5e5789998c1cf01ddf35f748cbfcf0100000000f8420e040a000000f8f35f74f8420e04 (UID: 00000000-00000876) "scp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000040670d0454670d04 (UID: 00000000-00000876)37:T4d9,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "scp.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "scp.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "scp.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "scp.exe") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "scp.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp")38:Te3e,Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "scp.exe") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "scp.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "scp.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "scp.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "scp.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "scp.exe") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "scp.exe") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "scp.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "82323362952,492,105,,GetForegroundWindow,user32.dll,"00:41:52.671",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found reference to API "82063506975,492,105,,GetForegroundWindow,user32.dll,"00:41:52.562",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found reference to API "82773509111,492,105,,GetForegroundWindow,user32.dll,"00:41:52.859",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found reference to API "82773263881,492,105,,GetForegroundWindow,user32.dll,"00:41:52.859",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found reference to API "82773386867,492,105,,GetForegroundWindow,user32.dll,"00:41:52.859",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found reference to API "154323907693,492,105,,GetForegroundWindow,user32.dll,"00:42:22.671",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp") Found reference to API "153647366435,492,107,,GetActiveWindow,user32.dll,"00:42:22.390",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp") Found reference to API "154323327405,492,105,,GetForegroundWindow,user32.dll,"00:42:22.671",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp") Found reference to API "154323659465,492,105,,GetForegroundWindow,user32.dll,"00:42:22.671",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp")39:T629,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "scp.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "scp.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "scp.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "scp.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "scp.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "scp.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "scp.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp")3a:T68b,"scp.exe" queries volume information of "C:\share" at 00000000-00000876-00000C17-1455148669 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1456359615 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1456362365 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1456367775 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1457063740 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1457066523 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1457071573 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1500827078 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1500830036 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1500835507 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1530862699 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1530865245 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1530870981 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1590865899 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1590869081 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1590874280 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1620865787 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1620868511 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-16208742913b:T62e,"scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1456359615 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1456362365 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1456367775 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1457063740 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1457066523 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1457071573 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1500827078 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1500830036 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1500835507 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1530862699 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1530865245 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1530870981 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1590865899 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1590869081 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1590874280 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1620865787 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-1620868511 "scp.exe" queries volume information of "C:\" at 00000000-00000876-00000C17-16208742913c:T8bd,"scp.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter WTSAPI32.DLL (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter UXTHEME.DLL (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter shcore (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter olepro32.dll (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32.dll (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter security.dll (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter SHCORE.DLL (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter USER32.DLL (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter Ole32.dll (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00000876) "scp.exe" called "LoadLibrary" with a parameter IMM32.DLL (UID: 00000000-00000876)3d:T529b,"scp.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter ___CPPdebugHook (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter Borland32 (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetSystemMetricsForDpi (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter SystemParametersInfoForDpi (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter OleIconToCursor (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter OleCreateFontIndirect (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter OleCreatePictureIndirect (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter OleLoadPicture (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter OleTranslateColor (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter OleCreatePropertyFrame (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter OleCreatePropertyFrameIndirect (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetTimeZoneInformationForYear (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetCurrentPackageFamilyName (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter WSAAddressToStringA (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter WSAAsyncSelect (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter WSAGetLastError (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter WSAEnumNetworkEvents (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter WSACleanup (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter ntohl (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter htonl (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter htons (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter ntohs (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter gethostname (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter gethostbyname (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter getservbyname (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter inet_addr (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter inet_ntoa (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter inet_ntop (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter connect (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter getsockopt (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter listen (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter accept (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter getsockname (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter SHGetImageList (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetProcessDpiAwareness (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter EnableNonClientDpiScaling (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetDpiForWindow (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter ImageList_WriteEx (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter LoadIconMetric (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter BeginBufferedPaint (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter BufferedPaintSetAlpha (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter EndBufferedPaint (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter DrawThemeTextEx (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter ImmAssociateContextEx (UID: 00000000-00000876) "scp.exe" called "GetProcAddress" with a parameter WTSUnRegisterSessionNotification (UID: 00000000-00000876)3e:T530,Found reference to API "LockResource" (Indicator: "LockResource"; File: "scp.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "scp.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "scp.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "scp.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "scp.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "scp.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp")3f:T8f2,"scp.exe" contains export function called "@$xp$108System@Generics@Collections@%TEnumerable__1$61System@Generics@Collections@%TPair__2$ip18Vcl@Graphics@TFont%%" at ordinal 849 "scp.exe" contains export function called "@$xp$108System@Generics@Collections@%TEnumerator__1$61System@Generics@Collections@%TPair__2$ip18Vcl@Graphics@TFont%%" at ordinal 846 "scp.exe" contains export function called "@$xp$12TUnixDirView" at ordinal 2213 "scp.exe" contains export function called "@$xp$12Tbx@TTBXDock" at ordinal 1125 "scp.exe" contains export function called "@$xp$12Tbx@TTBXItem" at ordinal 1094 "scp.exe" contains export function called "@$xp$13Tbx@TFontSize" at ordinal 1084 "scp.exe" contains export function called "@$xp$13Tbx@TTriState" at ordinal 1083 "scp.exe" contains export function called "@$xp$15Tb2dock@TTBDock" at ordinal 174 "scp.exe" contains export function called "@$xp$15Tb2item@TTBItem" at ordinal 512 "scp.exe" contains export function called "@$xp$15Tb2item@TTBView" at ordinal 507 "scp.exe" contains export function called "@$xp$15Tbx@TTBXToolbar" at ordinal 1111 "scp.exe" contains export function called "@$xp$16Tb2item@ITBItems" at ordinal 528 "scp.exe" contains export function called "@$xp$16Tbx@TTBXRootItem" at ordinal 1119 "scp.exe" contains export function called "@$xp$16Tbxlists@TSBZone" at ordinal 1432 "scp.exe" contains export function called "@$xp$16Tbxutils@TShadow" at ordinal 1798 "scp.exe" contains export function called "@$xp$17Tb2hook@THookProc" at ordinal 454 "scp.exe" contains export function called "@$xp$17Tbx@TFontSettings" at ordinal 1086 "scp.exe" contains export function called "@$xp$17Tbx@TTBXPopupMenu" at ordinal 1121 "scp.exe" contains export function called "@$xp$17Tbx@TTBXPopupView" at ordinal 1106 "scp.exe" contains export function called "@$xp$17Tbx@TTextWrapping" at ordinal 1081 "scp.exe" contains export function called "@$xp$17Tbxutils@TShadows" at ordinal 1805 "scp.exe" contains export function called "@$xp$18Tb2anim@Tb2anim__1" at ordinal 108 "scp.exe" contains export function called "@$xp$18Tb2dock@Tb2dock__3" at ordinal 190 "scp.exe" contains export function called "@$xp$18Tb2item@Tb2item__1" at ordinal 475 "scp.exe" contains export function called "@$xp$18Tb2item@Tb2item__8" at ordinal 49840:T182d,"Software\Embarcadero\Locales" in Source: scp.exe "Software\CodeGear\Locales" in Source: scp.exe "Software\Borland\Locales" in Source: scp.exe "Software\Borland\Delphi\Locales" in Source: scp.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: scp.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: scp.exe "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: scp.exe "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: scp.exe "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: scp.exe "Software\Microsoft\Windows\DWM" in Source: scp.exe "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: scp.exe "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: scp.exe "SYSTEM\CurrentControlSet\Control\Session Manager\Environment" in Source: scp.exe "Software\Classes\" in Source: scp.exe "Software\RegisteredApplications" in Source: scp.exe "Software\Microsoft\Windows\CurrentVersion\Uninstall\winscp3_is1" in Source: scp.exe "SOFTWARE\Microsoft\NET Framework Setup\NDP" in Source: scp.exe "SOFTWARE\Microsoft\PowerShell" in Source: scp.exe "SOFTWARE\Microsoft\PowerShellCore\InstalledVersions" in Source: scp.exe "Software\Martin Prikryl" in Source: scp.exe "Software\Wow6432`" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp 00000000-00000876.00000001.160828.04010000.00000004.mdmp 00000000-00000876.00000002.162748.04010000.00000004.mdmp 00000000-00000876.00000003.170180.04010000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp 00000000-00000876.00000001.160828.04010000.00000004.mdmp 00000000-00000876.00000002.162748.04010000.00000004.mdmp 00000000-00000876.00000003.170180.04010000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp 00000000-00000876.00000001.160828.04010000.00000004.mdmp "sSoftware\Wow6432" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp 00000000-00000876.00000001.160828.04010000.00000004.mdmp 00000000-00000876.00000002.162748.04010000.00000004.mdmp 00000000-00000876.00000003.170180.04010000.00000004.mdmp "are\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\P}" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp "Registry\Machine\Software\Classes\AllFilesystemObjects" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp "Registry\Machine\Software\Classes\Directory\DocObject" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp "Software\Classes\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp 00000000-00000876.00000001.160828.07490000.00000004.mdmp 00000000-00000876.00000002.162748.07490000.00000004.mdmp "Software\9bis.com\KiTTY" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp 00000000-00000876.00000001.160828.07490000.00000004.mdmp 00000000-00000876.00000002.162748.07490000.00000004.mdmp 00000000-00000876.00000003.170180.07490000.00000004.mdmp "Software\SimonTatham\PuTTY" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp 00000000-00000876.00000001.160828.07490000.00000004.mdmp 00000000-00000876.00000002.162748.07490000.00000004.mdmp 00000000-00000876.00000003.170180.01211000.00000004.mdmp 00000000-00000876.00000003.170180.07490000.00000004.mdmp "\REGISTRY\MACHINE\Software\M!" in Source: 00000000-00000876.00000001.160828.01999000.00000004.mdmp 00000000-00000876.00000002.162748.01999000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp 00000000-00000876.00000003.170180.0C310000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{3DFDF296-DBEC-4FB4-81D1-6A3438BCF4DE}\ShellFolder" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp 00000000-00000876.00000003.170180.0C310000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ShellFolder" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp 00000000-00000876.00000003.170180.0C310000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{24AD3AD4-A569-4530-98E1-AB02F9417AA8}\ShellFolder" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp 00000000-00000876.00000003.170180.0C310000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F86FA3AB-70D2-4FC7-9C99-FCBF05467F3A}\ShellFolder" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp 00000000-00000876.00000003.170180.0C310000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{088E3905-0323-4B02-9826-5D99428E115F}\ShellFolder" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp 00000000-00000876.00000003.170180.0C310000.00000004.mdmp "SOFTWARE\MIT\Kerberos" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp "Software\SimonTatham\PuTTY\Jumplist" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp "Software\SimonTatham\PuTTY\Sessions" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp "Software\SimonTatham\PuTTY\SshHostCAs" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp "Software\SimonTatham\PuTTY\SshHostKeys" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp "stry\Machine\Software\Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellEx\IconHandler" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp "Software\Martin Prikryl\WinSCP 2" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp "Software\Martin Prikryl\WinSCP 2 Override" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp41:Tec9,Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:876:168:WilStaging_02" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:876:64:WilError_01" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\MutexNPA_UnitVersioning_876" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\WinSCP" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\WinSCPDragExtMutex" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer" Process scp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit" Process scp.exe created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" Process scp.exe created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!0aefa8" Process scp.exe created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!0a2538" Process scp.exe created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!0af988"42:T1a03,"Software\Wow6432`" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp "are\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\P}" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp "Registry\Machine\Software\Classes\AllFilesystemObjects" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp "Registry\Machine\Software\Classes\Directory\DocObject" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp "Software\Classes\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp "Software\9bis.com\KiTTY" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp "Software\SimonTatham\PuTTY" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp "\REGISTRY\MACHINE\Software\M!" in Source: 00000000-00000876.00000001.160828.01999000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00000876.00000001.160828.04010000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00000876.00000001.160828.04010000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions" in Source: 00000000-00000876.00000001.160828.04010000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00000876.00000001.160828.04010000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00000876.00000001.160828.04010000.00000004.mdmp "Software\Classes\" in Source: 00000000-00000876.00000001.160828.07490000.00000004.mdmp "Software\9bis.com\KiTTY" in Source: 00000000-00000876.00000001.160828.07490000.00000004.mdmp "Software\SimonTatham\PuTTY" in Source: 00000000-00000876.00000001.160828.07490000.00000004.mdmp "\REGISTRY\MACHINE\Software\M!" in Source: 00000000-00000876.00000002.162748.01999000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00000876.00000002.162748.04010000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00000876.00000002.162748.04010000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00000876.00000002.162748.04010000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00000876.00000002.162748.04010000.00000004.mdmp "Software\Classes\" in Source: 00000000-00000876.00000002.162748.07490000.00000004.mdmp "Software\9bis.com\KiTTY" in Source: 00000000-00000876.00000002.162748.07490000.00000004.mdmp "Software\SimonTatham\PuTTY" in Source: 00000000-00000876.00000002.162748.07490000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{3DFDF296-DBEC-4FB4-81D1-6A3438BCF4DE}\ShellFolder" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ShellFolder" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{24AD3AD4-A569-4530-98E1-AB02F9417AA8}\ShellFolder" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F86FA3AB-70D2-4FC7-9C99-FCBF05467F3A}\ShellFolder" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{088E3905-0323-4B02-9826-5D99428E115F}\ShellFolder" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp "SOFTWARE\MIT\Kerberos" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp "Software\SimonTatham\PuTTY\Jumplist" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp "Software\SimonTatham\PuTTY\Sessions" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp "Software\SimonTatham\PuTTY\SshHostCAs" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp "Software\SimonTatham\PuTTY\SshHostKeys" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp "Software\SimonTatham\PuTTY" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp "stry\Machine\Software\Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellEx\IconHandler" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp "Software\Martin Prikryl\WinSCP 2" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp "Software\9bis.com\KiTTY" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp "Software\Martin Prikryl\WinSCP 2 Override" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp "Software\SimonTatham\PuTTY" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{3DFDF296-DBEC-4FB4-81D1-6A3438BCF4DE}\ShellFolder" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ShellFolder" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{24AD3AD4-A569-4530-98E1-AB02F9417AA8}\ShellFolder" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F86FA3AB-70D2-4FC7-9C99-FCBF05467F3A}\ShellFolder" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{088E3905-0323-4B02-9826-5D99428E115F}\ShellFolder" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp43:Td30,"scp.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74510000 "scp.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74510000 "scp.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74510000 "scp.exe" loaded module "KERNEL32" at base 73f80000 "scp.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 725c0000 "scp.exe" loaded module "KERNEL32.DLL" at base 73f80000 "scp.exe" loaded module "MSCTF.DLL" at base 73e30000 "scp.exe" loaded module "IMM32.DLL" at base 76960000 "scp.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 738c0000 "scp.exe" loaded module "WTSAPI32.DLL" at base 73a70000 "scp.exe" loaded module "NTDLL.DLL" at base 773f0000 "scp.exe" loaded module "RPCRT4.DLL" at base 74280000 "scp.exe" loaded module "UXTHEME.DLL" at base 738c0000 "scp.exe" loaded module "SHCORE" at base 770e0000 "scp.exe" loaded module "USER32" at base 74d30000 "scp.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74760000 "scp.exe" loaded module "OLEPRO32.DLL" at base 725a0000 "scp.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72570000 "scp.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73360000 "scp.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74fd0000 "scp.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 4310000 "scp.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32.DLL" at base 769f0000 "scp.exe" loaded module "SECURITY.DLL" at base 7370000 "scp.exe" loaded module "SSPICLI.DLL" at base 73e10000 "scp.exe" loaded module "%WINDIR%\SYSWOW64\MSV1_0.DLL" at base 724b0000 "scp.exe" loaded module "%WINDIR%\SYSWOW64\APPRESOLVER.DLL" at base 72410000 "scp.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76990000 "scp.exe" loaded module "SHCORE.DLL" at base 770e0000 "scp.exe" loaded module "%WINDIR%\SYSWOW64\MSXML6.DLL" at base 72130000 "scp.exe" loaded module "USER32.DLL" at base 74d30000 "scp.exe" loaded module "MSCMS.DLL" at base 720a0000 "scp.exe" loaded module "ICM32.DLL" at base 72060000 "scp.exe" loaded module "SHELL32" at base 4310000 "scp.exe" loaded module "COMCTL32.DLL" at base 72760000 "scp.exe" loaded module "COMCTL32" at base 72760000 "scp.exe" loaded module "GDI32.DLL" at base 76930000 "scp.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 72010000 "scp.exe" loaded module "OLE32.DLL" at base 74050000 "scp.exe" loaded module "DWMAPI.DLL" at base 72e00000 "scp.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 72e00000 "scp.exe" loaded module "CFGMGR32.DLL" at base 75220000 "scp.exe" loaded module "OLEAUT32.DLL" at base 74390000 "scp.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74d30000 "scp.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74d30000 "scp.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 765a0000 "scp.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 73e30000 "scp.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 74050000 "scp.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 71270000 "scp.exe" loaded module "%WINDIR%\SYSWOW64\THUMBCACHE.DLL" at base 71220000 "scp.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECS.DLL" at base 72f20000 "scp.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 70e6000044:T6be,"scp.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "scp.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "scp.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "scp.exe" touched "Custom Destination List" (Path: "HKCU\WOW6432NODE\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\TREATAS") "scp.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\WOW6432NODE\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "scp.exe" touched "XML DOM Document 6.0" (Path: "HKCU\WOW6432NODE\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}\TREATAS") "scp.exe" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "scp.exe" touched "Local Icon Cache" (Path: "HKCU\WOW6432NODE\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}\TREATAS") "scp.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "scp.exe" touched "Microsoft Access Application" (Path: "HKCU\WOW6432NODE\CLSID\{73A4C9C1-D68D-11D0-98BF-00A0C90DC8D9}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "scp.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "scp.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "scp.exe" touched "Start Menu Cache" (Path: "HKCU\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS")45:T4a2,The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 07:89:4D:00:FC:19:4A:17:DB:27:3A:EB:5C:F8:FA:CE:F1:44:23:A4; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O="DigiCert Inc.", C=US" (SHA1: DD:62:30:AC:86:0A:2D:30:6B:DA:38:B1:68:79:52:30:07:FB:41:7E; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert Inc.", C=US" (SHA1: 0D:EE:8F:52:D6:B8:D8:C4:B2:C9:57:3F:42:99:FD:97:D7:07:BA:B7; see report for more information)46:T49b,Found string "TSOAPAttachment" (Source: "00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp") Found string "ystem.IsAttachment" (Source: "00000000-00000876.00000001.160828.09130000.00000002.mdmp") Found string "ystem.Message.AttachmentContents" (Source: "00000000-00000876.00000001.160828.09130000.00000002.mdmp") Found string "ystem.Message.AttachmentNames" (Source: "00000000-00000876.00000001.160828.09130000.00000002.mdmp") Found string "ystem.Message.HasAttachments" (Source: "00000000-00000876.00000001.160828.09130000.00000002.mdmp") Found string "System.IsAttachment" (Source: "00000000-00000876.00000001.160828.09190000.00000002.mdmp") Found string "System.Message.AttachmentContents" (Source: "00000000-00000876.00000001.160828.09190000.00000002.mdmp") Found string "System.Message.AttachmentNames" (Source: "00000000-00000876.00000001.160828.09190000.00000002.mdmp") Found string "System.Message.HasAttachments" (Source: "00000000-00000876.00000001.160828.09190000.00000002.mdmp")47:T487,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "scp.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "scp.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "scp.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "scp.exe") Found reference to API "hrdir_b.c: LoadLibrary != mmdll borlndmm failed" (Indicator: "LoadLibrary"; Source: "00000000-00000876.00000000.158908.01303000.00000004.mdmp, 00000000-00000876.00000002.162748.01303000.00000004.mdmp, 00000000-00000876.00000003.170180.01303000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp")48:T530,"scp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "scp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "scp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "scp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") "scp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: ""; Value: "") "scp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES"; Key: ""; Value: "") "scp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: ""; Value: "") "scp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\PENDINGDELETE"; Key: ""; Value: "") "scp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "scp.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "scp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\SETTINGS\LANGUAGECONFIGURATION"; Key: ""; Value: "")49:T7d3,"scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")4a:T638,"scp.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "scp.exe" trying to access non-existent file "C:\OLEACC.DLL" "scp.exe" trying to access non-existent file "C:\OLEACCRC.DLL" "scp.exe" trying to access non-existent file "C:\FLTLIB.DLL" "scp.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "scp.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "scp.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "scp.exe" trying to access non-existent file "C:\DWMAPI.DLL" "scp.exe" trying to access non-existent file "C:\dwmapi.dll" "scp.exe" trying to access non-existent file "C:\WTSAPI32.DLL" "scp.exe" trying to access non-existent file "C:\WINSTA.DLL" "scp.exe" trying to access non-existent file "C:\WINSTA.dll" "scp.exe" trying to access non-existent file "C:\DOTNET.EXE" "scp.exe" trying to access non-existent file "C:\dotnet.exe" "scp.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\DOTNET.EXE" "scp.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\dotnet.exe" "scp.exe" trying to access non-existent file "C:\Windows\SysWOW64\DOTNET.EXE" "scp.exe" trying to access non-existent file "C:\WINDOWS\system32\dotnet.exe" "scp.exe" trying to access non-existent file "C:\Windows\DOTNET.EXE" "scp.exe" trying to access non-existent file "C:\WINDOWS\dotnet.exe" "scp.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\DOTNET.EXE" "scp.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\dotnet.exe"4b:T434,"scp.exe" trying to access non-existent file "C:\SCP.EXE.LOCAL" "scp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\WINSCP.RND" "scp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\winscp.rnd" "scp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\PUTTY.RND" "scp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\PUTTY.RND" "scp.exe" trying to access non-existent file "C:\Users\%OSUSER%\PUTTY.RND" "scp.exe" trying to access non-existent file "C:\Windows\PUTTY.RND" "scp.exe" trying to access non-existent file "C:\SCP.INI" "scp.exe" trying to access non-existent file "C:\scp.ini" "scp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\SCP.INI" "scp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\scp.ini" "scp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\VirtualStore\SCP.INI" "scp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\VirtualStore\scp.ini"4c:T495,Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; File: "scp.exe") Found reference to API "WNetGetUniversalNameW" (Indicator: "WNetGetUniversalName"; File: "scp.exe") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; File: "scp.exe") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; File: "scp.exe") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "scp.exe") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WNetGetUniversalNameW" (Indicator: "WNetGetUniversalName"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp")4d:T9d5,Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "scp.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "scp.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "scp.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "scp.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "scp.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "scp.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "scp.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "scp.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "scp.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "scp.exe") Found reference to API "WSASend" (Indicator: "WSASend"; File: "scp.exe") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00000876.00000003.170180.01211000.00000004.mdmp")4e:T41a,Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; File: "scp.exe") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; File: "scp.exe") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "scp.exe") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; File: "scp.exe") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00000876.00000003.170180.01211000.00000004.mdmp")4f:Tb6c,Found reference to API "WinHttpGetDefaultProxyConfiguration" (Indicator: "WinHttpGetDefaultProxyConfiguration"; File: "scp.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "scp.exe") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "scp.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "scp.exe") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "scp.exe") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; File: "scp.exe") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "scp.exe") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "scp.exe") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "scp.exe") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "scp.exe") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "scp.exe") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "scp.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "scp.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "scp.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "scp.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "scp.exe") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "scp.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "scp.exe") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "scp.exe") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "scp.exe") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "scp.exe") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WinHttpGetDefaultProxyConfiguration" (Indicator: "WinHttpGetDefaultProxyConfiguration"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp")50:Te3c,Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "scp.exe") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "scp.exe") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "scp.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "scp.exe") Found reference to API "WSAAsyncGetHostByName" (Indicator: "gethostbyname"; File: "scp.exe") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "scp.exe") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "scp.exe") Found reference to API "Waiting for PuTTY to connect to password pipe" (Indicator: " connect "; File: "scp.exe") Found reference to API "Internal error: Connect called while still connected" (Indicator: " connect "; File: "scp.exe") Found reference to API "Server does not send proper UTF-8, falling back to local charset" (Indicator: " send "; File: "scp.exe") Found reference to API "Failed to create listen socket" (Indicator: " listen "; File: "scp.exe") Found reference to API "Failed to get socket address" (Indicator: " socket "; File: "scp.exe") Found reference to API "Destroying data socket on error" (Indicator: " socket "; File: "scp.exe") Found reference to API "Destroying data socket after transfer completed" (Indicator: " socket "; File: "scp.exe") Found reference to API "Increasing send buffer from %d to %d" (Indicator: " send "; File: "scp.exe") Found reference to API "gethostname" (Indicator: "gethostname"; Source: "00000000-00000876-00000C2C-1453317431") Found reference to API "Could not send request" (Indicator: " send "; Source: "00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp") Found reference to API "Could not connect to server" (Indicator: " connect "; Source: "00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp") Found reference to API "Could not connect to proxy server" (Indicator: " connect "; Source: "00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp") Found reference to API "Missing flags for socket shutdown" (Indicator: " socket "; Source: "00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp") Found reference to API "ssl: Shutdown state: %ssent | %sreceived." (Indicator: " shutdown "; Source: "00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp") Found reference to API "Could not send message to proxy" (Indicator: " send "; Source: "00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp") Found reference to API "Could not send login message" (Indicator: " send "; Source: "00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp") Found reference to API "Could not send connect request" (Indicator: " connect "; Source: "00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp") Found reference to API "Could not send connect request" (Indicator: " send "; Source: "00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp") Found reference to API "Could not read connect reply" (Indicator: " connect "; Source: "00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp")51:Te26,Heuristic match: "uh.gw" Heuristic match: "video/vnd.dece.sd" Pattern match: "http://direct:80" Pattern match: "http://www.w3.org/2001/xmlschema" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://schemas.xmlsoap.org/soap/envelope/" Pattern match: "http://www.w3.org/2003/05/soap-envelope" Pattern match: "http://schemas.xmlsoap.org/soap/encoding/" Pattern match: "http://www.w3.org/2003/05/soap-encoding" Pattern match: "http://www.w3.org/1999/xmlschema" Pattern match: "http://www.w3.org/2000/10/xmlschema" Pattern match: "http://www.borland.com/namespaces/types" Heuristic match: "ssh.com" Pattern match: "https://www.msn.com/favicon.ico" Pattern match: "http://www.virtualbox.org" Pattern match: "http://go.microsoft.com/fwlink/?linkid=215117" Pattern match: "http://go.microsoft.com/fwlink/?linkid=223554" Pattern match: "http://support.microsoft.com/kb/4023057" Pattern match: "http://www.cacetech.com" Pattern match: "http://www.winpcap.org" Pattern match: "http://www.autoitscript.com/autoit3" Pattern match: "https://www.wireshark.org" Pattern match: "https://ask.wireshark.org/" Pattern match: "https://www.wireshark.org/download.html" Pattern match: "http://www.adobe.com/support/main.html" Pattern match: "http://www.adobe.com/products/acrobat/readstep.html" Pattern match: "http://www.adobe.com" Pattern match: "http://java.com/help" Pattern match: "http://java.com" Pattern match: "http://java.sun.com" Pattern match: "https://support.mozilla.org" Pattern match: "https://www.mozilla.org" Pattern match: "https://www.mozilla.org/firefox/64.0/releasenotes" Pattern match: "https://npcap.com/#download" Pattern match: "https://npcap.com/" Pattern match: "www.onet[1].xml" Pattern match: "www.msn.com/favicon.ico" Pattern match: "https://winscp.net/" Pattern match: "http://s3.amazonaws.com/doc/2006-03-01/" Heuristic match: "s3.amazonaws.com" Heuristic match: "anonymous@example.com" Heuristic match: "storage.googleapis.com" Pattern match: "https://sts.amazonaws.com/doc/2011-06-15/" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://ns.a" Pattern match: "e.com/xap/1" Pattern match: "http://purl.org/" Pattern match: "http://ns.ad" Pattern match: "http://ns" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Pattern match: "adobe.com/xap/1.0/mm/" Pattern match: "http://www.w3" Pattern match: "ns.adobe.com/xap/1.0/" Pattern match: "http://ns.q0" Pattern match: "http://ns.adobe.com/photosh" Pattern match: "obe.com/xap/1.0/stype/resourceev" Heuristic match: "p://ns.aq" Pattern match: "http://purl.org/dc" Heuristic match: "2\windows.sg" Heuristic match: "aes128-gcm@openssh.com" Heuristic match: "aes192-gcm@openssh.com" Heuristic match: "aes256-gcm@openssh.com" Pattern match: "http://ns.aq"52:T67c0,Found URL "https://www.msn.com/favicon.ico" - Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00000876.00000003.170180.04010000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00000876.00000003.170180.04010000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00000876.00000003.170180.04010000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00000876.00000003.170180.04010000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00000876.00000003.170180.04010000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00000876.00000003.170180.04010000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00000876.00000003.170180.04010000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00000876.00000003.170180.04010000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00000876.00000003.170180.04010000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00000876.00000003.170180.04010000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00000876.00000003.170180.04010000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00000876.00000003.170180.04010000.00000004.mdmp") Found URL "https://npcap.com/ [/%s=]]" (Indicator: "password"; File: "scp.exe") Found string "password" (Indicator: "password"; File: "scp.exe") Found string "passwordsfromfiles" (Indicator: "password"; File: "scp.exe") Found string "Cannot create password pipe" (Indicator: "password"; File: "scp.exe") Found string "Disconnecting and closing password pipe" (Indicator: "password"; File: "scp.exe") Found string "Waiting for PuTTY to connect to password pipe" (Indicator: "password"; File: "scp.exe") Found string "PuTTY has connected to password pipe" (Indicator: "password"; File: "scp.exe") Found string "Error writting password pipe" (Indicator: "password"; File: "scp.exe") Found string "Complete password was written to pipe" (Indicator: "password"; File: "scp.exe") Found string "Part of password was written to pipe" (Indicator: "password"; File: "scp.exe") Found string "Master password handler not set" (Indicator: "password"; File: "scp.exe") Found string "task_change_password" (Indicator: "password"; Source: "00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp") Found string "Change account password" (Indicator: "password"; Source: "00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp") Found string "missing secret" (Indicator: "secret"; Source: "00000000-00000876.00000002.162748.011BD000.00000004.mdmp") Found string "bad password read" (Indicator: "password"; Source: "00000000-00000876.00000003.170180.011AA000.00000004.mdmp") Found string "empty password" (Indicator: "password"; Source: "00000000-00000876.00000003.170180.011AA000.00000004.mdmp") Found string "maybe wrong password" (Indicator: "password"; Source: "00000000-00000876.00000003.170180.011AA000.00000004.mdmp")6c:T426,Found string "HostName" (Indicator: "hostname"; File: "scp.exe") Found string "Could not resolve hostname `%s': %s" (Indicator: "hostname"; Source: "00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp") Found string "Could not find IPv4 address of hostname %s for SOCKS v4 proxy" (Indicator: "hostname"; Source: "00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp") Found string "sess: Using IPv6 scope '%s', hostname rewritten to %s." (Indicator: "hostname"; Source: "00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp") Found string "certificate issued for a different hostname" (Indicator: "hostname"; Source: "00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp") Found string "Network error: No route to host" (Indicator: "route"; Source: "00000000-00000876.00000003.170180.01211000.00000004.mdmp")6d:T96d,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.04010000.00000004.mdmp") Found string ":\WINDOWS\system32\spool\drivers\color" (Indicator: "\drivers\"; Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.04010000.00000004.mdmp") Found string ":\windows\system32\spool\drivers\color\d65.camp" (Indicator: "\drivers\"; Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.040AD000.00000004.mdmp") Found string ":\windows\system32\spool\drivers\color\photo.gmmp" (Indicator: "\drivers\"; Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.040AD000.00000004.mdmp, 00000000-00000876.00000003.170180.040DC000.00000004.mdmp") Found string "??\c:\windows\system32\spool\drivers\color\d65.camp" (Indicator: "\drivers\"; Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.040AD000.00000004.mdmp") Found string "??\c:\windows\system32\spool\drivers\color\photo.gmmp" (Indicator: "\drivers\"; Source: "00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.040AD000.00000004.mdmp") Found string "??\C:\WINDOWS\system32\spool\drivers\color\Photo.gmmp" (Indicator: "\drivers\"; Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found string "??\C:\WINDOWS\system32\spool\drivers\color\D65.camp" (Indicator: "\drivers\"; Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp")6e:T4eb,Found reference to API "SystemParametersInfoW" (Indicator: "SystemParametersInfo"; File: "scp.exe") Found reference to API "SystemParametersInfoForDpi" (Indicator: "SystemParametersInfo"; File: "scp.exe") Found reference to API "SystemParametersInfoForDpi" (Indicator: "SystemParametersInfo"; Source: "00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp") Found reference to API "SystemParametersInfoW" (Indicator: "SystemParametersInfo"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "82322382380,492,113,,SystemParametersInfoW,user32.dll,"00:41:52.671",RX=0,PX=0" (Indicator: "SystemParametersInfo"; Source: "00000000-00000876.00000001.160828.04010000.00000004.mdmp") Found reference to API "154322422796,492,113,,SystemParametersInfoW,user32.dll,"00:42:22.671",RX=0,PX=0" (Indicator: "SystemParametersInfo"; Source: "00000000-00000876.00000002.162748.04010000.00000004.mdmp") Found reference to API "433490885920,492,113,,SystemParametersInfoW,user32.dll,"00:44:18.984",RX=0,PX=0" (Indicator: "SystemParametersInfo"; Source: "00000000-00000876.00000003.170180.04010000.00000004.mdmp")6f:T93f,Found reference to API "CopySid" (Indicator: "CopySid"; File: "scp.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "scp.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "scp.exe") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "scp.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "scp.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "scp.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "scp.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "scp.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01214000.00000004.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01214000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000876.00000003.170180.01214000.00000004.mdmp") Found reference to API "SetEntriesInAclA" (Indicator: "SetEntriesInAcl"; Source: "00000000-00000876.00000003.170180.01214000.00000004.mdmp")70:T403,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: scp.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: scp.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: scp.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: scp.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: scp.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: scp.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: scp.exe] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: scp.exe]71:T974,"scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "scp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")72:T83c,Found string "GetLogicalProcessorInformation" (Source: scp.exe, API is part of module: KERNELBASE.DLL) Found string "GetThreadPreferredUILanguages" (Source: scp.exe, API is part of module: KERNELBASE.DLL) Found string "SetThreadPreferredUILanguages" (Source: scp.exe, API is part of module: KERNELBASE.DLL) Found string "GetThreadUILanguage" (Source: scp.exe, API is part of module: KERNELBASE.DLL) Found string "VariantChangeTypeEx" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarNeg" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarNot" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarAdd" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarSub" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarMul" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarDiv" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarIdiv" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarMod" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarAnd" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarOr" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarXor" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarCmp" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarI4FromStr" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarR4FromStr" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarR8FromStr" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarDateFromStr" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarCyFromStr" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarBoolFromStr" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromCy" (Source: scp.exe, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromDate" (Source: scp.exe, API is part of module: OLEAUT32.DLL)73:T636,"scp.exe" has resource with unusual entropy "RT_ICON:7.923544392385863" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.891617099765174" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.89925043569334" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.889713526653796" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.887259735465478" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.88442980788853" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.874599304812917" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.885890135313418" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.889751406609193" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.88942514765703" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.883082577494332" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.896405211554697" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.893319927254322" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.885449370532904" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.8903324705750215" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.892886164295437" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.892591328792055" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.931386784798308" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.907206684492146" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.892028463012284" "scp.exe" has resource with unusual entropy "RT_RCDATA:7.861002056309858"74:T7fc,Found string "HttpForWebDAV" (Indicator: "webdav"; File: "scp.exe") Found string "WinSCP: SFTP, FTP, WebDAV, S3 and SCP client" (Indicator: "webdav"; Source: "00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp") Found string "WebDAV" (Indicator: "webdav"; Source: "00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp") Found string "WebDavsLabel" (Indicator: "webdav"; Source: "00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.0A8D0000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.0A8D0000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.0A8D0000.00000004.mdmp") Found string "WebDavsCombo" (Indicator: "webdav"; Source: "00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.0A8D0000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.0A8D0000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.0A8D0000.00000004.mdmp") Found string "ystem.WebDavPath" (Indicator: "webdav"; Source: "00000000-00000876.00000001.160828.09130000.00000002.mdmp") Found string "System.WebDavPath" (Indicator: "webdav"; Source: "00000000-00000876.00000001.160828.09190000.00000002.mdmp") Found string "HttpForWebDAV=0" (Indicator: "webdav"; Source: "00000000-00000876.00000003.170180.07CD0000.00000004.mdmp") Found string "HTTPFORWEBDAV" (Indicator: "webdav"; Source: "00000000-00000876.00000003.170180.07CD0000.00000004.mdmp")75:T79c,"scp.exe" called "GetDriveTypeW" with parameter A:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter B:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter D:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter E:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter F:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter G:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter H:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter I:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter J:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter K:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter L:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter M:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter N:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter O:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter P:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter Q:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter R:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter S:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter T:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter U:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter V:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter W:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter X:\ (UID: 00000000-00000876) "scp.exe" called "GetDriveTypeW" with parameter Y:\ (UID: 00000000-00000876)76:T625,GetUserNameA RegCreateKeyExA RegCreateKeyExW RegOpenKeyExA RegOpenKeyExW SetSecurityDescriptorDacl RegEnumKeyA RegDeleteValueW OpenProcessToken RegDeleteKeyW RegCloseKey RegEnumKeyExW GetDriveTypeW VirtualAlloc LoadLibraryExW MapViewOfFile Process32FirstW LockResource GetModuleFileNameW GetFileAttributesA GetStartupInfoA GetModuleHandleA ExitThread GetThreadContext OpenFileMappingW GetFileAttributesW CopyFileW DisconnectNamedPipe FindResourceExW GetVersionExA GetTickCount CreateToolhelp32Snapshot DeleteFileW GetModuleFileNameA SleepEx CreateDirectoryW IsDebuggerPresent FindFirstFileA FindNextFileA CreateFileW Sleep Process32NextW FindResourceW GetFileSize DeleteFileA ConnectNamedPipe OpenProcess TerminateProcess GetModuleHandleExA GetTempPathW UnhandledExceptionFilter LoadLibraryW GetDriveTypeA GetStartupInfoW CreateFileMappingW GetComputerNameW GetFileAttributesExW FindFirstFileExW LoadLibraryExA CreateFileMappingA CreateThread GetProcAddress FindNextFileW LoadLibraryA VirtualProtect GetSystemDirectoryA GetModuleHandleW GetCommandLineW FindFirstFileW CreateFileA GetSystemInfo GetVersionExW CreateProcessA CreateProcessW WriteFile WNetOpenEnumW GetUserNameExW ShellExecuteExW ShellExecuteW GetUpdateRect FindWindowExW GetLastActivePopup FindWindowW GetCursorPos SetKeyboardState GetClipboardData SetWindowsHookExW FindWindowA GetWindowThreadProcessId EnumPrintersW WSAStartup closesocket listen send bind accept sendto recv recvfrom connect WSASend socket77:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAzMzMzMzMwAAAAAAAAAAAAM4iIiIiIMAAAAAAAAAAAAAMzMzMzeDAAAAAAAAAAAAAAMzMzMzgwAAAAAAAAAAAAACMzMzM4MAAAAHd3d3d3d3czMzMzODAAAAB4d3d3d3dzMzMzMzgwAAAAf4iIiHd3MzMzMzM4MAAAAH+IiIiHczMzMzMzODAAAAB/iIiIiHMzMzMzMzgwAAAAf4iIiIhzMzMzMyM4MAAAAH+IiIiIhzMzMzIAMzAAAAB/iIiIiIhzMzMgAAMwAAAAf/iIiIiIhzM3AAAAAAAAAH//iIiIiIhzdwAAAAAAAAB///iIiIiIiHcAAAAAAAAAf///iIiIiIh3AAAAAAAAAHj/////////hwAAAAAAAABmd3d3d3d3d3cAAAAGYAAGZn+HQAAAf3dwAAAABmYAZmZ/h2QAAH+HcAAAAAaGZmbuf4dmAAB/hwAAAAAGjmZu7n/3ZgAHeIcAAAAABo7m7u5/+Hd3d4h3AAAAAAaO7u7uZ/+Hd3iIdwAAAAAGju7u7uaP//+Ih3AAAAAABo7u7u5md///+HcAAAAAAAb+7u7mZgd3d3dwAAAAAAAG/u7u7mYAAAAAAAAAAAAABv7u7u7mYAAAAAAAAAAAAAb//4iIiGYAAAAAAAAAAAAGZmZmZmZmAAAAAAAAAAAAD//+AA///gAP//8AD///gA///4AP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AABj+AAA8/gAAf/4AAH/+AAB//gAAf/4AAH/+AAB/PAPg/xgB4P8AAcD/AAHB/wAAAf8AAAH/AAAD/wAAA/8AEA//AB///wAP//8AB///AAf//w==78:T1239c,iVBORw0KGgoAAAANSUhEUgAABLAAAAJYCAIAAAD9hIhNAACAAElEQVR4Xuy8C8hl1Z2mvyiCiBQiQSSISCEhSPAfgjMMTWgaaST0dPcMobthYiYTO8ZUoh3LipeyNN7Ka7Q0FTXGmPIaU3G0vERtIxKcNjQhiBOCiIh0SygGCSJBRKQRCd/fql21zu99fnuvc853Od/5Pt+Hl7D3Wmuvvffau2qv51RcpZTdmiaHS557TlLKBZqdMQtKOb7EfOITkvIxTXlQsy0GxyInnijhicizManxnhjc0UsvlZiNGyVlg+YETXlB8mdFcpjk6KMlO3ZIyn+W4DKuv15SylbNbzV7JZ8pMaecIsHjLuWVmFtuKTHlRE35o0Rv/09/kpTPapQbbpCU8lLMcceVGDzB228vMaW8qQFfjPmHfygx6c2RP2WsveACycUXS7Ztk/zkJ5L77pM8+KDkoYckP/iBBLU/+pEEQ3nvvZL//b8l7Z537pTcfbfkwgsleEd//GPJnXdKvv99yV13Sb73PckDD0huukly+eWSJ56QfPGLkjvukOC8u3dLcEcYK4wGxnnvXgkG9mc/k+AGb71Vgmv+4Q8leNyPPip55JFWbr5Z8tOfSvBO4rx79khwR/iLA+e98UYJ7rc9OPrnaOHxx2P+3RgzW/iBNcbMHAthxEJoIbQQWggthBZCYaGUGtYZY5YMP7DGmJljIYxYCC2EFkILoYXQQihYCI1ZUfiBNcbMHAthxEJoIbQQWggthBZCwUJozIrCD6wxZuZYCCMWQguhhdBCaCG0EAoWQmNWFH5gjTGzRkUFU1V8Q2k1Oum/9toSAz/EXBxuiRxzjASwK9DUpzaf/rTk1VclW7dKMAsqR0nQVRLv2yVHFskpGpj2piIpf9CIxb33XolpDx0EafPmEoOLRGOA+TOm8bfdJilHS+hLCmbX77wjgR6npy/Cj6k4lP6IIyTQ1GSeD8T85V+WmGTa90swgcaMGQbYNrHvflcC18KxMGAMBx4SxAyNL7tMcs89EnR1//2Ss86SfOUrEhy7ZYsEg3PeeZJ/+ifJww9LICp4Ry+5RIIXC/aIlxJdYZwhORhYPFDUYmAhojAi+BIuA8Fbh7/dIM94+vhOwPFwzTBe/PyBa4bUtWUSHo4TIfonhZNTY8xswYfeGDNzLIQBC2HEQmghHMVCaCG0EBpjVgZ86I0xM8dCGLAQRiyEFsJRLIQWQguhMWZlwIfeGDNzLIQBC2HEQmghHMVCaCG0EBpjVgZ86I0xM8dCGLAQRiyEFsJRLIQWQguhMWZlwIfeGDN7ZOXMUjbHYIHDUm6WqHphATyYyb59JWbXLglXdFS5wgqWWHaSk/5jJWniLnAt0DZ6VVCgUn4Xw9oTZV1N1J50UomBaaPxsceWGOgT8rvfSV54QQIzwYlgj6jl4Ch4RnQ8HUnUfvnLkquvluCqXntNArfEWqDpvZKXHz3jzXnxRUnirRhMp9EzRwMTWUyCMZHFuppYoRSzfKzKiD+iEFGkPcuH1eCq4A/oGRqD20ctBKk5redVwaaw6Ch6xg1iTc7t2yUwQIwzhBB3hKeA28ffjPiZDbePq8I4ozEeKN5R3D6uGQ4Pl+5WuK3BZWAk2z8WwPDxBPFHA5eBp4+ngGFXp+Xk1BgzW/hFXT2ef/55Fk3D8weo27Gql9g+MlS+Rtm3sK8RtjarhIXQQmghtBCmWAgthDUWQmPMSsIvaqITpAqrA+3aylCHYw9vN1h0V7lxLlm7NKyvUVXpnX+isEOPO0hvOQrz4b0leSPSW1jLUZVLKrX9jLEQWggthBbCFAuhhbDGQmiMWUn4RU3Ajhqy1KiKDHU49vB2g1jbblnGNc4la5fO+nr/bXBCIZx8N5NnrYsuGdqI9BaWVN7eXRUshBZCC6GFMMVCaCGssRAaY1YSflETsKNuNxdGestjYd2Ou2hTGSqJoDDu5gNjSaQe0rWJu2uXORfCup0Lc0nvRqS3sAyXd7RrZ4OF0EJoIbQQplgILYQ1FkJjzErCL2qi15QmLKwl2D7YQneHGucGGVQNHd7bFY7t6C1ci6y6ENb/zbu5Km7nkt6NSG9hGS7vaNfOBnEPLixJdkmOKzGY9X4oBZJNsjYmJhilvKsR0PPhh0uwgCf9EGChVBrCoxrxpQ0bSsyCUj5bJJuwFuiLMTgW0A95kVPxlOY3MTATXAZW3UQtBiep5gsx6XH/R0zqeYfmhph33y0xWPyzlCdi2PNh8hMGlA+NId5YzpRv+8ckJ58sKeUljYKZuk5V+UcF02vM47GOKGbMWGYTsoFgRUfM8mGAOBEuEr6ESf9jj0nwVBA0hhC2jRc3iAUtr7pKgnVEcQvwJVzGOedIoDGwZTg8hg66iHF+/HEJTgTjhbbhFjBWe/dK8BKiMbQNaZsnrupHP5LgfvEnBbeAPzh4ZI8+KtFXhZNTY8xs4Wcx0XlUJZYPbbR3D3Z0iN4GtbBRHpnwkN7y3m57C9ciSxfCSK5FCega1GbYzVVDhb0bkd7CWo6qWlirUDJ7LIQWQguhhTDFQmghtBAaY2YCP4uJsU6VN+ou6G1WGWowVB5pHALQANuV3sK1yNKFsHd7qATUBt3sLhd2G43ybjtX9Z66tzAzdN5VxEJoIbQQWghTLIQWQguhMWYm8LOYgBplleq1rLxbGVs+1M/QgSVVjT0klve26S1ciyyjEI7dzdQG3eyutzCCBnU7V8U2ld7CDJpNeNSKYiG0EFoILYQpFkILoYXQGDMT+FlMDLlWt90wq6FaNKvEBkPb3UYvsbb3cJTnwkbJ2qVhfY2qyv7528S7md4GtXCot1yeq9o9g9xhY3dVsBBaCC2EFsIUC6GF0EJojJkJ/CwmOqeq5Nq4jTa1BIV1OzLJgSiJoGXczgf2NuitXevkfxvEvxO22T9/Gy7JtaC3QVc4eVU3M4wN4kakaxnprQpHHKxCyayJF/chb79dYkq5U7Mz5oMPSgymyOgZ7nHEERKAxugZteVTGlVcrkKpEpvYG5PM8zXNH2Jwv6VcG4OuUs8tcPtYlu/zn5dgvVacCI4H/+fAQp51YPEylHKpRsQMeswTlTM172veiEnjLI1xg+VwjQ4OugLt9xleeuqpkk44R1HefFNCB8AsHwtawnngHrfeKsEUGcdilo/zYvKNeTxq0VV7EU7IBlaDhCBhUcrTTpPAxGAIuF9kKveAaUOtIUhbtkjwFNongofDh3Esrgo3iJ6hi1B6PEGcF3/poCu8GxBCeCleUVxGW4/bx+JEeL7oWUWUk1NjzGzhZ3JK5sedIHWLZrn6MWZSMM21EFoIRwNrIRx+ny2EEguhhdBCaIxZLPxMToPFyZhlANNcC6GFcDSwFsLh99lCKLEQWggthMaYxcLP5GT4n9EMwFRtYdX/f5hrCAychdBCOBpYC+Hw+2whlFgILYQWQmPMYuFn0hgzYzDNtRBaCEcDayEcfp8thBILoYXQQmiMWSz8TBpjZgym5phPP/GE5JhjJJgxlyMlqIWZbNwoaU++20C9cM3nnSdJInpHTOr57hhMmUp5R/JnWO5ym+atGCxh+PLLElzk++9LMHS7dknwQHH7qEWoqRDCTRqFJqakgW3VoivMRXlV8FKs9XqCpvw2Jo9ATGL0S8GByIq7WEnxT3+S8N34mAZGhGkuFsO85RYJGk8VdAUVQWOsjYnXDsFcHF1BnxA0hnvAeWCAEKSLL5bAW9qehoeCO7rmGgku8jvfkfziFxI0xl8r994rwQ1igdb2DaIrnEiNiE8BI4meoXy4qnbP+DmgbY/f+IYEjwzPCBeJ+8XbrlfFyakxZrbwe2uMmTGYBFsItWcLoYWwYiG0EFoILYTGmOWH39tE958Ldv/FoLdXd9usTzAJthBqzxZCC2HFQmghtBBaCI0xyw+/t8aYGYNJsIVQe7YQWggrFkILoYXQQmiMWX74vTXGzBhMgi2E2rOF0EJYsRBaCC2EFkJjzPLD760xZsbkeXDMtddKaIBHaEhr8n300RIs/4jG5CjJv/yLpByt0Z5LebAVzNT12H37SszWrZK0funTMaecUmLeeUeC0YAgwXngHiAdi3u8P2bHjhJTyssxWAwTK0emE70ec8klJaaU52LSsb/UPKr5lQTPF36IKMceKwF4vriMdM0A43yb5kWNLleLmevu3RJM66FtmE9D2773PQlcC8dixc72LB9rNsKmrrxSgvPitcM1I5jlQ1TgaY891gp+K8IinHgKCDQGDwXLqOK8GEk0huJiYHEsbh9LsOJxX321BCuj4lgAET39dMl//a+SNliwFEuw4nFjHVG87RgcdIWfTtAVBkd/Z+Lk1BgzW/j3hoLvL2BrM398/qzPN8LWZlXIEhhjIbQQWggthBZCC6GF0BizcvDvDQXfX8DWfUzYPjarLXsLzVQ0rK9RVel9BCjs0OMO0m6Ty0NbKUcD7IKhxvNLlsAYC6GF0EJoIbQQWggthMaYlYN/byj4/gK27qM2a7fvre0tNFPRWV/vvw1OKIST72Ya7Xu3G+1rSS7sylk03HjuyBIYYyG0EFoILYQWQguhhdAYs3Lw7w0F31/A1gm06XYnKezoLTRTMZ9COHRgLo8ljcMbJblq7sgSGGMhtBBaCC2EFkILoYXQGLNy8O8NBd9fwNYJtKm7jY1Ib6GZCgthrppDzpOoEWEVNxggF6UsH8S8/XaJgR/Cav78zyXggw8kWIUS3gIlgHphNcQ0j5dbKOUNDXg8Bot/nnqqJCmuHPvCCyUGTwFrkLbvF4th8ryIqiYab9sm4ePeqGmyoOAGS/m9RvQJRlDKX2me0gA8X4GDU/41BpbOxodLUAt5Tpch4l1+/nMJJu5YpBHqhYk77OLppyVYpBFKgGAujp5hJm1fwh1BzHCDWIQTJ0ItXg70jMa4hXPOkcAAsVIo1qjEedUuqNZ4ZBAk3CB6xvPFWOGaL7xQcscdkvaismgMm8Jl4K9v3AJeM7wMl14qgdLjkwN5xu0//rgE44xjsX7p5s0xnJwaY2YLvs4AUwjA1gm0qbu9G5FGoZmKpQth4xHkEjB0+NCBubz3qHYzlOSqOcRCaCG0EHYPxUJoIbQQWgiNMbMGX2eAKQRg6wTaxF300Ntbb6GZiqULYe/2UAkYOnzowFxeSxrv0rS7c4iF0EJoIeweioXQQmghtBAaY2YNvs4AUwjA1gm0qbuNjUhvoZmKZRTCsbuZofZDB+byeAjobVZ3QaydQyyEFkILYfdQLIQWQguhhdAYM2vwdQaYQgC27qM2i+1zYW9vvYVmKhrW16iq4BG0dzON9r3bE7Zf4u4cYiG0EFoIu4diIbQQWggthMaYWYOvM8AUArB1H7k9Dux2e3vrLTRTkf9tEP9O2CY/gliSa0FugMPjixFLcnnd7i0c2m4Xzi3vamRqjpUzeSjRY5v+kOwRk37pCpNv+KE8xoUFNMZk7L33JABKkNbkVCg5b2rAb2Iwv6I/aM+4wVJ2xKRa8KyEfigrhaY7AqJPGOdS3pKcWCQwIh2rNBp/q2mBy+BoqMWdcIKkrcdt8F6hK1g63lgutIhVRjFF3r5d8oAulYl1gVGL1T6hMVACnTGXq66SwADbqtkWBlwkDAE6AdVuawyWUT33XEl7oVQsSgl9uu8+CdYCve46CW4fuewyCbQNf+k0l8qkeEOAMc7XXCNpPwVoKp4+BgevGQYWEgtPw+DgRWr/HIDbx5uDn130WE5OjTGzhd9UY8xqYyEcYSHUOwIWwhEWQguhhdBCaIxZHPymGmNWGwvhCAuh3hGwEI6wEFoILYQWQmPM4uA31ZhFgVnf/omfWSwWwhEWQr0jYCEcYSG0EFoILYTGmMXBb6oxZrWxEI6wEOodAQvhCAuhhdBCaCE0xiwOflONMbPmaE05NQbz6bZ6lfKM5g8a1E6FCBJW3UTtxz9eYpLVyGKnaX1LoPoET1OSLsqxaayAyBVWcy3lmxK1Gi46iq7IrzRTgR8LdmswOGpEfAq/1OAp/EEDe1TQ87ESrDGLpV/H8WUJH4pynOYwTRusjYmZKybf7YVDMduGTJ5/vgTTa6zZiMbwFkz6sXovVpK88UYJrBU+DOdBLYQQUgc/xHkvuEBy8cUSmNjOnRIsOgqNwW8Y7RtE7SWXSCDeV14pwYlgvDgR1uTEM8KSpBgrCCHWTcVTgLbh3Xj0UQnedqz1unWrBPeLZwT/x/NFY9ygDiwnp8aY2cLPojFm1lgILYSTYiG0EFoILYQWQmPMMsPPojFm1lgILYSTYiG0EFoILYQWQmPMMsPPojFm1lgILYSTYiG0EFoILYQWQmPMMsPPojFm1lgILYSTYiG0EFoILYQWQmPMMsPPojFm5vybBuyVqIowR2lw7AklZuNGCZa7hD6BZ54pMckfXtPcHANte/VVCU5UylMa8C+SU4qk3KkB0CdZ3jNdBozoVI0s0blvX4lBLdbVPOIISUKlrimib7whOfxwyfHHS157TQJtw+Ck0dgcgxPBWtuLjuKasRQqGuPNSdcsv3f88Y8lBvdLl8asF7PtB3T5R8zyMfnGCqVYZ7K9CiXkCsGKjnAPnBc2BfPEEp24QTht+35xVej5rrskqD3rLAl6xiKruN9HHpFgIU3cL2oh3rApPCN0hcHBmpxPPinBHWHVzccek+C8GFhcMxwPt4BauCUusr0UKpZvhQDj9vHjSPsZ6VVxcmqMmS069zDrjX9f+PdG2NqsEhZCC6GF0EJoIbQQWgiNMauDzj2Wn/g1Z50y1HKo3ExCw/oaVZU4+HX8Udihxwm5TW5fS2pjHIKqWB6regtz1bxhIbQQWggthBZCC6GF0BizOujcY/lZCBN9rSFDLYfKzSR01tf7b4MTCuHku73ENo1HOVQ1tnzC7bw7V1gILYQWQguhhdBCaCE0xqwOOvdYZhb6ZuSTFzbKzYSsrhAONcjlY594PqQjlw8dklvODxZCC6GF0EJoIbQQWgiNMauDzj2WmYWBGXljY8JyMyEWwlw+d2DGDGH4/OclALNeAl0sL0j+c4nBZbSvakHBunRtcGwpj0vUSzGPx1UlVNs+JqtfQp/Q1WGHSbBGJdZNxbHpjn6jeUgDEX1RA/5WI36IxQIpOczvYn75yxJDdOgYrhP7B4k+wXQZQGw5LXYKntDgMkB7YGUkOVPH0qBnny2Ba0EmsXImFpbEWpF4hDAEzOOfekqCZTaxvCdWCoWJwS6gIpi4Y81VzPKvuEKCE/3whxL4A1TzttskuCO4JS4D2ob1LdEzHgpO1BZCXAZuAQOLFwknOvdcCRYdxdDhNcNCqfA0/DoAL8UyqjDtG26Q4CKxIit6xjhjDVL80VC15uTUGDNb+JFcVg5MjXp2GxsTlpsJWboQRnItSsBQg1xeS/SEfPq5HG1iSWyfm80RsAsLoYUwYCGMWAgthBZCC6ExZvnhR3JZOTA16t89NHHqqYq7Q+VmQpYuhL3bQyVgqEEu733iuVmltz1KJuxq9YFdWAgthAELYcRCaCG0EFoIjTHLDz+Sy8qBqVHPbmNjwnIzIcsohGN3M0MNcvm0T3yofSyZsKvVB3ZhIbQQBiyEEQuhhdBCaCE0xiw//EguNwdmR7IxVWGj3ExCw/oaVZWhZ9G728vQI0b50FMeWz7hdt6dI2AXFkILYcBCGLEQWggthBZCY8zyw4/kcqPTpIMlaFA30LJdbiYh/9sg/p2wTR7zWJJre+l9fLUQVWgWS3rbowqFcbe3ZC546SVJWZC8/74ESyliPl0H4tBwbI2BXL3+uuTooyWYfsCmQDovuFZyfJHoopRXX11iSvkrzQeathLI4Bx7bInB/f7mNxKsyYl1NbGW3ssvSxKy5uqvf11i2kO3bZtkHDdIdFHZskFTXorBaOAlTI6nqDzDrcbRXglWOO44SaJ5+3yRFDgPptdwDwgDlmHco4tDQq7gSxAkdIUTQXIgDPAWnHf7dgka69Scf/hhNaeeKmlfBpQAJ8I4Y3Bwv2ecIcE4Q8xwLPR4yxYJxgpPAcfifnHNUE2Mxo03SjDOqMWw4waxFijyjW9I8MsCbgF/YvGM8PMHGmN1UwTyjGP13eDk1BgzW/hZNMbMGAuhhXBo6CyEEQuhhdBCaCE0xqwE/CwaY2aMhdBCODR0FsKIhdBCaCG0EBpjVgJ+Fo1ZFJjW5pmtGcRCaCEcGjoLYcRCaCG0EFoIjTErAT+LxpgZYyG0EA4NnYUwYiG0EFoILYTGmJWAn0VjzKzZKHn7bUkpX4w5/PASA3bskJTydMwXvlBiyqc0FIbdMR/7WIlJPBRDu2DPyibNUZJXXpGUT0uguGlwWg6QGr8S86c/lRjoE9KWuvbKqEcdJUHjJISiT7//fYkhh0vS/QoffCDB0GGp24cekpRyaQwat28fjxtSl0xbbh89v/uuhC8hfobAOwkxw0QWc3HcPybu+LXgv/03CZZ/bM/F25NvnAiXAcnBsdAYeAvO2/YHHItA27AKJS4DF4nVL3FHkElcJILGkBzYFB43bgHriJ52mgS3gEU4oZp4grhIdIXcfrsELzB6xnlxv+2e0RWeIFQTA4vz4uXXp8/JqTFmtvDrbIyZNRbCGAuhhdBCaCG8x0KoXSEWQmPMssKvszFm1lgIYyyEFkILoYXwHguhdoVYCI0xywq/zsaYWWMhjLEQWggthBbCeyyE2hViITTGLCv8OhtjZo2FMMZCaCG0EFoI77EQaleIhdAYs6zw62yMmTHJtd6XQNvKFs02zbWaX8Vs3FhiSnkvhlbz4ZXEKFwZVUkO8IUYmslhEq6qeoSm/E4jfPzjEizvmTRGakv5N0nz9sfxoESdZ9MmSfm4plwfg5H87W8l0AfUJnEFO2L27Ssx118vKeX3mq0aIa0FKqMBx8NbR4srm2PeeafEJB+WOyrlNzE4EaABYlnRvXslmCJjYUnoBHrG6pd///eSO+6QfOUrEix3iavCPB76BI3B+pb4JQl2gWk9Fiz9wQ8k6Bm1sFboBG4QXaHxhRdK8MpedJEEXV1zjQQag1r8McPgtMd561YJrhnGC5dGz1DcJ5+UPPGEBF099pgEryjuCH9RIliPF8GrAsX9x3+U6OvNyakxZrbgU55YaGal2P+B7mOo3Axx37/e1whbm1XBQmghtBB2WAgthBZCC6ExZvbgU57IEhgzNfu/vMPU2qFmQ+UNDn7u+wrbVbEEG2uIhvU1qip1NOKYoLBDjzsIyoca95b3lsTd9YOF0EJoIeywEFoILYQWQmPM7MGnPLHQzEqx/wPdx1B5g4Ofey0Z2u3dzhtriM76ev9tcEIhnHw30zuek29Pe7q1ioXQQmgh7LAQWggthBZCY8zswac8sdBMi/0f2bQbC0ffYm0Tq4YaoE0tBLVqqJPI2PKhBvPMnAjhUMtcjkMmeXBrHguhhdBC2GEhtBBaCC2ExpjZg095YqGZFvs/smm3FsbaXHjwG9233VtYt0E+ENuRseVDDeYZC+Ea5GjJgkLXQqgxD2jeioE+QVSofHpV5RRNeT0GMxkso9rWCVwkembb8qYGyOqXrNSxgoq8+qrkhRck0FQ8o2Q1e2P4BHVdTdryNKSe74/BRUIXMWFOjUXqMHRY67WUdzUCer7hhhIDXyjljhhMevm268Khb74pwXnfeKPElP/5PyVwjz26ziQMAa87ZupoDGGAxd13nwTHPvqoBJN+GBGG8oorJDBPHIu1MXGRWCsStXiiEMLzzpPAaSGEGFhYDaQdlo5grLDMZnvp1wsukMCHMVa4ZrgWXiQMDu4IJobLaPshTOy66yT4kaJtcfi9A88XTotnhJ7xTuoz4uTUGDNb8LFOLDQzhoXkA3kjMlSby4cagEb7SiwMTUYMdbImWLoQ9o5VrUUJGDt0uTwfkjfWOxZCC6GF0EJoIcTAWggthMaYFQMf68RCM2NYSFP5utFtd8QSbAyV12Mro9aHQGFvm9LXORjbYJ5ZuhD2bg+VgLFDl8t7D+m2c+N1ioXQQmghtBBaCDGwFkILoTFmxcDHOrHQzBgW0uS+bkRyLZrl8t5+QP30V9jiALV80Q3mmWUUwrG7mbFDl8t7D+m2c+N1ioXQQmghtBBaCDGwFkILoTFmxcDHOrHQzHi6j2/cxUZvYTwK27kwlkdQmDvJu73beWMN0bC+RlWlMVZ5N9M7novY7nbHnm69YCG0EFoILYQWQgyshdBCaIxZMfCxTiw0M57u4xt3UdVbW6uGGqBNLYy1LBroX5uMuapauFbI/zaIfydsk2+5d2SGQIM8to3yvJsPXDeo1ei8Ns3yX5FsKhLyrxJMoMuLGuUozWc15P/FcKVQhaqp94tgFoTbr6/OoffjZYne7xlnSErZJzlM1zslX9LoseW3Eo4zgMS2Vzd9R4PLkCfI0Ti2xKQXSTQVQvirX0kghNCH8jlJ8mH1Q32vTj5ZUsrNmj/EPPtsieHap8cUCR4Kh10V9xpdWBKS057mXnaZBCtJwi0x0JgiX3WV5NJLJTgWc3Ece+WVkh26jij88OKLJZdfLsENfvWrEiyF+o1vSPCn7utfl5x1luT00yXf/KYEPZ95pgRX9bWvSVC7ebMEXSH/639J/lGXykTagwNdhJc+/HAreJHw2wEk9p57JDgWfoiXAe8V1BpCiOAVvfVWCX6GULXm5NQYM1vCLMUYszpYCAdjIbQQWggthBZCvkgWQmPMshJmKcaY1cFCOBgLoYXQQmghtBDyRbIQGmOWlTBLMWbxYC66fzpqJsZCOBgLoYXQQmghtBDyRbIQGmOWlTBLMcasDhbCwVgILYQWQguhhZAvkoXQGLOshFmKMWZ1wFRV1tXkyoo6vcZCdMcdJ0k8pfljDIQBPWPNRijfc89JMJ1OhiAkUdkRs2VLiUmoTalM4rz0pfKeRnjrLUk5UVPekNDiVDbKE5o2X4753OdKDM+rK7JytU9dChUGmIYdq7lK41S7UyONMScsZYsEI6lDR9UEh2v0BeZ5PyPBK0qlhy9hoUX4EubT8EMsaLlHF5bEspNXXy3BcpfwB3SFi8RlQDaQ9tqnP/2pBKtfYi1Q9IzHgKuC5ED5oMcYKwwsvAUCfNttEowV/obCqpvf/a4EzoOlQXH7+HsT44wHihuE0uOqsNonPgxYdBS6iGGHh0Pb0BiPG1J3yy0SvDm4XzwU1VROTo0xs4UfXGPMzLEQWggrFkILoYXQQmghNMbMFH5wjTEzx0JoIaxYCC2EFkILoYXQGDNT+ME1xswcC6GFsGIhtBBaCC2EFkJjzEzhB9cYM3MshBbCioXQQmghtBBaCI0xM4UfXGPMjIGoQGPeeUeS0IUW1RAgVzgS50Vt2YT1S2/W3BDz9tslppRnJNoVVOSNNyR/93cS+jDVa7dGwInawXKmGzZI4NJjho5CKA8lmclvNQDW+mLML39ZYkp5Ngazr/S7wx9isBhkukEd5yOLpBxaxvZggIzGxo0l5tFHJSec0Er7fcYas3i++GOFcJFGXBZkA4thYor8xS9KMK3HGqR47dAV5OoaXQoV83gsLAkzwdvQNk8oAZwHvoSxQle4KjgtVrCE8kEm0TMCFYFcQcwwsHgo27ZJtm6V4EeLG2+UQDUhkzgv3BKKi8eNJ4hj0fg735HgvHhk8FI8lPYz2rtXggVa0RjXrH/oODk1xswWflHBQjOrR98cbD9D5R9Z/s++/9MIW5tVAZNvC6GFMGAhtBBaCC2EFkJjzMrCLyrIEhgzjr6Z0hjah9TaoWZD5Q0OTXh6CttVsQQb80PD+hpVlXqz8ZZR2KHHHWSoTbeN2o5aC1BYG6OkEqvmHVy6hdBCGLAQWggthBZCC6ExZmXhFxUsNLN69M3B9jNU3uDQhEdKhnZ7t/PG/NBZX++/DU4ohJPvZobaD5XX3cWVNHbnmu5mKhZCC2HAQmghtBBaCC2ExpiVhV9UsNDMOOpMqdsIswupRZtYEtvH2lo11ABtaiGoVUOdRMaWDzVYRdalEPb2kw+Ju3NNd3sVC6GFMGAhtBBaCC2EFkJjzMrCLypYaGYcdaZ0aFIh5bEkF+b22Bja7i2s2yAfiO3I2PKhBqvIGhXCWIjdXJW38+5cgyky14os98dgmnveeZJvfUuCFeAwDcDCiviUw+IgSJhgPPOM5NRTJegKd1TKr5p5VwPgSwAKBKY5liIqYpYMELUC5ZkrZ/5e0wIvQ+ICDdisUXS91iOOkOCNLeWvY448ssRg/oxXBS9hKc/FUAiP0pRvadRa9RbSW6eBTsCXMK/FFBnHYoFHCGHbtbAYJhpDgdpLg0KBsAolavE3BQKrgWthzVX8lQSNgVpfcYUEVnPJJRKc9/LLJddeK0Et1olFV5deKoG3XHaZBNqGx42ngB8aENhye/lWqBfeSVwVhh3rxELL8dY99pgEvyxgcHSlUN5Re3B0UVlOTo0xs0UnAYmFZsbRO3HvLW9sRIZqc/lQA9BoX4mFocmIoU7mgaULYe9Q1FqUgKHDcWDvbi3Ebq6q25FavgawEDZjIRzEQmghtBBaCC2Expilo5OAxEIz4+iduPeW541uG5P73ma95fXYyqj1IVDY26b0dQ7GNlhFli6EvdtDJWBohIfKsbv/saVDGo1j+VrCQtiMhXAQC6GF0EJoIbQQGmOWjk4CEgvNjGNosp7L80Yk107eYYOFBFscoJYvusEqsoxCOHY3M9R+qBy78aGgMIIGaw8LYTMWwkEshBZCC6GF0EJojFk6OglILDQzjqHJetyNc/pY1S6ECbQbxPIICnMnebd3O2/MDw3ra1RVGkORdzND7YfKe3dRONS496i1gYWwGQvhIBZCC6GF0EJoITTGLB2dBCQWmhnH0GQ97i4coFHVW1urhhqgTS2MtSwa6F+bjLmqWjgn5H8bxL8Ttsl31HvjQ9Sx6ojlodWY3Vg4bdXa4EtfknCm/ukS8/rrEkyR24bwyU9KEjtjXnqpxMB5sPZpeMr7Ycecx+uilIcVCXko5uSTS8y+fZJSntD8SfN7jdZy5czXJScWCYEQKrxBvf2PFwk0lbooJzr77BJTyhualpfyBkmzlnp8i0ZHg43lKZx0Uokpp2jK7zRT8ZpG4CqjmMhiAg2pw6qMmJpjHv/zn0swRYZroSs0hj1DrqCLMEDMxWFx8AdIPI7FuppYdBSuBXnuTK9myxYJxhnuAamDxe3aJcEtYPHP9v3ijq6+WtK+Xyz9iqGDaeN3NQzOWWdJUIungK6wyigaw+Lw8wcGB0MH8cZTwEjiJcQfHA0np8aY2YKvpDFm1lgILYQWQguhhZDjbCG0EBpjZgW+ksaYWWMhtBBaCC2EFkKOs4XQQmiMmRX4ShqzOGAEPVJghrAQWggthBZCCyHH2UJoITTGzAp8JY0xs8ZCaCG0EFoILYQcZwuhhdAYMyvwlTTGzBpM8/B1hmsl5XtLI8AeDz9cUsozGmHcecUe08qoAqZqL7wgKSdIIKK4DCx3+e67EqhI+5rLMUVStmvAeRrhj3+UfOpTknK0hCtnlvc1T8VgAlnK3pj33y8xU4GBxaqqv/pViUm/DsRX7q3DDisxZZMEE0jMGN98U4La446T4EWCPfJxHy/B/X7ucyWG09M9ugwjHA+LfyKYmsMfvv99CXxJ113kusBYGhS1kFgsaImeIYSQyTvukGCdSfQMicVfZ2iMFxrugcHBqpu4Kjg8xOwnP5kieL4YZ2gqaqF8qMXg4JEh8H8sHIr7xYkQdAWXxuPGLeBE+EUDte0XGD3jCeqwc3JqjJktdXpgjFkdLIQWQguhhbBnPg1hwKQftRZCC2GNhdAYMyV1emCMWR0shBZCC6GFsGc+DWHApB+1FkILYY2F0BgzJXV6YIxZHSyEFkILoYWwZz4NYcCkH7UWQgthjYXQGDMldXpgjFkdLIQWQguhhbBnPg1hwKQftRZCC2GNhdAYMyV1emCMmRPUW5Q0NQe/0fw2hkK4UXOSBI0xU8fkG7PtUu7XPBqTNGZPzLied2te0oCbNb+KgVu2wZQ4ITdYyr9pIN6H1jU9kDPPLDF4+hCzskGjFocnWMrdmj9oRJ5LeVujPfO9QoAo7saNJaaUXRrwh2b+UfOg5h3NyJwP5A2NHvvYYxIIw/nnS2A1WCkUjbHQIrzl29+WYMaMH4cgV2gMb9m7V4KZOkzsvPMk8GGoJlawxOqXV1whwaqbUD50tXmzBH/p7NwpgcXBTGBiGA0YEX4OQFd4CugKS6Hi+eLXAYwVtBwrdrZXc/3xjyVojLfu8sslUM0LL5TgjvAULrpIglp4KYbu61+XXHBBDCenxpjZIp/ixIfzr0bM/HPm9Wc2wtZmPrAQNnq2EFoIax60EFoILYQWQmPM0pFPcSJL4JwI4aHJYU9huyqWYGNd0rC+RlWljlscPRR26HEjcptYUsnlsYd4YC2PVXU3H74WsRA2erYQWghrHrQQWggthBZCY8zSkU9xYiFJYMwqcmhyKCVDu73beWNd0llf778NTiiEk+9m2u0n3I0bQ22wnXfXFhbCRs8WQgthzYMWQguhhdBCaIxZOvIpTiwkCYwZy4H522hGh6pc3m3nclCr8rGZseVDDdYHcyWEoN1bfkDdRu9Db59ozWEhbPRsIbQQ1jxoIbQQWggthMaYpSOf4sRCksCYsRyawo12c/nQdrdbtyOxfS4EY8uHGqwPLIRrghclpxSJcuSRkvIxDXlXo3Pxo4qEsgFgCNfGYK3I8lnJgsKO4aU8kSrBp0sMR4PHSnbo8ofJWr+peToG0x4ci4k6ZAO+gFVGn31WUj4hOfpoCX4OwB2l9UthRP+oAZtjXn65xKQfKd5qrG2bPFwaP/VUiQFYVhTyDAWA0uOnBCz9CvjDChzvRz+SYGVFaAwm/Zia3367BLNtnRPTLbHMJiwO1wzlg9PiMmCAp50mwXlxzdBFCBJE5b77JBgr/MnJS7bGoOf2eaF8uGaMFewRtdBFdIUbfOIJCZboxHsFW8Y1Yw1SuBZuH6qJRwYDbA873na8DI8/LsFPZTBAXDOGTo/l5NQYM1v4mVQWkgTGjAVzv6Hp+9hy0GhfiYWhyYihTtYZSxfC3lGttSjJTH54bBmr6vYkG902eph/XrQQWggthMVCaCFsxEJoITTGrBj8TCoLSQJjxoK5X91dRHmdSQ61AUN9VsY2WB8sXQh7t4dK2rSf3dC5ep8UXoZ8JblknnnRQmghtBAWC6GFsBELoYXQGLNi8DOpLCQJjBkL5n51d9pyFAK2OEAtX3SD9cEyCuHY3bG0Dx/azRt1u7dqqGSeedFCaCG0EBYLoYWwEQuhhdAYs2LwM6ksJAmMGQvmfnU3Tgux3W307vYWTnJs73beWJc0rK9RVWmMat7NtNtPuJs36m4sybVxd8550UJoIbQQFguhhbARC6GF0BizYvAzqSwkCYwZS2OO3js/bLQfKomFvX2iKpZgY12S/20Q/07YJg9O7xg2qCOfG6NkqEEtz+17S3L5/AMVeU8DXtZMUYvJWDlOU17RTMWLGtFFtt2kUXvkTJ2Ia8EBEKgIanEiTMVLeUqiF1nKDZodmrs1p8Zg+dZrr5W8/rokXdVWDS4DQWNRvjRW8shwVVAvaFseeekZPzScLNm3TxL/DH/IqaeWmHKihsjjxut97LESLMBbrr5aggn06adLsN4jVvuEECKXXSbBbBuGgGk91i/FQ8ICnpj0Y9lJ6AQ0BrXoGaLy059KMOmHl0KfoBO/+IUEZoKe8SPNrl0SqBcuA4ODXylwR7hfXCQaQ7xxXqwEC32CeeJYaCqWQkUtTAzvM3qG42HYoYt4RfGrBE6ENVexAq1eBienxpjZwi+qMWbmWAgthBZCC6GF0EJoITTGrA78ohpjZo6F0EJoIbQQWggthBZCY8zqwC+qMYsCE7mFtfZ/2lxdLIQWQguhhdBCaCG0EBpjVgd+UY0xM8dCaCG0EFoILYQWQguhMWZ14BfVGLO6YLZdyh7J8SUG09x33pGAF16QYPKN6SWmiKB9IrgWJv3lcI3K5NNPlxhILK4qjRUQe0Qdl/fkoqMfaIDIFR4KBvaDD0pMKa9rFFr6cxrc0R80b2vulRxWJOT3mjckRxeJ2tTxx5eYROsHDqx2WU6RbNkigVpjnEu5RbNbojJ5zDESrlEJb4FdwBAwF4chXHmlBGL2yCMSvO7QVHgausLUHLN8OMDFF0sgSE8+KYG3wIh+pkt0fu1rkm3bJFACqPVZZ0kgVxBvPCMIEq4KjXfulJxzjgS1eNxY2/fssyUw/O3bJRhnPF8ci58DELyx+N3hkkskGGdcFV4GfAngh3i92z6MO8JT0Fvg5NQYM1vk22yMWXWS5OyxEFoILYQWQguhhdBCaIxZIeTbbIxZdZLk7LEQWggthBZCC6GF0EJojFkh5NtsjFl1kuTssRBaCC2EFkILoYXQQmiMWSHk22yMWXWS5OyxEFoILYQWQguhhdBCaIxZIeTbbIxZBY6S5HUaZc3G8lcxWB4PJoYZ86uvlhgq0J8XSXlTs0PzkAZmIoud4jLKx4qk7IzBZKw9OJ/8pCQh/vDXf11i0pqccr9f+UqJKRs1cFrekYDbP/roEkO3LLs0N8dgqlbK+5o9MfnlicFip0k1kT9JNqS1Q2PKlyUcHLwq72qg5XslJ5QYvO3lWMmGDRLc78svSzjLx8z1wQclmNZfecD0aqBPCI6FIKExJv049rbbJPBSGMI110iw3CWCWT7WAoWY4bx/8zeSBx6QQK2xii6cB6tuwlsgwBddJMFV4acFePgeXb8Ut4+uMBq4DDwjvEiPPSbBewXhx3qe+MOPnwMuvVSCNwc/NOA1wyqyuF+YNq4ZwQ3i6cMt9RY4OTXGzBaZuKxBnj8AS6dkqIdaPtSgsiyXsRJcteeqRtjarA5N50EshDEWQguhhdBCaCG0EBpjlohMXProVCfCFsrYBsvLVKcbajy2fKhBZJI2s6dhfY2qCqayvYUdetxBGm3ybi6Ju5Xe3lDVWzvHNJ0HsRDGWAgthBZCC6GF0EJojFkiMnHpY1rPmbb9ElmW0w11sm6EsPffBicUwsl3M432uSqXxN1c2G7fe/i80nQexEIYYyG0EFoILYQWQguhMWaJyMSljyHP6cqfP0QtzCW1fKgNCmt5bJB3c0noYH953K4N4nakXT7UoBbWKpSsOnMlhLEkVrULJynJVWuKpvMgFsIYC6GF0EJoIbQQWgiNMUtEJi59DEkOjKhuo31uFlu2t2tJLY+7uSTu9m7HjWm3ewvrdi2Ju/OAhXANsHmzJAmDgI914reafZoXNC9pZF1N+MOnPiXZtEmSzgvXmoKNGyXwJczbS3lN86+STUVS7tSA1onSVSmbcCKxOF5V+WUMpmpYkxNPAReZasUPUXv55ZLEQzHtXxbKKSUm/dDQ4qSTJOQTGl2BFo5XyjMxr71WYvB64xawGmJ5+GEJpuY//7nk/vsleISwmptukmACDefBfBo6AQOE8uGq4FoQQlzVrl0SnBe3D1/CTziXXSZBV//8z5K//VsJTgT1wnmxbipMDNYKBcL94nHjCUK9YDVQL6g1HjdeO1wz7ghPcCovhTxv3SrBq4IniB84MBpojOeL28fg4LxqvJycGmNmC77GmU57IrUczdrl7d2x5WjQMXTU0HbemLZ8qEHv7jywdCGM5FqUgNyglsSqduEkJTiwo5bMOxbCSFKvzQ1PsxBqrYXQQmghtBBaCI0xU4OvcWZIcoZcaKi8vTu2HA06ho4a2s4b05Y/nzjYVJvND0sXwt7toRKQG9SSvNEub5c0qtYAFsJIUq/NDU+zEGqthdBCaCG0EFoIjTFTg69xZkhyhlxoqLy9O1Ret9GgY+xR2M4b05ajAWjXrgrLKIRjdzO5QS2JGwANKo2SRtUawEIYSeq1ueFpFkKttRBaCC2EFkILoTFmavA1zgxJzlh3GtqNLcdu512Alu3tuDHtdi6M5dieHxrW16iq7J/7TbybabSv20Ntejvv7WGS3bnGQhhJ6rW54WkWQq21EFoILYQWQguhMWZq8DXOdAoUqeVoVjcazboStEFhLK+1KKnEqrHbKIy0y4ca1MKuPO7OCfnfBvHvhG32z/2GS3ItwBwMVfV/Qa3qPTaX5Kre2jXDCy9I8A097jgJRAXBtD7xhZjPfKbEvPuuJC06qiZ2WIlJkvOcRhZKLeX3GpHJL3+5xMAQSrle8jFZ0PKZZySwKR0KDuy2bZIzzpB89rMSGCAWtHziCckJJ0gSr8e8/36JSeqF0cAzuqWR+KflQ/CqvPKKpJSrNViDVJ/gBll0NC1n2rpmSGx6gd+KwS1gQVq8k6w9XoOFFn/xC8keXYUSs15MzVEL5cOfDegTlACiAl3EbBuSg7842rdw1VWS735XApmEIXzvexJozJNPSiB18CXUtoOFQ6++WgIhhLecf77kuutawbFtP8R54Wmnny655JJWMLB4KPhrBY1xGRBRvDn4ZQErweIl/NrXJHi9cSyeL95JPZaTU2PMbNGpyKrRtqlGbRazVWFOLsOsByyEFkILoYXQQjgmFkILoTFm+dCpyKrRsKlGlTHrEAuhhdBCaCG0EI6JhdBCaIxZPnQqsmr0Wp//2W0NgbnZ/umZWRwWQguhhdBCaCEcEwuhhdAYs3zoVMQYs9pYCC2EFkILoYVwTCyEFkJjzPKhUxFjzMx5+WUJp7k6vca89p13JFjBEtNrrF+K2uk4RTKuK1m/FCtJpluAtn1Lc4ZGOOIIybj7lROldVNlJC+4oMSUsjPm6adLTLqFN2L+y38pMbApPP103r0xf/EXJSap1/0xeM0wnyzlac07GhjgyxrRRTwFvLHJ8QQ+o40aXVYU00v8GoLGGNiTTy4xXMIRYgblu/JKCSbBWAv07rtbgeNhccjt2yXXXiuBmGHyjcvAAp5oDF1EILHwhwsvlMBb8KsMnlnTEPiOYpzhhzgWy8bqgpa8oyuukECfMFZ4ZLiMBx6Q4LxoDNfCNWNwzjlHAqWHh+O8GDq8zzgvjBd/Fh59VILRaP9ZwHulf+g4OTXGzBZ+j40xM8ZCaCG0EHbwGVkILYQWwi4WQmPMSsLvcaL7D/m6/5bP26u7bdYnFkILoYWwg8/IQmghtBB2sRAaY1YSfo+NMTPGQmghtBB28BlZCC2EFsIuFkJjzErC77ExZsZYCC2EFsIOPiMLoYXQQtjFQmiMWUn4PTbGzJzfaJSPaXQuzsm3qsiOHSXmtdckmKpt3SrZt0+C2uuvl2C2DRWBPpXyO829MX/8Y4nZsEFSylbJCUWiZlLKCxrlUxryQAxFRcHAlnJpDI9F1PGwIuvHP15iqNZcsfPsmCRId2tEU/WGaHEwz7/7Owlu8L33JLAYgFUYyyaNXgaWYMVVYX3acmKR6DuJaS1faMxroV6YbbenyAjm4qjF8o+PPCJBY9TCWyA5OO/jj0vgAPfdJ8GSuzBArI0JXcTql7Aa3C+GHXeElTPvvVcC48Xin2gMbYOnYXDwfHFVN90k2b1bgmeExnivMJK4qnPPlWApVDxfnAgCjMeNJXbxyPAHGH9SIM9QPnSFq9Jr5uTUGDNbRh/mXv7Tf2plhhyaZ65hVuUWTvybExtha7NKWAgthBZCC6GF0EJoITTGrA6jD3MvWQKnFEKdJfYzYRsWLTc4Rd0dKl8ESzl2cTSsr1FViY8mDkhGjxN6m8XCWI5aFMbdWFLb56N6yS3zUbWkNsYhqIrlsaq3EFUWwlEshBZCC6GF0ELIq7IQGmNWktGHuZcsgdMLITZALD80mexhqHwZGTrFUPkiWMauJqSzvt5/G5xQCCff7WXokKHyCbdR0ugt09tnPmSoamz5hNtx10I4ioXQQmghtBBaCHlVFkJjzEoy+jD3kiVwGiEcmv426G3T28+hmefBkkps1luOqkZJo3zoqNogl8fambG6QthoMNRVPmQRVbllZagql4/tPB/SkcuHDqm7FsJRLIQWQguhhdBCyKuyEBpjVpLRh7mXLIHzIYSxJO4ucbvbwG6jfOx2t1u38+5KYyEEQ1W5fGzn+ZCOXD50SG65H5gYpG7LFklahfLfNDCxf43ZtavEkCM0ynHHScrhGrWpU04pMaVs18j6lrCLE06QENpyGxkNLMtXPi3BqpMLTTjOqnxYK/Ev/1JSym2a32oUHeczzpB88IHk7LMlxx8vefVVCe7o058uMRjnY4+V8BeNaR7K5s0SXAZehk99SoLfDkr5K03TeMubEiy0iOk1arGgJQwB64jCEGA1WJMTwSqjmNZjSVKcCLcAx8P7jUCBcF6o5j/9kwSN4YcYHJgJ9Al/RDHOuGbcIJQPtT/7meSrX5XgqmBiqIWlY+FQXEaUpQ+DlwE3+M//LIEtwx4hdbhI1OKhYDlT3AKGDu8V7gjnxQ2iVo2Xk1NjzGzhRxJkCVxJIRxq0O5naHfeynt3V5qlC2Ek16IExAbopO7Gwq68bqOkXRXRVsJQbS6fpPPecrSJJbF9bnYQC6GF0ELYYSG0EFoILYTGmBnAjyTIErhiQtiobfcjE4gDDDWrGwANsLtc5b27K83ShbB3e6gE5Aa9ozS0jZKpqoYYapnLezvPzSq97VEyUVcWQguhhbDDQmghtBBaCI0xM4AfSZAlcGWEsFFVUm17tzLUbIntF13eu7vSLKMQjt3N5AZjR2nyQ2JJrhpiqGUuH+o8t+wYah9LJurKQmghtBB2WAgthBZCC6ExZgbwIwmyBE4jhGVgKhy3824v7cN7a2P50Ha3i43Jy4e2u428i6oZ0LC+RlWlcS95t5ehQ4bK29tDu5NcSaW3/8k7H1s+4XbePYiF0EJoIeywEFoILYQWQmPMDOBHEmQJnF4IK7Gwt0FHrYrE8tym9/BYGMtRlQvrbrs8VqGwbmMXVTMg/9sg/p2wTb7gRdzOJKOEktwe5ajNLdvkHmIhqtAslvS2RxUK4+6hkiMlp54qKeWXGnEPrm+pKlLKK5oHJRuKRMFicjTAIsuZlrJbc2fM4YeXGF4G2KQp12vkWAgD5Lk+g0NPQlYo/cpXSgzAU0i3rwaoFofzpmMFNIbyYfYF5+GxZY9GoD7pAp4Ub3030om+oMHTB/+iEdizXhUXSsUbe7ykPc4QYDb+2tck7Ukw1k5EY6y7iPUt21Nk2BQcD4tS3nWXBLWXXipBLewCl4E7wi2gFut5wuLaJ8JYoWcIEnrGCqU4Fs6D1WzxBHGDCIbuqqskO3dKcL+wVlwz3ivYI4Khg8W1n+BPfiJp/2aB9wq3gBcYqnnbbRKsx4vb11pOTo0xs4VfzXnl4GxhGqZtv9Is4hbMRwMLYWSThdBCaCG0EFoILYTGmNnBr+Y64sC8xZj5x0IY2WQhtBBaCC2EFkILoTFmdvCruY44MG8xMwLzunkYfF7QHFzSABbCyCYLoYXQQmghtBBaCI0xs4NfTWPMrLEQRjZZCC2EFkILoYXQQmiMmR38ahpjZsyzz0owCcZakZhAP/NMiXnpJQkab9tWYpLVCHAtrGlXyt6YN98sMTgvaF8klACXAf7iLyTlFMl//+8S6oSCywBQPkxN213B0046qcTgBt9/X4IpMQ1f7wgDi2ke9OnddyUAvvTOO5Ijj5SU8kXNezFY+xQ3iBfpS18qMaV8S6LvBsCaq6W8pQGPS2BimNZj8g1hQK2unViuvFKCKTKm5nt0zUbUYlqP6fXPdOVMTM3xyuIWbrpJglk+8vd/L8ESrG0lwFjhjvAUIHUwk7aJtaXu6qslaAzFxe3Dl6Be+CHtuuskOBYW1+4ZVwWZxFPAeq2wODwUnAjPCA8Ul4EniJHEnwUsz6sPhZNTY8xs4UfSGDNjLIQRC6GF0EJoIbQQsmcLoTFmJeFH0hgzYyyEEQuhhdBCaCG0ELJnC6ExZiXhR9IYM2MshBELoYXQQmghtBCyZwuhMWYl4UfSGDNjLIQRC6GF0EJoIbQQsmcLoTFmJeFH0hgzY+APkCvMmNEYMyisLIgVO//0J0kpL8Wg5zRx3xaDxuXPSgxrx6xCKcAfuIyqjkaqFVKtHJuWb233vDMmaerWmHT7T8UcfXSJQc84LxyPa4HqeU8+ucTgl4W2/593noTmSbQrVc1xvBnz8sslphwhwThjudr0jPZqwPYYHgthaAshVAR/CBFMvmFxmIvjMrDOJHr+7nclOBEcD11hpo55PNbkPPdcCQTp61+XXHONBGMFM4HywaZOO02CpUGfeEKCRwa5wlXh9uGHuCN0hZVRcV54GnwJ522vfQoTw49DGDpcBl6k9jjjgUL5LrpIgrcOY3XOORIY4JNPSvREnJwaY2YLv5kAP24iM+TQzGqpjO1kuU40Jxzx/x3RCFubVaGaQ4eF0EJYYyG0EFoILYQWQmPMSsNvJsgSOKUQ6ryoh9hgqE2ZQOQmZJJ+JmmzVmhYX6Oq0vt0UNihxwm9zWJhLEctCuNuLKnt81Eg99l7SG95b0ncXST1ZB0WQgthjYXQQmghtBBaCI0xKw2/mSBL4PRCiA0wVA4mbDaWSfqZpM1aobO+3n8bnFAIJ9/tZeiQofIJt1HS6A0MdTjh9uQnmoKu34qF0EJYYyG0EFoILYQWQmPMSsNvJsgSOI0QHpgLDe42CkFuE+ZaPYWN8ljVW1irULJGWV0hbDQY6iofsoiq3LIydEgll+OQ2CA3XgwLioXQQlhjIbQQWggthBZCY8xKw28myBK4AkKoc6cecj+1JG4sy3YtibtrFwshGDqkkstxSGyQGy+KwzXlfskxJSapiEyCOc3V2qQT7WN3xsBMACYYOHbHjhJTyuWSTRRXiWpbuv23NHLeDRtKzIeXKflskeixeAq8BVWgBeXEE0vM449LSrlNszcm3aBcRnpGcmwpD8Z88pMl5phjJBicdF7tWV9C3G/5sH1M2RGT3jpwRgx6Bpi3J6Wvz25/MFbpBd4j2bxZcu21EizgicZ7dGlQTJGxvCd6Rlf/439IUAu7QM9oDAeAimD9UmgMlqz84hcl6Aq+1L4M/EHClAInQs94ClAgDA4aw6Yee0yCWtzCz38uwfNFYxg+/vDjIqHH6AoPBdIOe0RjXAb+5OBYPFCsfYqgKzyy88+X4HcmnEh1kZNTY8xs4ccZZAlcbiGMdB99lqYDp2ozbXnv7tpl6UIYybUoAbEBOqm7sbArr9soaVdFtJXQ6K0jl+dD8sbSsBA2YiEMSc9IjrUQxmCs0gtsIbQQWggthMaYg/DjDLIErqQQloE2k/Qz1KZRDnqbrXWWLoS920MlIDeoJUM9T3gISnLVEGMPyeW9h3TbufGisBA2YiEMSc9IjrUQxmCs0gtsIbQQWggthMaYg/DjDLIEriMhjOWgXbuGWEYhHLubyQ2Gxn+oPJZMVTXE2ENyee8h3XZuvCgshI1YCEPSM5JjLYQxGKv0AlsILYQWQguhMeYg/DiDLIHTCGFpTqZ7t+NuZKhZ3Fj0drfbu73WaVhfo6qCoWjv9jJ0yFB5e3tod5Ir6Wh0PtV2tzv5eZtYCBuxEIakZyTHWghjMFbpBbYQWggthBZCY8xB+HEGWQKnF8JKLAxN+tuAoUN6Cxvlsaq3sCuPu2ua/G+D+HfCNnkoMIChZpDecc7HohbtUY7a3HIItMxdNcrzbj5wccjkG0sJJnQiS40R4GljdOLIItHaOiKHblvOi57HnVckB8KAEyXVfEqiKoJVKNEVVlWlThxVYtI1y/3yWB2rJFcCFkfEDb77rqR8RtK+Koxk+zLeeUdSNmrwbmDY8RPGYRoeq2OFYzdJ7rxTgldlTM/6BNObszmGg4N57e7dEqyOiDnxxRdLMOuFEeHYtnlecIHkkkskWP4Rtbh/qCbMBFcFu7juOgnuCD6MVSixyujevRIM+/btElzz174mwbFYKhNyBeXD7WOs7tdFZR95RAIhxP3iWLxIuH2sI4qxOvNMCYQQN4hXFIOD4Fg8QfU03iCOxcLWeGPRGKuqai0np8aY2TKaH8w3h2Z0K87MTmRMRaa5FsIIuqKZWAhDLIQWQguhhdBCaIxZBKP5gTFmlZBproUwgq5oJhbCEAuhhdBCaCG0EBpjFsFofmDMEsDc+8D0e5XhBc3BJQ0h01wLYQRd0UwshCEWQguhhdBCaCE0xiyC0fzAGLNKyDTXQhhBVzQTC2GIhdBCaCG0EFoIjTGLYDQ/MMasEvtn8zVJY97StKbXFAZMvjm9fkUjtZgjsWedmsPExkzcKVe4KtSqALfvV49Ntd3FHAyUAIKE20fPqMVyj+lYOe8OrrkqPUNxcSzeja1bS0z7vOkpNGtPKhK6tBxLuZqmNj2jnTE4th08BawEi/MWgBkzJu7wtPb0GhqD2ptuktxzjwQyCV1Ez6iFirTvCFfVrm0vZwpBwnnbtegKZoJavO6ohcbAWtEYfohaCDBqsZDmAw9IYERf/rLk29+WoGfUPvqoBC/h2WdL0FV7rPA3BZ4Rfh3Asbhf1GLp17al61+FnJwaY2YLP4vGmJkjk2BM+i2EFsIavBsWwhgLoYXQQngw7bHC3xQWQmOMhdCYOUAmwZj0WwgthDV4NyyEMRZCC6GF8GDaY4W/KSyExhgLoTFzgEyCMem3EFoIa/BuWAhjLIQWQgvhwbTHCn9TWAiNMRZCY+YAmQRj0m8htBDW4N2wEMZYCC2EFsKDaY8V/qawEBpjLITGzAEyVcU0l0akE3c05vR6g4S1UBGCCfSbGjmWPY9Z71F71sYJ0cVXXy0x1BjlW9+SQCY5zlwqE5r6BckpRaLSDm1L4yzXTI3Rx/3mmyWGI/lZyUsvSUp5IIbS/mcS9ky2Stpa3q5tvzljap+JSbWKPlAMDo/FVPU735Fgag6reewxCabXcK22IMHxsOgqlrv85jclWHQUK3ZircjTT5dAgSBXqMUSnZddJoHiYiFN1P7gBxLUQicuv1yya5fkrrskDz8swUXCeXAsamHpeFWwIitUE2P1+OOS9gKeeK9uvVWCxlNJO2rbl6Haxhs87zwJXlFILGTye9+L4eTUGDNb+A0F//f/tjJDDs2slo2l9FaPXfarWnYWmjFzwl4LoYXQQjhBrYXQQmghtBAaY5YffkNBlsAphVDnRf1M2IZFS2MpHcZjl9LPDGhcXKOqEh9NB1soYxs0mOpEZYJzjW0wP+y1EFoILYQT1FoILYQWQguhMWb54TcUZAmcXgixAVA+YbOls5QO47FL6WcGdBe3kFKr2kx7d9O2j0z4JkzO0nuYGXsthBZCC+EEtRZCC6GF0EJojFl++A0FWQKnEcJJpviLaxMZquotjyVD27kxynNV3J0ruitbSKlVbYZurSvHaNTdWJKbxapGSdytPaAwbqBB3a0l88xeC6GF0EI4Qa2F0EJoIbQQGmOWH35DQZbAuRHC3u1RIxWG3CZvdNtDR/Vu15K4O1d0V7aQUqvaDN0aBiEOTi3sdhtVcTeXxAOHtnMhymvhXIOZOqaqaZYPWrLRVk3MNqEE9Idydgy6Sjoh58Wc4d57JVjBsnucFU7cdZY/7jJ0NKYRFVwGjsWJfv1rCXvWY9sCjDvCNI896zjzmrU2PVC53xNOKDGoTed9KgbXjPPyoUzzFNJVSc/tFVn59NtXBRPDBBqC1F4M85JLJBdfLJlqLo6rxPS6fRlYzhRWg9Ug4R46U+doYDlTnBfLe27bJkHj9oqsP/6xBLW4QaStQFBcDCzOi58D0HPbpXHe9tDhZwjoMc7bXkYVToue0Ri/DqC2/Yru3ClBLX7vwFhpY05OjTGzZTQR6SVL4HILYTk0oT80h+mh3c/Yo3obdIXtroZ6aO/OFd2VLaTUqjbdQ4nUcjRrl2MX5bUwEstDq55OxjaYdyyEFsIK7shCaCEcxUIYkyXQQlhjITTGTMloItJLlsDlFsKlt4m7YTa0n9ygEhugMFLL0ayxO1d0V7aQUqvaDN3a0AgMlWO3t9vewpLKcydjG8w7FkILYQV3ZCG0EI5iIYzJEmghrLEQGmOmZDQR6SVL4BwL4YTlsXDoENBuNnTUPNBd2UJKrWozdGtDIzBUjpJcPlRYUnk+19gG846F0EJYwR1ZCC2Eo1gIY7IEWghrLITGmCkZTUR6yRI4jRCWgdn50HbereCQ2O3QKdpt8ka3jd1cPtRmPmlcXKOqMnR3KI+D01seS3JhR6M89p/PNXTSoQ7nDguhhbCCO7IQWghHsRDGZAm0ENZYCI0xUzKaiPSSJXB6IQzzk1FhaNLfBuDwoUNiYazKjRvbuTHKYxWazRsLzYwFd11vtm5gt92sUViGy4teRizERi7HIXMLJrLCvn0SzCgwvU5T850x771XYjDbxLEU0abGpGk97kgWh3z//RLTnrin8/5VDG6hrdboub4fh94SPe8Y2dA1SI8oMRs3SnAigGdUygcaOW96vkL7fl98scTgzcFI4ljKJKLLmZbyYMzLL5eYUt6PofKdKEn3W0dpf9r3i7/tsD4t7xfTaywNiiUrsdAiJsFYdhK1EAYYPxrfcosE82ms6AgRRVdojGDijmMxWO1rxt9Q0BicCLKBWjwFnAhrkOKh4AbxBG++WYKe77tP0jYiPO4tWyRojMtAbdvx2qMBMcPt48c/3NE110iwMipMG+fF8737bglWVW3ePienxpjZEqcT88yhudPBba1cNeJVmQnxiGV0IqtYCC2ENen5Cu37tRBaCAdjIYyxEFoIjfnoEacTa4UDkyizJvGz60UnsoqF0EJYk56v0L5fC6GFcDAWwhgLoYXQmI8ecTqxVjgwiTJrjEOzX9ODTmQVC6GFsCY9X6F9vxZCC+FgLIQxFkILoTEfPeJ0whizKuhEVrEQWghr0vMV2vdrIbQQDsZCGGMhtBAa89EjTieMMatCe5ortc89V2JQW8pDMZjIYXqNWp5XJ/3t2lI2a8K8vOzlsXrNadIvxyZdlGPbPb/9dolBz7j9ZJ5vauTY444rMahNV3V9DM577LGScrJmzP3KeUt5TqLPiFKnx+Kq8FDa5+UT1KRj8UBVrbVnynP7nRwzVlLLa77ySglWv8RMfY8u7wmNwVC2Z/mYfGN6jcYQQtTCTNAz7mjrVgksDneE4LxQEdRCvTA4aIyBfeopCe4I2nbaaZKrrpJAVHBeXFVb+Nsy2T4WnoZaBL8d4N246CIJjsUd4djbb5e0nyCWnEVt+5287DJJ80Xi5NQYM1uKMWa1mWIiayGMafdsIYyxEMbwmi2EFsKattRZCGPa76SF0Ji1QzHGrDZTTGQthDHtni2EMRbCGF6zhdBCWNOWOgthTPudtBAas3YoxpjVZoqJrIUwpt2zhTDGQhjDa7YQWghr2lJnIYxpv5MWQmPWDsUYs9pMMZG1EMa0e7YQxlgIY3jNFkILYU1b6iyEMe130kJozNqhGGNWFygBp6rtSbDWYs1GzArYs06+r722xFx6qYTz+OZV4bw8tq0TWqtDxfvlaPDYPZqdzcix7atKtQrdUk7Ewdkgad8RFpLEaKBnrE+brll65jPSq2ofm655dLNlWjHTnlmr9wt9QG0p2yRay9VNoW3f+Y4E09zHHpOgFotwtteoRO65R4JFGpvzaZ4XvoRj8a6gq299S4K/GtC4Lc9tYYDEtk/UHsl775VgXc32yqi4DDQ+/XQJPA1dYWDbd4TGeEZYRhXHXnGFBMqHnH++BF1t3y7BZVxwgQR/NB59VIKeH3hAglq9fU5OjTGzZTSHMYnnD8DSyZjwwKWcYjJ07XVmFdj/Q7+JWAgbV6VDxfvlaPBYC6GF0EJoIbQQWgiNMWMYzWEG6IylMlT+/IDV9DYYarwIlrGrTKPzRlXHUINcnkuWlSyBUwvh6P+xtRwsVz/rBwth46p0qHi/HA0eayG0EFoILYQWQguhMWYMoznMANCVujuJxizl2AlZxq4yS+l86NhcnkuWlSyB0wlh9Ldlcbll6WRdYSFsXJUOFe+Xo8FjLYQWQguhhdBCaCE0xoxhNIcZYClS19vm+UAtqeV1txJ3uza1pO7GkoNNdbfbQMtKVwJQ3u3W9rG2K6zUwliVW3YltTzuLitZAqcQwixvXQnK6279t8SskbUQVWgfa/Pu+sRC2LgqHSreL0eDx1oILYQWQguhhdBCaIwZw2gOM8CQukziMENtcp+xJNfWjbiNjfZuPBa7qKqgEM16Dx/a7naxEektXCZggMgYso9lqYuF0et6t2vjuBF3ewvXOd0AVTgJ1gl02VQkn5BggsFjTywSrcXE/dlnJemq3pJAgXTynY7Vq+I6kwKOHTdWexui8vLLEh7LwYHE6jVvLBI9L+4Iy3viqv76ryXpCUrPqfaLGh1JfQo4b1p0VI89rMTgWMyfKVd8vn+nkTtCz3i+qN2xQ5JG49EYdIXz/v73JaY8/LCkOXMtP/+5BKtf7tolQVcYO0y+MY/H8o+4SHTVnppffLEEtfAWyCQc4Kc/laCra66RnHuupD3OuAUsHIrGGHbU3nSTBKaNccaqm+iqLXUYq7vukqAx5PmOOyQQ0d27JbhmmDY8HO9V/OHkw+CqvvpVCRrjV4m2lj/xhASqicb6qnByaoyZLaOJ1wCd2FSGyp8fUJreBmg84S7KO4YaY3eovHe3o91mbM8Tlnf0Fi4TnfgNZQwH5lH9JY2NCctBbj/Ucr1xcMZ6CIoKptebLISNsdrbkA0LYYyF0EI4ioXQQmghNOajzWjiNcCQqwyVNxiSogl3e8841Bi7uRzE2g4UDu0usbyjt3CZqO7XmzEcmEf1l/RuADTIu+32OHDdglGgqGB6vclC2BirvQ3ZsBDGWAgthKNYCC2EFkJjPtqMJl4DDLnKUHmDISmacLf3jEONsTtU3qB9yNieJyzv6C1cJqL+5YzhwDyqv6SxAVA+1D7udttDHa43Ds5YD0FRwfR6k4WwMVZ7G7JhIYyxEFoIR7EQWggthMZ8tBlNvAYYcpWh8siEUtTYff4AvdvYyLu97XNVt1u3I402seeh7W4DuyjvLVlWqvv1ZjwHplI9290uansb56NyeT4WR61nurutUFQwvd5kIWyM1d6GbFgIYyyEFsJRLIQWQguhMR9tRhOvAYZ0pZOfCFscoLcBSmJVLakNYm0sn6SklscGtSS27CVWoRmqIrlB3EWzWLUyRP3LmYgwp+opzyUoz23idm3caLbe0Yk75ao5gcbkGxPX886TcNI/jTC88IKklDdjeFXac5q4yx1BzJKotMSM552mFleF8/7xjxIOXdkTgxUNcUfvvy8p5WyNjEaSK6nFHY0bKzmWAtwcjXQZ0/TcfK/qn/lDf/Jb7yRrlXSRclXp2OYbi6kqnmhb27ZskaArqAhkEo0hDBDC226TPPmkBI3PPFOCE+GOUHvRRRIs4Nm+ZlgNar/9bQm6guRgPU8s7vrggxKMM2ohokhbn666SoI7giChq7ZMtp8C7giX0W6MWlzz3r2S731PgmPxQPFzQFuA8eZA+K++OoaTU2PMbMEX1kRgbpOwiPbTHvIRwUJoIeyVHLlfnneaWlwVzmshtBBaCC2EFkI+UAuhMesUfGHNIqhGZ7tbLj5KNlg4gbYQNiVH7pfnnaYWV4XzWggthBZCC6GFkA/UQmjMOgVfWLM4OhW0DS6dQ7PEjxSYBFsIW5Ij98vzTlOLq8J5LYQWQguhhdBCyAdqITRmnYIvrDFm5mASbCFsSY7cL887TS2uCue1EFoILYQWQgshH6iF0Jh1Cr6wxpjZIxNZTlU5Rd4mQe0nNM2J+7HHSsoGjfaMq/rSlyS8ZpWNUi6N2bixxKSJu1xzkknpOdXKsbiql16S8Joxks11RL/ylRKT7hf69GBMMiLpOTmeHEv10mNRi/ul4uJ+9ZoxsByr5nlLeVwjt4CxSj1LLUeSv5VgnOXY9G78RwyvGVNzLJWJae4DD0jaE2id9bIxrnKq5S7hAD/4gQR3BAeAEcHEcF6oJmpvvVWC2ptvluC8sCkc2x5ndIXaSy+VoCtcFY6F88BL0RjLmaIW64j+7GcSNMYj27ZNgp8h0Bhd4RbuvluCxtDF9lVdcIEEte2FYWHaWsvJqTFmthRjzGozmluXpDFp4m4hHCXVyrG4KguhhdBCaCG0ELKxhdAYM4EQxv86zturu23WK6O5dUkakybuFsJRUq0ci6uyEFoILYQWQgshG1sIjTETCKExZqUZza1L0pg0cbcQjpJq5VhclYXQQmghtBBaCNnYQmiMsRAaMweM5tYlaUyauFsIR0m1ciyuykJoIbQQWggthGxsITTGWAiNmQNGc+sPg5XYUFvKZo3YFKfX6oeYBGPiiqTzYvIttTyvuiVr28dqbVpJcqdGVvvEsbxmVSDMrkt5SnO5Rs6brnl3TFK+9rE4EWgfG292zEgmQVrKsTs1io4zeobxpp6FVCvnbV8znz5r9c3BvBZrVGJpUNTiKjG9vuQSCabIWIYR3gLXwkViLVAIA9yjrRO7dklQ274MSB2UAI1x+xhJeAv84eyzJRjn+++XoGecF8dirNBV+1jYMsb5wgsl6AqDg2Pblo5j29aKlxBvLBq3F5XFeTEaqL3lFgm62rEjhpNTY8xs4QdYqf8BWy9s/RHmwKzPmEUiU1ULYYyFsHlsvNkxI5nkainH7tQoFsIYC2EMbh8jaSGMsRAaY2YIP8AKFVBh60SvJsVCnTX1FMby3GCoPFd15PJcsjiWqx/z0USmqhbCGAth89h4s2NGMsnVUo7dqVEshDEWwhjcPkbSQhhjITTGzBB+gBUqoMLWiUPTof6SXNUuz7tD23l3qDCXLI7l6sd8NJGpqoUwxkLYPDbe7JiRTHK1lGN3ahQLYYyFMAa3j5G0EMZYCI0xM4QfYIUKqLB14tB0qL8EVZVc3jikUZXJbWJJd20doclE5bFqqLBW1UJjOmSqaiGMsRA2j403O2Ykk1wt5didGsVCGGMhjMHtYyQthDEWQmPMDOEHWKECKmyd6OSnKlDvbiaXNw5pVGVym3j40Ha3gd1G+7HbxgCZ5qalFKUWn/LuxaqkSbAcq9/fgilyml7LsaxtK58qAa4Z54Wm4ry8o6ZspEl/azR4rPacjpWeeaz2/MILJSbd0akxGBz0DH0qJ2na1zzNWKWnILXpCW6PScfiflsjedJJJQZazmtu36/2PO6nBD0WU1VMoNuLjv7kJxLMidEYa4Gitj29hjBgJckbb5Sg5/ZimBBR1LbvCNe8WsfCHvH71vbtEhggfoTDOOPtx+Oe6prPP1+CH6XQeOtWCWpxg7gFNMZV4bx4keDSGGcMzmWXSXDe226TNK+Kk1NjzGwpTaiAClsnOgWqIoTdbjtMZUeFdRsljapuO/cWiQ0qtQot425lbPsJy42J6FTVQijRO5pGcnhs+46mkQ0eqz1bCDWtkbQQSjD5RlcWwsaxFkILoTFmCZQmVECFrRNRh+L2qEWg0WCSKtBbngtxhZHYJpfHBnEXjWP5qLUxik5VLYQSvaNpJIfHtu9oGtngsdqzhVDTGkkLoQSTb3RlIWwcayG0EBpjlkBpQgVU2DoRdShuj1oEGg0mqQK95bmw0XMHyofaD5VXhsqNKZyqWgglekfTSA6Pbd/RNLLBY7VnC6GmNZIWQgkm3+jKQtg41kJoITTGLIHShAqosHWi14JqIWrHlufdoe28O1QYT9rbGwp72w9td7vYMCajU1ULoUTvaBrJ4bHtO5pGNnis9mwh1LRG0kIoweQbXVkIG8daCC2ExpglUJpQARW2TvRaUCzUqWxPYSzPDYbKc1VHLo8lQ4fHwlg1an2oNpfHwrptjMJpriwcioksp8hjpvVyLGtpnphe747hsdNcVdIJqeWxbY3RWk76tfbXv5aMOa/eUfuaeV5dsrJ9bDrvFLXpGe2c/JoLkWO56iZr5WUY84zG3JH0HP+6/JB9+0pMuirpGfebbl9O1D4vp6qYE6O2rTFY/BMmhvk0pvWYuGMBT5wIwoCeIUg4Fifatk2CxldfLUFt+yLb+tQeybZOYAHP9tKguF+MFWrPPVfS7gpBY5hn+6Hs3i1BLbQNtXiRUHveeRLUYoVSrDKKP1ff/74EXeFx33efBI3vuSeGk1NjzGzRGYIxZvbo9NpC2JINraWYaa2FUAPk2KReqJWXYcwzGnNH0jPEzEIoabuWhdBCWGMhNMYsDZ0hGGNmj06vLYQt2dBaipnWWgg1QI5N6oVaeRnGPKMxdyQ9Q8wshJK2a1kILYQ1FkJjzNLQGYIxZvbo9NpC2JINraWYaa2FUAPk2KReqJWXYcwzGnNH0jPEzEIoabuWhdBCWGMhNMYsDZ0hGGNmj06vLYQt2dBaipnWWgg1QI5N6oVaeRnGPKMxdyQ9Q8wshJK2a1kILYQ1FkJjzNLQGYIxZvYcr1F26NKgaXotqzK258TpWKnFsZgx81hVAgB7PPpoCc6bVPMBzSuSMSoiPZcPewvBlCkdK2A0fvlLyYYNEpyIS4OqxuAy2iPJOypvxqShA/hlAZGr4puzSZJOJMeWsjkGbw6O/eQnJekpaM+fLTFYknTjRkkpj2oe10jtZz5TYjA3pRBiLg6duPNOCWa9EAYc257HQyfOOUeCxnfcIXn4YQlUpK0xuCMIAxqfcYYEtTt3Sh5/XILRaNvjj38sgWlfd50EQ4eu2mtytmsfekiCVwXn/eEPJe3HjbRvASvfQr3uvluCY/Ey4CcMNMY1Y6HUiy+W4KquukqCsdLXjJNTY8xsCZMHY8yqYCEU2bAQRvSOLIQWQguhhXCzhdAYs8yEyYMxZlWwEIpsWAgjekcWQguhhdBCuNlCaIxZZsLkwRizKlgIRTYshBG9IwuhhdBCaCHcbCE0xiwzYfJgjFkVLIQiGxbCiN6RhdBCaCG0EG62EBpjlpkweTDGrAawC8yvSnlI0vaHkyXtqTm6Yq2qCCbumCRwWs+LbK2NiWMvv1yC2ksukaDndAt7NDfEUIGoXv+gkdp0oilqYTVQIDyyqWp53g0S1KIr1HK1TzVe3FH6RUOuiu8GjoWm6jVzdVM9FrdAD2dXzavCgpZYShGudfPNEkyC8WcD+c53JJh8t4M1ObGu5rXXSnDsaadJUItjn3xSglVG9+6VwC1hUw88IIFa4zLQFdQLjS+4QILads/wfzRun/fKKyXtBTzb9/vIIxLU4jJg+JdeKmnfEVwatT/4gQTSjp8D8H3C38hQ+vYN6vq0nJwaY2bLgUnkIFc2Yet5ZWH/xGn1mZPLMHOHhTDGQhiZqpbntRBaCGsshBZCC6ExZpgDk8hBov5l2HqA+r2epLwWxqrewkhvg7wxCblxLlkcy9WPWW9YCGMshJGpanleC6GFsMZCaCG0EBpjhjkwiRwk6l+GrftYCBY07Xa7MNJu0K4FuXEuWRzL1Y9Zb1gIYyyEkalqeV4LoYWwxkJoIbQQGmOGOTCJHCTqX4atEwsDCpTLa0muGiqM9Dbo7XM0e+g7pPR1Ncnhk5THqqHCWlULzfrHQhhjIYxMVcvzWggthDUWQguhhdAYM8yBSeQgUf8ybJ1YGBCbXF5LctVQYaS3Qe6zmzbk7Ugu7D0E290Gdhvtx26bjxBf+IIEU3NMc59+WrJli6Qcoymy/GMpb8X85jcl5pZbJH/+55JS3tfITL17dysUQp2aP/GEpJT/0MikH/ebdEKEUMe1lD/TqBKkNSqlll2x9gPJUSUmqaasBEsV0TvC4FByVHGPO67EpJ7f0mCs5Lys/XBAQtoyuUMXwkVjBG4FIYQ94ViMMy4Dd5Sewt4Y1mLdRcxcYURY/hHrW+IOd++W6CSYufVWCRbShLViHo/z4hZgJrffLmnfPpQAtRhKdIWhw7FwDygQFqWEisBLt2+X4EQ33ijBUpmQK6yMChODPON+Ie2oxaqbuEhYa3ulUPypu/deSVtE8Xc9XkI4PI7FOGNw0BjS3uyZk1NjzGyJM54MFVBh68SBb3QPubyWpE/8YGGkt0Fjo3e3FmZqFVrG3crY9hOWm48KFkILYY2F0EJoIbQQWgiNMTMmzngyVECFrRMHvtE95PJakquGCiO9DXKfo6nDIUatD5ELawkPDi17y2ODuIvGsXzU2nx0sBBaCGsshBZCC6GF0EJojJkxccaToQIqbJ048I3uIZfXklw1VBjpbZD77G0Gcpuxh6N8qP1QeWWo3KxzLIQWwhoLoYXQQmghtBAaY2ZMnPFkqIAKW/dx4DO9yO12YaS3QS2MG4s419jDUdjbfmi728WG+WhhIbQQ1lgILYQWQguhhdAYM2PijCdDBVTYeoDwvR5fnpsNFUZ6G9TCWFtP2ntI6etqksNjYawatT5Um8tjYd02HylkIpum9a3a9lycYkZEVNrHpquS6XW7thxdYpLkiLVSF9UBMBrta0YtesY8FtNL9ow7UjFDLWVDbwFjBQVKI/mmRrQt/j1y4K+Pt2JQy6vSa07nbdfqDw2fKpLyYAysFbUIhh3n5S0cpinXa1rPCIPDufiuXZKzzpJg0g/lw5wYwZwYK4Xm9jFf/7oE3oJaHAv1wjz+rrsk0JipbrCddlcQlXx4DG4ftRgNLIaJWhgvauGlOBGGDqt93nmnJN9FTLsxtA3n/dGPJJBJ+D+eAs6L3x0wGtu2SdpdIVhCWoedk1NjzGz5/9l7/1jNqvref4UvNWbC5RpKiNcS71zC5RJqKdcSarnWUkoVKaVIqSIiUkBESpFSRER+OPyGARUQR0AExBEoRUS0lMsVpJQipdRLDCGEawhpiCHEEEKMIYbMd2bOzJ71fq3nWeecmXOeM2fm9cr7j2fttfbea+/9nNmf10OymKoLRWQBWd5Rvn6vQtiZM3oVwphVzrk5b783HplC2JMcRCHsHEoh7AxWCEVkPpmqC0VkAVneUb5+r0LYmTN6FcKYVc65OW+/Nx6ZQtiTHEQh7BxKIewMVghFZD6ZqgtFZAFZ3lG+fq9C2JkzehXCmFXOuTlvvzcemULYkxxEIewcSiHsDFYIRWQ+maoLRWQBWd5Rvn6vQtiZM3oVwphVzrk5b783HplC2JMcRCHsHEoh7AxWCEVkPpmqC0VkAVnek5ylEfZ2dXG6sj72hWygcC3bZ/LI2LfpBeiNdSYbiU336CrfaadF+jrR3I0wk6Y3aHrjiviMMrPbd5re5XV22aXUaZ5v+lJXUyHtOC9sip6WNL0xq/4V8XuVT593MnsxSdxJHvn44yOoxftrNiIooPu9WN8SXgqLw48WGIyVM9F7880RzOob34igF+dFLwJRwfViiU70Qr3Q+9nPRtAL58GssMoolP7ooyPYF7/ZoBcGiBNhMDwcwRXhLweHgh+i90tfiqAX6+KiFznvvAh6YdroxQPFd/LEE+uwOBWRycKXt4hMnG6JvFQhVAjH9S6voxDWwSRxJ3lkhVAhVAhHRiEU2Trgy1tEJk63RF6qECqE43qX11EI62CSuJM8skKoECqEI6MQimwd8OUtIhOnWyIvVQgVwnG9y+sohHUwSdxJHlkhVAgVwpFRCEW2DvjyFpGJ0y2RlyqECuG43uV1FMI6mCTuJI+sECqECuHIKIQiWwd8eYvIxMkiOCv1ppBd2Vk7kSVyt+jHYnL9oh+9UK+m6L8hk8V3Xi9ONE3Rn9fbnDeO3MhG7MtZ9c+bvc15+7Pq926Y8NpgWdGAs8ojb0ovZgUhbPatJ7yc38m8VzBtnLd5RnFknBeTxL74ImHfFSsivCIUsldfHUFvX59Q1mPlTPTecUcEh8Iijejtl/Vf+UoEtfisDtU3IuQLX4igF9Pozwr22J6rzumnR9DbF6TjjotgMHwYTxCH6s8Zy9X2Lx8PpX/e/hP81rci6EVwJ3He/gXid0Tse/31kexlcSoik6UuNlpW/aiXxciagnOCTPh0skjJ8loh7IhZXm9z3jgy5tzcSYVwQzArhVAh3BCFUCEc0r9AhVBk0VIXGy2tBG6EEA4vaHaMAsNmuNfMGXnAdmO7ZeOYq+PIlk2W1wphR8zyepvzxpEx5+ZOKoQbglkphArhhiiECuGQ/gUqhCKLlrrYaGklcLZCuKbAG/V5HDMZsymMPH67sd2ycczVcWTLJstrhbAjZnm9zXnjyJhzcycVwg3BrBRChXBDFEKFcEj/AhVCkUVLXWy0tBI4KyFcU92N2YJ3d7sR40f2DgPa7fXGejvGjNuIXdrjzHB73TVu49A1bJStjSyvFcKOmOX1NueNI2POzZ1UCDcEs1IIFcINUQgVwiH9C1QIRRYtdbHR0krg3ArhyM9TH9DsjK93mclx6u3jNo48Pj5PfUCzM37az7KVMvUlGED1hRIZFtfXGByZRXDue8MNERTu1KecVVPW3xvZudTBBXJWeeRGj7MXK5R2e6e5G11B4hWVYyOzeQq4k0ceWeo0540r2mOPUofXu0uJlJfrNM8o9u3fDaxQ2hwq+MlPIs3gOC93zjtZyrUZzAryHL3NncS+mSuuiPRXR4QhoCZGEYwVStGLfVHWw0z6/oBg+UcowS23RDArSOzN3RVKcaPRi1U3b7opgvP2zROH6i/9igeK9Txn9UBPPTXSvxvoxb+qGHzUUZG//MsILuHGGyMXXtjLt78dwXK1mMZ990XQ2785eAq4VxgMmcwvA4tTEZksfB0nrQTOoRDO63YwbvywsWXowsi6OTDt+Blul62RDV+6tSiEEYWwikKYUQjHRyFUCBVCEZkxfB0nrQQuIiFcX3+tox0w0G6sx4N6TLu9HlA3MbjevmG0bJ3gm6EQRhTCKgphRiEcH4VQIVQIRWTG8HWctBK4WIRwhtvHbeyPL832cePHbR8Yt122IlYlCmFEIayiEGYUwvFRCBVChVBEZgxfx0krgbMSwpLCg89DE5+HMXVzI8bXG0duH2g3jjwXttcbR44f93mqiQ+y9TL15RhQCCMKYRWFMKMQjo9CqBAqhCIyY/g6TloJnK0QlqrcHbkRXdgysgsbh89o1oOH7Rg/buPI42BYvbHu2jB6fW+7vd44fJatlSyCWUBvE2nK3LvqPPVUqcOqF1KXrvXaa5FSTqiDF315a4a6+GqdXXYpdaAEFGAqwcrOCpa4G888E9l55wjuxnT3KiaJp9BoagC5ah7Z65mwGuy7cmWkLIngyJS6pRH24np3L5G8z82+YdqYBh5oc/m3ZvDNwVNAbz6U8nQk59x8RW+rw+8GKlfU4rApDEbx3R/8uc9FzjwzguIbXgqLw2DoBMwEgRHhe4Y595dCRXA3+kf+znci6P361yNYwfIzn4n0FfeCCyL4UuLmYF9ILB4KxBv7XnttBL2YRl9xL700gh8LMLj/yHAJf/M3EQzu/wyBW4fe22+PYFY5DRanIjJZhhpmwihCIuvJQlYhjJSVCuEQhVAhVAgVQoVQROacoYaZMAqhyHqykFUII2WlQjhEIVQIFUKFUCEUkTlnqGEmjEIosp4sZBXCSFmpEA5RCBVChVAhVAhFZM4ZahgRWSCykFUII2WlQjhEIVQIFUKFUCEUkTlnqGFEZKEI9cIKfyi+67WJVoM6pyncX45sVyJZfDf7Ri81NUW0qdRX1sGcceRGFwPum0V/Myv4Q48f/CCy444RCAN699038uY3R0q5LHNg5tA6KJhhcRDRZcsiuO3wYYgZ1jvEYBovuaQO6lic6LTTIjvtFMEl7LlnpCFv3dK4ObwE8KZM/pVhkuUb34igNEcvnhnyta9FoBOwGhTQEIZ+LX7XXREcGc8bvX/91xHY1HXXRf72byOYBozo7/8+gi/Hu98d+eIXI1hDGbKBXlwRBAlX9PjjEbj0V78awXcUTx+rfeJx49ZhVvjHHZeP3quvjmChVKgmXAtzxpdhxYoILh+D7703cs89EXwJv/KVyBe+EPne9yL5jFicishk4TtURCaOQqgQKoQKoUKoECqEIrIw8B0qIhNHIVQIFUKFUCFUCBVCEVkY+A4VkYmjECqECqFCqBAqhAqhiCwMfIeKyMRRCBVChVAhVAgVQoVQRBYGvkNFZMLAapB99okcemjkkUci2PfuuyOHHRaB80C9KDlIubEO9j3ppFKnkY0QwqY3eUsvjSAdljmzzgsvlDqNiOasppamXB8oUCnX1MFtx91Y7Z6ZZPcIDgV7pPHuViLwf9yufILwtL33jnAaSLmjDn6VQCleto00N+epOvzW7RTBvpwkf+84ps4vflHqcF/UxKjUv/zlCAp3KAHWxoRbotqGL11/fQTnhVviRCjNIWaQK0gdBuPyYRffymVUsS/0GP8GweLwB4xZ4ebgiwVBwokwq+9+N4JDYbFTTBJrcmI1V/TCiK68MoKb0/+qwC3xBKGLeGQ4EZZ+xQKtkMnlyyPw8HPOifT/cC6+OHL22ZG0ZRanIjJZNpQlo1h1992dcPQWytqiZQTjtovMDtSmiELYiUKoEG6YpEKoECqEU8GJFEIRmY4NZckoWgmcrRDWr2/2zQzsuNHHGainNMBBFeN6x20XmR2oTRGFsBOFUCHcMEmFUCFUCKeCEymEIjIdG8qSUbQSOCshXPu6H9ucIRu310yY4ZHHDRu3XWR2oDZFFMJOFEKFcMMkFUKFUCGcCk6kEIrIdGwoS0bRSuCmCGFN/VofuX3csOHDyN5hQLu9pe0d9qq76o3YPnLMsFFkRqA2RRTCThRChXDDJBVChVAhnApOpBCKyHRsKEtG0UrgnAjh1Nt82s/40G6f9vNUc/gMxh0ZzXEHH7dx+CwyI6a+NAPoxTv0/vsjqGuR/pFRIu++ewS1OIVwaQQnamfSmRUo25c66H3ppVIHCxyWcm8kJ1nKDZE0sf4VYZlNGu/bI9h3jz1KnXe+M8JZldsyy+vgTr76agQL0mKZTdTeWDf14YcjuJMHHFDqYIFDnrfcXQer1+JuPPdcpFnq9ot1cPlPPRXBbUdv47RPR84/P3L55ZHPfz6CwfgTRQF94YURVNtwHgSLNJ53XuSKKyIXXRTBnFHH41AIznvppRHcHEgsjBeChPUtYbwwTwgwDBAmdvvtERgg9oXT4lAQfsyqb+mYRl/5EEwDUocbC6fF9wr2iFl98pMRyDOWFUUvfv7BiXAJuHXozctncSoik6V0aSVwVkJYstatN1ZDwqzq7SM3jhs87faWTleZwQHbDyObItOwKkGvQlijENZRCBVChXBdFEKFUEQ2gdKllcDZCmHNqsqgAAbUYOO4wdNub2m7NkxoLcNGjGk/gA2jRaal/+1RCGsUwjoKoUKoEK6LQqgQisgmULq0EjhXQpg96xi5HRvHHWTa7S39kdMesP0gsjGsStCrENYohHUUQoVQIVwXhVAhFJFNoHRpJXBWQrhqvErVXSO3tx/a7eM+T30Y2azpjOwcvD1RvbHeLjIjpr5AA+hVCGsUwjoKoUKoEK6LQqgQisgmULq0EjgrISxZ685q+7gtI7uwcfjcNmvarvpoQ++wcegattef2wEiMwJlLmpCrrtYflUHVe9220WwgCfW1XzjjQjL+lyjEvtikmVVJnWi/vNYzf77lzqNAt1aBzcHF9jcnPAHnLeUo+qgfm4OlW6ZcgU9xiSx3CN6ES6ymtlzz0jZNlNWZEA4z7nnljrNzcmnn4pLeU5Q5C9L85yOEyJ5+bvtFil7ZrCqah7qJz8pdaDWWN2UlSvKXDzRG2+MwC7gHvfcE8GJPvWpCBYsRQGN1S/vvDMCjcHCuFjvEXaB612ZKoLlLqGauDn9fXEi3I2+5OBuwMT6J8oFLXmvIGawOAQ+jMvHqpu4GxiMSeKh4GsGS++vMorVTbGMKu4z1iCF4WMNUjwy3Dr8LeCR4bz5BWZxKiKThS9nEZkwMASFUCEcohAqhAqhQqgQish8w5eziEwYGIJCqBAOUQgVQoVQIVQIRWS+4ctZRCYMDEEhVAiHKIQKoUKoECqEIjLf8OUsIhMGhqAQKoRDFEKFUCFUCBVCEZlv+HIWkQnzzDMRvDThD1jjDb3/8R+RUh7IRE2MBUtLubEOvQVGlKBwx+qXv/xlBKpZynOZWfEfdTBnWitsavsMSUGie8SdPO20Uge1GcATLOXhOvTSnDNWN8V56XjvKnXQu/POpU4pB2WWZe6M5KxefDGCEwH8hLHDDhF8N5rfLILXX49gX5wX+/LIMDH8EaImxsqZWHYSa3Ji0dH+ip04EQJBghGhjkfhjguEEWFNzn6Vj28wNBXOA8nBrGBEWNAS9xkCjOBe4QniEmDp6MUkMQ34Ic6LQ8GIcIHYF2KGp4DrxTRggPhVAk8BN6e/Li6cFnPGFwk+jK83zpu9LE5FZLLgLSkik0YhVAgVQoVQIaQvKYQKoYhMCrwlRWTSKIQKoUKoECqE9CWFUCEUkUmBt6SITBqFUCFUCBVChZC+pBAqhCIyKfCWFJFJoxAqhAqhQqgQ0pcUQoVQRCYF3pIiMnlimU2sjgjJYZmby102Vf6JdXAoBLzwQqQBvnRHJEtzrn2aCgRDaGZ1eh30Pvts5LXXIjCiM86IoBfrar7jHZHmEgIYIK5oxx0j02hqLoXaPIVckXVpqfPzn0dwn0u5IROOx+9VWRnJxT95CQkuv5QnI3uVOrg5zdPPfZeUOs3guDmcZJ637JTBKpSoa6+9NgL1gqdh0VUs7wlDgNShjsdgiArcA7KBI3/+8xGsYIlKHdcL2YBdQAihT1A+3DqsnIlZYeFQzAqKe/fdEdw6WE3/+UIX+w8Fl487iSvCNOB42Bf3Gee9/fbIvfdGMCu45Wc+E8EvGjgy7hWEEJeAryimAXvMwSxORWSy4FUOODrhaBHZKBRChVAhVAgVQoVQIRSRhQGvcsDRCUd3WVtjbAwbvaPIYkEhVAgVQoVQIVQIFUIRWRjwKgccnXB0l7U1xsaw0TuKLBYUQoVQIVQIFUKFUCEUkYUBr3LA0QlHjycrjbEb614MQJfIloRCqBAqhAqhQqgQKoQisjDgVQ44OuHoLmtrjGgOW/B53AeRLRO4RylHRN5dIl0DxLKTqLZLWZEJWEAvzZTHM8HU3/AAZINlPc2kf6hrM0mKCs570UWlTnNk3I3QCTgeFLfhgTrNiZZn+uBe3ZsJ8HyfeCICacf6pShN998/AqnDFd13X6mDXtyrvfeOlHJ3JL/PcDx4eH9WALf9V78qdfhzAMzk6qsjV1wRgWuh2v7OdyIooFHW40QwE/RCNfEIMRg2BX1CpY4jn3tuBH9IWCgVIgolgOTADyEbWDkT9wrXe2EuhgmNwfUiODLUC5PEBeJQmBUeNy4fh8JXBb8d4HuFSUJT8YsGvqK4XhwZ14tLOP/8CI583nkRPEFYOr5mOSsWmCIyWVBgAI5OOLrL2hf09M3OB5EtE4WweyiFUCFUCBVChVAhFJF5BAUG4OiEo7usfUFHE6Crbg6fRbZAFMLuoRRChVAhVAgVQoVQROYRFBiAoxOO7rL2BT22OTBsbz+IbJkohN1DKYQKoUKoECqECqGIzCMoMABHJxzdsPalPOLzVHNkb+eDyJaJQtg9lEKoECqECqFCqBCKyDyCAgNwdMLRDWtfyhs+r39Nc8uwse4dmhgjsqWBSh0LPL7tbaUOKuayXSb3Hf54pjjppFKnlAMzZ0a2L5Fyf+ZXdS65pNTBFR19dASzQuEKQyjlxchSaOqNmYCKm6KCaWBw3z1wqMcfj/AZlZcyD9XhkTE4vQU39qCDIljDD/cKJ6IglWMyT2Xi5wAcqtHyWQn/dXXwAwcCx0Nv88NKHJlf79XPpQ6qfNTEd90VQZWP8hoVM0pknAjffrgWerFkJVYZxaxw3m9/O4JeyAYW5IV74G7AAHHr0At9wvqlWLIS58WNhUziyKefHsGcEfgS5oxbhyeIO4lJYlZYZBX7Qryhi9dcE4Fr4ZsD4ccvGuecE8H14lcJPIX+tx0PBXPG9/nyy+uwwBSRyYKXtYhMGoWwjkKoEI6LQqgQjnUPhVAhFJFNAC9rEZk0CmEdhVAhHBeFUCEc6x4KoUIoIpsAXtYiMmkUwjoKoUI4LgqhQjjWPRRChVBENgG8rEVk0iiEdRRChXBcFEKFcKx7KIQKoYhsAnhZi8jkiYUlX3211GnK3ADrTHLw7pn9MuW5zB2ZWzKxJueSJaVOs2LnwZlbM3fWgXpBgd54IwIlaHqXZWAmITkwEzDc4Sma3pgGngLWesW+WDmTBpirqsItcahSXs/cVIeDU2LLtpmkcdoQQppneazOCy+UOqUcnYlbh9VcMWd+N8pVmfgiMXm9hx4a4RcYlTrqeCy0iCVJv/zlCFa/RLWN1SBRqf/t30YgKlhI8957I7ALPCTYI9Rr+fIIrgi6CCO6+eYIrAb7whDwMwx04qMfjeAS4DyQDegxZoXHjUlCcnAo3NivfCWCpwB96kssrgiD8VBwItxY3CucCBeIHxr6vzvgRNBFfK/wBcZ9zu8zi1MRmSxZBYjIAqAQKoQKoUKoECqECqGILAxZBYjIAqAQKoQKoUKoECqECqGILAxZBYjIAqAQKoQKoUKoECqECqGILAxZBYjIAqAQKoQKoUKoECqECqGILAxZBYjIxGHVi8K9HF4H60yigG7q+BSkbWI1SA5OQ3j99Qhn1T9U9gLMGXU8F5Z8aybNBIfCzZnmvG+O5UzhaRjMu1EOrYNVRrEv+P73Sx1eb/lgHZwXh0I5XXaN8MhLMxTCp+tg32XLIpB2zIpfhvw5AHPmkXMaMG3M6t3vjgDs23++LHMxSxggLBa9EML+mo3f/W4E/oDSHEKISUJyLr44gjnDanBezBmiglnBeKFPWCoTs8I0rr46AtfCBf7930f6+oQrwpExGFcEjcE0IKIInhF6cSLYFB43nuCKFRFMEt9JnAhfQhg+niDWL8Xl47bj1wFMEn8aF1xQh8WpiEwWvkSTB7tw9GxY8woWkaIQKoT19SqECqFCqBAqhCIyWfgSTaiACUfPhjWv4C7TDhDZQlAIFcIN16sQKoQKoUKoEIrIZOFLNKECJhw9G9a8grtMO0BkC0EhVAg3XK9CqBAqhAqhQigik4Uv0YQKmHD0dPAVPGr7uC3jNoosehRChXDD9SqECqFCqBAqhCIyWfgSTaiACUd3WffaHfV5w6CqOW77yKbIIgYFNIJCtpRLMi/VQX019Zc2QF9KJcBgUMozdRpBOiNzZZ1jjy11yl6ZckwmV86EiKY9Nu4Rutjcqy9msAbpiXX22qvU4a1Lb/n5z0sd3FiSNsWFYcktmQMyK+s0kww4Sd6cuLFYCxRfBi7uigeaF3jAAREcClrO71X3dwcER/7FL0qdslMEg1kTw3nwdwVBwlKKfV/q98KIoE9XXhnB8o9wgLvuiqDKhz+cd14EvgR/WJlLVt5xRwRXhBPBeTBJDEbwFDDJc86JQJ8Q3I3+nDFJLNGJYBVZ+DDMEx6OLyEeN5wWvVh0FFeE4CngOwkDhPKdcUbk8ssjZ50VgR9iTd3cl8WpiEwWFg0JFTDh6C5r3rnjmwPD9nEDpuj3iiwm2tK2jkKoECqECqFCyKegECqEIjJ3sGhIqIAJR3dZ884d0+SruRkwbGmHiSx62tK2jkKoECqECqFCyKegECqEIjJ3sGhIqIAJR3dZ884d1Zzt9pFNkUVMW9rWUQgVQoVQIVQI+RQUQoVQROYOFg0JFTDh6IY179nq89DE53Fjhu1o1sNEFj1taVtHIVQIFUKFUCHkU1AIFUIRmTtYNCRUwISjG9a8Z7MZr+Bm+9TndmO7pd4usriB8jVlfSgB1k5EPc2FJVMXm94wIix22q/jqalLM3le7Atw3sbxoJrhpWefXeqceWYEh9pllwjuM2YFFUHvTjuVOn21xkKpWGgQg5un/6s6GLzuC7QBON7xdU47rdQBzTJcBZAAAFpvSURBVJEfiOxe6nBw3it8N/hVybtRyoGRPFFf+QAGv/BCBIM5K1Tq554bQS1+ySURVNuwuOXLIxfmQov9ZSexkCbKawgS9oWo4BKwqirMBCeCEMLEIAzQVIgK3AOLcOKKcAmwVtxJzAq9eGSf/WwEgyE5MF7cSTg8BuMSoJo4EWQSIlpL+OrgPvcfN1QTXxX8ooHvJL4qEFH8OILni1nh+eZPGCxORWSysCwQkQmD2rRRAoVQIVQI1wTnBRisEPYMQSFUCIcohCKiEIosOKhNGyVQCBVChXBNcF6AwQphzxAUQoVwiEIoIgqhyIKD2rRRAoVQIVQI1wTnBRisEPYMQSFUCIcohCKiEIosOKhNGyVQCBVChXBNcF6AwQphzxAUQoVwiEIoIgqhyIKDogjramJ5PFhcv2I+7LBSB0L4zndGsLAkXuXYFycq5ck6WCuSg/cpddC7KeDGNgIcS4OWcnAd3KvmyFiEM57CNNdb/qNO/5FBren/uSIrVvvcf/8IHiiCfTGNd7+71ME0Lrgg0l/6FcJfyk11cN7yphIpR2TOzCzL9H6GaO9ABM6D0hx/otCn22+P4C8HdXy/NMfqlzgyrBW9qMUhDKjj4QCo1O+9N4KiH/qE68XNQS9kA56GE8Glr78+AtVcsSKCBS3xQPGvKvQJPwdgX9wc3Fg8o1lZHJ4+7hV68WMBrghHxq3DYNxnPEE8I2gqvoT4PuPy8UNDTpLFqYhMljVlk4gsIArhXIEbqxB2ohBGFEKFUCFUCEW2YtaUTSKygCiEcwVurELYiUIYUQgVQoVQIRTZillTNonIAqIQzhW4sQphJwphRCFUCBVChVBkK2ZN2SQiC4hCOFfgxiqEnSiEEYVQIVQIFUKRrZg1ZZOILCgrM1FeT2diMbjpjSUcd9ih1IHVoOhHWY/BTK4zidLliSciKPob50GVf1+d5gLBI5mgMZMTI7lS6HSEAL/6aqkDppvzMRkQksPO/O0Aj2zJkghuDkq1Un5WB4fil2GvTLLHHhEsK9rcjRMiucootO3ZZ0sdLLGLBVoxZ3zN4PD8ymKtSLhWro7IArp/KBTfKNyhiwgkBxKLFSxxZDxvBKKCXjgARAWXf/fdveDmLFsWwTSwCCdkA8F9vvPOCG7dOedEsDwxrgjLbOLp44qgi3hGMLF77omcdVakf59xr/C4Efg/vs94CrixePp94z3//AjOiyvKXhanIjJZ+C5Pbu7C0bNhVF0kspWiECqEQ4BCqBAqhAphc59xr1oJrKMQish08F2e1PrXwtFdUAiNqotEtlIUQoVwCFAIFUKFUCFs7jPuVSuBdRRCEZkOvsuTWv9aOLoLCqFRdZHIVopCqBAOAQqhQqgQKoTNfca9aiWwjkIoItPBd3lS618LR48nC4B1W9reYYvIVoVCqBAOAQqhQqgQKoTNfca9aiWwjkIoItPBd3lS618LR3dBITQ06+0YI7JVkBXy6r+B2zK3ZMIAUfXutlvk5ZcjpZyWuTKyNNa3xJExSYAql90Jynr0oqxHbyl31EEv5gybYm96aSkPZAIsM/nYY5FSHq+DE/G8XfpXhF8HcIEwXgrw9hHq4n6ZLqifodY4L64IEoulX1Ga8tbhke3STf6UUMpP6zz6aKlTvvrVCJaOvDVXv4QhYNHV7343gl7U8ai2+yqCdTWvvjqCOcNboIuXXhrB9xvrauK8xx0X6avXpz8dwZERTBI2hacAW8YVwT3gpfAlKNDnPheB1awufergcfeXfoU+4YpwN3BeTBKrjOKrgvPiq4JFZeHS+CPE08dfCh4Zjox85zuR/LazOBWRyYIXPaj1r4Wju6ypBEY1sV1kq4MVs0KoEI65IoVQIVQIFUKFUETmHLzoQa1/LRzdZU0lMKa5oVQQ2QoZ/gDW/xkohArh6CtSCBVChVAhVAhFZM7Bix7U+tfC0V3WVALjm52NIls4rJgVQoVwzBUphAqhQqgQKoQiMufgRQ9q/Wvh6IY1b/9Rn+tmZ4zIVkHUywqhQjj+ihRChVAhVAgVQhGZc/CiB7X+tXB0w5q3f/V5XT0wXZfI1kY4Xtmh1GFZPw23ZpJ3ZZZGsFoe3IOlee4Li8MVPf10qdOsqvpCHZwXtQrW4UMdyzuZ7sHVL8uvMk/WGf5VGkkpZ9TZZptSh/eqPFGnkTqAJ3hCnYcfLnVKeb3ONCbWXUYVTxBfBsBL2CbTpVmRNYTw8cdLHR6ZJzqyDlZwxLKiuBv8s0KZi6/dt78dwe8fUCCU9V/5SgQrZ8JMUItfdFEECzyuWBGBMMAtoSKwRxwZVT4mCdfCeXEiiApmBVHBbccTxY2FEGKScC2cCJcAb4FLw+EhSJgzpgGpw43FrcNTOPvsyPXXR/AE8VXBvcLdwBXhyOhF8BMGfg7A5eO2n3deJC+fxamITBa+rUVk4iiECuGAQqgQKoQKoUIoIhOFb2sRmTgKoUI4oBAqhAqhQqgQishE4dtaRCaOQqgQDiiECqFCqBAqhCIyUfi2FpGJoxAqhAMKoUKoECqECqGITBS+rUVk4kTR31S9sYQj6lq4Byoo+NLpp0dwKAD32GWXSCk31MG+vIS3Z/bK7J4pz2fOzqxbyXN9sJJkSF3Zt9ShA5QfZPIp5CRxgW+8Uepg9csDD4w0VwSW18ESrM8/H8FSqChrcdtfeSVSyl2R1d5eBRcIl8ZStxBCfAmb+xzssEME19s8lJczIcCcJP9wkrdldsrcfHMESzheeGEEtTiUD+U1DgWZxF8sliSFe/SXyjz//AjWmcS/BTCEo4+O4AJxZPgSLhB6jElCvLEmJ36HgD7hGcEtcWRMAzcWt/2EEyIf+lAEunjEERHM+dprI9BF+CHOizuJp4AniK8ZDgVtw52ES3/84xEYIE6ELzD8H4qLrxnuVe7L4lREJgtfmiIycRRChVAhVAgVQoVQIRSRhYEvTRGZOAqhQqgQKoQKoUKoEIrIwsCXpohMHIVQIVQIFUKFUCFUCEVkYeBLU0QmjkKoECqECqFCqBAqhCKyMPClKSITJ6rtpkQOYWC1DddamslVN5sjh11cckmp0xCDMavddy91Srm3DoRhWa6kiF6KGdcCjSPjirbbLtKQR16a9yoFCUdullG9MhP3+bTTSh2cqFFrXC8UN44MbZsVcPh1t2Q9Bx0Uaa43QF3XPMGYcykH1MHX7O1vj+y6a6T5Tm74yq3Nmr+XKk/V4X1+awbfZ1TqUAJU2xiMqheSg30/+9kIhAF/G1DNU0+NwExws7CcKcp6nBeTxC8NKPpxvdAJ7AttQ7AGKabxsY9FoHxwD+yL68V5YTV/93eRvsZgyVkMxqxgYvjmwJYxGIfCrwMwT1w+lA+DsTQoToRbhyPjW4c7iWeEbw6u9+KL67A4FZHJghc9OL8LR28Ca8sVka2UqGsbbYsiWCFUCDcOhVAhVAgVQoVQREaCFz2gAiYcvQmsLVd6TDtAZPESdW2jbVEEK4QK4cahECqECqFCqBCKyEjwogdUwISjN4G15UqPaQeILF6irm20LYpghVAh3DgUQoVQIVQIFUIRGQle9IAKmHB0l7UFybqVC4YtNfVIbGy3jNsoshiJurbRtiiCFUKFcONQCBVChVAhVAhFZCR40QMqYMLRXdbXJCOa+DyMqZvjto9siiwuosxlIYulFLfNlNPr4O0MyZn6Sxv4yU9KnUceiTRlfRbQ2Ys5o6zFebFvoxN312l676pDYdg58tJLkb6mcn1L+sMs7kaz3GX0Ys5YOxDPF4MbpY81VyFX+F7xXuUCnnANCCHOi18lmiPH9TZzDvgDx1L8otG7z81544rKu0sdPu4lGbjHl78cwZmgfFgc8uyzI6inUSKjysdCwMcdF0EtjsU/sRgmJgmr+chHIpgkvAWLrMJbsC+WQsWSpJ/+dOT44yOQK/gDToS7kXZRVqyI4BJwKOgi7tVFF0XwYwG+G5gGToTFP/E1wyP77ncjEG8MxqqquDnYFyvQ4kv4rVxltG+e2BcyiT8NzDlPxOJURCZL9WYeARUw4egua+vAmTYHhu3jBkzR7xXZzFmuEFZiphAqhAqhQqgQKoQiMjmqN/MIqIAJR3dZWwfOqNlUjxwwbGmHiSxGliuElZgphAqhQqgQKoQKoYhMjurNPAIqYMLRXdbWgdM3Z7t9ZFNkcbFcIazETCFUCBVChVAhVAhFZHJUb+YRUAETjm5YW/uN+DzVHLbg87gxw3Y062Eii5HlCmElZgqhQqgQKoQKoUIoIpOjejOPgAqYcHTD2tpvxOdhS1aJ3D71ud3Ybqm3iywyqAR7R/bbL0L2ypDlmVsyL9WhiCZNWR+lOUcnw9/q+r/Y+zMo+sEbdVDWN0qQS3R2pe773y91SO57zz2RUq7NrJeQdYnlLnlkXi/uZCw6ilu3886lTikPZ0Ac+fDDSx18N555ptRBDXzmmRFYHKWu3FqHJobrxe8d/MbekIne5si5L468NALjZRGMRTghKhiMXigfCmiUyFiVEfcdBTQ8DUfGwpKo1CFIODKMCMIAQUL6hoBFR7H2KX7BwuqXOBGODLnCzcFDQW9fNW++OYK1XnGv0IvniyND2668MoI5Yxr41uGKMBiHwjSgixdcEMGiozgvDoUnCMXF48ac88gsTkVksgylg4gsDAqhQlhFIayjECqECuHa4FuHK1IIRWTTGEoHEVkYFEKFsIpCWEchVAgVwrXBtw5XpBCKyKYxlA4isjAohAphFYWwjkKoECqEa4NvHa5IIRSRTWMoHURkYVAIFcIqCmEdhVAhVAjXBt86XJFCKCKbxlA6iMhmwbnnRqAi04nZykz0LsvFPxv6ohK9r79e6pQdMtg3S/OjjorgiqBA/evFYCpBVwinud5tYqVQPIW3vCVS9o3051x2K5HZSM6OO5Y6OPI054Ug8ebEifqzwk8Yp5wSKeXMOs0VxSqydPjyszpvvFHq7L9/pLwzQ3AVwcMPR1ip10a3OiiRzzorgvIaC1riRwuoCE6EQ6H4xjTgS/3CHUU/hBCrUKJwP+20CJYGxXlxvTgRZoVDwS5gy7h82CNWN8UVYRXdv/u7CFQTk8RDwY8FWFcT58W+mDPcEpeAaXz2sxE8I3wZ8OsADgVrhdOec04Eg/GM8PQ/97kI7jNmlXNmcSoikwVvSRFZYBTCmv71YjAdgM6Ts+pfr0I4flYKoUKoECqECqHIlgTekiKywCiENf3rxWA6AJ0nZ9W/XoVw/KwUQoVQIVQIFUKRLQm8JUVkgVEIa/rXi8F0ADpPzqp/vQrh+FkphAqhQqgQKoQiWxJ4S4rIAqMQ1vSvF4PpAHSenFX/ehXC8bNSCBVChVAhVAhFtiTwlhSRScNFGlNFsMwmNOa110qdsl+mnFDn6adLnWbR0SigUfSXd2TSLrBC6bHHRsruGShBHor+gOTNwa3jvkljj49kHs68kPlJZEmJkGWZPvfXaSZ5YCZ5cybZY4/IrHr5nSyXZGJ92lKOrfPqq6VOc2N/mgH4ReOyzI8z4NVMnzsiqPKxrOq110ZQuH/72xEs8IiiH+U1nAdlPfaFTGIwVt3ESqFwHkwD++LIuDmf/GTkO9+J4MjwlpNPjuDXL+jEJz4RwS9Jf/RHkb/4i8hHPxr52MciONQHPhA58sgI/jnDrDD4/e+PHHZY5M//PAJd/OAHI7iEP/zDCL6T731vBCfC4p+QumuuiVx8cQS/lXzkI5EPf7gXLG2M837hC3VYnMpEeFBkPXxJJsd34eiNYm3NI7IVw+I7nUchVAgVQoVQIaTFKYQKoWwydALZiuFLMqECJhzdZW1tM4Jx2wemHSCyuGHxnc6jECqECqFCqBDS4hRChVA2GTqBbMXwJZlQAROO3ijW1jw9ph0gsrhh8Z3OoxAqhAqhQqgQ0uIUQoVQNhk6gWzF8CWZUAETju6ytrbZ8DlrnhHbx20Zt1FkscLiO51HIVQIFUKFUCGkxSmECqFsMnQC2YrhSzKhAiYc3WVtbbPuw7jPUx/QHLd9ZFNkMXJPJsrrpvgGT2ay2u56C1YKnfprHOBoHIoq8lwGPBvhvriEJM/b15hS7o1gzu/KJI3G9EnlwxW9KbLDDpHmPkOQrskcUKfZF1wQyWmU8lgdrJvKe7VXBtfbh8/3xEgqPa8I/l+ez7yceTEDw8eNfSJzS+TyyyMf+lDkyit7OfroCCpmiMqsHKDfu38uuorzQkX6s0LvH/xBBHaBYFHKv/qrCHzpuOMif/ZnEVwgJAf2CNnArGAmf/mXETxf+OF550UwZ5wIh8KNPeaYCJ4+9oVq4unjgeLG4kQnnhjBnDFJHOqiiyK4fDwj3FgE3yskTZvFqYhMFr7KEypgwtFdhuoFZcyoqmYN48aDfq/IokAhVAgVwrVXpBDW6fcqhAqhQigicwRf5QkVMOHoLkP1gjKmbrI2aAYMW9phIosXhVAhVAjXXpFCWKffqxAqhAqhiMwRfJUnVMCEo7sM1QvKmI3ePrIpshhRCBVChXDtFSmEdfq9CqFCqBCKyBzBV3lCBUw4uqGuWIbP6977oz5PfehsR7MeJrJ4UQgVQoVw7RUphHX6vQqhQqgQisgcwVd5QgVMOLqhrljwOWqAZns9fobDRBYvP8sEe+0VISygT4qwNJ8Fy5ZFGiU4sM7wNzn8ZXZZWQf7NsqXV5SrfU63L7gzAgVKTjklgvVa6fD9+7xfZs9MOTUTYN3UZhnVGzMQpEMy12b2j3BWcajHHy91yq4ZnuiIzJV1tt++1EHhWnaLrFgRQW8ph2aCffaJfPGLkfe8J8JKHVUvamKU5qi2sc7kCSdE4B4Izou1MXGi/r5/+qeR//W/In1Bgqedf34ErgWdwKEw5699LQLlw5cDi44eckjk05+OYM74d/NLX4r8zd9EsGApTLsPbvtv/Vbkd383gqeAE+2+e+TggyNLl0b+5E8iv//7EVw+/mXcc88IjrzrrhH8IaEX++LnACguvir/9m91WJyKyGThP24iMnEUwg00UqcQjo1CqBCO3VchVAgVQhGZMfzHTUQmjkK4gUbqFMKxUQgVwrH7KoQKoUIoIjOG/7iJyMRRCDfQSJ1CODYKoUI4dl+FUCFUCEVkxvAfNxGZOArhBhqpUwjHRiFUCMfuqxAqhAqhiMwY/uMmIhMGpSoXS3xTrBW5ZEmkvC3DNSpvy+Rqn7Pjx5ke998faRgWjZzK8ZmrIqltu+wSQe8dd0RmxTbbRGbHXhFoKgdTRM/MLM/ckTkqA8KWS3koktZ63XUReOn3v1/qYJKNl0JE4WkPZOIresklpc5DD0VgrTACfhm4BinAzbk/8q//Gnnyych3vhOBTqDo//rXIzfdFIGZQET/+3+PgEMPjfSBMMAPTz01Apv6wAciWMESZT1U5H3vi+AC0fvHfxyBauJ5Y9XNvpdCRHH5GIwbiyeInyUuvjjym78ZWb48gn/c//API48+GsHvLvhO/vCHkQceiPzf/xvBNLAu7ve+F/nRjyKPPBJBb3+SF14YwXnx1553ksWpiEwWvkREZMIohAqhQqgQKoR0PIVQIRSRScGXiIhMGIVQIVQIFUKFkI6nECqEIjIp+BIRkQmjECqECqFCqBDS8RRChVBEJgVfIiIyYRRChVAhVAgVQjqeQqgQisik4EtERCbO0RlUri9lspAtP82gJn40g8Id+x6WgXuckQHpHtuVSDpefy3QN70p0gDZAOEP7Cy/zASN5IDLMv1ePME7MtDylzIYDB7LYF9wbObkzAuZtPR9SmRWbJOh/+O8AN/J/LbzyP19QVcXv/rVyGWXRb7whcill0ZgCKjFUSLjUFddFbnoogh04lOfioDTTotgHdELLojA8bAUKtZ+RU4+OYJerDP5138dweq9H/lI5OijI/A0BEuw4j5ffXXkjDMi550XOeusCFY3xePG88UTxL5f/nIE++L54kTf+lYEF4ifBvHvF9YRxTTwjYWn4USQOqxf+p/+UwSH+i//JYLLz6fP4lREJgvfKcl7u3D0bBjxu3ky7QCRLQaFcAMKoUJYRSFUCMdEIVQIRWTu4DsloQImHD0bBt8bJ37jtg9MO0BksaAQbkAhVAirKIQK4ZgohAqhiMwdfKckVMCEo2fDtDq36QNEFgsK4QYUQoWwikKoEI6JQqgQisjcwXdKQgVMOHo6hkUWphg29gdg+7gt4zaKbP4ohBtQCBXCKgqhQjgmCqFCKCJzB98pCRUw4egutafh88iN7QA0x20f2RRZRKS27VciUC9W2+dmnslcmYHyQWPA2RmYSb8WBzCin2UwK/gDBierMvSlsIsbbyx1mkvAjT0880QGoBf3KsV72xIhD0X2w5ch5oxFGUu5sc7OO5c6t94aIft1w69KPNDXXy91Snktg/u8MoNb91Qmbt3ee5c6pVySWZ45IBM3Z+01V0DMEMjG5ZdHIBuo8iEMME8o31/8ReTMMyM47zXXRFDHQwjhpVdcETn77Mj110fOOSfynvdEoF7wJSyy+qEPRXAJffU6//zI6oqkzuc/H4Go4LYffnjkqKMiMG18GSBX3/525LvfjXzjG5HVFVgdyDMsbtmySPu1rPOZz0RwvfhOYk3h++7r5R/+IYJeHArBvhkWpyIyWfgeTKiACUd3GSds7YeRzYFx40G/V2RzRiFUCAceUggVQoVQIVQIRWRe4XswoQImHN1lnO+1H9rmqqQdMGxph4ksOhRChXDgIYVQIVQIFUKFUETmFb4HEypgwtFdYGit1007YIbbRzZFFhEKoUI48JBCqBAqhAqhQigi8wrfgwkVMOHohtrK6v9qh88jN7YDOtvRrIeJLDoUQoVw4CGFUCFUCBVChVBE5hW+BxMqYMLRDa2z1bRjRg6ot9fjZzhMZPPnyUywzTaRsiST5fXKlaUOXtZYww9lT2Ni0BhU6iFIu+xS6jRF/6BVU8GJcPmPZFDW48iYFY4ch7rpplKnEZVbMo9nwEWZ2zLY9/TMWRlcwssZOG06z5tLJBn+QVz/zyJOlIciP8vAAJEu+2W6c8bzffzxUqdsg1VGMUncK5C/s+BrhvL0iCMi//RPvTz0UARV/qOPRh5+OHL66RFIzoW53iNUE0KIwZgGlADrW0L5MA3oIpQP58VgGOCpp0ZgJjBtHOrjH4/AebAv3PK66yKYFeQZvbjeI4/sBWuuYq1XXC809dOfjqAX5ok5H3RQBD6MrwreBFB6fFVwCVjcFb8s9GeFr0peEYtTEZksfGeKyMRRCBXCIS8rhEMUwohCqBAqhCIyP/CdKSITRyFUCIe8rBAOUQgjCqFCqBCKyPzAd6aITByFUCEc8rJCOEQhjCiECqFCKCLzA9+ZIjJxFEKFcMjLCuEQhTCiECqECqGIzA98Z4rIxIHGABgCimDwagZFcCyziWX5GmEAOG8cqtn35xn4A5RvVjyXifPuv3+pw8tPnfjpTyONHx6aQS+8FE6L2w5Oy+CKHqoDfXjhhUgDngIEaWWdffYpdZr1POMSXnyx1GnEDM8X5OPevkR2zSRPPhlpPPykzAUZ8FgmQaX+7ndHYCao1A84IIK1MWEm2BfVNpb3/LVfi/StBudFaQ6dwDTgaVjP85hjItgXvnTssRGsbvrhD0c++MEIjPerX43g8tGLC8QDxawgwHi+N98c+ehHI7gbOBQeyrJcGhRGhCP3V1U95ZTIf/2vEaxPC+B4+LHgxz+OHHZYBL/K4D7jG4tFdLEgLX7+yDmzOBWRycJ/N0Rk4iiEM0chVAiHKIQKoUKoEIrIHMB/N0Rk4iiEM0chVAiHKIQKoUKoEIrIHMB/N0Rk4iiEM0chVAiHKIQKoUKoEIrIHMB/N0Rk4iiEM0chVAiHKIQKoUKoEIrIHMB/N0Rk4lyVeT2D3usyUYu/8kqp0wx+NANhSPbrhs4Dq7kkg0sAkCskF//cvUTyElC6bLtt5PXXI80inLNhCdZ6DXBk1LGlLMv09i17lUjui+udzoiCPfaINJyamQW4z6Ucltl4Gh++JhPwTgI8QWgbTBQrWH75yxG4B4p+BIaASh2Lf2IwDAFGBAOE5Bx4YGTvvSO4QBT9WEkSl48LxN3AFX3oQxEs0bnrrpEPfCDyJ38SwUqwH/lIBIP/4i8iBx8cwYLLOC/2hdNCn3CB2PeQQyI4Efbt3yscCm6J82JZ0fe/PwLFxS+F+L0DC4ceemhk//xNDjcHh8pJsjgVkcnCt2SyexeOngtGvLhFtnQUwk4UQoVwHQqhQqgQKoQiMh/wLZlQAROOngtGvLiTaQeILDoUwk4UQoVwHQqhQqgQKoQiMh/wLZlQAROOngtGvLiTaQeILDoUwk4UQoVwHQqhQqgQKoQiMh/wLZlQAROOno5xb+d6e93Vbmy3jNsosohQCDtRCBXCdSiECqFCqBCKyHzAt2RCBUw4ukv9Up7h56kPaI7bPrIpsgi4555IKTdlfpZ5IRNM/QkNnHVWqUPeHMG+6AWvvhop5dpMsm2mS1P090m5emuJ9EklQGVOYZiGmAbv5FtKpNyWATDtx+rwyOXMTPj/NtuUOtj32WdLnYbugqV5n3Hkk04qdRruyeA3i9mQz2iXXSLNE8zbvl/+wHH44RHYBRbDxN9V3x9Qi2Mwjvynf9oLvOVjH4tACVCp4wKhE1CCE06I4BJ+67ciUC9MEtoGncDlw3lwKAw+/vgILuHP/zyCQ2GhVKxBisHHHRfB88WNxbKxsEccGV8zPEHs21c+HOqv/iqCQ+F79elPR3BkfFVwCfhrx+PGFwnf2JNPrsPiVEQmS/12baECJhzdZdUYcxu3HYwbD/q9IpsjCmGNQqgQzpR8RgqhQqgQKoQisnHUb9cWKmDC0V1QM6waI3h1cybjp7a0w0QWDQphjUKoEM6UfEYKoUKoECqEIrJx1G/XFipgwtFdVo1RNWwfmrPdPrIpsghQCGsUQoVwpuQzUggVQoVQIRSRjaN+u7ZQAROOblhV6dlUqdB21dvxeepDZzua9TCRRYNCWKMQKoQzJZ+RQqgQKoQKoYhsHPXbtYUKmHB0w6pG3gbGba+76i3D9hkOE1lEPB9BIUudCLhWZO57//2RUm7I3JLJor+8lrkzM6WjQ7qzmqY3bIqj++T14sjDPw1TNOdNugI8jTyDnBVo9sUCrbnIKhQXR+7OuZH2/n0+MbJf+hK+ot3zoroGWHeQV7RrpnsnG4YfTUbm5Uwsz0vngXtACVBeoxZH1Yu1IiEqWLET9w52gSPDxGAmH/945M/+LIIqH7OCTGJf9P7xH0cwGM8bJ8KdxPVCnnH5MEBcPh4KHigeCp4vLmG//SKf+EQE08AkoV4YjODy+4GY4YpwZHy9Id64V/jm4FBYrhY3B7NC4LQZFqciMln4RhWRiaMQdkSlS14vjgz1as6bdCUHvTgyB+esQLOvQlhFIVQIhyiEnSiEIjKn8I0qIhNHIeyISpe8XhwZ6tWcN+lKDnpxZA7OWYFmX4WwikKoEA5RCDtRCEVkTuEbVUQmjkLYEZUueb04MtSrOW/SlRz04sgcnLMCzb4KYRWFUCEcohB2ohCKyJzCN6qITByFsCMqXfJ6cWSoV3PepCs56MWROThnBZp9FcIqCqFCOEQh7EQhFJE5hW9UEVlgpimCb8kElA0U7nnkvj7hyNPNalO4tU6jbXdkQEpOV1Tmkj0zgPcKph08/HAE+zZSl/B60+Ehk9k73dO/oM5OO5U6sySeEc677bYRfL1x3mZl1F/UeemlUgfnbXoT6AQWS0RdC8lBUJpDRdoquQ58CYeCbGBfzPm97430DRCLUkL5oKn9Q8EufuM3IjAT3Hb4IW4sFAI3tm+t/UvoCxLu5Be/GIG1fuELETwUrGXcX8/za1+LfOUrkeNSYv/ojyKQOjwjzPnSSyN4RldcETn44MhVV0VwRe97XwTPKG87i1MRmSx8LYrIAkOdAFExo49lvUI4TyiEsyCeEc6rEEZQuCuECqFCKCITga9FEVlgqBMgKmb0saxXCOcJhXAWxDPCeRXCCAp3hVAhVAhFZCLwtSgiCwx1AkTFjD6W9QrhPKEQzoJ4RjivQhhB4a4QKoQKoYhMBL4WRWSBoU6AqJjRx7JeIZwnFMJZEM8I51UIIyjcFUKFUCEUkYnA16KITJxcwrHcVgclBGHRnyyNNEV/VMy5Zysbj2cw559kQJ6IR47ed76z1JlORXAJL2SwquqZmWSvDMH1horsu2+p04BZ5XqtS/MxkYcy8d2AtpVyf5277ip1Snk201+E87BMHJlz5Aq0EGCcqD8NfJFizVUIQgMu4dAMZvVMBKt9Ll8eOf74yEEHRd7//ghmCYuDxkAYEFTbV18dueaayA03RKAxCIp+mOdXvxrB3cChYHFf/3oE+nTddRGoF3QCvbhezArTgBAuWxaBmUBycKgLLohAn/AP9MUXR971rshFF0UuvDDy+c/3gkv49V+P/Of/HDn33Aj2PfPMCKZx/vkRzBlfwve8J4Kb0z9yXiCLUxGZLHyjJku6cLSIbBSQjdsUQoVwPQ8phAqhQqgQ8hIUQhGZU/hGTaiACUeLyEYB2bhNIVQI1/OQQqgQKoQKIS9BIRSROYVv1IQKmHC0iGwUkI3bFEKFcD0PKYQKoUKoEPISFEIRmVP4Rk2ogAlHd1lbf66rSIctdXOGY0S2PCAbtymECuF6HlIIFUKFUCHkJSiEIjKn8I2aUAETju6yvgTd0Gw/t2PqrmG7yBZGVL1NifxYBr3Yt3+ofu8rmSczMCIc6ohMD9Q5jXu8mLm7TqPH+9dpjgzgtAB3A9cLbqvzMFYKLfdk/iNzQJ2TTy51SrmmznPPlToN12XwUOLWlfJUBmKG68VTeCiD3mUZTANHxqxwc3Ao5JIMLuGJzGMZCGHeuksuiaCsx9cOg1Exo/iGTiAooJHLL4+ccUakP+dPfSqCwZ/4RARV/rXXRnAo6MQpp0TwhcaClvgThSHgEnAnsQjnhSkbZ50VOf30CG5dP7hXmAYsfcWKyNlnR7AvfneAeKMXR8Z5segoTBsPFF8k7AvTxjTwZcCcV66MfOlLkf408rwsTmU8x0+K9ya7yxYN64uECphwdBcY3UjBm8kYkS0PFNBTQjIEdS16sW//UP3eKQ8cohDWAbcphArhuiiECqFCqBBOkNWqtmp1hbw+89dcLYGrVtfi67PaGf7fof9viM0trMn6IqECJhzdpbW7qf8AWG9XCGXrBAX0lJAMQV2LXuzbP1S/d8oDhyiEdcBtCqFCuC4KoUKoECqEE6RvcXPYVAi3qibri4QKmHB0l47dDV0KoWydoICeEpIhqGvRi337h+r3TnngEIWwDrhNIVQI10UhVAgVQoVwgvQtbg6bCuFW1WR9kVABE45umOF//esI4bgukS0JFNBTQjIEdS16sW//UP3eKQ8cohDWAbcphArhuiiECqFCqBBOkL7FzWFTIdyqmqwvEipgwtENI62v3lIr39SWqn/dFowR2fLAYph3ZFATo7x+NIOqF6U5iu/nMtgX03g1g1nhRP1ZrczMIRdEdil1hn9NRv+bsk0EgwH33QSmOXLOapqUFXVwZNDse0odjk44SdBObKPTPTKn1aX5Aif9IhgVM8pcFO44FOr4L3whgkNdcUXk+usjKPpxIgSFO1QTF3jaaZE//uMIlhV93/siRx4ZwYqsWGX0d35nFsGio+j9+McjH/1opD1aJ7//+7204zvBGrPtgE6g1n/wB5FPfjKCfbF6bXvwOlhGFWuutuPrYOnXdkAn+GEle3ffymBBLbLQ8LUoIhNHIZwrFEKFcDTNFziBTSmECqFCODLzKYSd/3ax5TVX199obvgvcavW/NeYTWk++MKDQ2zanGGTr0URmTgK4VyhECqEo2m+wAlsSiFUCBXCkVEI56i5RCG0uZk1+VoUkYmjEM4VCqFCOJrmC5zAphRChVAhHBmFcI6aSxRCm5tZk69FEZk4CuFcoRAqhKNpvsAJbEohVAgVwpFRCOeouUQhtLmZNflaFJHNCta1bdE84xL5F78odWbJMXWefbbUueuuSCmPZDaFhzMgVpLE9WLok09GwI9/HAG33hqZJT+pc+yxpc6mcO65kVIOqXNBrmc5h5x6aoRXtEuGy7felAn23jsC7r8/Mh2hxzCgUn4eQeV69NGRP/zDSFvp1umX5qjFDz000h6tzqOPRn70o8jjj0ceeyzS53/8jwg455wI/BAyCW+BIOFQv/EbEdx28LnPRXbYIQKLO/jgCBb/POGECFhdXtd561sjBxwQwaHwLwX0GHcD/N7vRX7t1yL77hvBDw2f/nTkm9+M/OVfRvAPBxZZxW8H+MYuXx4BO+0Uwc8BN94YyUMtEZEFhX/OIrJZQclpJFAhVAgVwlEohAqhQriYhLDz3y4WsHnzIzcPsWlzC27yz1lENisoOY0EKoQKoUI4CoVQIVQIFcJNbXYKaJs2t6Qm/5xFZLOCktNIoEKoECqEo1AIFUKFUCHc1GangLZpc0tq8s9ZRDYrKDmNBCqECqFCOAqFUCFUCBXCTW12CmibNrekJv+cRWQz4xeRPUod1JMwor32KnX6PP98ZBpWZbpgVgCDIWYc3aVZ7PTxDDT1xch+JVKezGCh1Bci3PeJzGEZ9N6RCXvkkXmiXCeWvXkozJl3I29de644cl5COyAGQwjxUDCrgzK47fnIGFzRKxkMzmmg+P7EJyLvf38EtfhnPhO55ZbI5ZdH4C2/+7uRv//7CGpx8Nd/HQG//duRT30qsssuEbBsWQTq9Zu/GVm6NILVPo87LvKxj0Ugz3/+5xH4Yf/I+FkCJ8LamOiFtuHIOC+CScIPjzoqgn0xK/TiinCo/uWjF5PE9wrf9v7l41C4dZgGeuGleUVLRGRB4YsgYb2VcPRcME+HFVm8KIQzhVZD91AI6yiEVRTCGoWwY0QIJqkQ1pmlEHb+24XNfvP4S44fYtPmxjX5IkhYbyUcPRfM02FFFi8K4Uyh1dA9FMI6CmEVhbBGIewYEYJJKoR1FMJJNTtVvk2bM2zyRZCw3ko4ei6Yp8OKLF4UwplCq6F7KIR1FMIqCmGNQtgxIgSTVAjrKISTanaqfJs2Z9jkiyBhvZVwdJep8fWOIw+Fz+2Aenu9UWRLRSGcKbQauodCWEchrKIQ1iiEHSNCMEmFsI5COKlmp8q3aXOGTb4IEtZbCUd3wS51E59Hbhz3eeqDyKImC9n9UE9nxcxeVMyPZVAiQ0WOyGTFjBPtkCkvZ7o6UZ7NQFRQqSfvyZSTMtgX7gEw+NHIdiWyY2a3DIHGrKyzcmWp0xzq4EzcHKwrWfaO7LZbpHmgh0beVSLvzpDZKB+Cp8BefBnwUPDdOCqDr/fzdbB04p13Ro44IlLelEFNjCIYtfjhh0c+/vEIql6kX7jPSlTQi30xGE575JGRY46JHHhgZFZzRt73vghWRv3nf448+GAv+GNALxZZxWCcCNO4777Iww9H+vv+8IcRzAqHwtKvDzwQwWCsyHrFFRFIOxb//PznI/jbwHqt550XwYqsK1ZELrww8tBDkX/910j/keVPJ0tEZEEpXabsaxwc3QXjxzXbD/3tIlsACmGdRCFUCBVChfBBhXDLF8LOf7uwuSnN937yvUNs2hzXLF0q+xsBR3fBeB6r8b3hQ3+7yBaAQlgnUQgVQoVQIXxQIVQIbW5ks+MANm0OKV1S2QhHd8H4cbsP28eNH7ejyOJFIayTKIQKoUKoED6oECqENjey2XEAmzaHlC61/rVwdEM9BuNxhOFz/WEmn6c+iCxqFMI6iUKoECqECuGDCqFCaHMjmx0HsGlzSOkyZV/j4OiGekw7fuSh8LkdUG+vN4osXlAEX5SB8r03c2KdJUtKnSuvjFxzTQR2cfLJkVNOiey+e4T6VC7JhIgeckip8+qrkbJ7hPqUqnnYYaUOFjtl0V++mDm6TrMEa9gFV6F8a4mUazM/zsDD0XtZ5pUM9gVXZmKSzcqRT9U588xSBytHgoMOimy/feT734+UckBkm1Jnzz0juMAzzih19t03UspZdTDnX/0qctFFkVIuyJycSb773ci//Vvkn/4pAvdAEQxh+Jd/icAurr8+AmHAkftmgsHf+EakL0i4XkwDf5O4fNwc7ItJPvFEBINx5H/8xwjuJPZNu5gmP/hBBD8eYPA3vxl55JFe4Ie4fNyrdvc6mCQuH/aIG4tD9R9K/8uA7xUO1X+g/fPefnudJSKyoPC1KCITRyFUCIdgX6AQKoQKoUK4ZQph579d2LRpc76bfC2KyMRRCBXCIdgXKIQKoUKoECqENm3anOMmX4siMnEUQoVwCPYFCqFCqBAqhAqhTZs257jJ16KITByFUCEcgn2BQqgQKoQKoUJo06bNOW7ytSgiEwdKEApEEyun1Ln22lIHzlPKIZGlJZLstFMEQvimN0VKOTySYlbKDzIpV+XcOp/P9fD22SfS2HJw8MGRsiSC3kaBUr22LZFyZiadJ09Uds4sjRyTKzj++MeRhmWRlKt77onwUPtmyn/UefrpUucXv4iUckNk+xLJdVPLO0udavWvEYt9obcR/ifrnHZaqYM7id7mq3Jr5M2lzr33Rkq5N4Kq91vfiqCQhTCgF+rVNzFUzCj6ceR+eQ2bQi8kHteLwejtGyD27U8Svd/+dgSDcV6kr144Ufsg6uCK8BSwFmj/AhGcCJeAQ2EaGIxDwcSwcOiv/3rk938/0p8kvvz4xmJWmAZ6cSe7D2WJiCwo1XtbRBYGhVAhHFjrgQqhQvgvCmGeF1EItzgh7Py3C5s2bc53s3pvi8jCoBAqhANrPVAhVAj/RSHM8yIKoUJo06bNuWtW720RWRgUQoVwYK0HKoQK4b8ohHleRCFUCG3atDl3zeq9LSILg0KoEA6s9UCFUCH8F4Uwz4sohAqhTZs2565ZvbdFZCE48cQI3OORXC6ulNcyZ9X55S9LHaxv+cYbpQ5ko5SH62CF0oceisAfdt211Cnl1cxVkdSJyy6L3HhjpJST6kCPDzwwAslB+cHVPlc7YZW3vCWCXqxgucceESxnihqp7JbZK3L88RFo2/PPR5qFNM/I3JJJac9lVHEi/nZQvh/JOcPxyttKpBwayV6ICVYZhZZj5dtSns4cW4e/WUDay/I6H/xgqcMSGUY0K4vDnwq+DdgXwTTgPCjcH3wwgsUhUZrfcUcEV4TzIrgiTAPp3xzcDdxnqAj2xayw7/33R9CLfO97Edwr3BxMA4P7C7RiztgXwePui3d/MKaBy8d5cYE33RTB3cC+eGT4TuK7AbXOR7ZERBaUNfVoB/zuz/8MIOtYUxSNYtx2kQ0ohAqhQqgQrkm/6Ed5rRDWUQgXvxB2/tuFTZs257u5ph7t0NGZTtd6WDYsHjDzKTioYlzvuO0iG1AIFUKFUCFck37Rj/JaIayjECqENm3a3ITmmnq0w5TOrGoydHWBDi1GO5rhnMcNG7ddZAMKoUKoECqEa9Iv+lFeK4R1FEKF0KZNm5vQXFOPdhjcDxm6ukCH6maUExX9jfX2dkz9oR7c7ltvxHbQ9o7csd6I7SPHDBtFFEKFUCFUCNemX/SjvFYI6yiECqFNmzY3obmmHu0wZS6rmgxdXWA+Q3NdFTHq89SH+vNMBtfNegyaI8dgPEDXuOa4A47bOHwWWc1pmazFtyt1UE9DzN7xjlKnlGvrNDpxSp0nnyx10FvKqXV+9rNSp5Qj6ixZUurQPXbJUCeW1TnppFLn7W+PlP0yqcc48osvRnA3LrkkAmHA2phc3bTcn7mvDv2wPJC5LhPecuyxpc4110RKOSHzRJ13vavUwXqtS5eWOqXcmLmzzt13lzqoNjHnbbYpdX760wiAh7/0UqTsk0ldXG19dbhwaLkoE9JeyhsR1NMoZFExozRHL6revl3grw6DUcdjVujFrPpmMqsLxIkw5/4kYRf9Sc5qVrhX6MW+CJ4RJAd/sf0j4xLQi337DwXBrLAvJgkfxmD8rIhHhjk//HAEjxtHxiShx7giPN98gktEZEHh6xlMacuqJkNXlynzGai3V6PCmurtIzeOGzzt9s7GkWOm6HSVGZy0/TCyKVs5CqFCqBAqhArhbGaFe4Ve7IsohHUw54UTws5/u7Bp0+Z8N/l6BlPasqrJ0NWl1h58Bm1XvWX4XDdnux0bAUesp+0auSOGtdux17BdpCiECqFCqBCuCQb3XQu9mBUeUr80718gToQ59yepENbpPxREIbRp0+YEm3w9gyltWdVk6OoC7RmaM9GhcYM3evu0G0fSP9q0J20/iLQohAqhQqgQKoSzmRXuFXqxL6IQ1sGcFUKbNrfKJl/PoGMxna71dDSp7hppTSMH4/PUh872cV31xnp7S3u0+vPIA+Jzu7HeLlIUQoVQIVQI1wSD+66FXswKD6lfmvcvECfCnPuTVAjr9B8KohDatGlzgk2+nsGqbqaj1R4IEjSp3j5y47jtU5+HjfWYqS2dfbEdtL31XkPvsHHoGrbXn9sBIoVl/Z4lkpIDjbnllkgpR0b2LnW22y6C8vqCCyKvvBKpv75rv8FhNeeeW+qU8krmB3Vee63UKeXZyI6lDrxlt90ihxwSKeWmTExyxYpSZ5YcmDkjE70/+EGps/feESyFCiOCmO2zT6kDLW+m8VIGPzRg30PrvPnNpQ4qN/hhWW1fdcqv6rztbaUOFoZtFmgNi7vqqlKnlF9m8BSOzZxdB7qIghmL6LJyRfrlNWpiFNDt0eqgrEdp3g+MCMGR0Ytp4Hl/4xsR+AOuFyfCvcKRId7/3/8X6YPz4siYBnpxvZjGbbdF0Nu/dRh8880RPDL4Eq4IJ8KR+0+//4ywL5Svf4GzmiQWpO2vuJsnWiIiCwr/yRWRiaMQKoQKoUKoEHbBeXFkTAO9uF5MQyHsXOCsJtlK4GyEsPPfLmzatDnfTf6TKyITRyFUCBVChVAh7ILz4siYBnpxvZiGQti5wFlNspVAhdCmzUXS5D+5IjJxFEKFUCFUCBXCLjgvjoxpoBfXi2kohJ0LnNUkWwlUCG3aXCRN/pMrIhNHIVQIFUKFUCHsgvPiyJgGenG9mIZC2LnAWU2ylUCF0KbNRdLkP7kiMmGwdOQuu0T23z9SysmZWzKhE2WvUgd1bKNtT0X2wwKeYRfPPVfqrC7WMpdlDso8V+faa0sd2NTZZ0dK+XGdo44qdcqbM+XwzCOZ5ZHU41J+VufnPy91mhOdnvlgHSyUetddkfKWCJZv3XbbSPPIXswsi+xW6uA+P/tshFeU+3Jx1+TkkyP4RQPLTG6/fQRfhlKezODbDgM8MPNE5p46vN7ycgT+AKuZVU18zz0RHAqFO4I/UfRikijrv/e9CM6LKh8nmtVg9OLyMStcAlTz//yfSFcYePl4CriEBx+MwIhwZNy6++6L/PCHETzff/iHyD/+YwRzxhcJ9wq9/WeEI+MC+9eLtarRi0eGy8d5MUkEAtyd1RIRWVD4aheRCaMQKoQKoUK4JvgTRS8mqRAqhENwgf3r3VyFsPPfLmzatDnfTb7aRWTCKIQKoUKoEK4J/kTRi0kqhArhEFxg/3oVQps2bTZNvtpFZMIohAqhQqgQrgn+RNGLSSqECuEQXGD/ehVCmzZtNk2+2kVkwiiECqFCqBCuCf5E0YtJKoQK4RBcYP96FUKbNm02Tb7aRWTiHFHnxBNLnfKmzHsycIDyTObOOig/3ngjsuOOEaxQWnaO7Ldf5K1vjTSzuqEOVt3E4pCHHlrqlHJR5sQ6t95a6pRyWCaUAJUMqr4lSyJlm8y7MqsyXAwzeOCBSCnP1+EqoztklmawjmhOEstbNvteW+f550sdiPctuXrtq69GcPm4k6WsrAMRLdtFTjghUsqtmQfqbLNNqVPKdXUuuaTUwUPBMrk33FDqsCbuB1UvCmgEXzscCiUyiv6+iCI4VDuTzqywL8QMkoNJQggxZ5wInoZe7ItZ4bciTAM3FofCI8Ng3Jz+kXFzcGQoEPbFnyguEGtyohf3CpNEL/6AcTewL06EOeP5YnBfy3Gobu8SEVlQSpdVZVUnHC0iG4VCqBAqhAqhQpj7YlYKYR1MEr34A8bdwL44EeY8QSHs/LcLmzZtznezdOlYX6drYNWa/13ZJJjYiUTmA4VQIVQIFUKFMPfFrBTCOpgkevEHjLuBfXEizFkhtGlz62iWLlPWN/K/DSqEInOFQqgQKoQKoUKY+2JWCmEdTBK9+APG3cC+OBHmrBDatLl1NEuXuRLC+kVcN+uRNcN2dNUb0TVFu9ewRWSzRSFUCBVChVAhzH0xK4WwDiaJXvwB425gX5wIc1YIbdrcOpqlyxwKYbux/jz1jt64z1PN4TOa6BLZDIkFLbna57yx116RZsnKqLYhhCy+U2PQe9VVkbJr5q0RGkL6Q0k93n33CFQE3oLlPWFiTz0VKXtk8FBgy2sXcR3ypjdFsO8++5Q6ONThh0eeeSZSyiF13vOeUuf++yNYGvSXv4yUck0dKP3y5ZGdd4688koEK6Py1wHcKywNiuebX7NlyyJQa/50gsVsV9/bKq+/HsGJyh13RFBA9/n1X4/0Wbo0gvL661+PoJ6+/fZIt7wu3/pWBINxgf0qH76EE2EwrKavMTgUeqFe//7vka99LYJLQHCivgHivDgUeuF4OBROhLvxv/93pH/b+5NEcChcAn4avPnmyDe/GcGcofTQRZwXgzGN/HteIiILCt9WySSFcNi4KdtHNkU2cxRChVAhVAgVwq7zKISdSSI4FC5hcxXCzn+7sGnT5nw3+bZKFqkQTm2ZAttFNkMUQoVQIVQIFcKu8yiEnUkiOBQuQSG0adNm0+TbKlm8QjjQ6RLZTFAIFUKFUCFUCLvOoxB2JongULgEhdCmTZtNk2+rpGN9na6Bkf428vOqtczq89SHaZvoEtkMUQgVQoVQIVQIu86jEHYmieBQuASF0KZNm02Tb6uk/W+D+O+EfUb628jPU7I3MAxAV72xGrJhTGeLyOYKatM1iytuyFlnlTqrS9dM0KhILkq5bYmUo+q8+GKpU8qNmfsyL0ey6Ee1eeaZkVKerQO7gKhcdFGpg2UnDzmk1LnggkizKOVP6jQrlJ5WZ4cdSp2DDorce2+EN/btmXwKp59e6uy0U6R5gvvXOeOMUgfXW96ceUvk2Wcj4LXXIqWcm4lL+NWvSp1Sjs48Vufpp0udUg7PvBrZsUTykZVyZiZO9I53lDpl90wu7lrKTyOoelGLI6h6sS/cA0Uw0jcirKuJwQgWTsWJcAlYOBR/sX33wPX2B6MXc8YkMRizQvo3B0eGHuMJ9vfF4P4VYZJYdBRPAeDI+JFixYoIngLy1a9GMCtM4/LLI/gifeMbkf7Tx93AiaCaV19dZ4mILCj8F2mB0NxkK0YhVAgVQoXwRwphDsaskP7NwZEVwjqYxmYjhJ3/dmHTps35bvJfpAVCIZStGIVQIVQIFcIfKYQ5GLNC+jcHR1YI62AaCqFNmzYVQpGFRyFUCBVChfBHCmEOxqyQ/s3BkRXCOpiGQmjTps3NRghFtmIUQoVQIVQIf6QQ5mDMCunfHBxZIayDaSiENm3aVAhFNj8uqzOsj7R+laRrM+DgOtj3yitLHfQec0ypg174Ek+L8rrcm3kkc0Pm8UwaQjkr0y3rty+RFAZOuTyXeSaDEz0RWa2XdfISfvGLUqeUA+rApprBAXo5OM0TvVhKcM89I2W3DGQSi3/yZ4hbMtA2+CHuJKQO35yXMvgZAo8Mg/Orwt9Z8gnmQyl/8AcRWPtnPxv5zGci4LzzIlhy933vi1x8cWS//SJYn/e66yLbbRfBYCjBFVdEUOVjdVMc6tprI/AHVPm33NILzgvJwTS+8pUIrghHxr6//duRT34y8vGPRz71qQj4vd+LHHFE5Hd+J/LhD0f+5/+MHH10BNPAuqm4XngarhfBMsG4z1BN3MlLL43A8XAoyDPOiyVn8fRXrqyzREQWFP7TJyILzWUKoUI4BXo5WCFUCBXCqWBfhXARCmHnv13YtGlzvpv8p09EFprLFEKFcAr0crBCqBAqhFPBvgqhQmjTps3ZNPlPn4gsNJcphArhFOjlYIVQIVQIp4J9FUKF0KZNm7Np8p8+EVloLlMIFcIp0MvBCqFCqBBOBfsqhAqhTZs2Z9PkP30iMnHgLah6UW3/LANPezKDQ63RlfHqtTyDavuwDPY9PvNoHbjlyy+XOqUck7kzc3qEooIqH/fqxUyeaL8SgfPkieBaWBn1xhsj1LYEve96V6SUQ+ug+ITj4VC4z6Vcmbkkg68KvoQY/FQmH0p+rw4/vNRpvkj45qSY5QM9Jn+kKOWDdU4+udRpnj7OC7dcGUHVC/XCqrJt/V0HhfvNN0dQE990U+SHP4zgi4W1InFkrPcIA0ThjkPdmkvu4m701QvXi0Ndf33kS1+K4Mi33x7B5f+3/xaBtJ97bgSD99kn8rGPRbCUMxwP0o6/2H33jUBEsbopHA9PEHcDNxbiDXvE437kkQjuJI78xS9Gvve9CL4M+DkA3zrMCoP/6Z8iOY0lIrKgRKXSsKqb+WBtGSOydYFaXCGsoxAqhAqhQqgQbvlC2PlvFzZt2pzvZlQqDR0563QNNPXJ9Mxw2Dg2cfeZM7ETydYAanGFsI5CqBAqhAqhQqgQ2rRpcx6bUak0TEnPyP82OBMfWluTjG2OZCZjOmzi7jNnYieSrQHU4gphHYVQIVQIFUKFUCG0adPmPDajUmmYWyHElixdZjSg7m2b9RbsW39uB9Tb0VVvRNcU7V7DFpEZglpcIayjECqECqFCqBAqhDZt2pzHZlQqDVNys6rJ0NVnbU0yesv6imXEZ3yomyM3jtxSd438jJPO6vNUc/iMJrpEpuXsDCr1F+qgZmjqaRTBp2ROjWyDpTLTHveDLz2SgRLEWpFc0JKV+i8zN9ShLuY0dtwx0igu/DCvd9sS4WKnj2ZwY3G9J2VCcp57rtQp5cd1pv4pGSjlqMzPI6v765QjM1iiM2QSq26iRGxu3fEZ3EkE64jGd+OZZ0odTjIfaCknZuLbXsoJmbiTzSU8H3lbifBxvxGBAUJjoG0okdGLmhj6hF54Gkrzv/u7CCaJfwuuvjqCSeKKHn00AkOALqKsxyX0rxd54IFIX3JgU7AaBPfqn/85gguExuACMWfcjf5tx3lx2/GLDq63/0XCItErY4lOLu+JC+zfq/63HT9h/OM/RvCdxGD0XnZZJL+iS0RkQSldpswGJcmwcVpaNRq2oGvc9oF2wMiRI3tHfp7hBKbdPrIpMisUwg1RCBVChVAhXBOFsM5WIISd/3Zh06bN+W6WLlOWg5Jk2DgtrSYNW1AU1dvrwZ0B9ciBkb0jP2P3jd5eb5kC20WmRSHcEIVQIVQIFcI1UQjrKIQ2bdqcz2bpMiU3KEmGjdPS2tGwpe2aYtyAujn1eeQRRu4+8vO44892e0unS2QkCuGGKIQKoUKoEK6JQlhHIbRp0+Z8NkuXjtl0ugY6ErW+FmJX+2Hqc6dZM2739nN9kBl+nvowbRNdItOiEG6IQqgQKoQK4ZoohHUUQps2bc5ns3RBMcLaZDqaymdsb72xHYDtbXNg2N455vChZhiArnpjNSTmNm6LyAx5PnNj5tjIbiVSXsk8nIFbnpmBA6D4XquF67PttqUOV+xMI2oqdfQ+ncGhYt9nny11yh4ZVPnbQvlwXljcDzKYxt11fvazUqcRbxwZkgOZ7F1v2blESPrSW0oEh9oGwh9Sd+KJpU4zyQMy4ZalvDfzVAaD81A7lQi+3jTPmNWSJaVOMzjWIC3lgTpYGJbnRSH77/8eQYmMahv19P33R+A8MEAsO4kC+stfjuC8ONStubwndAIOACHE4p8rVkRwXqhmX0VuvjmCI//rv0YuvTSCm4Mj33FHBNcLBcI0cJ/xfPHbCST2qqsiuJM470MPRSCTsEf4EmbV11SsMop7ha8o9sUThGrixuLIuCJ8J3FzkJzVEhFZUOpSYxGx6d616UcQmSsUwjr/f3tnGypXde/hhRSRg7QiQcTCbZBLkbZIa18QP5SDWCtCIYhIKCJpauUiIhcpRazY2GhtfGmq1l5Kv7Tc+hJfKhZsK22xaSpWUinihxLwfggSgoRLCUHED3KaOMk+6/fsmXVeZubM0fP8eD7Mf++191577TmZ9czIMo5VCDMKoUJ4CoVQIfxwCWHjtwtLS8tpl/VU44OSibjcRE5izESiENbEsQphRiFUCE+hECqECqGlpeWEynqqsf4zwf8mc1LnMWb8KIQ1caxCmFEIFcJTKIQKoUJoaWk5obKeahhjZhKFsCaOVQgzCqFCeAqFUCFUCC0tLSdU1lMNY8xMktp2RgnKLTW9eW3MmOfnS00pe2oefrjU9NaKfDyphectTuuTLVtKDb2Fi50+lUQ3nn221PQm/XckLyVw2t0JPA17YSaLNvg+u2p6IwnzxPik8B9/LjW5FOoVV5Sad94JyukJ3RJjBfAUkMokT4D3Bsb5QM1ll5WaXuCH8YzefbfUlPJgsi/p31TFZ0tQXk5grfF9B4Vh//4AvjSYvndgpo4ZMxQINgUFggMATOthNbjuI48EOBaNcYOY1mNwYGL4Y8CFcAuwVtwCbAouDW9BJ3EsugHXgv9D2/785wDWiicIa8UN4r2BU6GTGGcMDk4FE8MDhcXhzYDbx0hiRVYMOzqJW8AfDgYHF8pezRljZhp+dBtj1jwK4SIKoUKoEA4Hk2+FsEYhrPlgCmHjtwtLS8tpl/zoNsaseRTCRRRChVAhHA4m3wphjUJYoxBaWlqusORHtzFmzaMQLqIQKoQK4XAw+VYIaxTCGoXQ0tJyhSU/uo0xax6FcBGFUCFUCIeDybdCWKMQ1iiElpaWKyz50W2MWfMcSmBTmKl/Pbk+uSnBpBnekqJydgnK6wmuuy2JWT6ui7XlILGlHE4eTnAh2EWq1zxcC7eQQsjGuEHoREr7f5Sg+ciOHi01Pbl6O8GbIZ/RR0vAxFO44IJSU8q1yf8lGKvbE7zN8hbmcyQBr4uBvTrBaESv+L3DxQntcVuSbxX8pWACDTAXx7wWzoPGmBO3p9eQDcy20SvIJBpjWv/HPwa4LoAR4cwPPBDg2PbgwJdgNf2RbzwFLJX5058GaPyXvwQ4M/r8u98FuAVcF8KP6+LfvnvvDXD74NFc7RPXBegkHhkMEN+6tWWyPex//3uANwPehDhVdnLOGDPTlGbe2PJGA7Y2xqwqhxRChVAhVAgVwhYYWJiJQliDR/YBEcLGbxeWlpbTLkszDetr7Ooy+P/I12GLCWV6ZzZmDXJIIVQIFUKFUCFsgYGFmSiENXhkCqGlpeVSZWlmYH1DfxtcphBy03SyZhcyZho5pBAqhAqhQqgQtsDAwkwUwho8MoXQ0tJyqbI0Mw0hxMZBWf+K2G/Q3z54Xe8apH9Ut8WYdZtDCqFCqBAqhAphCwwszEQhrMEjUwgtLS2XKksz0xDCUm2vX6z69aDsXqPELmPWYd6q6a27+P/JrQmUD4F6oTH2pntwnUnsvSaJU+3YUWq4wOPmEnD1yxuTfyV7EszykbQ4GkKIyt69pQbmuXVrqaE+zUOBYCbxfHsmFr06//xS0xscHAu5gi0jsTRob3BwoXhkmzaVGqx8yxU7TysBbx/XhYjiO4vtyStJ+81/OMlOYqzgaVgNEitYYvINJXjhhQDrW8IQsETnT34SoBvtZScxj8fEHetMYm/bAWAXmPRjcCDA2ItbwOqm0LaHHgpgyzjzk08GcB5cCI3bTovnC6fF0MGW0Wc0Rq/27Qswknhk6BVGA29CqGbbHtvPF2vMthtDCHGhXEV2zhgz0/AjNDO+ECLd9lEvxtw+tDRmnSdmzAqhQqgQKoQKoUK40YSw8duFpaXltEt+hGbGF0JuOpXaDwdltXNp8Ru1vd6CSxizbhMzZoVQIVQIFUKFUCFUCC0tLdes5EdoZkpC2Pe6UYK30u39NHYZs04SM2aFUCFUCBVChVAhVAgtLS3XrORHaKZhfY1dXUbJWN/r3v8xb2WvBy+WLLHLmHWYmDErhAqhQqgQKoQKoUJoaWm5ZiU/QjP93wbxO2E7A4WrM9iINv2WaNDfPqpNY4sx6zaYucLTMEX+7yQm7uWcUnPgQNBzy4MJJu47a/70p1JTyq4kpubvvVdqeo6Xq33mupqYMPe8NDuZ99tbofRYAn8ImexJ7LPBR7G8Zw47O/nPBH6IvRh23MJLyd1JyNWRI6Wmt27q68m2gDcI/4dNXZ68WAPH6X138GaCoduS/COJJ4iZee8vZWeyN8k/uvac+JlngsceC6B8mLhDciAbmJpjFUooARoD9Bl/sXC8R3MFy7Z7wFtgFwDOg8U/Yby4BQws1saE0+KRoZNPPx3gBp9/Prj//gAWB6v5/e8DDDukDgIMEYXU4ViM5BNPBFAvPDL0GY1xg3jXYdjxfNvXxcq3aIwbzMZzxpiZpqyPaG5mI0chXEQhVAgVQoVQIeRIbgAhbPx2YWlpOe2yrI8ohGYjRyFcRCFUCBVChVAh5EgqhJaWltMsy/qIQmg2chTCRRRChVAhVAgVQo6kQmhpaTnNshhjZh2FcBGFUCFUCBVChZAjqRBaWlpOsyzGmFkn1mzEhyZXktxUAvoDVpLcE5xZAhx7Rgk4F3+lucDjirgngWwg0BjcL8TspQTX/WUCE9uXoFdY3vNnAW0Kfc7GZXcC9cKF8oF+pAS4QSzvycY4M4I+41uJnydxqt7KqHHsgw+WGr6fKYT47gCDg07m4KThc3Dw9cfmXOr28ceD9vQadoGFJTEJxqQfQJDgD9iLY6EiuC58CX3GXjwk3C/Muy0bkDpcF33GqaAiaAwgKrlkJa8LH8bjxg3iKWCs0A3sxananfza1wLsxUNpv6/a6+LiawjcAp7Cb38bwLRXdF0A8c6lUOeMMTNNNR8wxswmCqFCqBAqhAqhQrihhbDx24WlpeW0y2o+YIyZTRRChVAhVAgVQoVQIRw+VbW0tJx2Wc0HjDGziUKoECqECqFCqBAqhMOnqpaWltMuq/mAMWY2UQgVQoVQIVQIFUKFcPhU1dLSctplNR8wxswm25M7gotKzZVXBqU8mGA+jSlyzKe//OVSs2MHltl8oebqq0tNz8S2Jbmc6XwJOFNPMaNc4UI318zPl5re2qcwwLCaY8dKTc95wNEknOcLXyg1WPwT0y2ub1neDjhWsLi7k04yB+xJcmDLkQTdaKrXWSXAEqwUM5wKpo1egWcSvFWwd2fSfF+xG8mjueomlmEEL78cQAkgG1hltD1Txxq72Ivr4syYqaPPu3cH7T5j8U/IFS4EeYYCYalMnPmvfw0gKvBDrDKKvTjVisYZfcZfbBvcIMYKboljcb/oRnuBVhyL+8UzQiexty3PuC7eOWiM54te/ehHQTaeM8bMNKWZ6+feaMDWY8f/G6HZmNmuEC6iEMZYKYQ12LtTIVQIFcIPjRA2fruwtLScdlmaaVhfY1eXhQx397KcNssPzjbZkxszwWxXCBdRCGOsFMIa7N2pECqECqFCaGlpOX5ZmhlY39DfBpcphI2ynyUbrCiTPZsx08t2hXARhTDGSiGswd6dCqFCqBAqhJaWluOXpZnpCWH3syE2thvU24du7LYP3dJo3zXobx+10ZhJZbtCuIhCGGOlENZg706FUCFUCBVCS0vL8cvSzJSEsJYrvB66cdRrvFj+9iVfD0q8wGtjJpUHEkxkvx5cWILzE87FMUUG/0h2JR+IHEsi3/lOgLz9doBcf33Qboy97cY33BD08q/kumAeuvhyzUUXlRrI5ObNpabn8PnOoQHG3k2bSk0pNyW31dx5Z6npWdztyaHgP0vAwcEb+J7kpaAbtAGbk/9tLg6Jd1K7MebE8BbM4/fsCTC9bufjHw/GySc+ESCf/GSAQBi++MVgPr+zufTS4CtfCXDst74VbN0afP7zwec+F3z608Hllwff/Gbw1a8GbYmF5GAtUKgmVqDdvz9omxiEH3shZgB9xlqg2AtwIQg/GmOswMMPB08+GeQXHHPGmJmG/7ZnxhfCOvX2qtUQ9VqyQSOjGk9quzETj0K46iiECmGHQrjaKIQKYQcutIZC2PjtwtLSctol/23PjC+Eo14jaNO9aG/vkicb3njV2wev6zMbM9kohKuOQqgQdiiEq41CqBB24EIKoaXlxij5b3tmgkJYl6PMalSDUduHbhzVeNXbl9xozJhRCFcdhVAh7FAIVxuFUCHswIUUQkvLjVHy3/ZMw/oau7qMUqyF9zN0e79B4zVejGqAcskToqy3o40xE4lCuOoohAphh0K42iiECmEHLqQQWlpujJL/tmf6vw3id8J2+voEE6t9rN47qkG9fdTGbhda1od0u7Cxe42y39iYCeayZFvNhReWmt5cPI790pdKDWaq114bvPpqcPPNQU8YrkwivTVIY5b/1FOlpqcEV9QcPVpqsILlWWeVmh1cGfX55OYajORnPhOUcxPqccgVlmAt5c7k1pqdO0sNpsQXXxy8/noAE9u1q9Rs3x5Acm65JXjzzQAXOvfc4Lrrgm9/O7jppuC45Nb0DDC+4OhZ657kcPLP5L6aZ54pNb1H9kqT9wLM8r/xjeD73w+efTbAEp14u2N6/cQTAe4BZ8YalVhmE7IBu4C1PprLqP7qV8H99wdY3xKdxF4YEW4fooLrYrlL3CBUs61PuC749a8D3AKkHSuyPvZYAMnBP7I4Fn/86AYWHcXjxuDgzBir554L8EDb18UTBA89FGAvFg7F48bQoVfph3OZbtZljFmbFGPMrKMQKoQK4QCFUCFUCDeoEC58bGGRhYWDCwc7jpf1zxGWlpYTL4sxZtZRCBVChXCAQqgQKoQK4fGZqkJoabmmZTHGzDoKoUKoEA5QCBVChVAhPD5TVQgtLde0LMaYWUchVAgVwgEKoUKoECqEx2eqCqGl5ZqWxRgz61ybvFaDVfqOy1eyNwl/gBK8+26AT3ZozBVXlJqzzw56+hRGtG9fqbnmmgDdOO20AHvhpVdeWWpuvz34wx+C3lKZbyX/E3yk1GA6jbn3mWcGeGSlXJqEl27bVmrKOckFSdlaA1vGXLSUd5JYvRaLBfKdw+vGWL32Wqk5//yglFtqer2KnHNOgK8D8HzbpypnJOVI8NkSbE7OTiAbP/hBgAk0uoUZM2QDbx3MmGEXcIAf/zj47ncDzMXvvjvAOxiygTOjV5i4g3vuCXCh9uD88IcB/g2CLsLT8BSgfGkXPDOOxe3DW9oiitFAJ7EIJ94M+O4Ap8L3Pfh2AL0C+KIB7w1cF48Mp7rrrgCPu72OKO63/W7PPi8YY2aa+tPVGDOTKIQKoUJ4AoVQIVQIN6wQNn67sLS0nHZZf7oaY2YShVAhVAhPoBAqhAqhQtifqlpaWk67rD9djTEziUKoECqEJ1AIFUKFUCHsT1UtLS2nXdafrsaYmUQhVAgVwhMohAqhQqgQ9qeqlpaW0y7rT1djzOyDSf+ePcEllwSl/KwGq0FedVVQzkvKHcmhJLJlS9Cb1j+evBpsjrn4BRcEpfw8eTBp5pLg2LHg8OFg8+aAUpdGtJDZsQPLmW5JQp+gAKXsr8Ezwv1CcUt5N8lHBucpV9UcOVJqoOWlHEwGy6V2xPsKy3vSHheS/LIAwl82JfxmAQP7XLInOZDcmhytweqm+CujEsAB4FqY9balDgqEyTc8DRrz9NMBOgn3wFqgmItjTU6sfok1SLEoJe4It4BOwkzgHmgMu/jFLwIcC8kBGGdcCLqINTkxktiLYyFXGKvf/CZANzDO7U62jRfgcwLPCA8F0o5j77svwNNvGz7+FvCM8IeTWo5/co0xa5zFmdWwxCLAPdjaGDN+FEKFUCFUCBVCHtuXQIWw40MhhI3fLiwtLaddLs6shqVhfY1dXRYyQzcOksedbMZNpzby4BFnxoH97aPa9DdiS10aM+EohAqhQqgQKoQ8ti+BCmGHQmhpaTleuTizGpaB9Q39bXCZQrj8Ehm6d7Bx6K7S296Vy9neeD3qcGOmEoVQIVQIFUKFkMf2JVAh7FAILS0txysXZ1bDMkMhLL0GXTnqwFW37zfArrpBv7Exk4xCqBAqhAqhQshj+xKoEHYohJaWluOVizOrYVEIBy/qBv3GxoyZmMhiikipK79MIlhWlBNozONzbcw77yw1PPYsrNiJufiugBfaWnPwYKkp5b+Czg0G8H5PitOAublSs3dvcN55AdbGfOGFgEN3BlawjE7i2DIffOpTQdmc5C3wujnsuCNoDO4IC7T2znywpvcU8oFC22iei6J1HHQSD6VcnJRXEiTekxh2/C0cOBCcfnpw440Blsm94YaAyoc/wrbyYdaLVRnbQohjsbopenVXLv+IiTvWqLz33gAXggLhfr/3vQC9euSRAJ3cvTvIST+PRWN8lYIbRCfRGBdqjxUeKFb7bPcKx+K6aIxT4VgI0m23BTgzTAzfUWFg8fQBvnfAP/14oHjn7N8fvPhi8Pzzwd/+FsD/c1XoBWPMsBR+5zpBVpDxhTBvinuxBUGDrsRpR21fPDJ31Rvxokt/V/+FMZPKSRVUCBVChVAhVAhPohDWbAAhbPx2YWm5YctCi5sgK8j4Qjj09agt/XRt2qcaZDltyrBz9hsP3TV43W9szJg5qYIKoUKoECqECuFJFMIahdDSckOWhRY3QVaQCQrhkuXQdG3qxqMOXOb5++fstxy6a/C639iYMXNSBRVChVAhVAgVwpMohDUKoaXlhiwLLW6CrCAN62vs6rLQNDSUo7LwfrClLruMarac7ct5PShHXd2YVeekCiqECqFCqBAqhCdRCGsUQkvLDVkWWtwEWUH6vw3id8J2FnruVG/p7x2ahffT31Kn2143q7f0G9d7uxINBhtRYosxY+bfjCgf1OrqSHgAAAAASUVORK5CYII=79:T558,XV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXQ==7a:T558,XV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXQ==7b:T558,XV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXQ==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"job_id":"696a41b1b001adeb89022aba","environment_id":160,"environment_description":"Windows 10 64 bit","size":24060560,"type":"PE32 executable for MS Windows 6.00 (GUI), Intel i386 (stripped to external PDB), 9 sections","type_short":["peexe","executable"],"type_short_id":"exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"scp.exe","md5":"02d2c09cc9f7b17e1aa3b6f2bbc6695a","sha1":"162c2709f55bb03ecbc3c3a513e9a99d803f1938","sha256":"bd11fd16014ce10d456fda42dabc79369d15074137edbda70dbeb201212735d7","sha512":"aa247b8c40f2ea561183f4cdd08a63b3bbb282dac426bd7561d732b5681d3fc7947df419f490f45d54cf4faaeaa5d74505e93d0ca65c74b24dfefae6ebdaa320","ssdeep":"393216:9F5fAS1MXKCpia5vAISVCKxbYw+E08T9uWgl2VrFBP/Ai:9F59wHKXzTrFxN","imphash":"11ad9ab467c809526220a0d24b60dcf4","entrypoint":"0x402e68","entrypoint_section":".text","image_base":"0x400000","subsystem":"Windows Gui","image_file_characteristics":["EXECUTABLE_IMAGE","LINE_NUMS_STRIPPED","LOCAL_SYMS_STRIPPED","32BIT_MACHINE","DEBUG_STRIPPED"],"dll_characteristics":["DYNAMIC_BASE","NX_COMPAT"],"major_os_version":"6","minor_os_version":"0","av_detect":0,"vx_family":null,"url_analysis":false,"analysis_start_time":"2026-01-16T13:48:36+00:00","threat_score":null,"interesting":true,"threat_level":0,"verdict":"no specific threat","certificates":[{"owner":"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US","issuer":"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US","serial_number":"e9b188ef9d02de7efdb50e20840185a","md5":"8D:DD:0B:C6:D9:D7:70:EB:6B:2B:67:1A:86:28:55:CC","sha1":"A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6","valid_from":"2022-08-01T00:00:00+00:00","valid_until":"2031-11-09T23:59:59+00:00"},{"owner":"CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O=\"DigiCert, Inc.\", C=US","issuer":"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US","serial_number":"8ad40b260d29c4c9f5ecda9bd93aed9","md5":"D9:12:99:E8:43:55:CD:8D:5A:86:79:5A:01:18:B6:E9","sha1":"7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C","valid_from":"2021-04-29T00:00:00+00:00","valid_until":"2036-04-28T23:59:59+00:00"},{"owner":"CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O=\"DigiCert, Inc.\", C=US","issuer":"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US","serial_number":"dc7ac5705ff21992e4043220c3a4986","md5":"E8:45:C3:0B:A9:F0:58:B0:FE:A9:95:40:92:E1:F0:C0","sha1":"07:89:4D:00:FC:19:4A:17:DB:27:3A:EB:5C:F8:FA:CE:F1:44:23:A4","valid_from":"2025-05-07T00:00:00+00:00","valid_until":"2038-01-14T23:59:59+00:00"},{"owner":"CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1, O=\"DigiCert, Inc.\", C=US","issuer":"CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O=\"DigiCert, Inc.\", C=US","serial_number":"a80ef184b8df10582d1c476a7957468","md5":"39:C1:22:79:23:AB:74:F5:63:D9:23:28:82:A7:8F:50","sha1":"DD:62:30:AC:86:0A:2D:30:6B:DA:38:B1:68:79:52:30:07:FB:41:7E","valid_from":"2025-06-04T00:00:00+00:00","valid_until":"2036-09-03T23:59:59+00:00"},{"owner":"CN=Martin Prikryl, O=Martin Prikryl, L=Prague, C=CZ, SERIALNUMBER=87331519, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=CZ","issuer":"CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O=\"DigiCert, Inc.\", C=US","serial_number":"4292e45125096fe6d57ab7c648aa118","md5":"D5:6A:E2:45:99:90:C6:88:00:5B:94:D5:F4:9C:6F:73","sha1":"0D:EE:8F:52:D6:B8:D8:C4:B2:C9:57:3F:42:99:FD:97:D7:07:BA:B7","valid_from":"2022-11-24T00:00:00+00:00","valid_until":"2026-02-17T23:59:59+00:00"}],"is_certificates_valid":true,"certificates_validation_message":null,"domains":[],"compromised_hosts":[],"hosts":[],"total_network_connections":0,"total_processes":1,"total_signatures":279,"extracted_files":[{"name":"L8LSHBOEDLAM9IT78ETL.temp","file_path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp","file_size":12,"md5":"e4a1661c2c886ebb688dec494532431c","sha1":"a2ae2a7db83b33dc95396607258f553114c9183c","sha256":"b76875c50ef704dbbf7f02c982445971d1bbd61aebe2e4b28ddc58a1d66317d5","sha512":"efdcb76fb40482bc94e37eae3701e844bf22c7d74d53aef93ac7b6ae1c1094ba2f853875d2c66a49a7075ea8c69f5a348b786d6ee0fa711669279d04adaac22c","type_tags":["unknown"],"description":"data","runtime_process":"scp.exe (PID: 876)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/696a41b1b001adeb89022aba/download/dropped-file?key=5ed62ca841d2014a91abccc8cd3a062191d9bf49d2d132f2016616c1cc9a7061f6c3d666233db64a1fe7d35be63fd1ad2f1d6ac29d68ec673e45e7a7e5beee8f89405bfed2aa1d95742aae3a8b1fa1efbc6f65dc","submit_link":"/bff/report/696a41b1b001adeb89022aba/submit/dropped-file?key=5ed62ca841d2014a91abccc8cd3a062191d9bf49d2d132f2016616c1cc9a7061f6c3d666233db64a1fe7d35be63fd1ad2f1d6ac29d68ec673e45e7a7e5beee8f89405bfed2aa1d95742aae3a8b1fa1efbc6f65dc","has_overview":true,"extended_details":null},{"name":"winscp.rnd","file_path":"%APPDATA%\\winscp.rnd","file_size":128,"md5":"98cdeecc46aa5496c1eb051036235e62","sha1":"ca776cd91db18144a19a8c8ade49ad86a5a9cf73","sha256":"453ac8d4d08af436e0a973dcf0e1d64da809982bae95dda4f4315b6f79d84e0e","sha512":"149196383275c88ff5b9b266c3606536eac28e367aae1e9dd5c50eaf4fd097900d7f7deeb9795e7b9001147697e54c458abf1f929a2d036e2fdd47fe20d93673","type_tags":["unknown"],"description":"data","runtime_process":"scp.exe (PID: 876)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/696a41b1b001adeb89022aba/download/dropped-file?key=7b97274a360118ce3d36a197689df38900205e3e07f0098c5477ea341007ee7ba591391c2088dcd0f5fa76a7ba284d31965811d6916d1e7eb36ee91a55b985f10ff2a3e8e3","submit_link":"/bff/report/696a41b1b001adeb89022aba/submit/dropped-file?key=7b97274a360118ce3d36a197689df38900205e3e07f0098c5477ea341007ee7ba591391c2088dcd0f5fa76a7ba284d31965811d6916d1e7eb36ee91a55b985f10ff2a3e8e3","has_overview":false,"extended_details":null},{"name":"scp.ini","file_path":"C:\\scp.ini","file_size":9402,"md5":"f408f0ff50ec380645b0ca0db22bbf41","sha1":"593e9243e356387b0b230e84cdf45668e20ef3af","sha256":"cf3b5c0e2e82f4c00958df452be49cbecaff5a13c74e39a1360e09c01c0ce5ea","sha512":"0ece3e5dae1687ab6c0501cd0780be1556e783871c67c22e9d22bc8b4fe565c611aec36850d272b091633d54d34ec4e2c57e6d7dbfbfcf29eca2ce3fa3c69dae","type_tags":["unknown"],"description":"ASCII text, with very long lines (632), with CRLF line terminators","runtime_process":"scp.exe (PID: 876)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/696a41b1b001adeb89022aba/download/dropped-file?key=5c3b0304b5a3fa415047fa951cf7d129a652d72d3f56667f9602505d9f8c255247098a36a16ee9907ac1cfb45eca83cb3ae177599aee6419467bf8d387e6240156be","submit_link":"/bff/report/696a41b1b001adeb89022aba/submit/dropped-file?key=5c3b0304b5a3fa415047fa951cf7d129a652d72d3f56667f9602505d9f8c255247098a36a16ee9907ac1cfb45eca83cb3ae177599aee6419467bf8d387e6240156be","has_overview":false,"extended_details":null}],"file_metadata":{"file_compositions":[],"imported_objects":[],"file_analysis":[],"total_file_compositions_imports":null},"processes":[{"uid":"00000000-00000876","parentuid":null,"name":"scp.exe","normalized_path":"C:\\scp.exe","command_line":null,"sha256":"bd11fd16014ce10d456fda42dabc79369d15074137edbda70dbeb201212735d7","av_label":null,"av_matched":0,"av_total":27,"pid":"876","icon":"$27","process_flags":[{"name":"Logged Script Calls","data":null}]}],"mitre_attcks":[{"tactic":"Resource Development","technique":"Digital Certificates","attck_id":"T1588.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1588/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["May contain SSL certificate"],"parent":{"technique":"Obtain Capabilities","attck_id":"T1588","attck_id_wiki":"https://attack.mitre.org/techniques/T1588"}},{"tactic":"Execution","technique":"Native API","attck_id":"T1106","attck_id_wiki":"https://attack.mitre.org/techniques/T1106","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Imports suspicious APIs"],"informative_identifiers_count":16,"informative_identifiers":["Contains ability to create/open files (API string)","Contains ability to create a new process (API string)","Contains ability to execute an application (API string)","Contains ability to load modules (API string)","Contains ability to set/get the last-error code for a calling thread (API string)","Contains ability to find and load resources of specific modules (API string)","Input file contains API references not part of its Import Address Table (IAT)","Contains ability to load modules (API string)","Contains ability to execute Windows APIs","Calls an API typically used to load a resource in memory","Contains ability to retrieve the fully qualified path of module (API string)","Contains ability to retrieve/modify process thread (API string)","Contains ability to retrieve address of exported function from a DLL (API string)","PE file contains large number of import functions","Calls an API typically used to retrieve function addresses","Calls an API typically used to find a resource in a module"],"parent":null},{"tactic":"Execution","technique":"Inter-Process Communication","attck_id":"T1559","attck_id_wiki":"https://attack.mitre.org/techniques/T1559","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to create/connect to a named pipe (API string)","Found named pipe like strings"],"parent":null},{"tactic":"Execution","technique":"Windows Command Shell","attck_id":"T1059.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to executes commands or batch file","Able to retrieve command line parameters of the running process","Contains ability to retrieve the command-line string for the current process (API string)"],"parent":{"technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059"}},{"tactic":"Execution","technique":"PowerShell","attck_id":"T1059.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1059/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Observed Powershell command strings"],"parent":{"technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059"}},{"tactic":"Execution","technique":"Shared Modules","attck_id":"T1129","attck_id_wiki":"https://attack.mitre.org/techniques/T1129","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Loads modules at runtime","Calls an API typically used to load libraries","Loads the RPC (Remote Procedure Call) module DLL"],"parent":null},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Logged script engine calls"],"parent":null},{"tactic":"Persistence","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Contains ability to disable/close registry key (API string)","Contains ability to modify registry key/value (API string)","Able to create/load registry keys (API string)","Able to delete registry key/value (API string)","Writes registry keys"],"parent":null},{"tactic":"Persistence","technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to modify the user configuration/privilege (API string)","Contains ability to add users to a group (API string)"],"parent":null},{"tactic":"Persistence","technique":"Device Registration","attck_id":"T1098.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1098/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to register device notification handler (API string)"],"parent":{"technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098"}},{"tactic":"Persistence","technique":"Socket Filters","attck_id":"T1205.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1205/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to monitor socket connection"],"parent":{"technique":"Traffic Signaling","attck_id":"T1205","attck_id_wiki":"https://attack.mitre.org/techniques/T1205"}},{"tactic":"Persistence","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to access device drivers"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Persistence","technique":"Local Account","attck_id":"T1136.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1136/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create a new user account (API string)"],"parent":{"technique":"Create Account","attck_id":"T1136","attck_id_wiki":"https://attack.mitre.org/techniques/T1136"}},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attck_id":"T1547.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to Windows Startup folder"],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Persistence","technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"],"parent":null},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attck_id":"T1574.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["References PATH environment registry keys"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Persistence","technique":"Transport Agent","attck_id":"T1505.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1505/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to establish persistence using Exchange transport agent (.NET)"],"parent":{"technique":"Server Software Component","attck_id":"T1505","attck_id_wiki":"https://attack.mitre.org/techniques/T1505"}},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attck_id":"T1134.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to obtains specified information about the security of a file or directory (API string)","Contains ability to impersonate access tokens (API string)","Imports system security related APIs"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to load/free library (API string)","Contains ability to retrieve entry point of a process loaded into memory (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to modify thread functionality – possible hijack (API string)","Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to modify the user configuration/privilege (API string)","Contains ability to add users to a group (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Device Registration","attck_id":"T1098.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1098/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to register device notification handler (API string)"],"parent":{"technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098"}},{"tactic":"Privilege Escalation","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to access device drivers"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Privilege Escalation","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Registry Run Keys / Startup Folder","attck_id":"T1547.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to Windows Startup folder"],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify access token privileges (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to inject code into another process (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Path Interception by PATH Environment Variable","attck_id":"T1574.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["References PATH environment registry keys"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attck_id":"T1134.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to obtains specified information about the security of a file or directory (API string)","Contains ability to impersonate access tokens (API string)","Imports system security related APIs"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":4,"suspicious_identifiers":[],"informative_identifiers_count":8,"informative_identifiers":["Contains key cryptographic functions (API string)","Contains ability to perform AES/RC4 encryption (API string)","Contains CRYPTO related strings","Contains ability to use Cryptographic classes","Loads the Bcrypt module DLL","Matched Compiler/Packer signature (DIE)","YARA signature match - AES encryption","Shows ability to obfuscate file or information"],"parent":null},{"tactic":"Defense Evasion","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Contains ability to disable/close registry key (API string)","Contains ability to modify registry key/value (API string)","Able to create/load registry keys (API string)","Able to delete registry key/value (API string)","Writes registry keys"],"parent":null},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to load/free library (API string)","Contains ability to retrieve entry point of a process loaded into memory (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to check debugger is running (API string)","Contains ability to register a top-level exception handler (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to modify thread functionality – possible hijack (API string)","Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Timestomp","attck_id":"T1070.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve file time (API string)","Contains ability to set file time (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attck_id":"T1222","attck_id_wiki":"https://attack.mitre.org/techniques/T1222","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify file attributes (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Socket Filters","attck_id":"T1205.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1205/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to monitor socket connection"],"parent":{"technique":"Traffic Signaling","attck_id":"T1205","attck_id_wiki":"https://attack.mitre.org/techniques/T1205"}},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to identify virtual environment using user register activity","Able to identify virtual environment by using user activity (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Able to identify sandbox environment running process","Contains ability to detect sandbox (imports API)","Able to detect virtual machine (string)","Attempts to call APIs commonly associated with anti-analysis and evasion techniques","Observed a high volume of repeated registry API calls (API Hammering)"],"parent":null},{"tactic":"Defense Evasion","technique":"Hidden Window","attck_id":"T1564.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to show a graphical window (API string)","Contains ability to pass information to a window procedure (API string)"],"parent":{"technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564"}},{"tactic":"Defense Evasion","technique":"Masquerading","attck_id":"T1036","attck_id_wiki":"https://attack.mitre.org/techniques/T1036","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Renames files","Drops files inside appdata directory"],"parent":null},{"tactic":"Defense Evasion","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attck_id":"T1006","attck_id_wiki":"https://attack.mitre.org/techniques/T1006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Attempts to read volume data via DOS device path","Contains ability to enumerate volumes (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attck_id":"T1480","attck_id_wiki":"https://attack.mitre.org/techniques/T1480","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Creates mutants","Shows ability to use execution guardrails"],"parent":null},{"tactic":"Defense Evasion","technique":"Code Signing","attck_id":"T1553.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["The input sample is signed with a certificate","The input sample is signed with a valid certificate"],"parent":{"technique":"Subvert Trust Controls","attck_id":"T1553","attck_id_wiki":"https://attack.mitre.org/techniques/T1553"}},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attck_id":"T1027.009","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/009","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Section contains high entropy"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify access token privileges (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"File Deletion","attck_id":"T1070.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Opens file with deletion access rights"],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to delete files/directories (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to inject code into another process (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attck_id":"T1027.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to dynamically determine API calls"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to method used by Windows shell items (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"System Checks","attck_id":"T1497.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains a Wine emulator-related string"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"Path Interception by PATH Environment Variable","attck_id":"T1574.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["References PATH environment registry keys"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Defense Evasion","technique":"Software Packing","attck_id":"T1027.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["PE file has unusual entropy resources"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attck_id":"T1027.013","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/013","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attck_id":"T1140","attck_id_wiki":"https://attack.mitre.org/techniques/T1140","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to deobfuscate/decode files or information"],"parent":null},{"tactic":"Credential Access","technique":"OS Credential Dumping","attck_id":"T1003","attck_id_wiki":"https://attack.mitre.org/techniques/T1003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"],"parent":null},{"tactic":"Credential Access","technique":"Keylogging","attck_id":"T1056.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Calls an API typically used for keylogging"],"informative_identifiers_count":2,"informative_identifiers":["Able to retrieve information about pressed keystrokes (API string)","Contains ability to hook/unhook windows functions (API string)"],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attck_id":"T1555","attck_id_wiki":"https://attack.mitre.org/techniques/T1555","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains string like password/secret"],"parent":null},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attck_id":"T1558","attck_id_wiki":"https://attack.mitre.org/techniques/T1558","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to access credential file using Kerberos"],"parent":null},{"tactic":"Credential Access","technique":"Credentials In Files","attck_id":"T1552.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1552/001","malicious_identifiers_count":1,"malicious_identifiers":["Found FTP credentials location strings"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Unsecured Credentials","attck_id":"T1552","attck_id_wiki":"https://attack.mitre.org/techniques/T1552"}},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attck_id":"T1539","attck_id_wiki":"https://attack.mitre.org/techniques/T1539","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Able to retrieve browser cookies using SQL"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Credential Access","technique":"Credential API Hooking","attck_id":"T1056.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/004","malicious_identifiers_count":1,"malicious_identifiers":["Sets a computer-based training (CBT) hook"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Sets a windows hook"],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Discovery","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to check debugger is running (API string)","Contains ability to register a top-level exception handler (API string)"],"parent":null},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/techniques/T1083","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Reads configuration files (.ini files)"],"informative_identifiers_count":18,"informative_identifiers":["Contains ability to retrieve file and directory information (API string)","Contains ability to read files (API string)","Contains ability to retrieve path in which Windows is installed (API string)","Tries to access non-existent files (executable)","Able to determine the valid logical drives on the computer","Reads files","Calls an API typically used for searching a directory for files","Contains ability to retrieve list of files and subdirectories","References Windows file paths for DLLs (possible dropped files)","Able to retrieve the valid logical drives on the computer","Touches files in the Windows directory","Tries to access recent files","Creates file in AppData directory","Able to rename or move file/directory (API string)","Contains ability to enumerate files on disk (API string)","Contains references to file movement (imports API)","Touches files","Tries to access non-existent files (non-executable)"],"parent":null},{"tactic":"Discovery","technique":"System Information Discovery","attck_id":"T1082","attck_id_wiki":"https://attack.mitre.org/techniques/T1082","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Calls an API typically used to find and list the Windows drive types"],"informative_identifiers_count":30,"informative_identifiers":["Contains ability to retrieve the OS information (API string)","Contains reference to mutex-related activity (API string)","Contains ability to find logical drives of the machine (API string)","Contains ability to retrieve volume information (API string)","Able to query volume/memory size (API string)","Found system command-related strings","Contains ability to retrieve a module handle (API string)","Contains ability to retrieve data about the local computer (API string)","Attempts to call APIs to gather system and hardware detail","Calls an API typically used to retrieve OS information","Queries volume information of an entire harddrive","Calls an API typically used to retrieve information about the current system","Able to retrieve geographical location information","Contains ability to read software policies","Able to gather system information (.NET)","Contains ability to retrieve the host name of a computer (API string)","Calls an API typically used to get product type","Contains ability to determine disk drive type (API string)","Reads information about supported languages","Reads the cryptographic machine GUID","Able to retrieve information about the current system (API string)","Contains ability to retrieve the host's architecture (API string)","Reads the windows installation date","Contains ability to retrieve the NetBIOS name of the local computer (API string)","Contains ability to retrieve information about MS-DOS device names (API string)","Calls an API used to retrieve geographical location information","Contains ability to retrieve the specified system metric or system configuration setting (API string)","Calls an API typically used to get system version information","Queries volume information","Reads the active computer name"],"parent":null},{"tactic":"Discovery","technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to query system locale information (API string)","Calls an API typically used to retrieve local language"],"parent":null},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attck_id":"T1016","attck_id_wiki":"https://attack.mitre.org/techniques/T1016","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to retrieve network parameters of a computer (API string)","Contains ability to free the memory used by network management functions (API string)","Contains ability to retrieve the local name for a socket (API string)"],"parent":null},{"tactic":"Discovery","technique":"Application Window Discovery","attck_id":"T1010","attck_id_wiki":"https://attack.mitre.org/techniques/T1010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":7,"informative_identifiers":["Contains ability to retrieve open application windows (API string)","Calls an API typically used to get handle of currently active window","Scanning for window names","Calls an API possibly used to retrieve a handle to the foreground window","Calls an API typically used to get active windows title","Contains ability to find open windows (API string)","Calls an API typically used to enumerate active windows"],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/techniques/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Read windows product name from registry"],"informative_identifiers_count":8,"informative_identifiers":["Contains registry location strings","Contains reference to Borland Delphi related registry entry","Able to query registry keys (API string)","Found registry key string for installed applications","Opens registry keys","Queries for Borland Delphi related registry entry","Queries registry keys","Found registry location strings in memory"],"parent":null},{"tactic":"Discovery","technique":"System Owner/User Discovery","attck_id":"T1033","attck_id_wiki":"https://attack.mitre.org/techniques/T1033","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve usernames and/or user information (API string)","Able to query security token membership for user discovery (API string)"],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/techniques/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Calls an API typically used to enumerate process encountered in a system snapshot"],"informative_identifiers_count":9,"informative_identifiers":["Contains ability to determine if process is running under WOW64 (API string)","Able to list processes on remote desktop session host","Contains ability to enumerate process and/or its information (API string)","Queries process information","Calls an API used to retrieve process information","Calls an API typically used for taking snapshot of the specified processes","Queries basic information of the specified process","Contains ability to retrieve/open a process (API string)","Calls an API typically used to determine if process is running under WOW64"],"parent":null},{"tactic":"Discovery","technique":"Domain Groups","attck_id":"T1069.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1069/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to enumerate permission groups in the domain"],"parent":{"technique":"Permission Groups Discovery","attck_id":"T1069","attck_id_wiki":"https://attack.mitre.org/techniques/T1069"}},{"tactic":"Discovery","technique":"Permission Groups Discovery","attck_id":"T1069","attck_id_wiki":"https://attack.mitre.org/techniques/T1069","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to enumerate user groups or their members (API string)"],"parent":null},{"tactic":"Discovery","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to identify virtual environment using user register activity","Able to identify virtual environment by using user activity (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Able to identify sandbox environment running process","Contains ability to detect sandbox (imports API)","Able to detect virtual machine (string)","Attempts to call APIs commonly associated with anti-analysis and evasion techniques","Observed a high volume of repeated registry API calls (API Hammering)"],"parent":null},{"tactic":"Discovery","technique":"System Time Discovery","attck_id":"T1124","attck_id_wiki":"https://attack.mitre.org/techniques/T1124","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to retrieve machine time (API string)","Able to retrieve date formats supported by the local system (API string)","Contains ability to retrieve machine timezone (API string)"],"parent":null},{"tactic":"Discovery","technique":"Network Share Discovery","attck_id":"T1135","attck_id_wiki":"https://attack.mitre.org/techniques/T1135","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Contains ability to enumerate system network resources (API string)","Contains ability to query information about shared network resources (API string)","Able to access Windows networking-related API (String)","Contains ability to provide information and utilities for managing network resources (API string)","Imports windows networking-related APIs"],"parent":null},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attck_id":"T1120","attck_id_wiki":"https://attack.mitre.org/techniques/T1120","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"System Language Discovery","attck_id":"T1614.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to retrieve system language (API string)","Reads the windows installation language"],"parent":{"technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614"}},{"tactic":"Discovery","technique":"Software Discovery","attck_id":"T1518","attck_id_wiki":"https://attack.mitre.org/techniques/T1518","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Reads the registry for installed applications"],"parent":null},{"tactic":"Discovery","technique":"System Network Connections Discovery","attck_id":"T1049","attck_id_wiki":"https://attack.mitre.org/techniques/T1049","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to enumerate network resources (API string)"],"parent":null},{"tactic":"Discovery","technique":"System Checks","attck_id":"T1497.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains a Wine emulator-related string"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"System Service Discovery","attck_id":"T1007","attck_id_wiki":"https://attack.mitre.org/techniques/T1007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to enumerate service (API string)","Queries services related registry keys"],"parent":null},{"tactic":"Discovery","technique":"Internet Connection Discovery","attck_id":"T1016.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1016/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"System Network Configuration Discovery","attck_id":"T1016","attck_id_wiki":"https://attack.mitre.org/techniques/T1016"}},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attck_id":"T1570","attck_id_wiki":"https://attack.mitre.org/techniques/T1570","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to move file or directory (API string)","Calls an API typically used to move file or directory"],"parent":null},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attck_id":"T1021.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1021/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Reads terminal service related keys (often RDP related)"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Remote Services","attck_id":"T1021","attck_id_wiki":"https://attack.mitre.org/techniques/T1021"}},{"tactic":"Collection","technique":"Screen Capture","attck_id":"T1113","attck_id_wiki":"https://attack.mitre.org/techniques/T1113","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Calls an API possibly used to take screenshots"],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to capture screen (API string)"],"parent":null},{"tactic":"Collection","technique":"Local Data Staging","attck_id":"T1074.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create directories (API string)"],"parent":{"technique":"Data Staged","attck_id":"T1074","attck_id_wiki":"https://attack.mitre.org/techniques/T1074"}},{"tactic":"Collection","technique":"Clipboard Data","attck_id":"T1115","attck_id_wiki":"https://attack.mitre.org/techniques/T1115","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to capture drag-drop file operations","Contains ability to access clipboard data (API string)"],"parent":null},{"tactic":"Collection","technique":"Email Collection","attck_id":"T1114","attck_id_wiki":"https://attack.mitre.org/techniques/T1114","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found E-Mail address in binary/memory"],"parent":null},{"tactic":"Collection","technique":"Local Email Collection","attck_id":"T1114.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1114/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to Outlook data files path"],"parent":{"technique":"Email Collection","attck_id":"T1114","attck_id_wiki":"https://attack.mitre.org/techniques/T1114"}},{"tactic":"Collection","technique":"Keylogging","attck_id":"T1056.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Calls an API typically used for keylogging"],"informative_identifiers_count":2,"informative_identifiers":["Able to retrieve information about pressed keystrokes (API string)","Contains ability to hook/unhook windows functions (API string)"],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Collection","technique":"Data from Local System","attck_id":"T1005","attck_id_wiki":"https://attack.mitre.org/techniques/T1005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Found Putty/Winscp session related registry strings"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Collection","technique":"Archive via Library","attck_id":"T1560.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1560/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to compress/decompress content at runtime"],"parent":{"technique":"Archive Collected Data","attck_id":"T1560","attck_id_wiki":"https://attack.mitre.org/techniques/T1560"}},{"tactic":"Collection","technique":"Credential API Hooking","attck_id":"T1056.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/004","malicious_identifiers_count":1,"malicious_identifiers":["Sets a computer-based training (CBT) hook"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Sets a windows hook"],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Collection","technique":"Automated Collection","attck_id":"T1119","attck_id_wiki":"https://attack.mitre.org/techniques/T1119","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to send encrypted data to the internet"],"parent":null},{"tactic":"Command and Control","technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":6,"informative_identifiers":["Contains ability to create a new HTTP request (API string)","Found potential URL in binary/memory","Contains ability to communicate with network (API string)","Contains references to network communication API (string)","Found potential URLs in memory dumps","Found potential IP address in binary/memory"],"parent":null},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attck_id":"T1095","attck_id_wiki":"https://attack.mitre.org/techniques/T1095","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to communicate with C2 using Sockets (API string)"],"parent":null},{"tactic":"Command and Control","technique":"Socket Filters","attck_id":"T1205.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1205/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to monitor socket connection"],"parent":{"technique":"Traffic Signaling","attck_id":"T1205","attck_id_wiki":"https://attack.mitre.org/techniques/T1205"}},{"tactic":"Command and Control","technique":"Proxy","attck_id":"T1090","attck_id_wiki":"https://attack.mitre.org/techniques/T1090","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains references to RPC protocol sequence strings"],"parent":null},{"tactic":"Command and Control","technique":"Web Service","attck_id":"T1102","attck_id_wiki":"https://attack.mitre.org/techniques/T1102","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found domain strings related to cloud services(possible C&C communication)"],"parent":null},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attck_id":"T1105","attck_id_wiki":"https://attack.mitre.org/techniques/T1105","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to write files (API string)","Contains ability to transfer files remotely using SFTP","Contains ability to transfer files using SCP","Dropped files"],"parent":null},{"tactic":"Command and Control","technique":"Web Protocols","attck_id":"T1071.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Contains ability to use Webdav for network"],"informative_identifiers_count":2,"informative_identifiers":["Found string related to HTTP headers","Contains reference to Windows HTTP services (API string)"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Remote Access Tools","attck_id":"T1219","attck_id_wiki":"https://attack.mitre.org/techniques/T1219","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to use IDE tunneling for remote connection"],"parent":null},{"tactic":"Command and Control","technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to use Microsoft's Enhanced Cryptographic Provider"],"parent":null},{"tactic":"Command and Control","technique":"Non-Standard Port","attck_id":"T1571","attck_id_wiki":"https://attack.mitre.org/techniques/T1571","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to open a port and listen for incoming connection (API string)","References server/domain address with port number"],"parent":null},{"tactic":"Command and Control","technique":"Data Encoding","attck_id":"T1132","attck_id_wiki":"https://attack.mitre.org/techniques/T1132","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform Base64 encoding/decoding"],"parent":null},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attck_id":"T1041","attck_id_wiki":"https://attack.mitre.org/techniques/T1041","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to upload file/data"],"parent":null},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attck_id":"T1029","attck_id_wiki":"https://attack.mitre.org/techniques/T1029","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform scheduled transfer (API string)"],"parent":null},{"tactic":"Impact","technique":"Service Stop","attck_id":"T1489","attck_id_wiki":"https://attack.mitre.org/techniques/T1489","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Opens a handle to the specified local process"],"informative_identifiers_count":3,"informative_identifiers":["Able to retrieve/open a process (API string)","Contains ability to terminate a process (API string)","Calls an API used to open a process handle"],"parent":null},{"tactic":"Impact","technique":"System Shutdown/Reboot","attck_id":"T1529","attck_id_wiki":"https://attack.mitre.org/techniques/T1529","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to reboot/shutdown the operating system (API string)","Contains ability to shutdown system"],"parent":null},{"tactic":"Impact","technique":"Account Access Removal","attck_id":"T1531","attck_id_wiki":"https://attack.mitre.org/techniques/T1531","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to delete a user account from a server (API string)","Contains ability to delete users from a group (API string)"],"parent":null},{"tactic":"Impact","technique":"Data Encrypted for Impact","attck_id":"T1486","attck_id_wiki":"https://attack.mitre.org/techniques/T1486","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to cryptographic keys"],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-935","type":2,"relevance":1,"name":"Able to compress/decompress content at runtime","description":"Found string \"unsupported compression algorithm\" (Source: \"00000000-00000876.00000002.162748.012F2000.00000004.mdmp\")","description_v2":["Found string \"unsupported compression algorithm\" (Source: \"00000000-00000876.00000002.162748.012F2000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"unsupported compression algorithm\" (Source: \"00000000-00000876.00000002.162748.012F2000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1560.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1560/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-981","type":2,"relevance":1,"name":"Able to enumerate permission groups in the domain","description":"Found reference string \"NetGroupEnum\" (Indicator: \"netgroupenum\"; File: \"scp.exe\")\n Found reference string \"NetLocalGroupEnum\" (Indicator: \"netlocalgroupenum\"; File: \"scp.exe\")","description_v2":["Found reference string \"NetGroupEnum\" (Indicator: \"netgroupenum\"; File: \"scp.exe\")","Found reference string \"NetLocalGroupEnum\" (Indicator: \"netlocalgroupenum\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found reference string \"NetGroupEnum\" (Indicator: \"netgroupenum\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference string \"NetLocalGroupEnum\" (Indicator: \"netlocalgroupenum\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1069.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1069/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-92","type":2,"relevance":1,"name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"scp.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"scp.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"scp.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"scp.exe\")","Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"scp.exe\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"scp.exe\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-309","type":2,"relevance":3,"name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"scp.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"scp.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"scp.exe\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"scp.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"scp.exe\")","Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"scp.exe\")","Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"scp.exe\")","Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"scp.exe\")","Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-140","type":6,"relevance":3,"name":"Calls an API typically used to find a resource in a module","description":"$28","description_v2":["\"scp.exe\" called \"FindResourceW\" with parameter \"123061868\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"123222860\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"131585292\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"131585260\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"131038364\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"131038404\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"131038444\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"131585100\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"131585068\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"131038484\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"131583020\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"131582988\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"131039284\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"131039324\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"131039364\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"131056340\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"130998588\" - (UID: 00000000-00000876)","\"scp.exe\" called \"FindResourceW\" with parameter \"130998556\" - (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"123061868\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"123222860\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"131585292\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"131585260\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"131038364\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"131038404\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"131038444\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"131585100\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"131585068\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"131038484\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"131583020\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"131582988\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"131039284\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"131039324\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"131039364\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"131056340\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"130998588\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"FindResourceW\" with parameter \"130998556\" - (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-139","type":6,"relevance":3,"name":"Calls an API typically used to load a resource in memory","description":"$29","description_v2":["\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20787024'}\" (UID: 00000000-00000876)","\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20787120'}\" (UID: 00000000-00000876)","\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20786848'}\" (UID: 00000000-00000876)","\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782352'}\" (UID: 00000000-00000876)","\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782656'}\" (UID: 00000000-00000876)","\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782192'}\" (UID: 00000000-00000876)","\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782800'}\" (UID: 00000000-00000876)","\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782480'}\" (UID: 00000000-00000876)","\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782400'}\" (UID: 00000000-00000876)","\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782704'}\" (UID: 00000000-00000876)","\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782240'}\" (UID: 00000000-00000876)","\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782848'}\" (UID: 00000000-00000876)","\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782528'}\" (UID: 00000000-00000876)","\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20787232'}\" (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20787024'}\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20787120'}\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20786848'}\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782352'}\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782656'}\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782192'}\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782800'}\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782480'}\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782400'}\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782704'}\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782240'}\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782848'}\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20782528'}\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadResource with parameter {'hModule': '1638400', 'hResInfo': '20787232'}\" (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-226","type":2,"relevance":1,"name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2a","description_v2":["Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"scp.exe\")","Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"scp.exe\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; File: \"scp.exe\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; File: \"scp.exe\")","Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; File: \"scp.exe\")","Found reference to API \"WaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjects\"; File: \"scp.exe\")","Found reference to API \"WaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjectsEx\"; File: \"scp.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"scp.exe\")","Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; File: \"scp.exe\")","Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"scp.exe\")","Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"scp.exe\")","Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"scp.exe\")","Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjects\"; File: \"scp.exe\")","Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjectsEx\"; File: \"scp.exe\")","Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; File: \"scp.exe\")","Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; File: \"scp.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjectsEx\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjectsEx\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjects\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjectsEx\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjects\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjectsEx\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjectsEx\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjectsEx\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-306","type":2,"relevance":1,"name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"scp.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01214000.00000004.mdmp\")","description_v2":["Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"scp.exe\")","Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01214000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01214000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1134.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-318","type":2,"relevance":1,"name":"Contains ability to load/free library (API string)","description":"$2b","description_v2":["Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"scp.exe\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"scp.exe\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"scp.exe\")","Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"scp.exe\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"scp.exe\")","Found reference to API \"hrdir_b.c: LoadLibrary != mmdll borlndmm failed\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000000.158908.01303000.00000004.mdmp, 00000000-00000876.00000002.162748.01303000.00000004.mdmp, 00000000-00000876.00000003.170180.01303000.00000004.mdmp\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hrdir_b.c: LoadLibrary != mmdll borlndmm failed\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000000.158908.01303000.00000004.mdmp, 00000000-00000876.00000002.162748.01303000.00000004.mdmp, 00000000-00000876.00000003.170180.01303000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-304","type":2,"relevance":1,"name":"Contains ability to modify registry key/value (API string)","description":"$2c","description_v2":["Found reference to API \"RegRestoreKeyW\" (Indicator: \"RegRestoreKey\"; File: \"scp.exe\")","Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"scp.exe\")","Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"scp.exe\")","Found reference to API \"RegReplaceKeyW\" (Indicator: \"RegReplaceKey\"; File: \"scp.exe\")","Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"scp.exe\")","Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"RegReplaceKeyW\" (Indicator: \"RegReplaceKey\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"RegRestoreKeyW\" (Indicator: \"RegRestoreKey\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegRestoreKeyW\" (Indicator: \"RegRestoreKey\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegReplaceKeyW\" (Indicator: \"RegReplaceKey\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegReplaceKeyW\" (Indicator: \"RegReplaceKey\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegRestoreKeyW\" (Indicator: \"RegRestoreKey\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-320","type":2,"relevance":1,"name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"scp.exe\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"scp.exe\")","Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-338","type":2,"relevance":1,"name":"Contains ability to perform Base64 encoding/decoding","description":"$2d","description_v2":["Found string \"0123456789abcdefABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")","Found string \"0123456789abcdefABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")","Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"0123456789abcdefABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"0123456789abcdefABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1132","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1132","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-409","type":2,"relevance":1,"name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"scp.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"scp.exe\")","Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-138","type":2,"relevance":2,"name":"Contains ability to use Cryptographic classes","description":"$2e","description_v2":["Found reference to \"PermitRSASHA512\" (Indicator: \"SHA512\"; File: \"scp.exe\")","Found reference to \"XSHA512\" (Indicator: \"SHA512\"; File: \"scp.exe\")","Found reference to \"HMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00000876.00000000.158908.01147000.00000004.mdmp, 00000000-00000876.00000003.170180.01147000.00000004.mdmp\")","Found reference to \"HMAC routines\" (Indicator: \"HMAC\"; Source: \"00000000-00000876.00000000.158908.01147000.00000004.mdmp, 00000000-00000876.00000003.170180.01147000.00000004.mdmp\")","Found reference to \"RC2-CBC\" (Indicator: \"RC2\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.01157000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")","Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")","Found reference to \"SHA512-256\" (Indicator: \"SHA512\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")","Found reference to \"SHA512-224\" (Indicator: \"SHA512\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")","Found reference to \"SHA512\" (Indicator: \"SHA512\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")","Found reference to \"HMAC-DRBG\" (Indicator: \"HMAC\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")","Found reference to \"RC2-ECB\" (Indicator: \"RC2\"; Source: \"00000000-00000876.00000003.170180.01157000.00000004.mdmp\")","Found reference to \"RC2-CFB\" (Indicator: \"RC2\"; Source: \"00000000-00000876.00000003.170180.01157000.00000004.mdmp\")","Found reference to \"RC2-OFB\" (Indicator: \"RC2\"; Source: \"00000000-00000876.00000003.170180.01157000.00000004.mdmp\")","Found reference to \"PBE-SHA1-RC2-64\" (Indicator: \"RC2\"; Source: \"00000000-00000876.00000003.170180.01157000.00000004.mdmp\")","Found reference to \"pbeWithSHA1AndRC2-CBC\" (Indicator: \"RC2\"; Source: \"00000000-00000876.00000003.170180.01157000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to \"PermitRSASHA512\" (Indicator: \"SHA512\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"XSHA512\" (Indicator: \"SHA512\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"HMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00000876.00000000.158908.01147000.00000004.mdmp, 00000000-00000876.00000003.170180.01147000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"HMAC routines\" (Indicator: \"HMAC\"; Source: \"00000000-00000876.00000000.158908.01147000.00000004.mdmp, 00000000-00000876.00000003.170180.01147000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RC2-CBC\" (Indicator: \"RC2\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.01157000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"SHA512-256\" (Indicator: \"SHA512\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"SHA512-224\" (Indicator: \"SHA512\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"SHA512\" (Indicator: \"SHA512\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"HMAC-DRBG\" (Indicator: \"HMAC\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RC2-ECB\" (Indicator: \"RC2\"; Source: \"00000000-00000876.00000003.170180.01157000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RC2-CFB\" (Indicator: \"RC2\"; Source: \"00000000-00000876.00000003.170180.01157000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RC2-OFB\" (Indicator: \"RC2\"; Source: \"00000000-00000876.00000003.170180.01157000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"PBE-SHA1-RC2-64\" (Indicator: \"RC2\"; Source: \"00000000-00000876.00000003.170180.01157000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"pbeWithSHA1AndRC2-CBC\" (Indicator: \"RC2\"; Source: \"00000000-00000876.00000003.170180.01157000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"registry-215","type":3,"relevance":7,"name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2f","description_v2":["\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\DIRECTORY\\BROWSEINPLACE\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\DIRECTORY\\BROWSEINPLACE\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\FOLDER\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\FOLDER\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\FOLDER\\BROWSEINPLACE\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\FOLDER\\BROWSEINPLACE\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\ALLFILESYSTEMOBJECTS\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\ALLFILESYSTEMOBJECTS\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\ALLFILESYSTEMOBJECTS\\BROWSEINPLACE\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\ALLFILESYSTEMOBJECTS\\BROWSEINPLACE\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\DIRECTORY\\CLSID\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\DIRECTORY\\CLSID\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\FOLDER\\CLSID\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\FOLDER\\CLSID\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\ALLFILESYSTEMOBJECTS\\CLSID\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\ALLFILESYSTEMOBJECTS\\CLSID\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\DIRECTORY\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\DIRECTORY\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\DIRECTORY\")"],"description_v3":[{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\DIRECTORY\\BROWSEINPLACE\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\DIRECTORY\\BROWSEINPLACE\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\FOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\FOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\FOLDER\\BROWSEINPLACE\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\FOLDER\\BROWSEINPLACE\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\ALLFILESYSTEMOBJECTS\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\ALLFILESYSTEMOBJECTS\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\ALLFILESYSTEMOBJECTS\\BROWSEINPLACE\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\ALLFILESYSTEMOBJECTS\\BROWSEINPLACE\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\DIRECTORY\\CLSID\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\DIRECTORY\\CLSID\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\FOLDER\\CLSID\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\FOLDER\\CLSID\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\ALLFILESYSTEMOBJECTS\\CLSID\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\ALLFILESYSTEMOBJECTS\\CLSID\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\DIRECTORY\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\DIRECTORY\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\DIRECTORY\")"}],"origin":"Registry Access","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-9","type":6,"relevance":4,"name":"Queries process information","description":"\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452434196 [PID: 876]\n \"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452442811 [PID: 876]\n \"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452695822 [PID: 876]\n \"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452704633 [PID: 876]\n \"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452797948 [PID: 876]\n \"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452807262 [PID: 876]\n \"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1453875681 [PID: 876]\n \"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1453884020 [PID: 876]\n \"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1453969725 [PID: 876]\n \"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1453978910 [PID: 876]","description_v2":["\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452434196 [PID: 876]","\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452442811 [PID: 876]","\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452695822 [PID: 876]","\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452704633 [PID: 876]","\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452797948 [PID: 876]","\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452807262 [PID: 876]","\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1453875681 [PID: 876]","\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1453884020 [PID: 876]","\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1453969725 [PID: 876]","\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1453978910 [PID: 876]"],"description_v3":[{"type":"text","value":"\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452434196 [PID: 876]"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452442811 [PID: 876]"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452695822 [PID: 876]"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452704633 [PID: 876]"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452797948 [PID: 876]"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1452807262 [PID: 876]"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1453875681 [PID: 876]"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1453884020 [PID: 876]"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1453969725 [PID: 876]"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queried SystemProcessInformation at 00000000-00000876-00000C15-1453978910 [PID: 876]"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-162","type":6,"relevance":1,"name":"Renames files","description":"\"scp.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\b065f58e9b454a89.customDestinations-ms\"","description_v2":["\"scp.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\b065f58e9b454a89.customDestinations-ms\""],"description_v3":[{"type":"text","value":"\"scp.exe\" renamed original file\"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\b065f58e9b454a89.customDestinations-ms\""}],"origin":"API Call","attck_id":"T1036","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1036","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-183","type":2,"relevance":1,"name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"scp.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"scp.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"scp.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"scp.exe\")","description_v2":["Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"scp.exe\")","Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"scp.exe\")","Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"scp.exe\")","Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-148","type":2,"relevance":1,"name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"scp.exe\")","description_v2":["Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-602","type":2,"relevance":1,"name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$30","description_v2":["Found api reference \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"scp.exe\")","Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"scp.exe\")","Found api reference \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"scp.exe\")","Found api reference \"CertGetCertificateChain\" (Indicator: \"CertGetCertificateChain\"; File: \"scp.exe\")","Found api reference \"CertCreateCertificateChainEngine\" (Indicator: \"CertCreateCertificateChainEngine\"; File: \"scp.exe\")","Found api reference \"CertVerifyCertificateChainPolicy\" (Indicator: \"CertVerifyCertificateChainPolicy\"; File: \"scp.exe\")","Found api reference \"CertFreeCertificateChain\" (Indicator: \"CertFreeCertificateChain\"; File: \"scp.exe\")","Found api reference \"CertFreeCertificateChainEngine\" (Indicator: \"CertFreeCertificateChain\"; File: \"scp.exe\")","Found api reference \"CertFreeCertificateChainEngine\" (Indicator: \"CertFreeCertificateChainEngine\"; File: \"scp.exe\")","Found api reference \"CertCreateCertificateContext\" (Indicator: \"CertCreateCertificateContext\"; File: \"scp.exe\")","Found api reference \"CertCloseStore\" (Indicator: \"CertCloseStore\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","Found api reference \"CertDuplicateCertificateContext\" (Indicator: \"CertDuplicateCertificateContext\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","Found api reference \"CertFindCertificateInStore\" (Indicator: \"CertFindCertificateInStore\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","Found api reference \"CertFindChainInStore\" (Indicator: \"CertFindChainInStore\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","Found api reference \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","Found api reference \"CertGetNameStringW\" (Indicator: \"CertGetNameStringW\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","Found api reference \"CertNameToStrW\" (Indicator: \"CertNameToStrW\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","Found api reference \"CertOpenStore\" (Indicator: \"CertOpenStore\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","Found api reference \"CertOpenSystemStoreW\" (Indicator: \"CertOpenSystemStoreW\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","Found api reference \"CryptDecodeObject\" (Indicator: \"CryptDecodeObject\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","Found api reference \"PFXImportCertStore\" (Indicator: \"PFXImportCertStore\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","Found api reference \"CertCreateCertificateChainEngine\" (Indicator: \"CertCreateCertificateChainEngine\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found api reference \"CertCreateCertificateContext\" (Indicator: \"CertCreateCertificateContext\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found api reference \"CertFreeCertificateChain\" (Indicator: \"CertFreeCertificateChain\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found api reference \"CertFreeCertificateChainEngine\" (Indicator: \"CertFreeCertificateChain\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found api reference \"CertFreeCertificateChainEngine\" (Indicator: \"CertFreeCertificateChainEngine\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found api reference \"CertGetCertificateChain\" (Indicator: \"CertGetCertificateChain\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found api reference \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertGetCertificateChain\" (Indicator: \"CertGetCertificateChain\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertCreateCertificateChainEngine\" (Indicator: \"CertCreateCertificateChainEngine\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertVerifyCertificateChainPolicy\" (Indicator: \"CertVerifyCertificateChainPolicy\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertFreeCertificateChain\" (Indicator: \"CertFreeCertificateChain\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertFreeCertificateChainEngine\" (Indicator: \"CertFreeCertificateChain\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertFreeCertificateChainEngine\" (Indicator: \"CertFreeCertificateChainEngine\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertCreateCertificateContext\" (Indicator: \"CertCreateCertificateContext\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertCloseStore\" (Indicator: \"CertCloseStore\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertDuplicateCertificateContext\" (Indicator: \"CertDuplicateCertificateContext\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertFindCertificateInStore\" (Indicator: \"CertFindCertificateInStore\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertFindChainInStore\" (Indicator: \"CertFindChainInStore\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertGetNameStringW\" (Indicator: \"CertGetNameStringW\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertNameToStrW\" (Indicator: \"CertNameToStrW\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertOpenStore\" (Indicator: \"CertOpenStore\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertOpenSystemStoreW\" (Indicator: \"CertOpenSystemStoreW\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CryptDecodeObject\" (Indicator: \"CryptDecodeObject\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"PFXImportCertStore\" (Indicator: \"PFXImportCertStore\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertCreateCertificateChainEngine\" (Indicator: \"CertCreateCertificateChainEngine\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertCreateCertificateContext\" (Indicator: \"CertCreateCertificateContext\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertFreeCertificateChain\" (Indicator: \"CertFreeCertificateChain\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertFreeCertificateChainEngine\" (Indicator: \"CertFreeCertificateChain\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertFreeCertificateChainEngine\" (Indicator: \"CertFreeCertificateChainEngine\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertGetCertificateChain\" (Indicator: \"CertGetCertificateChain\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1573","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-438","type":2,"relevance":3,"name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"scp.exe\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"scp.exe\")","description_v2":["Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"scp.exe\")","Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-195","type":2,"relevance":1,"name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"scp.exe\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"scp.exe\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"scp.exe\")","description_v2":["Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"scp.exe\")","Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"scp.exe\")","Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-280","type":2,"relevance":1,"name":"Contains reference to cryptographic keys","description":"$31","description_v2":["Found string \"Public key installation done.\" (Indicator: \"public key\"; File: \"scp.exe\")","Found string \"Install public key for authentication into the server\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")","Found string \"&Install Public Key into Server...\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")","Found string \"not a private key\" (Indicator: \"private key\"; Source: \"00000000-00000876.00000002.162748.011BD000.00000004.mdmp, 00000000-00000876.00000003.170180.011AA000.00000004.mdmp\")","Found string \"not a public key\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.011BD000.00000004.mdmp, 00000000-00000876.00000003.170180.011AA000.00000004.mdmp\")","Found string \"not a PuTTY SSH-2 private key\" (Indicator: \"private key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"---- BEGIN SSH2 PUBLIC KEY ----\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"invalid begin line in SSH-2 public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"truncated SSH-2 public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"unrecognised header in SSH-2 public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"---- END SSH2 PUBLIC KEY ----\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"invalid end line in SSH-2 public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"not enough data in SSH-2 public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"invalid algorithm prefix in SSH-2 public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"no key blob in OpenSSH public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"invalid length for base64 data in OpenSSH public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"key algorithms do not match in OpenSSH public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"not a public key or a PuTTY SSH-2 private key\" (Indicator: \"private key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"not a public key or a PuTTY SSH-2 private key\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"---- BEGIN SSH2 PUBLIC KEY\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"-----BEGIN OPENSSH PRIVATE KEY\" (Indicator: \"private key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"SSH-1 public key\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"SSH-2 public key (RFC 4716 format)\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"SSH-2 public key (OpenSSH format)\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"SSH-1 private key\" (Indicator: \"private key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")","Found string \"PuTTY SSH-2 private key\" (Indicator: \"private key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Public key installation done.\" (Indicator: \"public key\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Install public key for authentication into the server\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"&Install Public Key into Server...\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"not a private key\" (Indicator: \"private key\"; Source: \"00000000-00000876.00000002.162748.011BD000.00000004.mdmp, 00000000-00000876.00000003.170180.011AA000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"not a public key\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.011BD000.00000004.mdmp, 00000000-00000876.00000003.170180.011AA000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"not a PuTTY SSH-2 private key\" (Indicator: \"private key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"---- BEGIN SSH2 PUBLIC KEY ----\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"invalid begin line in SSH-2 public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"truncated SSH-2 public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"unrecognised header in SSH-2 public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"---- END SSH2 PUBLIC KEY ----\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"invalid end line in SSH-2 public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"not enough data in SSH-2 public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"invalid algorithm prefix in SSH-2 public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"no key blob in OpenSSH public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"invalid length for base64 data in OpenSSH public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"key algorithms do not match in OpenSSH public key file\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"not a public key or a PuTTY SSH-2 private key\" (Indicator: \"private key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"not a public key or a PuTTY SSH-2 private key\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"---- BEGIN SSH2 PUBLIC KEY\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"-----BEGIN OPENSSH PRIVATE KEY\" (Indicator: \"private key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SSH-1 public key\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SSH-2 public key (RFC 4716 format)\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SSH-2 public key (OpenSSH format)\" (Indicator: \"public key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SSH-1 private key\" (Indicator: \"private key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"PuTTY SSH-2 private key\" (Indicator: \"private key\"; Source: \"00000000-00000876.00000002.162748.0120E000.00000004.mdmp, 00000000-00000876.00000003.170180.0120E000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-32","type":15,"relevance":1,"name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption\n Matched sigs: Contains ability to perform Base64 encoding/decoding","description_v2":["The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption","Matched sigs: Contains ability to perform Base64 encoding/decoding"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform Base64 encoding/decoding"}],"origin":"Indicator Combinations","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-28","type":15,"relevance":1,"name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Uses Windows cryptography API for obfuscation\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match – cryptographic algorithms","description_v2":["The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains key cryptographic functions (API string)","Matched sigs: Contains ability to perform AES/RC4 encryption (API string)","Matched sigs: Contains CRYPTO related strings","Matched sigs: Contains ability to use Cryptographic classes","Matched sigs: Contains reference to cryptographic keys","Matched sigs: Uses Windows cryptography API for obfuscation","Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider","Matched sigs: Reads the cryptographic machine GUID","Matched sigs: YARA signature match - AES encryption","Matched sigs: Contains ability to perform Base64 encoding/decoding","Matched sigs: YARA signature match – cryptographic algorithms"],"description_v3":[{"type":"text","value":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains key cryptographic functions (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform AES/RC4 encryption (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains CRYPTO related strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use Cryptographic classes"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains reference to cryptographic keys"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Uses Windows cryptography API for obfuscation"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Reads the cryptographic machine GUID"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - AES encryption"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform Base64 encoding/decoding"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match – cryptographic algorithms"}],"origin":"Indicator Combinations","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-989","type":2,"relevance":1,"name":"Able to detect virtual machine (string)","description":"Found string \"1c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe\" (Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.04010000.00000004.mdmp\")\n Found string \"Bc:\\program files\\oracle\\virtualbox guest additions\\vboxdrvinst.exe\" (Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","description_v2":["Found string \"1c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe\" (Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found string \"Bc:\\program files\\oracle\\virtualbox guest additions\\vboxdrvinst.exe\" (Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"1%PROGRAMFILES%\\vmware\\vmware tools\\vmtoolsd.exe\" (Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Bc:\\program files\\oracle\\virtualbox guest additions\\vboxdrvinst.exe\" (Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-937","type":2,"relevance":1,"name":"Able to gather system information (.NET)","description":"$32","description_v2":["Found string \"GetUserNameExW\" (Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found string \"GetUserNameA\" (Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found string \"UserNameLabel\" (Source: \"00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.0A8D0000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.0A8D0000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.0A8D0000.00000004.mdmp\")","Found string \"UserNameEdit\" (Source: \"00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.0A8D0000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.0A8D0000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.0A8D0000.00000004.mdmp\")","Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00000876.00000001.160828.09130000.00000002.mdmp\")","Found string \"ystem.Identity.UserName\" (Source: \"00000000-00000876.00000001.160828.09130000.00000002.mdmp\")","Found string \"ystem.UserName\" (Source: \"00000000-00000876.00000001.160828.09130000.00000002.mdmp\")","Found string \"System.Identity.UserName\" (Source: \"00000000-00000876.00000001.160828.09190000.00000002.mdmp\")","Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00000876.00000001.160828.09190000.00000002.mdmp\")","Found string \"System.UserName\" (Source: \"00000000-00000876.00000001.160828.09190000.00000002.mdmp\")","Found string \"GetUserNameExA\" (Source: \"00000000-00000876.00000003.170180.01214000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"GetUserNameExW\" (Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetUserNameA\" (Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"UserNameLabel\" (Source: \"00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.0A8D0000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.0A8D0000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.0A8D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"UserNameEdit\" (Source: \"00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.0A8D0000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.0A8D0000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.0A8D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00000876.00000001.160828.09130000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ystem.Identity.UserName\" (Source: \"00000000-00000876.00000001.160828.09130000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ystem.UserName\" (Source: \"00000000-00000876.00000001.160828.09130000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Identity.UserName\" (Source: \"00000000-00000876.00000001.160828.09190000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00000876.00000001.160828.09190000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.UserName\" (Source: \"00000000-00000876.00000001.160828.09190000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetUserNameExA\" (Source: \"00000000-00000876.00000003.170180.01214000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-666","type":2,"relevance":1,"name":"Able to identify sandbox environment running process","description":"Found string \"1c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.04010000.00000004.mdmp\")\n Found string \"mware\\vmware tools\\vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00000876.00000000.158908.05730000.00000004.mdmp, 00000000-00000876.00000001.160828.05730000.00000004.mdmp, 00000000-00000876.00000002.162748.05730000.00000004.mdmp, 00000000-00000876.00000003.170180.05730000.00000004.mdmp\")","description_v2":["Found string \"1c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found string \"mware\\vmware tools\\vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00000876.00000000.158908.05730000.00000004.mdmp, 00000000-00000876.00000001.160828.05730000.00000004.mdmp, 00000000-00000876.00000002.162748.05730000.00000004.mdmp, 00000000-00000876.00000003.170180.05730000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"1%PROGRAMFILES%\\vmware\\vmware tools\\vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"mware\\vmware tools\\vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00000876.00000000.158908.05730000.00000004.mdmp, 00000000-00000876.00000001.160828.05730000.00000004.mdmp, 00000000-00000876.00000002.162748.05730000.00000004.mdmp, 00000000-00000876.00000003.170180.05730000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-661","type":2,"relevance":1,"name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"scp.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"scp.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"scp.exe\")","Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"scp.exe\")","Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-663","type":2,"relevance":1,"name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\winscp3_is1\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"scp.exe\")","description_v2":["Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\winscp3_is1\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\winscp3_is1\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1497.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-906","type":2,"relevance":1,"name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00000876-00000C2C-1456252251\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","description_v2":["Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00000876-00000C2C-1456252251\")","Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00000876-00000C2C-1456252251\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-908","type":2,"relevance":1,"name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"scp.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"scp.exe\")","Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-201","type":2,"relevance":1,"name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"scp.exe\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"scp.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"scp.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"scp.exe\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"scp.exe\")","Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"scp.exe\")","Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"scp.exe\")","Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"scp.exe\")","Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1614","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-193","type":2,"relevance":1,"name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"scp.exe\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"scp.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"scp.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"scp.exe\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"scp.exe\")","Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"scp.exe\")","Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"scp.exe\")","Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"scp.exe\")","Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-901","type":2,"relevance":1,"name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"scp.exe\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"scp.exe\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"scp.exe\")","Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"scp.exe\")","Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-739","type":2,"relevance":1,"name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"scp.exe\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01211000.00000004.mdmp\")","description_v2":["Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"scp.exe\")","Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01211000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01211000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-89","type":2,"relevance":1,"name":"Able to retrieve information about the current system (API string)","description":"$33","description_v2":["Found system information discovery API: \"GetEnvironmentStringsW\" in file \"scp.exe\"","Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"scp.exe\"","Found system information discovery API: \"GetEnvironmentStrings\" in file \"scp.exe\"","Found system information discovery API: \"GetSystemInfo\" in file \"scp.exe\"","Found system information discovery API: \"GetMonitorInfoW\" in file \"scp.exe\"","Found system information discovery API: \"GetUserObjectInformationW\" in file \"scp.exe\"","Found system information discovery API: \"GetEnvironmentStrings failed\" in \"00000000-00000876.00000000.158908.01303000.00000004.mdmp, 00000000-00000876.00000002.162748.01303000.00000004.mdmp, 00000000-00000876.00000003.170180.01303000.00000004.mdmp\"","Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\"","Found system information discovery API: \"WTSRegisterSessionNotification\" in \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\"","Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\"","Found system information discovery API: \"GetEnvironmentStrings\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\"","Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\"","Found system information discovery API: \"GetSystemInfo\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\"","Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\"","Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\""],"description_v3":[{"type":"text","value":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"scp.exe\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"scp.exe\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetEnvironmentStrings\" in file \"scp.exe\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetSystemInfo\" in file \"scp.exe\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetMonitorInfoW\" in file \"scp.exe\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetUserObjectInformationW\" in file \"scp.exe\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetEnvironmentStrings failed\" in \"00000000-00000876.00000000.158908.01303000.00000004.mdmp, 00000000-00000876.00000002.162748.01303000.00000004.mdmp, 00000000-00000876.00000003.170180.01303000.00000004.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"WTSRegisterSessionNotification\" in \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetEnvironmentStrings\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetSystemInfo\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\""}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-143","type":2,"relevance":1,"name":"Able to retrieve system language (API string)","description":"$34","description_v2":["Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"scp.exe\")","Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"scp.exe\")","Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"scp.exe\")","Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"scp.exe\")","Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"scp.exe\")","Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"scp.exe\")","Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-721","type":2,"relevance":1,"name":"Able to visualize and control listed components (API string)","description":"$35","description_v2":["Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; File: \"scp.exe\")","Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; File: \"scp.exe\")","Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; File: \"scp.exe\")","Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"scp.exe\")","Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"scp.exe\")","Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"scp.exe\")","Found reference to API \"FindWindowA\" (Indicator: \"findwindow\"; File: \"scp.exe\")","Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; File: \"scp.exe\")","Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; File: \"scp.exe\")","Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"FindWindowA\" (Indicator: \"findwindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"433661481781,492,100,,FindWindowExW,user32.dll,\"00:44:19.062\",RX=0,PX=0\" (Indicator: \"findwindow\"; Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found reference to API \"433596734404,492,110,,EnumWindows,user32.dll,\"00:44:19.031\",RX=0,PX=0\" (Indicator: \"enumwindows\"; Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowA\" (Indicator: \"findwindow\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowA\" (Indicator: \"findwindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"433661481781,492,100,,FindWindowExW,user32.dll,\"00:44:19.062\",RX=0,PX=0\" (Indicator: \"findwindow\"; Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"433596734404,492,110,,EnumWindows,user32.dll,\"00:44:19.031\",RX=0,PX=0\" (Indicator: \"enumwindows\"; Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-296","type":6,"relevance":3,"name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"scp.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000876)","description_v2":["\"scp.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-294","type":6,"relevance":3,"name":"Attempts to call APIs to gather system and hardware detail","description":"\"scp.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000876)\n \"scp.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00000876)\n \"scp.exe\" called \"GetDiskFreeSpaceExW\" with parameters (UID: 00000000-00000876)","description_v2":["\"scp.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000876)","\"scp.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00000876)","\"scp.exe\" called \"GetDiskFreeSpaceExW\" with parameters (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDiskFreeSpaceExW\" with parameters (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-297","type":6,"relevance":3,"name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"scp.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000876)\n \"scp.exe\" called \"WTSRegisterSessionNotification\" with parameters (UID: 00000000-00000876)","description_v2":["\"scp.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000876)","\"scp.exe\" called \"WTSRegisterSessionNotification\" with parameters (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"WTSRegisterSessionNotification\" with parameters (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-142","type":6,"relevance":3,"name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"scp.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000876)","description_v2":["\"scp.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-146","type":6,"relevance":3,"name":"Calls an API typically used to determine if process is running under WOW64","description":"\"scp.exe\" called \"IsWow64Process\" with parameter \"876\" - (UID: 00000000-00000876)","description_v2":["\"scp.exe\" called \"IsWow64Process\" with parameter \"876\" - (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"IsWow64Process\" with parameter \"876\" - (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-152","type":6,"relevance":3,"name":"Calls an API typically used to enumerate active windows","description":"\"scp.exe\" called \"EnumWindows\" with parameter \"30403096\" - (UID: 00000000-00000876)\n \"scp.exe\" called \"EnumWindows\" with parameter \"30405144\" - (UID: 00000000-00000876)\n \"scp.exe\" called \"EnumWindows\" with parameter \"30403592\" - (UID: 00000000-00000876)\n \"scp.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00000876)","description_v2":["\"scp.exe\" called \"EnumWindows\" with parameter \"30403096\" - (UID: 00000000-00000876)","\"scp.exe\" called \"EnumWindows\" with parameter \"30405144\" - (UID: 00000000-00000876)","\"scp.exe\" called \"EnumWindows\" with parameter \"30403592\" - (UID: 00000000-00000876)","\"scp.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"EnumWindows\" with parameter \"30403096\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"EnumWindows\" with parameter \"30405144\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"EnumWindows\" with parameter \"30403592\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-151","type":6,"relevance":3,"name":"Calls an API typically used to get active windows title","description":"\"scp.exe\" called \"GetWindowTextW\" with parameter \"&Show Login dialog on startup and when the last session is closed\" - (UID: 00000000-00000876)\n \"scp.exe\" called \"GetWindowTextW\" with parameter \"&Tools\" - (UID: 00000000-00000876)\n \"scp.exe\" called \"GetWindowTextW\" with parameter \"&Manage\" - (UID: 00000000-00000876)\n \"scp.exe\" called \"GetWindowTextW\" with parameter \"Help\" - (UID: 00000000-00000876)\n \"scp.exe\" called \"GetWindowTextW\" with parameter \"Close\" - (UID: 00000000-00000876)\n \"scp.exe\" called \"GetWindowTextW\" with parameter \"LoginX\" - (UID: 00000000-00000876)\n \"scp.exe\" called \"GetWindowTextW\" with parameter \"&Save\" - (UID: 00000000-00000876)\n \"scp.exe\" called \"GetWindowTextW\" with parameter \"A&dvanced...\" - (UID: 00000000-00000876)\n \"scp.exe\" called \"GetWindowTextW\" with parameter \"Login\" - (UID: 00000000-00000876)","description_v2":["\"scp.exe\" called \"GetWindowTextW\" with parameter \"&Show Login dialog on startup and when the last session is closed\" - (UID: 00000000-00000876)","\"scp.exe\" called \"GetWindowTextW\" with parameter \"&Tools\" - (UID: 00000000-00000876)","\"scp.exe\" called \"GetWindowTextW\" with parameter \"&Manage\" - (UID: 00000000-00000876)","\"scp.exe\" called \"GetWindowTextW\" with parameter \"Help\" - (UID: 00000000-00000876)","\"scp.exe\" called \"GetWindowTextW\" with parameter \"Close\" - (UID: 00000000-00000876)","\"scp.exe\" called \"GetWindowTextW\" with parameter \"LoginX\" - (UID: 00000000-00000876)","\"scp.exe\" called \"GetWindowTextW\" with parameter \"&Save\" - (UID: 00000000-00000876)","\"scp.exe\" called \"GetWindowTextW\" with parameter \"A&dvanced...\" - (UID: 00000000-00000876)","\"scp.exe\" called \"GetWindowTextW\" with parameter \"Login\" - (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"GetWindowTextW\" with parameter \"&Show Login dialog on startup and when the last session is closed\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetWindowTextW\" with parameter \"&Tools\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetWindowTextW\" with parameter \"&Manage\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetWindowTextW\" with parameter \"Help\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetWindowTextW\" with parameter \"Close\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetWindowTextW\" with parameter \"LoginX\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetWindowTextW\" with parameter \"&Save\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetWindowTextW\" with parameter \"A&dvanced...\" - (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetWindowTextW\" with parameter \"Login\" - (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-150","type":6,"relevance":5,"name":"Calls an API typically used to get handle of currently active window","description":"\"scp.exe\" called \"GetActiveWindow\" (UID: 00000000-00000876)","description_v2":["\"scp.exe\" called \"GetActiveWindow\" (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"GetActiveWindow\" (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-124","type":6,"relevance":3,"name":"Calls an API typically used to get product type","description":"\"scp.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000876)","description_v2":["\"scp.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-125","type":6,"relevance":3,"name":"Calls an API typically used to get system version information","description":"$36","description_v2":["\"scp.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000100000001000001c00000065000000000000002cfacf010000000000000000000000000000000000000000001019001e00000037064277ffffffffffffffff240109010000000000000000000000002cfacf01000000001c00000000000000acf9cf01000000001edb108c00facf0132ba447704eb3901000000000000000004eb390134facf01e0db080104eb3901fc10190048facf01cb7208016c7230010cfacf010c0000002cfacf011c00000000000000000019006cfacf010cc00801f4ea39011004000040000000acfacf01cb720801786d300148facf010c00000000000000acfacf0176252d007d252d00 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000a37b0000000044facf011000000031ad789944facf018e336174d4ca590728cb59079c336174e0010000400074007a007200650073002e0064006c006c002c002d003200310032000000000000000000000000000000000000000000000000000000000000000000000000000b0001000200000000000000000000000000400074007a007200650073002e0064006c006c002c002d0032003100310000000000000000000000000000000000000000000000000000000000000058902c0050facf0165902c0048facf0128cb590770ca590701facf01048f2d00385e0f01048f2d00f3a22c0090a23b000000000035a32c001e0000000010190016121900 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000009295a37bc3486472b8f2cf01a018667228facf01a018667266950b08feffffffdcf9cf015c7f647288f9cf010010190000800000757f6472f8f9cf01ffffffffffffffff0c00000000000000f8f9cf01000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff0c00000000000000f8f9cf010000000004000000d5982c0080345b07fd932c000100000008672c0000000000ba922c0000facf01 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000b8e0cf0138cf43777c38010424e1cf0101000000303801047c38010430380104040000000400000000e06b740010000024e1cf010100000030380104cd9743779c974377eec1108cb50f6274303801040000437700000000d4019c720000000080ee68740100000000000000f8e26b7400000000040000000000000048406a74f8e26b7428e1cf0180e88774c89d010480e8877424e1cf010000000080e887746c93cafdfeffffff000000000000000000000000130000005c4e0504020000000200000018000000304e05045c4e050400000000f5bb7899a8e3cf01ddf35f749ce1cf0100000000304e050418000000f8f35f74304e0504 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0000006f00660074005c00570069006e0064006f00770073005c0043006100630068006500730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000882e0304a02e0304 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000000188150604881506040a00100000000000150000000000000090150604e07706040000000000000100feffffff000000006002010400000000000000060000000015000000000000006002010415000000150000001500000015000000000000000000000080edcf01506a4677f2d691fafeffffff20edcf01b7164377e8020000f00200000c0401040cedcf0170bf9f720000010400000000f002000000000000000000005e0000000300000000000104e8020000080010000000000040edcf01ee13437740000000ee1343770800100000000000000000000800000090edcf01a40c61740000010408001000b50c617405b7789970bf9f7204010000 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f000002000000000002003293d974e4b1d5740183c65600000000680302004e00000030c0cf01240000000100000000e1cf010000000070000000ff1e30feffffffff25b0d57400000000e862730530becf010000000048bfcf01a0186672000000000000000058bfcf01222ab3738002000000000000000000000000000030bfcf011cbfcf01524346774300000070bfcf0173f65f74b2bfcf015c00000000000000fdfeff7f82f85f7400000000bc45c5fdfeffffff00000000000000000000000005000000007a0a0402000000020000000a000000f0790a04007a0a0400000000e5e57899b8c1cf01ddf35f74acbfcf0100000000f0790a040a000000f8f35f74f0790a04 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a0ff0204b4ff0204 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000090560d04000001040000010490560d04306d0104306d01047f070000c0000104d8320d0444becf01d2fb417701000000ff0700002a41000090560d04000001040000000000000000000001040000000000000000fc1d000048540d040000010400000000e8627305306d0104306d01047f070000c00001040000000000000000d2fb417701000000ff0700007341000048540d040000010400000000e8627305f8c2cf01d4c2cf0181f11177e862730510c8cf01a0c4cf01c5f11177000001049834437750540d0400c3cf011c600e7704000000f8c2cf015c837c74e0627305a090157700000000b4bfcf0100000000 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000647290800304001000000400000000600d040000000000f0010000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000e8627305000000000000000068bdcf010000000000000000000000000400000000000000ab3f000092d1a37bf8bdcf01deed4177ffffffffdcbdcf01524346774300000030becf0173f65f748ebecf015c000000000000000bffff7f82f85f7400000000d449cbfdffffffff00000000000000000000000009000000cc74040401000000010000001b00000098740404cc74040400000000a5e4789978c0cf01ddf35f746cbecf0100000000987404041b000000f8f35f7498740404 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d0670d04e8670d04 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000020022000080c10a0f0700000000000000000000000000000000000000000000000000000000010000005e030200010000003183c65600000000e8627305c0bfcf01bed3a37bb8becf01feffffff000000000000000000000b08feffffffe0bfcf01222ab37380020000000000000000000000000000b8bfcf01a4bfcf015243467743000000f8bfcf0173f65f743ac0cf015c00000000000000fdfeff7f82f85f74000000000420c2fdfeffffff0000000000000000000000000500000040a00d0402000000020000000a00000030a00d0440a00d04000000006de5789940c2cf01ddf35f7434c0cf010000000030a00d040a000000f8f35f7430a00d04 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c0010304d4010304 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000010000010000000000000001cf6d0100000000000000c0becf01854a9474df878c748c0fc3cc90800304d0910b04382c0a04a4cf7b74a4cf7b7466d2a37b00000000000000005cc2cf01a01866720e9a0b08feffffff0000cf01881a6074b31a60749080030400000000e86273050000000068c2cf018b848c74330000000000000000000000807f8c74b4858c74b8bfcf0100000000000000003187dc01202c0a04d0910b0490800304e862730580c3cf015cc3cf0181f11177e862730598c8cf0128c5cf01c5f111770000010498344377a0a80d0488c3cf011c600e770400000080c3cf015c837c74e0627305a090157700000000010000005e030200 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f000002000000000060749080030480f90a04000000000000000098c1cf018b848c7433000000d470c3cc14aa0d04807f8c74b4858c74a15b6472ea61848100000000e8627305b02d0a04888e0b04908003040c0000000000000000000000000003041c0100000a00000000000000ab3f00000200000000000100000100000000000064becf015243467743000000b8becf0173f65f7416bfcf015c000000000000000bffff7f82f85f74000000009c4ecbfdffffffff000000000000000000000000090000008c70040401000000010000001b000000587004048c700404000000002de4789900c1cf01ddf35f74f4becf0100000000587004041b000000f8f35f7458700404 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000060680d0478680d04 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000020022000080a8070f07000000000000000000000000000000000000000000000000000000000100000042030200010000009982c65604becf010000000000000000e862730510becf01feffffff28bfcf01a0186672000000000000000038bfcf01222ab3738002000000000000000000000000000010bfcf01fcbecf01524346774300000050bfcf0173f65f7492bfcf015c00000000000000fdfeff7f82f85f7400000000947cc1fdfeffffff0000000000000000000000000500000008430e0402000000020000000a000000f8420e0408430e0400000000c5e5789998c1cf01ddf35f748cbfcf0100000000f8420e040a000000f8f35f74f8420e04 (UID: 00000000-00000876)","\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000040670d0454670d04 (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000100000001000001c00000065000000000000002cfacf010000000000000000000000000000000000000000001019001e00000037064277ffffffffffffffff240109010000000000000000000000002cfacf01000000001c00000000000000acf9cf01000000001edb108c00facf0132ba447704eb3901000000000000000004eb390134facf01e0db080104eb3901fc10190048facf01cb7208016c7230010cfacf010c0000002cfacf011c00000000000000000019006cfacf010cc00801f4ea39011004000040000000acfacf01cb720801786d300148facf010c00000000000000acfacf0176252d007d252d00 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000a37b0000000044facf011000000031ad789944facf018e336174d4ca590728cb59079c336174e0010000400074007a007200650073002e0064006c006c002c002d003200310032000000000000000000000000000000000000000000000000000000000000000000000000000b0001000200000000000000000000000000400074007a007200650073002e0064006c006c002c002d0032003100310000000000000000000000000000000000000000000000000000000000000058902c0050facf0165902c0048facf0128cb590770ca590701facf01048f2d00385e0f01048f2d00f3a22c0090a23b000000000035a32c001e0000000010190016121900 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000009295a37bc3486472b8f2cf01a018667228facf01a018667266950b08feffffffdcf9cf015c7f647288f9cf010010190000800000757f6472f8f9cf01ffffffffffffffff0c00000000000000f8f9cf01000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff0c00000000000000f8f9cf010000000004000000d5982c0080345b07fd932c000100000008672c0000000000ba922c0000facf01 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000b8e0cf0138cf43777c38010424e1cf0101000000303801047c38010430380104040000000400000000e06b740010000024e1cf010100000030380104cd9743779c974377eec1108cb50f6274303801040000437700000000d4019c720000000080ee68740100000000000000f8e26b7400000000040000000000000048406a74f8e26b7428e1cf0180e88774c89d010480e8877424e1cf010000000080e887746c93cafdfeffffff000000000000000000000000130000005c4e0504020000000200000018000000304e05045c4e050400000000f5bb7899a8e3cf01ddf35f749ce1cf0100000000304e050418000000f8f35f74304e0504 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0000006f00660074005c00570069006e0064006f00770073005c0043006100630068006500730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000882e0304a02e0304 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000000188150604881506040a00100000000000150000000000000090150604e07706040000000000000100feffffff000000006002010400000000000000060000000015000000000000006002010415000000150000001500000015000000000000000000000080edcf01506a4677f2d691fafeffffff20edcf01b7164377e8020000f00200000c0401040cedcf0170bf9f720000010400000000f002000000000000000000005e0000000300000000000104e8020000080010000000000040edcf01ee13437740000000ee1343770800100000000000000000000800000090edcf01a40c61740000010408001000b50c617405b7789970bf9f7204010000 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f000002000000000002003293d974e4b1d5740183c65600000000680302004e00000030c0cf01240000000100000000e1cf010000000070000000ff1e30feffffffff25b0d57400000000e862730530becf010000000048bfcf01a0186672000000000000000058bfcf01222ab3738002000000000000000000000000000030bfcf011cbfcf01524346774300000070bfcf0173f65f74b2bfcf015c00000000000000fdfeff7f82f85f7400000000bc45c5fdfeffffff00000000000000000000000005000000007a0a0402000000020000000a000000f0790a04007a0a0400000000e5e57899b8c1cf01ddf35f74acbfcf0100000000f0790a040a000000f8f35f74f0790a04 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a0ff0204b4ff0204 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000090560d04000001040000010490560d04306d0104306d01047f070000c0000104d8320d0444becf01d2fb417701000000ff0700002a41000090560d04000001040000000000000000000001040000000000000000fc1d000048540d040000010400000000e8627305306d0104306d01047f070000c00001040000000000000000d2fb417701000000ff0700007341000048540d040000010400000000e8627305f8c2cf01d4c2cf0181f11177e862730510c8cf01a0c4cf01c5f11177000001049834437750540d0400c3cf011c600e7704000000f8c2cf015c837c74e0627305a090157700000000b4bfcf0100000000 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000647290800304001000000400000000600d040000000000f0010000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000e8627305000000000000000068bdcf010000000000000000000000000400000000000000ab3f000092d1a37bf8bdcf01deed4177ffffffffdcbdcf01524346774300000030becf0173f65f748ebecf015c000000000000000bffff7f82f85f7400000000d449cbfdffffffff00000000000000000000000009000000cc74040401000000010000001b00000098740404cc74040400000000a5e4789978c0cf01ddf35f746cbecf0100000000987404041b000000f8f35f7498740404 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d0670d04e8670d04 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000020022000080c10a0f0700000000000000000000000000000000000000000000000000000000010000005e030200010000003183c65600000000e8627305c0bfcf01bed3a37bb8becf01feffffff000000000000000000000b08feffffffe0bfcf01222ab37380020000000000000000000000000000b8bfcf01a4bfcf015243467743000000f8bfcf0173f65f743ac0cf015c00000000000000fdfeff7f82f85f74000000000420c2fdfeffffff0000000000000000000000000500000040a00d0402000000020000000a00000030a00d0440a00d04000000006de5789940c2cf01ddf35f7434c0cf010000000030a00d040a000000f8f35f7430a00d04 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c0010304d4010304 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000010000010000000000000001cf6d0100000000000000c0becf01854a9474df878c748c0fc3cc90800304d0910b04382c0a04a4cf7b74a4cf7b7466d2a37b00000000000000005cc2cf01a01866720e9a0b08feffffff0000cf01881a6074b31a60749080030400000000e86273050000000068c2cf018b848c74330000000000000000000000807f8c74b4858c74b8bfcf0100000000000000003187dc01202c0a04d0910b0490800304e862730580c3cf015cc3cf0181f11177e862730598c8cf0128c5cf01c5f111770000010498344377a0a80d0488c3cf011c600e770400000080c3cf015c837c74e0627305a090157700000000010000005e030200 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f000002000000000060749080030480f90a04000000000000000098c1cf018b848c7433000000d470c3cc14aa0d04807f8c74b4858c74a15b6472ea61848100000000e8627305b02d0a04888e0b04908003040c0000000000000000000000000003041c0100000a00000000000000ab3f00000200000000000100000100000000000064becf015243467743000000b8becf0173f65f7416bfcf015c000000000000000bffff7f82f85f74000000009c4ecbfdffffffff000000000000000000000000090000008c70040401000000010000001b000000587004048c700404000000002de4789900c1cf01ddf35f74f4becf0100000000587004041b000000f8f35f7458700404 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000060680d0478680d04 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000020022000080a8070f07000000000000000000000000000000000000000000000000000000000100000042030200010000009982c65604becf010000000000000000e862730510becf01feffffff28bfcf01a0186672000000000000000038bfcf01222ab3738002000000000000000000000000000010bfcf01fcbecf01524346774300000050bfcf0173f65f7492bfcf015c00000000000000fdfeff7f82f85f7400000000947cc1fdfeffffff0000000000000000000000000500000008430e0402000000020000000a000000f8420e0408430e0400000000c5e5789998c1cf01ddf35f748cbfcf0100000000f8420e040a000000f8f35f74f8420e04 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000040670d0454670d04 (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-222","type":6,"relevance":2,"name":"Calls an API typically used to retrieve OS information","description":"\"scp.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000060ea000050facf0140facf0140facf0138facf015527617400101900e4040000e9276174ada0789964facf0199380801e404000050facf010100000096101900010000003f00000000000000000000000000cf0194facf01a3390801 (UID: 00000000-00000876)","description_v2":["\"scp.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000060ea000050facf0140facf0140facf0138facf015527617400101900e4040000e9276174ada0789964facf0199380801e404000050facf010100000096101900010000003f00000000000000000000000000cf0194facf01a3390801 (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000060ea000050facf0140facf0140facf0138facf015527617400101900e4040000e9276174ada0789964facf0199380801e404000050facf010100000096101900010000003f00000000000000000000000000cf0194facf01a3390801 (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-147","type":6,"relevance":3,"name":"Calls an API typically used to retrieve local language","description":"\"scp.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00000876)","description_v2":["\"scp.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1614","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"static-190","type":0,"relevance":5,"name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: scp.exe]","description_v2":["Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: scp.exe]"],"description_v3":[{"type":"text","value":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: scp.exe]"}],"origin":"Static Parser","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"static-189","type":0,"relevance":5,"name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: scp.exe]","description_v2":["Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: scp.exe]"],"description_v3":[{"type":"text","value":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: scp.exe]"}],"origin":"Static Parser","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-62","type":2,"relevance":5,"name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\"; File: \"scp.exe\")","description_v2":["\"wine_get_version\" (Indicator: \"wine_get_version\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"\"wine_get_version\" (Indicator: \"wine_get_version\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1497.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-450","type":2,"relevance":1,"name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"scp.exe\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","description_v2":["Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"scp.exe\")","Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-194","type":2,"relevance":1,"name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"SetVolumeMountPointW\" (Indicator: \"SetVolumeMountPoint\"; File: \"scp.exe\")","description_v2":["Found reference to API \"SetVolumeMountPointW\" (Indicator: \"SetVolumeMountPoint\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetVolumeMountPointW\" (Indicator: \"SetVolumeMountPoint\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-413","type":2,"relevance":1,"name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"scp.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"scp.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"scp.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"433661481781,492,100,,FindWindowExW,user32.dll,\"00:44:19.062\",RX=0,PX=0\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","description_v2":["Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"scp.exe\")","Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"scp.exe\")","Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"scp.exe\")","Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"433661481781,492,100,,FindWindowExW,user32.dll,\"00:44:19.062\",RX=0,PX=0\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"433661481781,492,100,,FindWindowExW,user32.dll,\"00:44:19.062\",RX=0,PX=0\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-365","type":2,"relevance":1,"name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"scp.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"scp.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"scp.exe\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"scp.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"scp.exe\")","Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"scp.exe\")","Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1029","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1029","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-78","type":3,"relevance":1,"name":"Contains ability to read software policies","description":"\"scp.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","description_v2":["\"scp.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"],"description_v3":[{"type":"text","value":"\"scp.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-249","type":2,"relevance":1,"name":"Contains ability to retrieve file time (API string)","description":"$37","description_v2":["Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"scp.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"scp.exe\")","Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"scp.exe\")","Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"scp.exe\")","Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"scp.exe\")","Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-247","type":2,"relevance":1,"name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"scp.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"scp.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"scp.exe\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"scp.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"scp.exe\")","Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"scp.exe\")","Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-248","type":2,"relevance":1,"name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"scp.exe\")\n Found reference to API \"GetTimeZoneInformationForYear\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"scp.exe\")","Found reference to API \"GetTimeZoneInformationForYear\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTimeZoneInformationForYear\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-222","type":2,"relevance":1,"name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"scp.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"scp.exe\")","Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-141","type":2,"relevance":1,"name":"Contains ability to retrieve open application windows (API string)","description":"$38","description_v2":["Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"scp.exe\")","Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; File: \"scp.exe\")","Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"scp.exe\")","Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"scp.exe\")","Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"scp.exe\")","Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"scp.exe\")","Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; File: \"scp.exe\")","Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; File: \"scp.exe\")","Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"82323362952,492,105,,GetForegroundWindow,user32.dll,\"00:41:52.671\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found reference to API \"82063506975,492,105,,GetForegroundWindow,user32.dll,\"00:41:52.562\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found reference to API \"82773509111,492,105,,GetForegroundWindow,user32.dll,\"00:41:52.859\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found reference to API \"82773263881,492,105,,GetForegroundWindow,user32.dll,\"00:41:52.859\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found reference to API \"82773386867,492,105,,GetForegroundWindow,user32.dll,\"00:41:52.859\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found reference to API \"154323907693,492,105,,GetForegroundWindow,user32.dll,\"00:42:22.671\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")","Found reference to API \"153647366435,492,107,,GetActiveWindow,user32.dll,\"00:42:22.390\",RX=0,PX=0\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")","Found reference to API \"154323327405,492,105,,GetForegroundWindow,user32.dll,\"00:42:22.671\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")","Found reference to API \"154323659465,492,105,,GetForegroundWindow,user32.dll,\"00:42:22.671\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"82323362952,492,105,,GetForegroundWindow,user32.dll,\"00:41:52.671\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"82063506975,492,105,,GetForegroundWindow,user32.dll,\"00:41:52.562\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"82773509111,492,105,,GetForegroundWindow,user32.dll,\"00:41:52.859\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"82773263881,492,105,,GetForegroundWindow,user32.dll,\"00:41:52.859\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"82773386867,492,105,,GetForegroundWindow,user32.dll,\"00:41:52.859\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"154323907693,492,105,,GetForegroundWindow,user32.dll,\"00:42:22.671\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"153647366435,492,107,,GetActiveWindow,user32.dll,\"00:42:22.390\",RX=0,PX=0\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"154323327405,492,105,,GetForegroundWindow,user32.dll,\"00:42:22.671\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"154323659465,492,105,,GetForegroundWindow,user32.dll,\"00:42:22.671\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-312","type":2,"relevance":1,"name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"scp.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"scp.exe\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"scp.exe\")","Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"scp.exe\")","Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-171","type":2,"relevance":1,"name":"Contains ability to retrieve the OS information (API string)","description":"$39","description_v2":["Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"scp.exe\")","Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"scp.exe\")","Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"scp.exe\")","Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"scp.exe\")","Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"scp.exe\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"scp.exe\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"scp.exe\")","Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-167","type":2,"relevance":1,"name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"scp.exe\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"scp.exe\")","description_v2":["Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"scp.exe\")","Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1543","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-162","type":2,"relevance":1,"name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"scp.exe\")\n Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"scp.exe\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"scp.exe\")","Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"scp.exe\")","Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-324","type":2,"relevance":1,"name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: scp.exe","description_v2":["\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: scp.exe"],"description_v3":[{"type":"text","value":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: scp.exe"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-322","type":6,"relevance":1,"name":"Creates file in AppData directory","description":"\"scp.exe\" writes to a file \"%APPDATA%\\winscp.rnd\"","description_v2":["\"scp.exe\" writes to a file \"%APPDATA%\\winscp.rnd\""],"description_v3":[{"type":"text","value":"\"scp.exe\" writes to a file \"%APPDATA%\\winscp.rnd\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-138","type":3,"relevance":1,"name":"Queries for Borland Delphi related registry entry","description":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","description_v2":["\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-11","type":6,"relevance":2,"name":"Queries volume information","description":"$3a","description_v2":["\"scp.exe\" queries volume information of \"C:\\share\" at 00000000-00000876-00000C17-1455148669","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1456359615","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1456362365","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1456367775","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1457063740","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1457066523","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1457071573","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1500827078","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1500830036","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1500835507","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1530862699","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1530865245","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1530870981","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1590865899","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1590869081","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1590874280","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1620865787","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1620868511","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1620874291"],"description_v3":[{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\share\" at 00000000-00000876-00000C17-1455148669"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1456359615"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1456362365"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1456367775"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1457063740"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1457066523"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1457071573"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1500827078"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1500830036"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1500835507"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1530862699"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1530865245"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1530870981"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1590865899"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1590869081"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1590874280"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1620865787"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1620868511"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1620874291"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-39","type":6,"relevance":8,"name":"Queries volume information of an entire harddrive","description":"$3b","description_v2":["\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1456359615","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1456362365","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1456367775","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1457063740","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1457066523","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1457071573","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1500827078","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1500830036","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1500835507","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1530862699","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1530865245","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1530870981","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1590865899","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1590869081","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1590874280","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1620865787","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1620868511","\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1620874291"],"description_v3":[{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1456359615"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1456362365"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1456367775"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1457063740"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1457066523"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1457071573"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1500827078"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1500830036"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1500835507"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1530862699"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1530865245"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1530870981"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1590865899"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1590869081"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1590874280"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1620865787"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1620868511"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" queries volume information of \"C:\\\" at 00000000-00000876-00000C17-1620874291"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-1","type":3,"relevance":5,"name":"Reads the cryptographic machine GUID","description":"\"scp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","description_v2":["\"scp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"],"description_v3":[{"type":"text","value":"\"scp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-55","type":3,"relevance":10,"name":"Reads the registry for installed applications","description":"\"scp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCP.EXE\")\n \"scp.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\WINSCP3_IS1\")\n \"scp.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\WINSCP3_IS1\")","description_v2":["\"scp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCP.EXE\")","\"scp.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\WINSCP3_IS1\")","\"scp.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\WINSCP3_IS1\")"],"description_v3":[{"type":"text","value":"\"scp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCP.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\WINSCP3_IS1\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\WINSCP3_IS1\")"}],"origin":"Registry Access","attck_id":"T1518","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1518","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-13","type":3,"relevance":3,"name":"Reads the windows installation date","description":"\"scp.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","description_v2":["\"scp.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")"],"description_v3":[{"type":"text","value":"\"scp.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-169","type":6,"relevance":1,"name":"Tries to access recent files","description":"\"scp.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"scp.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.TEMP\"\n \"scp.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp\"\n \"scp.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\B065F58E9B454A89.CUSTOMDESTINATIONS-MS\"","description_v2":["\"scp.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"","\"scp.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.TEMP\"","\"scp.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp\"","\"scp.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\B065F58E9B454A89.CUSTOMDESTINATIONS-MS\""],"description_v3":[{"type":"text","value":"\"scp.exe\" trying to touch file \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to touch file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.TEMP\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to touch file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to touch file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\B065F58E9B454A89.CUSTOMDESTINATIONS-MS\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"External Systems","identifier":"avtest-1","type":12,"relevance":10,"name":"Sample was identified as clean by Antivirus engines","description":"0/27 Antivirus vendors marked sample as clean (0% detection rate)","description_v2":["0/27 Antivirus vendors marked sample as clean (0% detection rate)"],"description_v3":[{"type":"text","value":"0/27 Antivirus vendors marked sample as clean (0% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-307","type":2,"relevance":1,"name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"scp.exe\"\n Found registry modification API: \"RegConnectRegistryW\" in file \"scp.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"scp.exe\"\n Found registry modification API: \"RegLoadKeyW\" in file \"scp.exe\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\"\n Found registry modification API: \"RegLoadKeyW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\"","description_v2":["Found registry modification API: \"RegCreateKeyExA\" in file \"scp.exe\"","Found registry modification API: \"RegConnectRegistryW\" in file \"scp.exe\"","Found registry modification API: \"RegCreateKeyExW\" in file \"scp.exe\"","Found registry modification API: \"RegLoadKeyW\" in file \"scp.exe\"","Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\"","Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\"","Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\"","Found registry modification API: \"RegLoadKeyW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\""],"description_v3":[{"type":"text","value":"Found registry modification API: \"RegCreateKeyExA\" in file \"scp.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegConnectRegistryW\" in file \"scp.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegCreateKeyExW\" in file \"scp.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegLoadKeyW\" in file \"scp.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegLoadKeyW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\""}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-191","type":2,"relevance":1,"name":"Able to enumerate service (API string)","description":"Found reference to API \"EnumDeviceDrivers\" (Indicator: \"EnumDeviceDrivers\"; File: \"scp.exe\")","description_v2":["Found reference to API \"EnumDeviceDrivers\" (Indicator: \"EnumDeviceDrivers\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"EnumDeviceDrivers\" (Indicator: \"EnumDeviceDrivers\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-884","type":2,"relevance":1,"name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"scp.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"scp.exe\")","Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-930","type":2,"relevance":1,"name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found string \"GetCommandLineW\" (Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"GetCommandLineW\" (Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-175","type":6,"relevance":1,"name":"Calls an API typically used to load libraries","description":"$3c","description_v2":["\"scp.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter KERNEL32.DLL (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter Msctf.dll (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter imm32.dll (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter WTSAPI32.DLL (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter UXTHEME.DLL (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter shcore (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter user32 (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter uxtheme.dll (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter olepro32.dll (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\shell32.dll (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\ws2_32.dll (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter security.dll (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter SHCORE.DLL (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter shell32 (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter USER32.DLL (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter Ole32.dll (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter DWMAPI.DLL (UID: 00000000-00000876)","\"scp.exe\" called \"LoadLibrary\" with a parameter IMM32.DLL (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter KERNEL32.DLL (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter Msctf.dll (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter imm32.dll (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter WTSAPI32.DLL (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter UXTHEME.DLL (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter shcore (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter user32 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter uxtheme.dll (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter olepro32.dll (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\shell32.dll (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\ws2_32.dll (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter security.dll (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter SHCORE.DLL (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter shell32 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter USER32.DLL (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter Ole32.dll (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter DWMAPI.DLL (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"LoadLibrary\" with a parameter IMM32.DLL (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-224","type":6,"relevance":1,"name":"Calls an API typically used to move file or directory","description":"\"scp.exe\" called \"MoveFileW\" with parameter %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp & %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\b065f58e9b454a89.customDestinations-ms (UID: 00000000-00000876)","description_v2":["\"scp.exe\" called \"MoveFileW\" with parameter %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp & %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\b065f58e9b454a89.customDestinations-ms (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"MoveFileW\" with parameter %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp & %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\b065f58e9b454a89.customDestinations-ms (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-176","type":6,"relevance":1,"name":"Calls an API typically used to retrieve function addresses","description":"$3d","description_v2":["\"scp.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThreadUILanguage (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter ___CPPdebugHook (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetProcAddress (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter Borland32 (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter wine_get_version (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetNativeSystemInfo (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CompareStringOrdinal (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetLogicalProcessorInformation (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VariantChangeTypeEx (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarNeg (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarNot (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarAdd (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarSub (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarMul (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarDiv (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarIdiv (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarMod (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarAnd (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarOr (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarXor (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarCmp (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarI4FromStr (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarR4FromStr (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarR8FromStr (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarDateFromStr (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarCyFromStr (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarBoolFromStr (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarBstrFromCy (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarBstrFromDate (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter VarBstrFromBool (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CoInitializeEx (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CoAddRefServerProcess (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CoReleaseServerProcess (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CoResumeClassObjects (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CoSuspendClassObjects (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter WTSRegisterSessionNotification (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter BufferedPaintInit (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter AnimateWindow (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter InitializeFlatSB (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter UninitializeFlatSB (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_GetScrollProp (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_SetScrollProp (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_GetScrollRange (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_GetScrollPos (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_SetScrollPos (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_SetScrollRange (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter SetLayeredWindowAttributes (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter SetDefaultDllDirectories (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetDpiForMonitor (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetSystemMetricsForDpi (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter SystemParametersInfoForDpi (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter OpenThemeData (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CloseThemeData (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter DrawThemeBackground (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter DrawThemeText (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeBackgroundExtent (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemePartSize (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeTextExtent (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeTextMetrics (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeBackgroundRegion (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter HitTestThemeBackground (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter DrawThemeEdge (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter DrawThemeIcon (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter IsThemePartDefined (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeColor (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeMetric (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeString (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeBool (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeInt (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeEnumValue (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemePosition (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeFont (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeRect (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeMargins (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeIntList (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemePropertyOrigin (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter SetWindowTheme (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeFilename (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeSysColor (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeSysColorBrush (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeSysBool (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeSysSize (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeSysFont (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeSysString (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeSysInt (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter IsThemeActive (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter IsAppThemed (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetWindowTheme (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter EnableThemeDialogTexture (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeAppProperties (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter SetThemeAppProperties (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetCurrentThemeName (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeDocumentationProperty (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter DrawThemeParentBackground (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter EnableTheming (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter OleIconToCursor (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter OleCreateFontIndirect (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter OleCreatePictureIndirect (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter OleLoadPicture (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter OleTranslateColor (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter OleCreatePropertyFrame (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter OleCreatePropertyFrameIndirect (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter RaiseException (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetTimeZoneInformationForYear (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageFamilyName (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CryptAcquireContextA (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CryptGenRandom (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter CryptReleaseContext (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter SHGetFolderPathA (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter getaddrinfo (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter freeaddrinfo (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter getnameinfo (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter WSAAddressToStringA (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter WSAAsyncSelect (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter WSAEventSelect (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter select (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter WSAGetLastError (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter WSAEnumNetworkEvents (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter WSAStartup (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter WSACleanup (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter closesocket (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter ntohl (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter htonl (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter htons (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter ntohs (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter gethostname (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter gethostbyname (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter getservbyname (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter inet_addr (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter inet_ntoa (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter inet_ntop (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter connect (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter bind (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter getsockopt (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter setsockopt (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter socket (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter listen (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter send (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter shutdown (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter ioctlsocket (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter accept (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter getpeername (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter getsockname (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter recv (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter WSAIoctl (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter InitSecurityInterfaceA (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter IsWow64Process (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter SHGetImageList (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetProcessDpiAwareness (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter EnableNonClientDpiScaling (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter InitCommonControlsEx (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetDpiForWindow (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter ImageList_WriteEx (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter LoadIconMetric (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter ProcessIdToSessionId (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter DwmIsCompositionEnabled (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter BeginBufferedPaint (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter BufferedPaintSetAlpha (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter EndBufferedPaint (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter DrawThemeTextEx (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter ImmAssociateContextEx (UID: 00000000-00000876)","\"scp.exe\" called \"GetProcAddress\" with a parameter WTSUnRegisterSessionNotification (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThreadUILanguage (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter ___CPPdebugHook (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetProcAddress (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter Borland32 (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter wine_get_version (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetNativeSystemInfo (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CompareStringOrdinal (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetLogicalProcessorInformation (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VariantChangeTypeEx (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarNeg (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarNot (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarAdd (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarSub (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarMul (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarDiv (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarIdiv (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarMod (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarAnd (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarOr (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarXor (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarCmp (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarI4FromStr (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarR4FromStr (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarR8FromStr (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarDateFromStr (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarCyFromStr (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarBoolFromStr (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarBstrFromCy (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarBstrFromDate (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter VarBstrFromBool (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CoInitializeEx (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CoAddRefServerProcess (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CoReleaseServerProcess (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CoResumeClassObjects (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CoSuspendClassObjects (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter WTSRegisterSessionNotification (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter BufferedPaintInit (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter AnimateWindow (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter InitializeFlatSB (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter UninitializeFlatSB (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_GetScrollProp (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_SetScrollProp (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_GetScrollRange (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_GetScrollPos (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_SetScrollPos (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter FlatSB_SetScrollRange (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter SetLayeredWindowAttributes (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter SetDefaultDllDirectories (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetDpiForMonitor (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetSystemMetricsForDpi (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter SystemParametersInfoForDpi (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter OpenThemeData (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CloseThemeData (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter DrawThemeBackground (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter DrawThemeText (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeBackgroundExtent (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemePartSize (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeTextExtent (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeTextMetrics (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeBackgroundRegion (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter HitTestThemeBackground (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter DrawThemeEdge (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter DrawThemeIcon (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter IsThemePartDefined (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeColor (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeMetric (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeString (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeBool (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeInt (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeEnumValue (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemePosition (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeFont (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeRect (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeMargins (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeIntList (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemePropertyOrigin (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter SetWindowTheme (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeFilename (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeSysColor (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeSysColorBrush (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeSysBool (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeSysSize (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeSysFont (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeSysString (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeSysInt (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter IsThemeActive (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter IsAppThemed (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetWindowTheme (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter EnableThemeDialogTexture (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeAppProperties (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter SetThemeAppProperties (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetCurrentThemeName (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetThemeDocumentationProperty (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter DrawThemeParentBackground (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter EnableTheming (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter OleIconToCursor (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter OleCreateFontIndirect (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter OleCreatePictureIndirect (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter OleLoadPicture (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter OleTranslateColor (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter OleCreatePropertyFrame (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter OleCreatePropertyFrameIndirect (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter RaiseException (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetTimeZoneInformationForYear (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageFamilyName (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CryptAcquireContextA (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CryptGenRandom (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter CryptReleaseContext (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter SHGetFolderPathA (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter getaddrinfo (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter freeaddrinfo (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter getnameinfo (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter WSAAddressToStringA (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter WSAAsyncSelect (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter WSAEventSelect (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter select (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter WSAGetLastError (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter WSAEnumNetworkEvents (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter WSAStartup (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter WSACleanup (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter closesocket (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter ntohl (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter htonl (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter htons (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter ntohs (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter gethostname (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter gethostbyname (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter getservbyname (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter inet_addr (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter inet_ntoa (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter inet_ntop (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter connect (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter bind (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter getsockopt (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter setsockopt (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter socket (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter listen (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter send (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter shutdown (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter ioctlsocket (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter accept (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter getpeername (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter getsockname (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter recv (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter WSAIoctl (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter InitSecurityInterfaceA (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter IsWow64Process (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter SHGetImageList (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetProcessDpiAwareness (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter EnableNonClientDpiScaling (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter InitCommonControlsEx (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetDpiForWindow (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter ImageList_WriteEx (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter LoadIconMetric (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter ProcessIdToSessionId (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter DwmIsCompositionEnabled (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter BeginBufferedPaint (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter BufferedPaintSetAlpha (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter EndBufferedPaint (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter DrawThemeTextEx (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter ImmAssociateContextEx (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetProcAddress\" with a parameter WTSUnRegisterSessionNotification (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-215","type":2,"relevance":1,"name":"Contains ability to add users to a group (API string)","description":"Found reference to API \"NetGroupAdd\" (Indicator: \"NetGroupAdd\"; File: \"scp.exe\")\n Found reference to API \"NetLocalGroupAdd\" (Indicator: \"NetLocalGroupAdd\"; File: \"scp.exe\")\n Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAdd\"; File: \"scp.exe\")","description_v2":["Found reference to API \"NetGroupAdd\" (Indicator: \"NetGroupAdd\"; File: \"scp.exe\")","Found reference to API \"NetLocalGroupAdd\" (Indicator: \"NetLocalGroupAdd\"; File: \"scp.exe\")","Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAdd\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"NetGroupAdd\" (Indicator: \"NetGroupAdd\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NetLocalGroupAdd\" (Indicator: \"NetLocalGroupAdd\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAdd\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1098","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1098","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-204","type":2,"relevance":1,"name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"scp.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"scp.exe\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"scp.exe\")","Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"scp.exe\")","Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-214","type":2,"relevance":1,"name":"Contains ability to create a new user account (API string)","description":"Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; File: \"scp.exe\")\n Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAddMembers\"; File: \"scp.exe\")","description_v2":["Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; File: \"scp.exe\")","Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAddMembers\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAddMembers\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1136.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1136/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-423","type":2,"relevance":1,"name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"scp.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"scp.exe\")","Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-315","type":2,"relevance":1,"name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"scp.exe\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"scp.exe\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"scp.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"scp.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"scp.exe\")","Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"scp.exe\")","Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"scp.exe\")","Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"scp.exe\")","Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-345","type":2,"relevance":1,"name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"scp.exe\")\n Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; File: \"scp.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"scp.exe\")","Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; File: \"scp.exe\")","Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-79","type":0,"relevance":1,"name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: scp.exe)","description_v2":["Found GetProcAddress() and LoadLibraryA() in an import section (Source: scp.exe)"],"description_v3":[{"type":"text","value":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: scp.exe)"}],"origin":"Static Parser","attck_id":"T1027.007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-101","type":2,"relevance":1,"name":"Contains ability to execute Windows APIs","description":"details too long to display","description_v2":["details too long to display"],"description_v3":[{"type":"text","value":"details too long to display"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-240","type":2,"relevance":1,"name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"scp.exe\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"scp.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"scp.exe\")","Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"scp.exe\")","Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-174","type":2,"relevance":1,"name":"Contains ability to executes commands or batch file","description":"Found string \"-t -m \"%TEMP%\\putty.txt\" !`cmd.exe /c echo cd '!/' ; /bin/bash -login > \"%TEMP%\\putty.txt\"`\" (Indicator: \"cmd.exe /c\"; File: \"scp.exe\")\n Found string \"%ProgramFiles%\\PuTTY\\putty.exe -t -m \"%TEMP%\\putty.txt\" !`cmd.exe /c echo cd '!/' ; /bin/bash -login > \"%TEMP%\\putty.txt\"`\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")","description_v2":["Found string \"-t -m \"%TEMP%\\putty.txt\" !`cmd.exe /c echo cd '!/' ; /bin/bash -login > \"%TEMP%\\putty.txt\"`\" (Indicator: \"cmd.exe /c\"; File: \"scp.exe\")","Found string \"%ProgramFiles%\\PuTTY\\putty.exe -t -m \"%TEMP%\\putty.txt\" !`cmd.exe /c echo cd '!/' ; /bin/bash -login > \"%TEMP%\\putty.txt\"`\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"-t -m \"%TEMP%\\putty.txt\" !`cmd.exe /c echo cd '!/' ; /bin/bash -login > \"%TEMP%\\putty.txt\"`\" (Indicator: \"cmd.exe /c\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%ProgramFiles%\\PuTTY\\putty.exe -t -m \"%TEMP%\\putty.txt\" !`cmd.exe /c echo cd '!/' ; /bin/bash -login > \"%TEMP%\\putty.txt\"`\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-550","type":2,"relevance":1,"name":"Contains ability to find and load resources of specific modules (API string)","description":"$3e","description_v2":["Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"scp.exe\")","Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; File: \"scp.exe\")","Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"scp.exe\")","Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"scp.exe\")","Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"scp.exe\")","Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"scp.exe\")","Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-424","type":2,"relevance":1,"name":"Contains ability to load modules (API string)","description":"Found reference to API \"SymLoadModule\" (Indicator: \"LoadModule\"; File: \"scp.exe\")","description_v2":["Found reference to API \"SymLoadModule\" (Indicator: \"LoadModule\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SymLoadModule\" (Indicator: \"LoadModule\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-322","type":2,"relevance":1,"name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"scp.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"scp.exe\")","Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-206","type":2,"relevance":1,"name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"scp.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"scp.exe\")","Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-161","type":2,"relevance":1,"name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"scp.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"scp.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"scp.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"scp.exe\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"scp.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"scp.exe\")","Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"scp.exe\")","Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"scp.exe\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"scp.exe\")","Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"scp.exe\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-272","type":2,"relevance":1,"name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"scp.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"scp.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"scp.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01214000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"scp.exe\")","Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"scp.exe\")","Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"scp.exe\")","Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01214000.00000004.mdmp\")","Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01214000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-319","type":2,"relevance":1,"name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"scp.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"scp.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"scp.exe\")\n Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"scp.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")","description_v2":["Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"scp.exe\")","Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"scp.exe\")","Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"scp.exe\")","Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"scp.exe\")","Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-208","type":2,"relevance":1,"name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"scp.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"scp.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"scp.exe\")","Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"scp.exe\")","Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-78","type":0,"relevance":1,"name":"Contains export functions","description":"$3f","description_v2":["\"scp.exe\" contains export function called \"@$xp$108System@Generics@Collections@%TEnumerable__1$61System@Generics@Collections@%TPair__2$ip18Vcl@Graphics@TFont%%\" at ordinal 849","\"scp.exe\" contains export function called \"@$xp$108System@Generics@Collections@%TEnumerator__1$61System@Generics@Collections@%TPair__2$ip18Vcl@Graphics@TFont%%\" at ordinal 846","\"scp.exe\" contains export function called \"@$xp$12TUnixDirView\" at ordinal 2213","\"scp.exe\" contains export function called \"@$xp$12Tbx@TTBXDock\" at ordinal 1125","\"scp.exe\" contains export function called \"@$xp$12Tbx@TTBXItem\" at ordinal 1094","\"scp.exe\" contains export function called \"@$xp$13Tbx@TFontSize\" at ordinal 1084","\"scp.exe\" contains export function called \"@$xp$13Tbx@TTriState\" at ordinal 1083","\"scp.exe\" contains export function called \"@$xp$15Tb2dock@TTBDock\" at ordinal 174","\"scp.exe\" contains export function called \"@$xp$15Tb2item@TTBItem\" at ordinal 512","\"scp.exe\" contains export function called \"@$xp$15Tb2item@TTBView\" at ordinal 507","\"scp.exe\" contains export function called \"@$xp$15Tbx@TTBXToolbar\" at ordinal 1111","\"scp.exe\" contains export function called \"@$xp$16Tb2item@ITBItems\" at ordinal 528","\"scp.exe\" contains export function called \"@$xp$16Tbx@TTBXRootItem\" at ordinal 1119","\"scp.exe\" contains export function called \"@$xp$16Tbxlists@TSBZone\" at ordinal 1432","\"scp.exe\" contains export function called \"@$xp$16Tbxutils@TShadow\" at ordinal 1798","\"scp.exe\" contains export function called \"@$xp$17Tb2hook@THookProc\" at ordinal 454","\"scp.exe\" contains export function called \"@$xp$17Tbx@TFontSettings\" at ordinal 1086","\"scp.exe\" contains export function called \"@$xp$17Tbx@TTBXPopupMenu\" at ordinal 1121","\"scp.exe\" contains export function called \"@$xp$17Tbx@TTBXPopupView\" at ordinal 1106","\"scp.exe\" contains export function called \"@$xp$17Tbx@TTextWrapping\" at ordinal 1081","\"scp.exe\" contains export function called \"@$xp$17Tbxutils@TShadows\" at ordinal 1805","\"scp.exe\" contains export function called \"@$xp$18Tb2anim@Tb2anim__1\" at ordinal 108","\"scp.exe\" contains export function called \"@$xp$18Tb2dock@Tb2dock__3\" at ordinal 190","\"scp.exe\" contains export function called \"@$xp$18Tb2item@Tb2item__1\" at ordinal 475","\"scp.exe\" contains export function called \"@$xp$18Tb2item@Tb2item__8\" at ordinal 498"],"description_v3":[{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$108System@Generics@Collections@%TEnumerable__1$61System@Generics@Collections@%TPair__2$ip18Vcl@Graphics@TFont%%\" at ordinal 849"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$108System@Generics@Collections@%TEnumerator__1$61System@Generics@Collections@%TPair__2$ip18Vcl@Graphics@TFont%%\" at ordinal 846"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$12TUnixDirView\" at ordinal 2213"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$12Tbx@TTBXDock\" at ordinal 1125"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$12Tbx@TTBXItem\" at ordinal 1094"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$13Tbx@TFontSize\" at ordinal 1084"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$13Tbx@TTriState\" at ordinal 1083"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$15Tb2dock@TTBDock\" at ordinal 174"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$15Tb2item@TTBItem\" at ordinal 512"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$15Tb2item@TTBView\" at ordinal 507"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$15Tbx@TTBXToolbar\" at ordinal 1111"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$16Tb2item@ITBItems\" at ordinal 528"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$16Tbx@TTBXRootItem\" at ordinal 1119"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$16Tbxlists@TSBZone\" at ordinal 1432"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$16Tbxutils@TShadow\" at ordinal 1798"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$17Tb2hook@THookProc\" at ordinal 454"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$17Tbx@TFontSettings\" at ordinal 1086"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$17Tbx@TTBXPopupMenu\" at ordinal 1121"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$17Tbx@TTBXPopupView\" at ordinal 1106"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$17Tbx@TTextWrapping\" at ordinal 1081"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$17Tbxutils@TShadows\" at ordinal 1805"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$18Tb2anim@Tb2anim__1\" at ordinal 108"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$18Tb2dock@Tb2dock__3\" at ordinal 190"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$18Tb2item@Tb2item__1\" at ordinal 475"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" contains export function called \"@$xp$18Tb2item@Tb2item__8\" at ordinal 498"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-265","type":2,"relevance":1,"name":"Contains reference to Windows Startup folder","description":"\":\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\programdata\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp\n 00000000-00000876.00000001.160828.04010000.00000004.mdmp\n 00000000-00000876.00000002.162748.04010000.00000004.mdmp\n 00000000-00000876.00000003.170180.04010000.00000004.mdmp\n \":\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp\n 00000000-00000876.00000001.160828.04010000.00000004.mdmp\n 00000000-00000876.00000002.162748.04010000.00000004.mdmp\n 00000000-00000876.00000003.170180.04010000.00000004.mdmp","description_v2":["\":\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\programdata\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","00000000-00000876.00000001.160828.04010000.00000004.mdmp","00000000-00000876.00000002.162748.04010000.00000004.mdmp","00000000-00000876.00000003.170180.04010000.00000004.mdmp","\":\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","00000000-00000876.00000001.160828.04010000.00000004.mdmp","00000000-00000876.00000002.162748.04010000.00000004.mdmp","00000000-00000876.00000003.170180.04010000.00000004.mdmp"],"description_v3":[{"type":"text","value":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\programdata\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000001.160828.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000002.162748.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000003.170180.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\":\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000001.160828.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000002.162748.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000003.170180.04010000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1547.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1547/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-269","type":2,"relevance":1,"name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"scp.exe\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"scp.exe\")","Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-205","type":0,"relevance":1,"name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: scp.exe)","description_v2":["Found MoveFileW in import section (Source: scp.exe)"],"description_v3":[{"type":"text","value":"Found MoveFileW in import section (Source: scp.exe)"}],"origin":"Static Parser","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-120","type":2,"relevance":1,"name":"Contains registry location strings","description":"$40","description_v2":["\"Software\\Embarcadero\\Locales\" in Source: scp.exe","\"Software\\CodeGear\\Locales\" in Source: scp.exe","\"Software\\Borland\\Locales\" in Source: scp.exe","\"Software\\Borland\\Delphi\\Locales\" in Source: scp.exe","\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: scp.exe","\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\" in Source: scp.exe","\"\\SYSTEM\\CurrentControlSet\\Control\\Keyboard Layouts\\\" in Source: scp.exe","\"System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x\" in Source: scp.exe","\"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" in Source: scp.exe","\"Software\\Microsoft\\Windows\\DWM\" in Source: scp.exe","\"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" in Source: scp.exe","\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\" in Source: scp.exe","\"SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\" in Source: scp.exe","\"Software\\Classes\\\" in Source: scp.exe","\"Software\\RegisteredApplications\" in Source: scp.exe","\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\winscp3_is1\" in Source: scp.exe","\"SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\" in Source: scp.exe","\"SOFTWARE\\Microsoft\\PowerShell\" in Source: scp.exe","\"SOFTWARE\\Microsoft\\PowerShellCore\\InstalledVersions\" in Source: scp.exe","\"Software\\Martin Prikryl\" in Source: scp.exe","\"Software\\Wow6432`\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","00000000-00000876.00000001.160828.04010000.00000004.mdmp","00000000-00000876.00000002.162748.04010000.00000004.mdmp","00000000-00000876.00000003.170180.04010000.00000004.mdmp","\"Software\\Wow6432\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","00000000-00000876.00000001.160828.04010000.00000004.mdmp","00000000-00000876.00000002.162748.04010000.00000004.mdmp","00000000-00000876.00000003.170180.04010000.00000004.mdmp","\"oftware\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","00000000-00000876.00000001.160828.04010000.00000004.mdmp","\"sSoftware\\Wow6432\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","00000000-00000876.00000001.160828.04010000.00000004.mdmp","00000000-00000876.00000002.162748.04010000.00000004.mdmp","00000000-00000876.00000003.170180.04010000.00000004.mdmp","\"are\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\P}\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\AllFilesystemObjects\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\Directory\\DocObject\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp","\"Software\\Classes\\\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp","00000000-00000876.00000001.160828.07490000.00000004.mdmp","00000000-00000876.00000002.162748.07490000.00000004.mdmp","\"Software\\9bis.com\\KiTTY\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp","00000000-00000876.00000001.160828.07490000.00000004.mdmp","00000000-00000876.00000002.162748.07490000.00000004.mdmp","00000000-00000876.00000003.170180.07490000.00000004.mdmp","\"Software\\SimonTatham\\PuTTY\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp","00000000-00000876.00000001.160828.07490000.00000004.mdmp","00000000-00000876.00000002.162748.07490000.00000004.mdmp","00000000-00000876.00000003.170180.01211000.00000004.mdmp","00000000-00000876.00000003.170180.07490000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\M!\" in Source: 00000000-00000876.00000001.160828.01999000.00000004.mdmp","00000000-00000876.00000002.162748.01999000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\Wow6432Node\\CLSID\\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp","00000000-00000876.00000003.170180.0C310000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{3DFDF296-DBEC-4FB4-81D1-6A3438BCF4DE}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp","00000000-00000876.00000003.170180.0C310000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp","00000000-00000876.00000003.170180.0C310000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{24AD3AD4-A569-4530-98E1-AB02F9417AA8}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp","00000000-00000876.00000003.170180.0C310000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{F86FA3AB-70D2-4FC7-9C99-FCBF05467F3A}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp","00000000-00000876.00000003.170180.0C310000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{088E3905-0323-4B02-9826-5D99428E115F}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp","00000000-00000876.00000003.170180.0C310000.00000004.mdmp","\"SOFTWARE\\MIT\\Kerberos\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp","\"Software\\SimonTatham\\PuTTY\\Jumplist\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp","\"Software\\SimonTatham\\PuTTY\\Sessions\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp","\"Software\\SimonTatham\\PuTTY\\SshHostCAs\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp","\"Software\\SimonTatham\\PuTTY\\SshHostKeys\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp","\"stry\\Machine\\Software\\Classes\\CLSID\\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp","\"stry\\Machine\\Software\\Classes\\Wow6432Node\\CLSID\\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\\ShellEx\\IconHandler\" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp","\"Software\\Martin Prikryl\\WinSCP 2\" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp","\"Software\\Martin Prikryl\\WinSCP 2 Override\" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\"Software\\Embarcadero\\Locales\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\CodeGear\\Locales\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Borland\\Locales\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Borland\\Delphi\\Locales\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"\\SYSTEM\\CurrentControlSet\\Control\\Keyboard Layouts\\\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\DWM\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\RegisteredApplications\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\winscp3_is1\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\PowerShell\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\PowerShellCore\\InstalledVersions\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Martin Prikryl\" in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Wow6432`\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000001.160828.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000002.162748.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000003.170180.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Wow6432\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000001.160828.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000002.162748.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000003.170180.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"oftware\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000001.160828.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"sSoftware\\Wow6432\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000001.160828.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000002.162748.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000003.170180.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"are\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\P}\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\AllFilesystemObjects\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\Directory\\DocObject\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000001.160828.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000002.162748.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\9bis.com\\KiTTY\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000001.160828.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000002.162748.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000003.170180.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\SimonTatham\\PuTTY\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000001.160828.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000002.162748.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000003.170180.01211000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000003.170180.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\M!\" in Source: 00000000-00000876.00000001.160828.01999000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000002.162748.01999000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\Wow6432Node\\CLSID\\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000003.170180.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{3DFDF296-DBEC-4FB4-81D1-6A3438BCF4DE}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000003.170180.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000003.170180.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{24AD3AD4-A569-4530-98E1-AB02F9417AA8}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000003.170180.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{F86FA3AB-70D2-4FC7-9C99-FCBF05467F3A}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000003.170180.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{088E3905-0323-4B02-9826-5D99428E115F}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000003.170180.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\MIT\\Kerberos\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\SimonTatham\\PuTTY\\Jumplist\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\SimonTatham\\PuTTY\\Sessions\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\SimonTatham\\PuTTY\\SshHostCAs\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\SimonTatham\\PuTTY\\SshHostKeys\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"stry\\Machine\\Software\\Classes\\CLSID\\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"stry\\Machine\\Software\\Classes\\Wow6432Node\\CLSID\\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\\ShellEx\\IconHandler\" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Martin Prikryl\\WinSCP 2\" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Martin Prikryl\\WinSCP 2 Override\" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"$41","description_v2":["Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:876:168:WilStaging_02\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:876:64:WilError_01\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\MutexNPA_UnitVersioning_876\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\WinSCP\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\WinSCPDragExtMutex\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer\"","Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit\"","Process scp.exe created mutex with name \"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs\"","Process scp.exe created mutex with name \"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!0aefa8\"","Process scp.exe created mutex with name \"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!0a2538\"","Process scp.exe created mutex with name \"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!0af988\""],"description_v3":[{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:876:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:876:64:WilError_01\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\MutexNPA_UnitVersioning_876\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\WinSCP\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\WinSCPDragExtMutex\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!0aefa8\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!0a2538\""},{"type":"linebreak"},{"type":"text","value":"Process scp.exe created mutex with name \"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!0af988\""}],"origin":"Created Mutant","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-154","type":0,"relevance":0,"name":"File contains dynamic base/NX flags","description":"\"scp.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","description_v2":["\"scp.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT"],"description_v3":[{"type":"text","value":"\"scp.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-63","type":2,"relevance":3,"name":"Found E-Mail address in binary/memory","description":"Pattern match: \"anonymous@example.com\"\n Pattern match: \"aes128-gcm@openssh.com\"\n Pattern match: \"aes192-gcm@openssh.com\"\n Pattern match: \"aes256-gcm@openssh.com\"","description_v2":["Pattern match: \"anonymous@example.com\"","Pattern match: \"aes128-gcm@openssh.com\"","Pattern match: \"aes192-gcm@openssh.com\"","Pattern match: \"aes256-gcm@openssh.com\""],"description_v3":[{"type":"text","value":"Pattern match: \"anonymous@example.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"aes128-gcm@openssh.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"aes192-gcm@openssh.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"aes256-gcm@openssh.com\""}],"origin":"File/Memory","attck_id":"T1114","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1114","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-146","type":2,"relevance":1,"name":"Found named pipe like strings","description":"Found string - \\\\.\\PIPE\\WinSCPPuTTYPassword.%.8x.%.8x.%.4x","description_v2":["Found string - \\\\.\\PIPE\\WinSCPPuTTYPassword.%.8x.%.8x.%.4x"],"description_v3":[{"type":"text","value":"Found string - \\\\.\\PIPE\\WinSCPPuTTYPassword.%.8x.%.8x.%.4x"}],"origin":"File/Memory","attck_id":"T1559","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1559","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"memorydump-10","type":20,"relevance":1,"name":"Found registry location strings in memory","description":"$42","description_v2":["\"Software\\Wow6432`\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","\"Software\\Wow6432\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","\"oftware\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","\"Software\\Wow6432 \" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","\"sSoftware\\Wow6432 \" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","\"are\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\P}\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\AllFilesystemObjects\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\Directory\\DocObject\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp","\"Software\\Classes\\\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp","\"Software\\9bis.com\\KiTTY\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp","\"Software\\SimonTatham\\PuTTY\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\M!\" in Source: 00000000-00000876.00000001.160828.01999000.00000004.mdmp","\"Software\\Wow6432`\" in Source: 00000000-00000876.00000001.160828.04010000.00000004.mdmp","\"Software\\Wow6432\" in Source: 00000000-00000876.00000001.160828.04010000.00000004.mdmp","\"oftware\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\" in Source: 00000000-00000876.00000001.160828.04010000.00000004.mdmp","\"Software\\Wow6432 \" in Source: 00000000-00000876.00000001.160828.04010000.00000004.mdmp","\"sSoftware\\Wow6432 \" in Source: 00000000-00000876.00000001.160828.04010000.00000004.mdmp","\"Software\\Classes\\\" in Source: 00000000-00000876.00000001.160828.07490000.00000004.mdmp","\"Software\\9bis.com\\KiTTY\" in Source: 00000000-00000876.00000001.160828.07490000.00000004.mdmp","\"Software\\SimonTatham\\PuTTY\" in Source: 00000000-00000876.00000001.160828.07490000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\M!\" in Source: 00000000-00000876.00000002.162748.01999000.00000004.mdmp","\"Software\\Wow6432`\" in Source: 00000000-00000876.00000002.162748.04010000.00000004.mdmp","\"Software\\Wow6432\" in Source: 00000000-00000876.00000002.162748.04010000.00000004.mdmp","\"Software\\Wow6432 \" in Source: 00000000-00000876.00000002.162748.04010000.00000004.mdmp","\"sSoftware\\Wow6432 \" in Source: 00000000-00000876.00000002.162748.04010000.00000004.mdmp","\"Software\\Classes\\\" in Source: 00000000-00000876.00000002.162748.07490000.00000004.mdmp","\"Software\\9bis.com\\KiTTY\" in Source: 00000000-00000876.00000002.162748.07490000.00000004.mdmp","\"Software\\SimonTatham\\PuTTY\" in Source: 00000000-00000876.00000002.162748.07490000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\Wow6432Node\\CLSID\\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{3DFDF296-DBEC-4FB4-81D1-6A3438BCF4DE}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{24AD3AD4-A569-4530-98E1-AB02F9417AA8}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{F86FA3AB-70D2-4FC7-9C99-FCBF05467F3A}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{088E3905-0323-4B02-9826-5D99428E115F}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp","\"SOFTWARE\\MIT\\Kerberos\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp","\"Software\\SimonTatham\\PuTTY\\Jumplist\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp","\"Software\\SimonTatham\\PuTTY\\Sessions\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp","\"Software\\SimonTatham\\PuTTY\\SshHostCAs\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp","\"Software\\SimonTatham\\PuTTY\\SshHostKeys\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp","\"Software\\SimonTatham\\PuTTY\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp","\"Software\\Wow6432`\" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp","\"Software\\Wow6432\" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp","\"Software\\Wow6432 \" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp","\"sSoftware\\Wow6432 \" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp","\"stry\\Machine\\Software\\Classes\\CLSID\\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp","\"stry\\Machine\\Software\\Classes\\Wow6432Node\\CLSID\\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\\ShellEx\\IconHandler\" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp","\"Software\\Martin Prikryl\\WinSCP 2\" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp","\"Software\\9bis.com\\KiTTY\" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp","\"Software\\Martin Prikryl\\WinSCP 2 Override\" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp","\"Software\\SimonTatham\\PuTTY\" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\Wow6432Node\\CLSID\\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{3DFDF296-DBEC-4FB4-81D1-6A3438BCF4DE}\\ShellFolder\" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\ShellFolder\" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{24AD3AD4-A569-4530-98E1-AB02F9417AA8}\\ShellFolder\" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{F86FA3AB-70D2-4FC7-9C99-FCBF05467F3A}\\ShellFolder\" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{088E3905-0323-4B02-9826-5D99428E115F}\\ShellFolder\" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\"Software\\Wow6432`\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Wow6432\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"oftware\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Wow6432 \" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"sSoftware\\Wow6432 \" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"are\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\P}\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\AllFilesystemObjects\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\Directory\\DocObject\" in Source: 00000000-00000876.00000000.158908.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\9bis.com\\KiTTY\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\SimonTatham\\PuTTY\" in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\M!\" in Source: 00000000-00000876.00000001.160828.01999000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Wow6432`\" in Source: 00000000-00000876.00000001.160828.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Wow6432\" in Source: 00000000-00000876.00000001.160828.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"oftware\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\" in Source: 00000000-00000876.00000001.160828.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Wow6432 \" in Source: 00000000-00000876.00000001.160828.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"sSoftware\\Wow6432 \" in Source: 00000000-00000876.00000001.160828.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\\" in Source: 00000000-00000876.00000001.160828.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\9bis.com\\KiTTY\" in Source: 00000000-00000876.00000001.160828.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\SimonTatham\\PuTTY\" in Source: 00000000-00000876.00000001.160828.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\M!\" in Source: 00000000-00000876.00000002.162748.01999000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Wow6432`\" in Source: 00000000-00000876.00000002.162748.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Wow6432\" in Source: 00000000-00000876.00000002.162748.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Wow6432 \" in Source: 00000000-00000876.00000002.162748.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"sSoftware\\Wow6432 \" in Source: 00000000-00000876.00000002.162748.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\\" in Source: 00000000-00000876.00000002.162748.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\9bis.com\\KiTTY\" in Source: 00000000-00000876.00000002.162748.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\SimonTatham\\PuTTY\" in Source: 00000000-00000876.00000002.162748.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\Wow6432Node\\CLSID\\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{3DFDF296-DBEC-4FB4-81D1-6A3438BCF4DE}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{24AD3AD4-A569-4530-98E1-AB02F9417AA8}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{F86FA3AB-70D2-4FC7-9C99-FCBF05467F3A}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{088E3905-0323-4B02-9826-5D99428E115F}\\ShellFolder\" in Source: 00000000-00000876.00000002.162748.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\MIT\\Kerberos\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\SimonTatham\\PuTTY\\Jumplist\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\SimonTatham\\PuTTY\\Sessions\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\SimonTatham\\PuTTY\\SshHostCAs\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\SimonTatham\\PuTTY\\SshHostKeys\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\SimonTatham\\PuTTY\" in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Wow6432`\" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Wow6432\" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Wow6432 \" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"sSoftware\\Wow6432 \" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"stry\\Machine\\Software\\Classes\\CLSID\\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"stry\\Machine\\Software\\Classes\\Wow6432Node\\CLSID\\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\\ShellEx\\IconHandler\" in Source: 00000000-00000876.00000003.170180.04010000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Martin Prikryl\\WinSCP 2\" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\9bis.com\\KiTTY\" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Martin Prikryl\\WinSCP 2 Override\" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\SimonTatham\\PuTTY\" in Source: 00000000-00000876.00000003.170180.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\Wow6432Node\\CLSID\\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{3DFDF296-DBEC-4FB4-81D1-6A3438BCF4DE}\\ShellFolder\" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\\ShellFolder\" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{24AD3AD4-A569-4530-98E1-AB02F9417AA8}\\ShellFolder\" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{F86FA3AB-70D2-4FC7-9C99-FCBF05467F3A}\\ShellFolder\" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{088E3905-0323-4B02-9826-5D99428E115F}\\ShellFolder\" in Source: 00000000-00000876.00000003.170180.0C310000.00000004.mdmp"}],"origin":"Memory Dumps","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-7","type":6,"relevance":1,"name":"Loads modules at runtime","description":"$43","description_v2":["\"scp.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 74510000","\"scp.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 74510000","\"scp.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 74510000","\"scp.exe\" loaded module \"KERNEL32\" at base 73f80000","\"scp.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 725c0000","\"scp.exe\" loaded module \"KERNEL32.DLL\" at base 73f80000","\"scp.exe\" loaded module \"MSCTF.DLL\" at base 73e30000","\"scp.exe\" loaded module \"IMM32.DLL\" at base 76960000","\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 738c0000","\"scp.exe\" loaded module \"WTSAPI32.DLL\" at base 73a70000","\"scp.exe\" loaded module \"NTDLL.DLL\" at base 773f0000","\"scp.exe\" loaded module \"RPCRT4.DLL\" at base 74280000","\"scp.exe\" loaded module \"UXTHEME.DLL\" at base 738c0000","\"scp.exe\" loaded module \"SHCORE\" at base 770e0000","\"scp.exe\" loaded module \"USER32\" at base 74d30000","\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINDOWS.STORAGE.DLL\" at base 74760000","\"scp.exe\" loaded module \"OLEPRO32.DLL\" at base 725a0000","\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 72570000","\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\PROPSYS.DLL\" at base 73360000","\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\ADVAPI32.DLL\" at base 74fd0000","\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\SHELL32.DLL\" at base 4310000","\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WS2_32.DLL\" at base 769f0000","\"scp.exe\" loaded module \"SECURITY.DLL\" at base 7370000","\"scp.exe\" loaded module \"SSPICLI.DLL\" at base 73e10000","\"scp.exe\" loaded module \"%WINDIR%\\SYSWOW64\\MSV1_0.DLL\" at base 724b0000","\"scp.exe\" loaded module \"%WINDIR%\\SYSWOW64\\APPRESOLVER.DLL\" at base 72410000","\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 76990000","\"scp.exe\" loaded module \"SHCORE.DLL\" at base 770e0000","\"scp.exe\" loaded module \"%WINDIR%\\SYSWOW64\\MSXML6.DLL\" at base 72130000","\"scp.exe\" loaded module \"USER32.DLL\" at base 74d30000","\"scp.exe\" loaded module \"MSCMS.DLL\" at base 720a0000","\"scp.exe\" loaded module \"ICM32.DLL\" at base 72060000","\"scp.exe\" loaded module \"SHELL32\" at base 4310000","\"scp.exe\" loaded module \"COMCTL32.DLL\" at base 72760000","\"scp.exe\" loaded module \"COMCTL32\" at base 72760000","\"scp.exe\" loaded module \"GDI32.DLL\" at base 76930000","\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\DATAEXCHANGE.DLL\" at base 72010000","\"scp.exe\" loaded module \"OLE32.DLL\" at base 74050000","\"scp.exe\" loaded module \"DWMAPI.DLL\" at base 72e00000","\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\DWMAPI.DLL\" at base 72e00000","\"scp.exe\" loaded module \"CFGMGR32.DLL\" at base 75220000","\"scp.exe\" loaded module \"OLEAUT32.DLL\" at base 74390000","\"scp.exe\" loaded module \"EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL\" at base 74d30000","\"scp.exe\" loaded module \"EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL\" at base 74d30000","\"scp.exe\" loaded module \"API-MS-WIN-CORE-COM-L1-1-0.DLL\" at base 765a0000","\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSCTF.DLL\" at base 73e30000","\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\OLE32.DLL\" at base 74050000","\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\EXPLORERFRAME.DLL\" at base 71270000","\"scp.exe\" loaded module \"%WINDIR%\\SYSWOW64\\THUMBCACHE.DLL\" at base 71220000","\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINDOWSCODECS.DLL\" at base 72f20000","\"scp.exe\" loaded module \"%WINDIR%\\SYSWOW64\\ONECOREUAPCOMMONPROXYSTUB.DLL\" at base 70e60000"],"description_v3":[{"type":"text","value":"\"scp.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 74510000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 74510000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 74510000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"KERNEL32\" at base 73f80000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 725c0000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"KERNEL32.DLL\" at base 73f80000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"MSCTF.DLL\" at base 73e30000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"IMM32.DLL\" at base 76960000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 738c0000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"WTSAPI32.DLL\" at base 73a70000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"NTDLL.DLL\" at base 773f0000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"RPCRT4.DLL\" at base 74280000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"UXTHEME.DLL\" at base 738c0000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"SHCORE\" at base 770e0000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"USER32\" at base 74d30000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINDOWS.STORAGE.DLL\" at base 74760000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"OLEPRO32.DLL\" at base 725a0000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 72570000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\PROPSYS.DLL\" at base 73360000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\ADVAPI32.DLL\" at base 74fd0000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\SHELL32.DLL\" at base 4310000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WS2_32.DLL\" at base 769f0000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"SECURITY.DLL\" at base 7370000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"SSPICLI.DLL\" at base 73e10000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSWOW64\\MSV1_0.DLL\" at base 724b0000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSWOW64\\APPRESOLVER.DLL\" at base 72410000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 76990000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"SHCORE.DLL\" at base 770e0000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSWOW64\\MSXML6.DLL\" at base 72130000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"USER32.DLL\" at base 74d30000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"MSCMS.DLL\" at base 720a0000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"ICM32.DLL\" at base 72060000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"SHELL32\" at base 4310000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"COMCTL32.DLL\" at base 72760000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"COMCTL32\" at base 72760000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"GDI32.DLL\" at base 76930000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\DATAEXCHANGE.DLL\" at base 72010000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"OLE32.DLL\" at base 74050000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"DWMAPI.DLL\" at base 72e00000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\DWMAPI.DLL\" at base 72e00000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"CFGMGR32.DLL\" at base 75220000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"OLEAUT32.DLL\" at base 74390000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL\" at base 74d30000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL\" at base 74d30000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"API-MS-WIN-CORE-COM-L1-1-0.DLL\" at base 765a0000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSCTF.DLL\" at base 73e30000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\OLE32.DLL\" at base 74050000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\EXPLORERFRAME.DLL\" at base 71270000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSWOW64\\THUMBCACHE.DLL\" at base 71220000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINDOWSCODECS.DLL\" at base 72f20000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SYSWOW64\\ONECOREUAPCOMMONPROXYSTUB.DLL\" at base 70e60000"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-9","type":10,"relevance":0,"name":"Loads the Bcrypt module DLL","description":"\"scp.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76990000\n \"scp.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73190000","description_v2":["\"scp.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76990000","\"scp.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73190000"],"description_v3":[{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76990000"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73190000"}],"origin":"Loaded Module","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-10","type":10,"relevance":0,"name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"scp.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74280000","description_v2":["\"scp.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74280000"],"description_v3":[{"type":"text","value":"\"scp.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74280000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-64","type":6,"relevance":10,"name":"Logged script engine calls","description":"\"scp.exe\" called \"Msxml2.DOMDocument.6.0.CreateObject\" ... ","description_v2":["\"scp.exe\" called \"Msxml2.DOMDocument.6.0.CreateObject\" ..."],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"Msxml2.DOMDocument.6.0.CreateObject\" ..."}],"origin":"API Call","attck_id":"T1059","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-157","type":0,"relevance":0,"name":"Matched Compiler/Packer signature (DIE)","description":"\"scp.exe\" was detected as \"Borland Delphi\" and name: \"Compiler\"\n \"scp.exe\" was detected as \"Turbo Linker\" and name: \"Linker\"","description_v2":["\"scp.exe\" was detected as \"Borland Delphi\" and name: \"Compiler\"","\"scp.exe\" was detected as \"Turbo Linker\" and name: \"Linker\""],"description_v3":[{"type":"text","value":"\"scp.exe\" was detected as \"Borland Delphi\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" was detected as \"Turbo Linker\" and name: \"Linker\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-187","type":2,"relevance":1,"name":"Observed Powershell command strings","description":"Found string \"New-Object\" (Indicator: \"New-Object\"; File: \"scp.exe\")","description_v2":["Found string \"New-Object\" (Indicator: \"New-Object\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found string \"New-Object\" (Indicator: \"New-Object\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1059.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-72","type":3,"relevance":3,"name":"Overview of unique CLSIDs touched in registry","description":"$44","description_v2":["\"scp.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","\"scp.exe\" touched \"Shell File System Folder\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\INPROCSERVER32\")","\"scp.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")","\"scp.exe\" touched \"Custom Destination List\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\\TREATAS\")","\"scp.exe\" touched \"A collection of IUnknown objects that can be enumerated\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\\TREATAS\")","\"scp.exe\" touched \"XML DOM Document 6.0\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{88D96A05-F192-11D4-A65F-0040963251E5}\\TREATAS\")","\"scp.exe\" touched \"Task Bar Communication\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")","\"scp.exe\" touched \"Local Icon Cache\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{2155FEE3-2419-4373-B102-6843707EB41F}\\TREATAS\")","\"scp.exe\" touched \"Known Folder Manager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\\TREATAS\")","\"scp.exe\" touched \"Microsoft Access Application\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{73A4C9C1-D68D-11D0-98BF-00A0C90DC8D9}\\IMPLEMENTED CATEGORIES\\{00021490-0000-0000-C000-000000000046}\")","\"scp.exe\" touched \"UsersFiles\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\SHELLFOLDER\")","\"scp.exe\" touched \"delegate folder that appears in Users Files Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\INSTANCE\")","\"scp.exe\" touched \"Start Menu Cache\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\\TREATAS\")"],"description_v3":[{"type":"text","value":"\"scp.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched \"Shell File System Folder\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\INPROCSERVER32\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched \"Custom Destination List\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched \"A collection of IUnknown objects that can be enumerated\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched \"XML DOM Document 6.0\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{88D96A05-F192-11D4-A65F-0040963251E5}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched \"Task Bar Communication\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched \"Local Icon Cache\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{2155FEE3-2419-4373-B102-6843707EB41F}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched \"Known Folder Manager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched \"Microsoft Access Application\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{73A4C9C1-D68D-11D0-98BF-00A0C90DC8D9}\\IMPLEMENTED CATEGORIES\\{00021490-0000-0000-C000-000000000046}\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched \"UsersFiles\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched \"delegate folder that appears in Users Files Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\INSTANCE\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched \"Start Menu Cache\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\\TREATAS\")"}],"origin":"Registry Access","attck_id":"T1546.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-80","type":0,"relevance":1,"name":"PE file contains executable sections","description":"\"scp.exe\" has an executable section named \".text\"","description_v2":["\"scp.exe\" has an executable section named \".text\""],"description_v3":[{"type":"text","value":"\"scp.exe\" has an executable section named \".text\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-145","type":0,"relevance":1,"name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"KERNEL32.DLL\" : \"281\" [Source: scp.exe]\n Observed large number of imported APIs from \"USER32.DLL\" : \"244\" [Source: scp.exe]","description_v2":["Observed large number of imported APIs from \"KERNEL32.DLL\" : \"281\" [Source: scp.exe]","Observed large number of imported APIs from \"USER32.DLL\" : \"244\" [Source: scp.exe]"],"description_v3":[{"type":"text","value":"Observed large number of imported APIs from \"KERNEL32.DLL\" : \"281\" [Source: scp.exe]"},{"type":"linebreak"},{"type":"text","value":"Observed large number of imported APIs from \"USER32.DLL\" : \"244\" [Source: scp.exe]"}],"origin":"Static Parser","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-95","type":0,"relevance":0,"name":"PE file contains writable sections","description":"\"scp.exe\" has an writable section named \".data\"\n \"scp.exe\" has an writable section named \".tls\"\n \"scp.exe\" has an writable section named \".didata\"","description_v2":["\"scp.exe\" has an writable section named \".data\"","\"scp.exe\" has an writable section named \".tls\"","\"scp.exe\" has an writable section named \".didata\""],"description_v3":[{"type":"text","value":"\"scp.exe\" has an writable section named \".data\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has an writable section named \".tls\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has an writable section named \".didata\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-96","type":0,"relevance":0,"name":"PE file entrypoint instructions","description":"\"scp.exe\" file has an entrypoint instructions - \"jmp\t0x402e7e,bound\tdi, dword ptr [edx],inc\tebx,sub\tebp, dword ptr [ebx],dec\teax,dec\tedi,dec\tedi,dec\tebx,nop\t,jmp\t0x1702f2a,les\tebp, ptr [edi],inc\teax,add\tbyte ptr [ecx + 0x13000a3], ah,shl\teax, 2,mov\tdword ptr [0x13000a7], eax,push\tedx,push\t0,call\t0x12fe582,mov\tedx, eax,mov\tdword ptr [0x13000ab], edx,call\t0x12e5fd4,pop\tedx,call\t0x12e5b14,call\t0x12e6134,push\t0,call\t0x12f81dc,pop\tecx,push\t0x130004c,push\t0,call\t0x12fe582,mov\tdword ptr [0x13000ab], eax,push\t0,jmp\t0x12f60d8,\"","description_v2":["\"scp.exe\" file has an entrypoint instructions - \"jmp\t0x402e7e,bound\tdi, dword ptr [edx],inc\tebx,sub\tebp, dword ptr [ebx],dec\teax,dec\tedi,dec\tedi,dec\tebx,nop\t,jmp\t0x1702f2a,les\tebp, ptr [edi],inc\teax,add\tbyte ptr [ecx + 0x13000a3], ah,shl\teax, 2,mov\tdword ptr [0x13000a7], eax,push\tedx,push\t0,call\t0x12fe582,mov\tedx, eax,mov\tdword ptr [0x13000ab], edx,call\t0x12e5fd4,pop\tedx,call\t0x12e5b14,call\t0x12e6134,push\t0,call\t0x12f81dc,pop\tecx,push\t0x130004c,push\t0,call\t0x12fe582,mov\tdword ptr [0x13000ab], eax,push\t0,jmp\t0x12f60d8,\""],"description_v3":[{"type":"text","value":"\"scp.exe\" file has an entrypoint instructions - \"jmp\t0x402e7e,bound\tdi, dword ptr [edx],inc\tebx,sub\tebp, dword ptr [ebx],dec\teax,dec\tedi,dec\tedi,dec\tebx,nop\t,jmp\t0x1702f2a,les\tebp, ptr [edi],inc\teax,add\tbyte ptr [ecx + 0x13000a3], ah,shl\teax, 2,mov\tdword ptr [0x13000a7], eax,push\tedx,push\t0,call\t0x12fe582,mov\tedx, eax,mov\tdword ptr [0x13000ab], edx,call\t0x12e5fd4,pop\tedx,call\t0x12e5b14,call\t0x12e6134,push\t0,call\t0x12f81dc,pop\tecx,push\t0x130004c,push\t0,call\t0x12fe582,mov\tdword ptr [0x13000ab], eax,push\t0,jmp\t0x12f60d8,\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-125","type":0,"relevance":3,"name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0xefec00\" greater than 0x100000\n Raw size of \".data\" is \"0x278600\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x48b400\" greater than 0x100000","description_v2":["Raw size of \".text\" is \"0xefec00\" greater than 0x100000","Raw size of \".data\" is \"0x278600\" greater than 0x100000","Raw size of \".rsrc\" is \"0x48b400\" greater than 0x100000"],"description_v3":[{"type":"text","value":"Raw size of \".text\" is \"0xefec00\" greater than 0x100000"},{"type":"linebreak"},{"type":"text","value":"Raw size of \".data\" is \"0x278600\" greater than 0x100000"},{"type":"linebreak"},{"type":"text","value":"Raw size of \".rsrc\" is \"0x48b400\" greater than 0x100000"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-124","type":0,"relevance":3,"name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0xeff000\" greater than 0x100000\n Virtual size of \".data\" is \"0x30f000\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x48c000\" greater than 0x100000","description_v2":["Virtual size of \".text\" is \"0xeff000\" greater than 0x100000","Virtual size of \".data\" is \"0x30f000\" greater than 0x100000","Virtual size of \".rsrc\" is \"0x48c000\" greater than 0x100000"],"description_v3":[{"type":"text","value":"Virtual size of \".text\" is \"0xeff000\" greater than 0x100000"},{"type":"linebreak"},{"type":"text","value":"Virtual size of \".data\" is \"0x30f000\" greater than 0x100000"},{"type":"linebreak"},{"type":"text","value":"Virtual size of \".rsrc\" is \"0x48c000\" greater than 0x100000"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"scp.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"scp.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")","description_v2":["\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"scp.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")","\"scp.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")"],"description_v3":[{"type":"text","value":"\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-625","type":2,"relevance":1,"name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00000876-00000C2B-1453198320]\n Observed system executable string:\"%WINDIR%\\system32\\shell32.dll\" [Source: 00000000-00000876-00000C2B-1453236408]\n Observed system executable string:\"%WINDIR%\\system32\\ws2_32.dll\" [Source: 00000000-00000876-00000C2B-1453280733]","description_v2":["Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00000876-00000C2B-1453198320]","Observed system executable string:\"%WINDIR%\\system32\\shell32.dll\" [Source: 00000000-00000876-00000C2B-1453236408]","Observed system executable string:\"%WINDIR%\\system32\\ws2_32.dll\" [Source: 00000000-00000876-00000C2B-1453280733]"],"description_v3":[{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00000876-00000C2B-1453198320]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\shell32.dll\" [Source: 00000000-00000876-00000C2B-1453236408]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\ws2_32.dll\" [Source: 00000000-00000876-00000C2B-1453280733]"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"summary-6","type":15,"relevance":10,"name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","description_v2":["The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate"],"description_v3":[{"type":"text","value":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate"}],"origin":"Indicator Combinations","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-70","type":6,"relevance":10,"name":"Scanning for window names","description":"\"scp.exe\" searching for class \"ApplicationManager_DesktopShellWindow\"\n \"scp.exe\" searching for class \"Shell_TrayWnd\"\n \"scp.exe\" searching for class \"MS_WINHELP\"","description_v2":["\"scp.exe\" searching for class \"ApplicationManager_DesktopShellWindow\"","\"scp.exe\" searching for class \"Shell_TrayWnd\"","\"scp.exe\" searching for class \"MS_WINHELP\""],"description_v3":[{"type":"text","value":"\"scp.exe\" searching for class \"ApplicationManager_DesktopShellWindow\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" searching for class \"Shell_TrayWnd\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" searching for class \"MS_WINHELP\""}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-71","type":6,"relevance":10,"name":"Sets a windows hook","description":"\"scp.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 492","description_v2":["\"scp.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 492"],"description_v3":[{"type":"text","value":"\"scp.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 492"}],"origin":"API Call","attck_id":"T1056.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"certificate-0","type":17,"relevance":10,"name":"The input sample is signed with a certificate","description":"$45","description_v2":["The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information)","The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information)","The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 07:89:4D:00:FC:19:4A:17:DB:27:3A:EB:5C:F8:FA:CE:F1:44:23:A4; see report for more information)","The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O=\"DigiCert","Inc.\", C=US\" (SHA1: DD:62:30:AC:86:0A:2D:30:6B:DA:38:B1:68:79:52:30:07:FB:41:7E; see report for more information)","The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O=\"DigiCert","Inc.\", C=US\" (SHA1: 0D:EE:8F:52:D6:B8:D8:C4:B2:C9:57:3F:42:99:FD:97:D7:07:BA:B7; see report for more information)"],"description_v3":[{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 07:89:4D:00:FC:19:4A:17:DB:27:3A:EB:5C:F8:FA:CE:F1:44:23:A4; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O=\"DigiCert"},{"type":"linebreak"},{"type":"text","value":"Inc.\", C=US\" (SHA1: DD:62:30:AC:86:0A:2D:30:6B:DA:38:B1:68:79:52:30:07:FB:41:7E; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O=\"DigiCert"},{"type":"linebreak"},{"type":"text","value":"Inc.\", C=US\" (SHA1: 0D:EE:8F:52:D6:B8:D8:C4:B2:C9:57:3F:42:99:FD:97:D7:07:BA:B7; see report for more information)"}],"origin":"Certificate Data","attck_id":"T1553.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"certificate-2","type":17,"relevance":10,"name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","description_v2":["The entire certificate chain of the input sample was validated successfully."],"description_v3":[{"type":"text","value":"The entire certificate chain of the input sample was validated successfully."}],"origin":"Certificate Data","attck_id":"T1553.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-153","type":0,"relevance":0,"name":"Uses 32 bit executable PE","description":"\"scp.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","description_v2":["\"scp.exe\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE"],"description_v3":[{"type":"text","value":"\"scp.exe\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-938","type":2,"relevance":1,"name":"Able to establish persistence using Exchange transport agent (.NET)","description":"$46","description_v2":["Found string \"TSOAPAttachment\" (Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")","Found string \"ystem.IsAttachment\" (Source: \"00000000-00000876.00000001.160828.09130000.00000002.mdmp\")","Found string \"ystem.Message.AttachmentContents\" (Source: \"00000000-00000876.00000001.160828.09130000.00000002.mdmp\")","Found string \"ystem.Message.AttachmentNames\" (Source: \"00000000-00000876.00000001.160828.09130000.00000002.mdmp\")","Found string \"ystem.Message.HasAttachments\" (Source: \"00000000-00000876.00000001.160828.09130000.00000002.mdmp\")","Found string \"System.IsAttachment\" (Source: \"00000000-00000876.00000001.160828.09190000.00000002.mdmp\")","Found string \"System.Message.AttachmentContents\" (Source: \"00000000-00000876.00000001.160828.09190000.00000002.mdmp\")","Found string \"System.Message.AttachmentNames\" (Source: \"00000000-00000876.00000001.160828.09190000.00000002.mdmp\")","Found string \"System.Message.HasAttachments\" (Source: \"00000000-00000876.00000001.160828.09190000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"TSOAPAttachment\" (Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ystem.IsAttachment\" (Source: \"00000000-00000876.00000001.160828.09130000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ystem.Message.AttachmentContents\" (Source: \"00000000-00000876.00000001.160828.09130000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ystem.Message.AttachmentNames\" (Source: \"00000000-00000876.00000001.160828.09130000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ystem.Message.HasAttachments\" (Source: \"00000000-00000876.00000001.160828.09130000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.IsAttachment\" (Source: \"00000000-00000876.00000001.160828.09190000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Message.AttachmentContents\" (Source: \"00000000-00000876.00000001.160828.09190000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Message.AttachmentNames\" (Source: \"00000000-00000876.00000001.160828.09190000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Message.HasAttachments\" (Source: \"00000000-00000876.00000001.160828.09190000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1505.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1505/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-310","type":2,"relevance":1,"name":"Contains ability to load modules (API string)","description":"$47","description_v2":["Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"scp.exe\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"scp.exe\")","Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"scp.exe\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"scp.exe\")","Found reference to API \"hrdir_b.c: LoadLibrary != mmdll borlndmm failed\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000000.158908.01303000.00000004.mdmp, 00000000-00000876.00000002.162748.01303000.00000004.mdmp, 00000000-00000876.00000003.170180.01303000.00000004.mdmp\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hrdir_b.c: LoadLibrary != mmdll borlndmm failed\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000000.158908.01303000.00000004.mdmp, 00000000-00000876.00000002.162748.01303000.00000004.mdmp, 00000000-00000876.00000003.170180.01303000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-543","type":2,"relevance":1,"name":"Contains ability to register device notification handler (API string)","description":"Found reference to API \"RegisterDeviceNotificationW\" (Indicator: \"RegisterDeviceNotification\"; File: \"scp.exe\")\n Found reference to API \"RegisterDeviceNotificationW\" (Indicator: \"RegisterDeviceNotification\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"RegisterDeviceNotificationW\" (Indicator: \"RegisterDeviceNotification\"; File: \"scp.exe\")","Found reference to API \"RegisterDeviceNotificationW\" (Indicator: \"RegisterDeviceNotification\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegisterDeviceNotificationW\" (Indicator: \"RegisterDeviceNotification\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegisterDeviceNotificationW\" (Indicator: \"RegisterDeviceNotification\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1098.005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1098/005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-264","type":6,"relevance":3,"name":"Creates a thread in a self process","description":"\"scp.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","description_v2":["\"scp.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"],"description_v3":[{"type":"text","value":"\"scp.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"}],"origin":"API Call","attck_id":"T1055.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"binary-0","type":8,"relevance":3,"name":"Dropped files","description":"\"scp.ini\" has type \"ASCII text with very long lines (632) with CRLF line terminators\"- Location: [C:\\scp.ini]- [targetUID: 00000000-00000876]\n \"winscp.rnd\" has type \"data\"- Location: [%APPDATA%\\winscp.rnd]- [targetUID: 00000000-00000876]","description_v2":["\"scp.ini\" has type \"ASCII text with very long lines (632) with CRLF line terminators\"- Location: [C:\\scp.ini]- [targetUID: 00000000-00000876]","\"winscp.rnd\" has type \"data\"- Location: [%APPDATA%\\winscp.rnd]- [targetUID: 00000000-00000876]"],"description_v3":[{"type":"text","value":"\"scp.ini\" has type \"ASCII text with very long lines (632) with CRLF line terminators\"- Location: [C:\\scp.ini]- [targetUID: 00000000-00000876]"},{"type":"linebreak"},{"type":"text","value":"\"winscp.rnd\" has type \"data\"- Location: [%APPDATA%\\winscp.rnd]- [targetUID: 00000000-00000876]"}],"origin":"Binary File","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-177","type":3,"relevance":1,"name":"Opens registry keys","description":"$48","description_v2":["\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"\"; Value: \"\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"\"; Value: \"\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"\"; Value: \"\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"\"; Value: \"\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\"; Key: \"\"; Value: \"\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"\"; Value: \"\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\PENDINGDELETE\"; Key: \"\"; Value: \"\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\MUI\\SETTINGS\"; Key: \"\"; Value: \"\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\\MACHINELANGUAGECONFIGURATION\"; Key: \"\"; Value: \"\")","\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\SETTINGS\\LANGUAGECONFIGURATION\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\PENDINGDELETE\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\MUI\\SETTINGS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\\MACHINELANGUAGECONFIGURATION\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\SETTINGS\\LANGUAGECONFIGURATION\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-235","type":6,"relevance":1,"name":"Queries basic information of the specified process","description":"\"scp.exe\" queries basic process information of the \"C:\\scp.exe\" (UID: 876)","description_v2":["\"scp.exe\" queries basic process information of the \"C:\\scp.exe\" (UID: 876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" queries basic process information of the \"C:\\scp.exe\" (UID: 876)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-172","type":3,"relevance":1,"name":"Queries registry keys","description":"$49","description_v2":["\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"BIAS\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"STANDARDNAME\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"STANDARDBIAS\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"STANDARDSTART\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"DAYLIGHTNAME\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"DAYLIGHTBIAS\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"DAYLIGHTSTART\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"TIMEZONEKEYNAME\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"DYNAMICDAYLIGHTTIMEDISABLED\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"FIRSTENTRY\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"LASTENTRY\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"2026\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"2007\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"ACTIVETIMEBIAS\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"BIAS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"STANDARDNAME\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"STANDARDBIAS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"STANDARDSTART\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"DAYLIGHTNAME\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"DAYLIGHTBIAS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"DAYLIGHTSTART\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"TIMEZONEKEYNAME\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"DYNAMICDAYLIGHTTIMEDISABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"FIRSTENTRY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"LASTENTRY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"2026\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"2007\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"ACTIVETIMEBIAS\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-243","type":6,"relevance":1,"name":"Reads files","description":"\"scp.exe\" reads file \"c:\\program files (x86)\\desktop.ini\"\n \"scp.exe\" reads file \"c:\\scp.ini\"\n \"scp.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\iconcache.db\"","description_v2":["\"scp.exe\" reads file \"c:\\program files (x86)\\desktop.ini\"","\"scp.exe\" reads file \"c:\\scp.ini\"","\"scp.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\iconcache.db\""],"description_v3":[{"type":"text","value":"\"scp.exe\" reads file \"%PROGRAMFILES%\\(x86)\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"c:\\scp.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"C:\\Users\\%USERNAME%\\appdata\\local\\iconcache.db\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-530","type":2,"relevance":1,"name":"References PATH environment registry keys","description":"Found string \"SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\"; File: \"scp.exe\")","description_v2":["Found string \"SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found string \"SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1574.007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1574/007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"summary-29","type":15,"relevance":1,"name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Contains a Wine emulator-related string\n Matched sigs: Able to detect virtual machine (string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","description_v2":["The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity","Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)","Matched sigs: Able to identify sandbox environment running process","Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","Matched sigs: Able to identify virtual environment by using user activity (API string)","Matched sigs: Contains ability to detect sandbox (imports API)","Matched sigs: Contains a Wine emulator-related string","Matched sigs: Able to detect virtual machine (string)","Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)"],"description_v3":[{"type":"text","value":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to identify sandbox environment running process"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to identify virtual environment by using user activity (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to detect sandbox (imports API)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains a Wine emulator-related string"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to detect virtual machine (string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)"}],"origin":"Indicator Combinations","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-263","type":6,"relevance":1,"name":"Touches files","description":"\"scp.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"scp.exe\" trying to touch file \"C:\\SCP.EXE.LOCAL\"\n \"scp.exe\" trying to touch file \"C:\\OLEACC.DLL\"\n \"scp.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\oleacc.dll\"\n \"scp.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"scp.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"","description_v2":["\"scp.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"","\"scp.exe\" trying to touch file \"C:\\SCP.EXE.LOCAL\"","\"scp.exe\" trying to touch file \"C:\\OLEACC.DLL\"","\"scp.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\oleacc.dll\"","\"scp.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"","\"scp.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\""],"description_v3":[{"type":"text","value":"\"scp.exe\" trying to touch file \"%WINDIR%\\System32\\WOW64LOG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to touch file \"C:\\SCP.EXE.LOCAL\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to touch file \"C:\\OLEACC.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\oleacc.dll\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-55","type":6,"relevance":7,"name":"Touches files in the Windows directory","description":"\"scp.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"scp.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"scp.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp\"\n \"scp.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Explorer\"\n \"scp.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"scp.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"scp.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp\"","description_v2":["\"scp.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"","\"scp.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"","\"scp.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp\"","\"scp.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Explorer\"","\"scp.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","\"scp.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\"","\"scp.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp\""],"description_v3":[{"type":"text","value":"\"scp.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Explorer\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-126","type":6,"relevance":3,"name":"Tries to access non-existent files (executable)","description":"$4a","description_v2":["\"scp.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"","\"scp.exe\" trying to access non-existent file \"C:\\OLEACC.DLL\"","\"scp.exe\" trying to access non-existent file \"C:\\OLEACCRC.DLL\"","\"scp.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"","\"scp.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"","\"scp.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RPCSS.DLL\"","\"scp.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\"","\"scp.exe\" trying to access non-existent file \"C:\\DWMAPI.DLL\"","\"scp.exe\" trying to access non-existent file \"C:\\dwmapi.dll\"","\"scp.exe\" trying to access non-existent file \"C:\\WTSAPI32.DLL\"","\"scp.exe\" trying to access non-existent file \"C:\\WINSTA.DLL\"","\"scp.exe\" trying to access non-existent file \"C:\\WINSTA.dll\"","\"scp.exe\" trying to access non-existent file \"C:\\DOTNET.EXE\"","\"scp.exe\" trying to access non-existent file \"C:\\dotnet.exe\"","\"scp.exe\" trying to access non-existent file \"C:\\ProgramData\\Oracle\\Java\\javapath_target_114250\\DOTNET.EXE\"","\"scp.exe\" trying to access non-existent file \"C:\\ProgramData\\Oracle\\Java\\javapath\\dotnet.exe\"","\"scp.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\DOTNET.EXE\"","\"scp.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\dotnet.exe\"","\"scp.exe\" trying to access non-existent file \"C:\\Windows\\DOTNET.EXE\"","\"scp.exe\" trying to access non-existent file \"C:\\WINDOWS\\dotnet.exe\"","\"scp.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\wbem\\DOTNET.EXE\"","\"scp.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\Wbem\\dotnet.exe\""],"description_v3":[{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\OLEACC.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\OLEACCRC.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RPCSS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\DWMAPI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\dwmapi.dll\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\WTSAPI32.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\WINSTA.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\WINSTA.dll\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\DOTNET.EXE\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\dotnet.exe\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath_target_114250\\DOTNET.EXE\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\ProgramData\\Oracle\\Java\\javapath\\dotnet.exe\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\DOTNET.EXE\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\dotnet.exe\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\Windows\\DOTNET.EXE\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\WINDOWS\\dotnet.exe\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\wbem\\DOTNET.EXE\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\Wbem\\dotnet.exe\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-161","type":6,"relevance":3,"name":"Tries to access non-existent files (non-executable)","description":"$4b","description_v2":["\"scp.exe\" trying to access non-existent file \"C:\\SCP.EXE.LOCAL\"","\"scp.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\WINSCP.RND\"","\"scp.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\winscp.rnd\"","\"scp.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\PUTTY.RND\"","\"scp.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\PUTTY.RND\"","\"scp.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\PUTTY.RND\"","\"scp.exe\" trying to access non-existent file \"C:\\Windows\\PUTTY.RND\"","\"scp.exe\" trying to access non-existent file \"C:\\SCP.INI\"","\"scp.exe\" trying to access non-existent file \"C:\\scp.ini\"","\"scp.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\SCP.INI\"","\"scp.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\scp.ini\"","\"scp.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\VirtualStore\\SCP.INI\"","\"scp.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\VirtualStore\\scp.ini\""],"description_v3":[{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\SCP.EXE.LOCAL\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\WINSCP.RND\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\winscp.rnd\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"%LOCALAPPDATA%\\PUTTY.RND\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\PUTTY.RND\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\PUTTY.RND\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\Windows\\PUTTY.RND\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\SCP.INI\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\scp.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\SCP.INI\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\scp.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\VirtualStore\\SCP.INI\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\VirtualStore\\scp.ini\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-242","type":6,"relevance":1,"name":"Writes files","description":"\"scp.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\winscp.rnd\"\n \"scp.exe\" writes file \"c:\\scp.ini\"\n \"scp.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\l8lshboedlam9it78etl.temp\"\n \"scp.exe\" writes file \"%appdata%\\winscp.rnd\"\n \"scp.exe\" writes file \"%appdata%\\microsoft\\windows\\recent\\customdestinations\\l8lshboedlam9it78etl.temp\"","description_v2":["\"scp.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\winscp.rnd\"","\"scp.exe\" writes file \"c:\\scp.ini\"","\"scp.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\l8lshboedlam9it78etl.temp\"","\"scp.exe\" writes file \"%appdata%\\winscp.rnd\"","\"scp.exe\" writes file \"%appdata%\\microsoft\\windows\\recent\\customdestinations\\l8lshboedlam9it78etl.temp\""],"description_v3":[{"type":"text","value":"\"scp.exe\" writes file \"%APPDATA%\\winscp.rnd\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" writes file \"c:\\scp.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" writes file \"C:\\Users\\%USERNAME%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\l8lshboedlam9it78etl.temp\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" writes file \"%appdata%\\winscp.rnd\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" writes file \"%appdata%\\microsoft\\windows\\recent\\customdestinations\\l8lshboedlam9it78etl.temp\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-923","type":2,"relevance":1,"name":"Able to access Windows networking-related API (String)","description":"$4c","description_v2":["Found reference to API \"WNetCloseEnum\" (Indicator: \"WNetCloseEnum\"; File: \"scp.exe\")","Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"scp.exe\")","Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResource\"; File: \"scp.exe\")","Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"scp.exe\")","Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; File: \"scp.exe\")","Found reference to API \"WNetCloseEnum\" (Indicator: \"WNetCloseEnum\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WNetCloseEnum\" (Indicator: \"WNetCloseEnum\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResource\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetCloseEnum\" (Indicator: \"WNetCloseEnum\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1135","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1135","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-879","type":2,"relevance":1,"name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"scp.exe\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")","description_v2":["Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"scp.exe\")","Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1205.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1205/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-228","type":2,"relevance":1,"name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"scp.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"scp.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")","description_v2":["Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"scp.exe\")","Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"scp.exe\")","Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1095","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1095","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-601","type":2,"relevance":1,"name":"Contains ability to communicate with network (API string)","description":"$4d","description_v2":["Found reference to API \"WinHttpSendRequest\" (Indicator: \"HttpSendRequest\"; File: \"scp.exe\")","Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; File: \"scp.exe\")","Found reference to API \"WinHttpReadData\" (Indicator: \"WinHttpReadData\"; File: \"scp.exe\")","Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; File: \"scp.exe\")","Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; File: \"scp.exe\")","Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"scp.exe\")","Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; File: \"scp.exe\")","Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; File: \"scp.exe\")","Found reference to API \"WinHttpQueryHeaders\" (Indicator: \"WinHttpQueryHeaders\"; File: \"scp.exe\")","Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"scp.exe\")","Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"scp.exe\")","Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WinHttpQueryHeaders\" (Indicator: \"WinHttpQueryHeaders\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WinHttpReadData\" (Indicator: \"WinHttpReadData\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WinHttpSendRequest\" (Indicator: \"HttpSendRequest\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WinHttpSendRequest\" (Indicator: \"HttpSendRequest\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpReadData\" (Indicator: \"WinHttpReadData\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpQueryHeaders\" (Indicator: \"WinHttpQueryHeaders\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpQueryHeaders\" (Indicator: \"WinHttpQueryHeaders\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpReadData\" (Indicator: \"WinHttpReadData\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpSendRequest\" (Indicator: \"HttpSendRequest\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-537","type":2,"relevance":1,"name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"scp.exe\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"scp.exe\")","Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-210","type":2,"relevance":1,"name":"Contains ability to create/connect to a named pipe (API string)","description":"$4e","description_v2":["Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"scp.exe\")","Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"scp.exe\")","Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"scp.exe\")","Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"scp.exe\")","Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetNamedPipeClientProcessId\" (Indicator: \"GetNamedPipe\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetNamedPipeClientProcessId\" (Indicator: \"GetNamedPipe\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1559","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1559","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-257","type":2,"relevance":1,"name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"scp.exe\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; File: \"scp.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"scp.exe\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"scp.exe\")","Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; File: \"scp.exe\")","Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"scp.exe\")","Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1049","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1049","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-419","type":2,"relevance":1,"name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"scp.exe\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")","description_v2":["Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"scp.exe\")","Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1571","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1571","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-113","type":2,"relevance":1,"name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"scp.exe\")","description_v2":["Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1135","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1135","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-190","type":2,"relevance":3,"name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; File: \"scp.exe\")\n Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; File: \"scp.exe\")","Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1135","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1135","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-577","type":2,"relevance":1,"name":"Contains ability to transfer files using SCP","description":"Observed string: \"WinSCP: SFTP, FTP, WebDAV, S3 and SCP client\" (Indicator: \" scp \") in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp\n 00000000-00000876.00000001.160828.07490000.00000004.mdmp\n 00000000-00000876.00000002.162748.07490000.00000004.mdmp\n 00000000-00000876.00000003.170180.07490000.00000004.mdmp","description_v2":["Observed string: \"WinSCP: SFTP, FTP, WebDAV, S3 and SCP client\" (Indicator: \" scp \") in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp","00000000-00000876.00000001.160828.07490000.00000004.mdmp","00000000-00000876.00000002.162748.07490000.00000004.mdmp","00000000-00000876.00000003.170180.07490000.00000004.mdmp"],"description_v3":[{"type":"text","value":"Observed string: \"WinSCP: SFTP, FTP, WebDAV, S3 and SCP client\" (Indicator: \" scp \") in Source: 00000000-00000876.00000000.158908.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000001.160828.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000002.162748.07490000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00000876.00000003.170180.07490000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-511","type":2,"relevance":1,"name":"Contains ability to upload file/data","description":"Found string \"Content-Disposition: form-data; name=\"\"; File: \"scp.exe\")","description_v2":["Found string \"Content-Disposition: form-data; name=\"\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found string \"Content-Disposition: form-data; name=\"\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1041","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1041","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-323","type":2,"relevance":1,"name":"Contains reference to Windows HTTP services (API string)","description":"$4f","description_v2":["Found reference to API \"WinHttpGetDefaultProxyConfiguration\" (Indicator: \"WinHttpGetDefaultProxyConfiguration\"; File: \"scp.exe\")","Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; File: \"scp.exe\")","Found reference to API \"WinHttpSetOption\" (Indicator: \"WinHttpSetOption\"; File: \"scp.exe\")","Found reference to API \"WinHttpReadData\" (Indicator: \"WinHttpReadData\"; File: \"scp.exe\")","Found reference to API \"WinHttpSetTimeouts\" (Indicator: \"WinHttpSetTimeouts\"; File: \"scp.exe\")","Found reference to API \"WinHttpQueryOption\" (Indicator: \"WinHttpQueryOption\"; File: \"scp.exe\")","Found reference to API \"WinHttpCloseHandle\" (Indicator: \"WinHttpCloseHandle\"; File: \"scp.exe\")","Found reference to API \"WinHttpWriteData\" (Indicator: \"WinHttpWriteData\"; File: \"scp.exe\")","Found reference to API \"WinHttpGetIEProxyConfigForCurrentUser\" (Indicator: \"WinHttpGetIEProxyConfigForCurrentUser\"; File: \"scp.exe\")","Found reference to API \"WinHttpSetCredentials\" (Indicator: \"WinHttpSetCredentials\"; File: \"scp.exe\")","Found reference to API \"WinHttpQueryAuthSchemes\" (Indicator: \"WinHttpQueryAuthSchemes\"; File: \"scp.exe\")","Found reference to API \"WinHttpGetProxyForUrl\" (Indicator: \"WinHttpGetProxyForUrl\"; File: \"scp.exe\")","Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; File: \"scp.exe\")","Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; File: \"scp.exe\")","Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; File: \"scp.exe\")","Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; File: \"scp.exe\")","Found reference to API \"WinHttpReceiveResponse\" (Indicator: \"WinHttpReceiveResponse\"; File: \"scp.exe\")","Found reference to API \"WinHttpQueryHeaders\" (Indicator: \"WinHttpQueryHeaders\"; File: \"scp.exe\")","Found reference to API \"WinHttpAddRequestHeaders\" (Indicator: \"WinHttpAddRequestHeaders\"; File: \"scp.exe\")","Found reference to API \"WinHttpSetStatusCallback\" (Indicator: \"WinHttpSetStatusCallback\"; File: \"scp.exe\")","Found reference to API \"WinHttpQueryDataAvailable\" (Indicator: \"WinHttpQueryDataAvailable\"; File: \"scp.exe\")","Found reference to API \"WinHttpAddRequestHeaders\" (Indicator: \"WinHttpAddRequestHeaders\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WinHttpCloseHandle\" (Indicator: \"WinHttpCloseHandle\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WinHttpGetDefaultProxyConfiguration\" (Indicator: \"WinHttpGetDefaultProxyConfiguration\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"WinHttpGetIEProxyConfigForCurrentUser\" (Indicator: \"WinHttpGetIEProxyConfigForCurrentUser\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WinHttpGetDefaultProxyConfiguration\" (Indicator: \"WinHttpGetDefaultProxyConfiguration\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpSetOption\" (Indicator: \"WinHttpSetOption\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpReadData\" (Indicator: \"WinHttpReadData\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpSetTimeouts\" (Indicator: \"WinHttpSetTimeouts\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpQueryOption\" (Indicator: \"WinHttpQueryOption\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpCloseHandle\" (Indicator: \"WinHttpCloseHandle\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpWriteData\" (Indicator: \"WinHttpWriteData\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpGetIEProxyConfigForCurrentUser\" (Indicator: \"WinHttpGetIEProxyConfigForCurrentUser\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpSetCredentials\" (Indicator: \"WinHttpSetCredentials\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpQueryAuthSchemes\" (Indicator: \"WinHttpQueryAuthSchemes\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpGetProxyForUrl\" (Indicator: \"WinHttpGetProxyForUrl\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpReceiveResponse\" (Indicator: \"WinHttpReceiveResponse\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpQueryHeaders\" (Indicator: \"WinHttpQueryHeaders\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpAddRequestHeaders\" (Indicator: \"WinHttpAddRequestHeaders\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpSetStatusCallback\" (Indicator: \"WinHttpSetStatusCallback\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpQueryDataAvailable\" (Indicator: \"WinHttpQueryDataAvailable\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpAddRequestHeaders\" (Indicator: \"WinHttpAddRequestHeaders\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpCloseHandle\" (Indicator: \"WinHttpCloseHandle\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpGetDefaultProxyConfiguration\" (Indicator: \"WinHttpGetDefaultProxyConfiguration\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpGetIEProxyConfigForCurrentUser\" (Indicator: \"WinHttpGetIEProxyConfigForCurrentUser\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-899","type":2,"relevance":1,"name":"Contains references to network communication API (string)","description":"$50","description_v2":["Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; File: \"scp.exe\")","Found reference to API \"inet_addr\" (Indicator: \"inet_addr\"; File: \"scp.exe\")","Found reference to API \"gethostbyname\" (Indicator: \"gethostbyname\"; File: \"scp.exe\")","Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; File: \"scp.exe\")","Found reference to API \"WSAAsyncGetHostByName\" (Indicator: \"gethostbyname\"; File: \"scp.exe\")","Found reference to API \"WSAGetLastError\" (Indicator: \"wsagetlasterror\"; File: \"scp.exe\")","Found reference to API \"inet_ntoa\" (Indicator: \"inet_ntoa\"; File: \"scp.exe\")","Found reference to API \"Waiting for PuTTY to connect to password pipe\" (Indicator: \" connect \"; File: \"scp.exe\")","Found reference to API \"Internal error: Connect called while still connected\" (Indicator: \" connect \"; File: \"scp.exe\")","Found reference to API \"Server does not send proper UTF-8, falling back to local charset\" (Indicator: \" send \"; File: \"scp.exe\")","Found reference to API \"Failed to create listen socket\" (Indicator: \" listen \"; File: \"scp.exe\")","Found reference to API \"Failed to get socket address\" (Indicator: \" socket \"; File: \"scp.exe\")","Found reference to API \"Destroying data socket on error\" (Indicator: \" socket \"; File: \"scp.exe\")","Found reference to API \"Destroying data socket after transfer completed\" (Indicator: \" socket \"; File: \"scp.exe\")","Found reference to API \"Increasing send buffer from %d to %d\" (Indicator: \" send \"; File: \"scp.exe\")","Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00000876-00000C2C-1453317431\")","Found reference to API \"Could not send request\" (Indicator: \" send \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")","Found reference to API \"Could not connect to server\" (Indicator: \" connect \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")","Found reference to API \"Could not connect to proxy server\" (Indicator: \" connect \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")","Found reference to API \"Missing flags for socket shutdown\" (Indicator: \" socket \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")","Found reference to API \"ssl: Shutdown state: %ssent | %sreceived.\" (Indicator: \" shutdown \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")","Found reference to API \"Could not send message to proxy\" (Indicator: \" send \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")","Found reference to API \"Could not send login message\" (Indicator: \" send \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")","Found reference to API \"Could not send connect request\" (Indicator: \" connect \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")","Found reference to API \"Could not send connect request\" (Indicator: \" send \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")","Found reference to API \"Could not read connect reply\" (Indicator: \" connect \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"inet_addr\" (Indicator: \"inet_addr\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"gethostbyname\" (Indicator: \"gethostbyname\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAAsyncGetHostByName\" (Indicator: \"gethostbyname\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAGetLastError\" (Indicator: \"wsagetlasterror\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"inet_ntoa\" (Indicator: \"inet_ntoa\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Waiting for PuTTY to connect to password pipe\" (Indicator: \" connect \"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Internal error: Connect called while still connected\" (Indicator: \" connect \"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Server does not send proper UTF-8, falling back to local charset\" (Indicator: \" send \"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Failed to create listen socket\" (Indicator: \" listen \"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Failed to get socket address\" (Indicator: \" socket \"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Destroying data socket on error\" (Indicator: \" socket \"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Destroying data socket after transfer completed\" (Indicator: \" socket \"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Increasing send buffer from %d to %d\" (Indicator: \" send \"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00000876-00000C2C-1453317431\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Could not send request\" (Indicator: \" send \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Could not connect to server\" (Indicator: \" connect \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Could not connect to proxy server\" (Indicator: \" connect \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Missing flags for socket shutdown\" (Indicator: \" socket \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ssl: Shutdown state: %ssent | %sreceived.\" (Indicator: \" shutdown \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Could not send message to proxy\" (Indicator: \" send \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Could not send login message\" (Indicator: \" send \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Could not send connect request\" (Indicator: \" connect \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Could not send connect request\" (Indicator: \" send \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Could not read connect reply\" (Indicator: \" connect \"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-186","type":2,"relevance":1,"name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"storage.googleapis.com\" (Indicator: \".googleapis.com\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")","description_v2":["Found string \"storage.googleapis.com\" (Indicator: \".googleapis.com\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"storage.googleapis.com\" (Indicator: \".googleapis.com\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1102","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1102","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-14","type":2,"relevance":0,"name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"\n \"5.1.32.0\"\n \"17.005.0107.0008\"\n \"2.13.0.0\"\n \"3.3.14.3\"\n \"2.53.0.0\"\n \"5.2.24.0\"\n \"6.5.5.0\"\n \"1.3.101.110\"\n \"1.3.101.111\"\n \"1.3.101.112\"\n \"1.3.101.113\"","description_v2":["\"192.168.0.2\"","\"5.1.32.0\"","\"17.005.0107.0008\"","\"2.13.0.0\"","\"3.3.14.3\"","\"2.53.0.0\"","\"5.2.24.0\"","\"6.5.5.0\"","\"1.3.101.110\"","\"1.3.101.111\"","\"1.3.101.112\"","\"1.3.101.113\""],"description_v3":[{"type":"text","value":"\"192.168.0.2\""},{"type":"linebreak"},{"type":"text","value":"\"5.1.32.0\""},{"type":"linebreak"},{"type":"text","value":"\"17.005.0107.0008\""},{"type":"linebreak"},{"type":"text","value":"\"2.13.0.0\""},{"type":"linebreak"},{"type":"text","value":"\"3.3.14.3\""},{"type":"linebreak"},{"type":"text","value":"\"2.53.0.0\""},{"type":"linebreak"},{"type":"text","value":"\"5.2.24.0\""},{"type":"linebreak"},{"type":"text","value":"\"6.5.5.0\""},{"type":"linebreak"},{"type":"text","value":"\"1.3.101.110\""},{"type":"linebreak"},{"type":"text","value":"\"1.3.101.111\""},{"type":"linebreak"},{"type":"text","value":"\"1.3.101.112\""},{"type":"linebreak"},{"type":"text","value":"\"1.3.101.113\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":3,"name":"Found potential URL in binary/memory","description":"$51","description_v2":["Heuristic match: \"uh.gw\"","Heuristic match: \"video/vnd.dece.sd\"","Pattern match: \"http://direct:80\"","Pattern match: \"http://www.w3.org/2001/xmlschema\"","Pattern match: \"http://www.w3.org/2000/xmlns/\"","Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","Pattern match: \"http://schemas.xmlsoap.org/soap/envelope/\"","Pattern match: \"http://www.w3.org/2003/05/soap-envelope\"","Pattern match: \"http://schemas.xmlsoap.org/soap/encoding/\"","Pattern match: \"http://www.w3.org/2003/05/soap-encoding\"","Pattern match: \"http://www.w3.org/1999/xmlschema\"","Pattern match: \"http://www.w3.org/2000/10/xmlschema\"","Pattern match: \"http://www.borland.com/namespaces/types\"","Heuristic match: \"ssh.com\"","Pattern match: \"https://www.msn.com/favicon.ico\"","Pattern match: \"http://www.virtualbox.org\"","Pattern match: \"http://go.microsoft.com/fwlink/?linkid=215117\"","Pattern match: \"http://go.microsoft.com/fwlink/?linkid=223554\"","Pattern match: \"http://support.microsoft.com/kb/4023057\"","Pattern match: \"http://www.cacetech.com\"","Pattern match: \"http://www.winpcap.org\"","Pattern match: \"http://www.autoitscript.com/autoit3\"","Pattern match: \"https://www.wireshark.org\"","Pattern match: \"https://ask.wireshark.org/\"","Pattern match: \"https://www.wireshark.org/download.html\"","Pattern match: \"http://www.adobe.com/support/main.html\"","Pattern match: \"http://www.adobe.com/products/acrobat/readstep.html\"","Pattern match: \"http://www.adobe.com\"","Pattern match: \"http://java.com/help\"","Pattern match: \"http://java.com\"","Pattern match: \"http://java.sun.com\"","Pattern match: \"https://support.mozilla.org\"","Pattern match: \"https://www.mozilla.org\"","Pattern match: \"https://www.mozilla.org/firefox/64.0/releasenotes\"","Pattern match: \"https://npcap.com/#download\"","Pattern match: \"https://npcap.com/\"","Pattern match: \"www.onet[1].xml\"","Pattern match: \"www.msn.com/favicon.ico\"","Pattern match: \"https://winscp.net/\"","Pattern match: \"http://s3.amazonaws.com/doc/2006-03-01/\"","Heuristic match: \"s3.amazonaws.com\"","Heuristic match: \"anonymous@example.com\"","Heuristic match: \"storage.googleapis.com\"","Pattern match: \"https://sts.amazonaws.com/doc/2011-06-15/\"","Pattern match: \"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"","Pattern match: \"http://ns.a\"","Pattern match: \"e.com/xap/1\"","Pattern match: \"http://purl.org/\"","Pattern match: \"http://ns.ad\"","Pattern match: \"http://ns\"","Heuristic match: \"ystem.activityhistory.id\"","Heuristic match: \"ystem.appusermodel.id\"","Heuristic match: \"ystem.identityprovider.name\"","Heuristic match: \"ystem.protocol.name\"","Heuristic match: \"ystem.sam.name\"","Heuristic match: \"ystem.structuredquery.is\"","Heuristic match: \"ystem.structuredquery.virtual.cc\"","Heuristic match: \"ystem.structuredquery.virtual.to\"","Heuristic match: \"system.activityhistory.id\"","Heuristic match: \"system.identityprovider.name\"","Heuristic match: \"system.sam.name\"","Heuristic match: \"system.structuredquery.virtual.cc\"","Heuristic match: \"system.structuredquery.virtual.to\"","Heuristic match: \"system.structuredquery.is\"","Heuristic match: \"system.protocol.name\"","Heuristic match: \"system.appusermodel.id\"","Heuristic match: \"system.structuredquerytype.implicit.is\"","Pattern match: \"adobe.com/xap/1.0/mm/\"","Pattern match: \"http://www.w3\"","Pattern match: \"ns.adobe.com/xap/1.0/\"","Pattern match: \"http://ns.q0\"","Pattern match: \"http://ns.adobe.com/photosh\"","Pattern match: \"obe.com/xap/1.0/stype/resourceev\"","Heuristic match: \"p://ns.aq\"","Pattern match: \"http://purl.org/dc\"","Heuristic match: \"2\\windows.sg\"","Heuristic match: \"aes128-gcm@openssh.com\"","Heuristic match: \"aes192-gcm@openssh.com\"","Heuristic match: \"aes256-gcm@openssh.com\"","Pattern match: \"http://ns.aq\""],"description_v3":[{"type":"text","value":"Heuristic match: \"uh.gw\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"video/vnd.dece.sd\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://direct:80\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/xmlschema\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2000/xmlns/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/xmlschema-instance\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://schemas.xmlsoap.org/soap/envelope/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2003/05/soap-envelope\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://schemas.xmlsoap.org/soap/encoding/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2003/05/soap-encoding\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/1999/xmlschema\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2000/10/xmlschema\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.borland.com/namespaces/types\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ssh.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.msn.com/favicon.ico\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.virtualbox.org\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?linkid=215117\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?linkid=223554\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://support.microsoft.com/kb/4023057\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.cacetech.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.winpcap.org\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.autoitscript.com/autoit3\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.wireshark.org\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://ask.wireshark.org/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.wireshark.org/download.html\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.adobe.com/support/main.html\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.adobe.com/products/acrobat/readstep.html\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.adobe.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://java.com/help\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://java.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://java.sun.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://support.mozilla.org\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.mozilla.org\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.mozilla.org/firefox/64.0/releasenotes\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://npcap.com/#download\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://npcap.com/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.onet[1].xml\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.msn.com/favicon.ico\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://winscp.net/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://s3.amazonaws.com/doc/2006-03-01/\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"s3.amazonaws.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"anonymous@example.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"storage.googleapis.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://sts.amazonaws.com/doc/2011-06-15/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/1999/02/22-rdf-syntax-ns#\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ns.a\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"e.com/xap/1\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://purl.org/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ns.ad\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ns\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.activityhistory.id\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.appusermodel.id\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.identityprovider.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.protocol.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.sam.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.structuredquery.is\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.structuredquery.virtual.cc\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.structuredquery.virtual.to\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.activityhistory.id\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.identityprovider.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.sam.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.structuredquery.virtual.cc\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.structuredquery.virtual.to\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.structuredquery.is\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.protocol.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.appusermodel.id\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"system.structuredquerytype.implicit.is\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"adobe.com/xap/1.0/mm/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"ns.adobe.com/xap/1.0/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ns.q0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ns.adobe.com/photosh\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"obe.com/xap/1.0/stype/resourceev\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"p://ns.aq\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://purl.org/dc\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"2\\windows.sg\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"aes128-gcm@openssh.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"aes192-gcm@openssh.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"aes256-gcm@openssh.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ns.aq\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"memorydump-2","type":20,"relevance":1,"name":"Found potential URLs in memory dumps","description":"$52","description_v2":["Found URL \"https://www.msn.com/favicon.ico\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")","Found URL \"http://www.virtualbox.orgoracle\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=215117microsoft\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")","Found URL \"http://support.microsoft.com/kb/4023057c:\\windows\\softwaredistribution\\download\\eb561161694e9fba93423cc2a2678b78\\img\\update\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")","Found URL \"http://www.cacetech.comwinpcap\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")","Found URL \"http://www.autoitscript.com/autoit3autoit\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")","Found URL \"https://www.wireshark.orgc:\\program\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")","Found URL \"https://ask.wireshark.org/wireshark\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")","Found URL \"http://www.adobe.com/support/main.htmlc:\\windows\\installer\\\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")","Found URL \"http://support.microsoft.com/kb/4023057c:\\windows\\softwaredistribution\\download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\update\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")","Found URL \"http://java.com/helpc:\\users\\hapubws\\appdata\\locallow\\oracle\\java\\jre1.8.0_161\\http://java.comjava\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")","Found URL \"https://support.mozilla.orgmozilla\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")","Found URL \"https://npcap.com/\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")","Found URL \"https://npcap.com/oracle\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=215117microsoft\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found URL \"http://support.microsoft.com/kb/4023057c:\\windows\\softwaredistribution\\download\\eb561161694e9fba93423cc2a2678b78\\img\\update\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found URL \"http://www.cacetech.comwinpcap\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found URL \"http://www.autoitscript.com/autoit3autoit\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found URL \"https://www.wireshark.orgc:\\program\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found URL \"https://ask.wireshark.org/wireshark\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found URL \"http://www.adobe.com/support/main.htmlc:\\windows\\installer\\\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found URL \"http://support.microsoft.com/kb/4023057c:\\windows\\softwaredistribution\\download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\update\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found URL \"http://java.com/helpc:\\users\\hapubws\\appdata\\locallow\\oracle\\java\\jre1.8.0_161\\http://java.comjava\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found URL \"https://support.mozilla.orgmozilla\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found URL \"https://npcap.com/\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found URL \"https://npcap.com/oracle\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=215117microsoft\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")","Found URL \"http://support.microsoft.com/kb/4023057c:\\windows\\softwaredistribution\\download\\eb561161694e9fba93423cc2a2678b78\\img\\update\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")","Found URL \"http://www.cacetech.comwinpcap\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")","Found URL \"http://www.autoitscript.com/autoit3autoit\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")","Found URL \"https://www.wireshark.orgc:\\program\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")","Found URL \"https://ask.wireshark.org/wireshark\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")","Found URL \"http://www.adobe.com/support/main.htmlc:\\windows\\installer\\\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")","Found URL \"http://support.microsoft.com/kb/4023057c:\\windows\\softwaredistribution\\download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\update\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")","Found URL \"http://java.com/helpc:\\users\\hapubws\\appdata\\locallow\\oracle\\java\\jre1.8.0_161\\http://java.comjava\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")","Found URL \"https://support.mozilla.orgmozilla\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")","Found URL \"https://npcap.com/\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")","Found URL \"https://npcap.com/oracle\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=215117microsoft\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found URL \"http://support.microsoft.com/kb/4023057c:\\windows\\softwaredistribution\\download\\eb561161694e9fba93423cc2a2678b78\\img\\update\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found URL \"http://www.cacetech.comwinpcap\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found URL \"http://www.autoitscript.com/autoit3autoit\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found URL \"https://www.wireshark.orgc:\\program\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found URL \"https://ask.wireshark.org/wireshark\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found URL \"http://www.adobe.com/support/main.htmlc:\\windows\\installer\\\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found URL \"http://support.microsoft.com/kb/4023057c:\\windows\\softwaredistribution\\download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\update\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found URL \"http://java.com/helpc:\\users\\hapubws\\appdata\\locallow\\oracle\\java\\jre1.8.0_161\\http://java.comjava\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found URL \"https://support.mozilla.orgmozilla\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found URL \"https://npcap.com/\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found URL \"https://npcap.com/oracle\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://go.microsoft.com/fwlink/?linkid=215117microsoft\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://support.microsoft.com/kb/4023057c:\\windows\\softwaredistribution\\download\\eb561161694e9fba93423cc2a2678b78\\img\\update\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.cacetech.comwinpcap\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.autoitscript.com/autoit3autoit\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.wireshark.orgc:\\program\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ask.wireshark.org/wireshark\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.adobe.com/support/main.htmlc:\\windows\\installer\\\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://support.microsoft.com/kb/4023057c:\\windows\\softwaredistribution\\download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\update\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://java.com/help%LOCALAPPDATA%\\ow\\oracle\\java\\jre1.8.0_161\\http://java.comjava\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://support.mozilla.orgmozilla\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://npcap.com/\" - Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://npcap.com/oracle\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://go.microsoft.com/fwlink/?linkid=215117microsoft\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://support.microsoft.com/kb/4023057c:\\windows\\softwaredistribution\\download\\eb561161694e9fba93423cc2a2678b78\\img\\update\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.cacetech.comwinpcap\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.autoitscript.com/autoit3autoit\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.wireshark.orgc:\\program\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ask.wireshark.org/wireshark\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.adobe.com/support/main.htmlc:\\windows\\installer\\\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://support.microsoft.com/kb/4023057c:\\windows\\softwaredistribution\\download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\update\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://java.com/helpC:\\Users\\%USERNAME%\\appdata\\locallow\\oracle\\java\\jre1.8.0_161\\http://java.comjava\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://support.mozilla.orgmozilla\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://npcap.com/\" - Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://npcap.com/oracle\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://go.microsoft.com/fwlink/?linkid=215117microsoft\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://support.microsoft.com/kb/4023057c:\\windows\\softwaredistribution\\download\\eb561161694e9fba93423cc2a2678b78\\img\\update\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.cacetech.comwinpcap\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.autoitscript.com/autoit3autoit\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.wireshark.orgc:\\program\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ask.wireshark.org/wireshark\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.adobe.com/support/main.htmlc:\\windows\\installer\\\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://support.microsoft.com/kb/4023057c:\\windows\\softwaredistribution\\download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\update\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://java.com/helpC:\\Users\\%USERNAME%\\appdata\\locallow\\oracle\\java\\jre1.8.0_161\\http://java.comjava\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://support.mozilla.orgmozilla\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://npcap.com/\" - Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://npcap.com/oracle\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://go.microsoft.com/fwlink/?linkid=215117microsoft\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://support.microsoft.com/kb/4023057c:\\windows\\softwaredistribution\\download\\eb561161694e9fba93423cc2a2678b78\\img\\update\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.cacetech.comwinpcap\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.autoitscript.com/autoit3autoit\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.wireshark.orgc:\\program\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ask.wireshark.org/wireshark\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.adobe.com/support/main.htmlc:\\windows\\installer\\\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://support.microsoft.com/kb/4023057c:\\windows\\softwaredistribution\\download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\update\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://java.com/helpC:\\Users\\%USERNAME%\\appdata\\locallow\\oracle\\java\\jre1.8.0_161\\http://java.comjava\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://support.mozilla.orgmozilla\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://npcap.com/\" - Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://npcap.com/ [/%s=]]\" (Indicator: \"password\"; File: \"scp.exe\")","Found string \"password\" (Indicator: \"password\"; File: \"scp.exe\")","Found string \"passwordsfromfiles\" (Indicator: \"password\"; File: \"scp.exe\")","Found string \"Cannot create password pipe\" (Indicator: \"password\"; File: \"scp.exe\")","Found string \"Disconnecting and closing password pipe\" (Indicator: \"password\"; File: \"scp.exe\")","Found string \"Waiting for PuTTY to connect to password pipe\" (Indicator: \"password\"; File: \"scp.exe\")","Found string \"PuTTY has connected to password pipe\" (Indicator: \"password\"; File: \"scp.exe\")","Found string \"Error writting password pipe\" (Indicator: \"password\"; File: \"scp.exe\")","Found string \"Complete password was written to pipe\" (Indicator: \"password\"; File: \"scp.exe\")","Found string \"Part of password was written to pipe\" (Indicator: \"password\"; File: \"scp.exe\")","Found string \"Master password handler not set\" (Indicator: \"password\"; File: \"scp.exe\")","Found string \"task_change_password\" (Indicator: \"password\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")","Found string \"Change account password\" (Indicator: \"password\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")","Found string \"missing secret\" (Indicator: \"secret\"; Source: \"00000000-00000876.00000002.162748.011BD000.00000004.mdmp\")","Found string \"bad password read\" (Indicator: \"password\"; Source: \"00000000-00000876.00000003.170180.011AA000.00000004.mdmp\")","Found string \"empty password\" (Indicator: \"password\"; Source: \"00000000-00000876.00000003.170180.011AA000.00000004.mdmp\")","Found string \"maybe wrong password\" (Indicator: \"password\"; Source: \"00000000-00000876.00000003.170180.011AA000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"(sftp|scp|ftp[es]|dav[s]|s3)://[user[:password]@]host[:port][/path/[file]]\" (Indicator: \"password\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"[mysession] [/%s= [/%s=]]\" (Indicator: \"password\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"password\" (Indicator: \"password\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"passwordsfromfiles\" (Indicator: \"password\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Cannot create password pipe\" (Indicator: \"password\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Disconnecting and closing password pipe\" (Indicator: \"password\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Waiting for PuTTY to connect to password pipe\" (Indicator: \"password\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"PuTTY has connected to password pipe\" (Indicator: \"password\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Error writting password pipe\" (Indicator: \"password\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Complete password was written to pipe\" (Indicator: \"password\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Part of password was written to pipe\" (Indicator: \"password\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Master password handler not set\" (Indicator: \"password\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"task_change_password\" (Indicator: \"password\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Change account password\" (Indicator: \"password\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"missing secret\" (Indicator: \"secret\"; Source: \"00000000-00000876.00000002.162748.011BD000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"bad password read\" (Indicator: \"password\"; Source: \"00000000-00000876.00000003.170180.011AA000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"empty password\" (Indicator: \"password\"; Source: \"00000000-00000876.00000003.170180.011AA000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"maybe wrong password\" (Indicator: \"password\"; Source: \"00000000-00000876.00000003.170180.011AA000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1555","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1555","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-96","type":2,"relevance":1,"name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\winscp3_is1\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: scp.exe","description_v2":["\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\winscp3_is1\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: scp.exe"],"description_v3":[{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\winscp3_is1\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: scp.exe"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-126","type":2,"relevance":7,"name":"Found system command-related strings","description":"$6c","description_v2":["Found string \"HostName\" (Indicator: \"hostname\"; File: \"scp.exe\")","Found string \"Could not resolve hostname `%s': %s\" (Indicator: \"hostname\"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")","Found string \"Could not find IPv4 address of hostname %s for SOCKS v4 proxy\" (Indicator: \"hostname\"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")","Found string \"sess: Using IPv6 scope '%s', hostname rewritten to %s.\" (Indicator: \"hostname\"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")","Found string \"certificate issued for a different hostname\" (Indicator: \"hostname\"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")","Found string \"Network error: No route to host\" (Indicator: \"route\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"HostName\" (Indicator: \"hostname\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Could not resolve hostname `%s': %s\" (Indicator: \"hostname\"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Could not find IPv4 address of hostname %s for SOCKS v4 proxy\" (Indicator: \"hostname\"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"sess: Using IPv6 scope '%s', hostname rewritten to %s.\" (Indicator: \"hostname\"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"certificate issued for a different hostname\" (Indicator: \"hostname\"; Source: \"00000000-00000876.00000002.162748.011F6000.00000004.mdmp, 00000000-00000876.00000003.170180.011F6000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Network error: No route to host\" (Indicator: \"route\"; Source: \"00000000-00000876.00000003.170180.01211000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Destruction","identifier":"string-216","type":2,"relevance":1,"name":"Contains ability to delete a user account from a server (API string)","description":"Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; File: \"scp.exe\")","description_v2":["Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1531","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1531","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Destruction","identifier":"string-218","type":2,"relevance":1,"name":"Contains ability to delete users from a group (API string)","description":"Found reference to API \"NetGroupDel\" (Indicator: \"NetGroupDel\"; File: \"scp.exe\")\n Found reference to API \"NetLocalGroupDel\" (Indicator: \"NetLocalGroupDel\"; File: \"scp.exe\")","description_v2":["Found reference to API \"NetGroupDel\" (Indicator: \"NetGroupDel\"; File: \"scp.exe\")","Found reference to API \"NetLocalGroupDel\" (Indicator: \"NetLocalGroupDel\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"NetGroupDel\" (Indicator: \"NetGroupDel\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NetLocalGroupDel\" (Indicator: \"NetLocalGroupDel\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1531","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1531","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-230","type":2,"relevance":1,"name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in file \"scp.exe\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"scp.exe\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\"","description_v2":["Found registry deletion API: \"RegDeleteValueW\" in file \"scp.exe\"","Found registry deletion API: \"RegDeleteKeyW\" in file \"scp.exe\"","Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\"","Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\"","Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\""],"description_v3":[{"type":"text","value":"Found registry deletion API: \"RegDeleteValueW\" in file \"scp.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry deletion API: \"RegDeleteKeyW\" in file \"scp.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\""}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-729","type":2,"relevance":1,"name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"scp.exe\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"scp.exe\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01214000.00000004.mdmp\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"scp.exe\")","Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"scp.exe\")","Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01214000.00000004.mdmp\")","Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01214000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"static-191","type":0,"relevance":5,"name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: scp.exe]","description_v2":["Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: scp.exe]"],"description_v3":[{"type":"text","value":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: scp.exe]"}],"origin":"Static Parser","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-474","type":2,"relevance":1,"name":"Contains ability to access device drivers","description":"$6d","description_v2":["Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found string \":\\WINDOWS\\system32\\spool\\drivers\\color\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.04010000.00000004.mdmp\")","Found string \":\\windows\\system32\\spool\\drivers\\color\\d65.camp\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.040AD000.00000004.mdmp\")","Found string \":\\windows\\system32\\spool\\drivers\\color\\photo.gmmp\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.040AD000.00000004.mdmp, 00000000-00000876.00000003.170180.040DC000.00000004.mdmp\")","Found string \"??\\c:\\windows\\system32\\spool\\drivers\\color\\d65.camp\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.040AD000.00000004.mdmp\")","Found string \"??\\c:\\windows\\system32\\spool\\drivers\\color\\photo.gmmp\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.040AD000.00000004.mdmp\")","Found string \"??\\C:\\WINDOWS\\system32\\spool\\drivers\\color\\Photo.gmmp\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found string \"??\\C:\\WINDOWS\\system32\\spool\\drivers\\color\\D65.camp\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string %WINDIR%\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\system32\\spool\\drivers\\color\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\windows\\system32\\spool\\drivers\\color\\d65.camp\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.040AD000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\windows\\system32\\spool\\drivers\\color\\photo.gmmp\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.040AD000.00000004.mdmp, 00000000-00000876.00000003.170180.040DC000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"??\\c:\\windows\\system32\\spool\\drivers\\color\\d65.camp\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.040AD000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"??\\c:\\windows\\system32\\spool\\drivers\\color\\photo.gmmp\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00000876.00000000.158908.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.040AD000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"??\\C:\\WINDOWS\\system32\\spool\\drivers\\color\\Photo.gmmp\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"??\\C:\\WINDOWS\\system32\\spool\\drivers\\color\\D65.camp\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-308","type":2,"relevance":1,"name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"scp.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"scp.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"scp.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"scp.exe\")","Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"scp.exe\")","Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"scp.exe\")","Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-91","type":2,"relevance":1,"name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"scp.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"scp.exe\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"scp.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"scp.exe\")","Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"scp.exe\")","Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"scp.exe\")","Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1056.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-77","type":2,"relevance":1,"name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"scp.exe\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"scp.exe\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"scp.exe\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"scp.exe\")","Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"scp.exe\")","Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"scp.exe\")","Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1134","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-426","type":2,"relevance":1,"name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"scp.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"scp.exe\")","Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1222","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1222","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-132","type":2,"relevance":1,"name":"Contains ability to modify the user configuration/privilege (API string)","description":"$6e","description_v2":["Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"scp.exe\")","Found reference to API \"SystemParametersInfoForDpi\" (Indicator: \"SystemParametersInfo\"; File: \"scp.exe\")","Found reference to API \"SystemParametersInfoForDpi\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")","Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"82322382380,492,113,,SystemParametersInfoW,user32.dll,\"00:41:52.671\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")","Found reference to API \"154322422796,492,113,,SystemParametersInfoW,user32.dll,\"00:42:22.671\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")","Found reference to API \"433490885920,492,113,,SystemParametersInfoW,user32.dll,\"00:44:18.984\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SystemParametersInfoForDpi\" (Indicator: \"SystemParametersInfo\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SystemParametersInfoForDpi\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000876.00000000.158908.013A7000.00000004.mdmp, 00000000-00000876.00000002.162748.013A7000.00000004.mdmp, 00000000-00000876.00000003.170180.013A7000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"82322382380,492,113,,SystemParametersInfoW,user32.dll,\"00:41:52.671\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000876.00000001.160828.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"154322422796,492,113,,SystemParametersInfoW,user32.dll,\"00:42:22.671\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"433490885920,492,113,,SystemParametersInfoW,user32.dll,\"00:44:18.984\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000876.00000003.170180.04010000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1098","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1098","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-114","type":2,"relevance":1,"name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$6f","description_v2":["Found reference to API \"CopySid\" (Indicator: \"CopySid\"; File: \"scp.exe\")","Found reference to API \"SetSecurityDescriptorDacl\" (Indicator: \"SetSecurityDescriptorDacl\"; File: \"scp.exe\")","Found reference to API \"InitializeSecurityDescriptor\" (Indicator: \"InitializeSecurityDescriptor\"; File: \"scp.exe\")","Found reference to API \"SetSecurityDescriptorOwner\" (Indicator: \"SetSecurityDescriptorOwner\"; File: \"scp.exe\")","Found reference to API \"GetLengthSid\" (Indicator: \"GetLengthSid\"; File: \"scp.exe\")","Found reference to API \"EqualSid\" (Indicator: \"EqualSid\"; File: \"scp.exe\")","Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"scp.exe\")","Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; File: \"scp.exe\")","Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"CopySid\" (Indicator: \"CopySid\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"EqualSid\" (Indicator: \"EqualSid\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"GetLengthSid\" (Indicator: \"GetLengthSid\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"InitializeSecurityDescriptor\" (Indicator: \"InitializeSecurityDescriptor\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01214000.00000004.mdmp\")","Found reference to API \"SetSecurityDescriptorDacl\" (Indicator: \"SetSecurityDescriptorDacl\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"SetSecurityDescriptorOwner\" (Indicator: \"SetSecurityDescriptorOwner\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01214000.00000004.mdmp\")","Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00000876.00000003.170180.01214000.00000004.mdmp\")","Found reference to API \"SetEntriesInAclA\" (Indicator: \"SetEntriesInAcl\"; Source: \"00000000-00000876.00000003.170180.01214000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CopySid\" (Indicator: \"CopySid\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetSecurityDescriptorDacl\" (Indicator: \"SetSecurityDescriptorDacl\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InitializeSecurityDescriptor\" (Indicator: \"InitializeSecurityDescriptor\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetSecurityDescriptorOwner\" (Indicator: \"SetSecurityDescriptorOwner\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLengthSid\" (Indicator: \"GetLengthSid\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EqualSid\" (Indicator: \"EqualSid\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CopySid\" (Indicator: \"CopySid\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EqualSid\" (Indicator: \"EqualSid\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLengthSid\" (Indicator: \"GetLengthSid\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InitializeSecurityDescriptor\" (Indicator: \"InitializeSecurityDescriptor\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01214000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetSecurityDescriptorDacl\" (Indicator: \"SetSecurityDescriptorDacl\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetSecurityDescriptorOwner\" (Indicator: \"SetSecurityDescriptorOwner\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp, 00000000-00000876.00000003.170180.01214000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00000876.00000003.170180.01214000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetEntriesInAclA\" (Indicator: \"SetEntriesInAcl\"; Source: \"00000000-00000876.00000003.170180.01214000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1134.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-406","type":2,"relevance":1,"name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: scp.exe\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp","description_v2":["Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: scp.exe","Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp"],"description_v3":[{"type":"text","value":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: scp.exe"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1529","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1529","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-316","type":2,"relevance":1,"name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"scp.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"scp.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"scp.exe\")","Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"scp.exe\")","Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-535","type":2,"relevance":0,"name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"scp.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"scp.exe\")","Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"static-87","type":0,"relevance":1,"name":"Imports system security related APIs","description":"$70","description_v2":["Observed import api \"AllocateAndInitializeSid\" which can \"allocate and initialize a security identifier (SID) with up to eight subauthorities\" [Source: scp.exe]","Observed import api \"CopySid\" which can \"copy a security identifier (SID) to a buffer\" [Source: scp.exe]","Observed import api \"EqualSid\" which can \"test two security identifier (SID) values for equality\" [Source: scp.exe]","Observed import api \"GetLengthSid\" which can \"return the length in bytes of a valid security identifier (SID)\" [Source: scp.exe]","Observed import api \"InitializeSecurityDescriptor\" which can \"initialize a new security descriptor\" [Source: scp.exe]","Observed import api \"InitializeSid\" which can \"initialize a security identifier (SID)\" [Source: scp.exe]","Observed import api \"SetSecurityDescriptorDacl\" which can \"set information in a discretionary access control list (DACL)\" [Source: scp.exe]","Observed import api \"SetSecurityDescriptorOwner\" which can \"set the owner information of an absolute-format security descriptor\" [Source: scp.exe]"],"description_v3":[{"type":"text","value":"Observed import api \"AllocateAndInitializeSid\" which can \"allocate and initialize a security identifier (SID) with up to eight subauthorities\" [Source: scp.exe]"},{"type":"linebreak"},{"type":"text","value":"Observed import api \"CopySid\" which can \"copy a security identifier (SID) to a buffer\" [Source: scp.exe]"},{"type":"linebreak"},{"type":"text","value":"Observed import api \"EqualSid\" which can \"test two security identifier (SID) values for equality\" [Source: scp.exe]"},{"type":"linebreak"},{"type":"text","value":"Observed import api \"GetLengthSid\" which can \"return the length in bytes of a valid security identifier (SID)\" [Source: scp.exe]"},{"type":"linebreak"},{"type":"text","value":"Observed import api \"InitializeSecurityDescriptor\" which can \"initialize a new security descriptor\" [Source: scp.exe]"},{"type":"linebreak"},{"type":"text","value":"Observed import api \"InitializeSid\" which can \"initialize a security identifier (SID)\" [Source: scp.exe]"},{"type":"linebreak"},{"type":"text","value":"Observed import api \"SetSecurityDescriptorDacl\" which can \"set information in a discretionary access control list (DACL)\" [Source: scp.exe]"},{"type":"linebreak"},{"type":"text","value":"Observed import api \"SetSecurityDescriptorOwner\" which can \"set the owner information of an absolute-format security descriptor\" [Source: scp.exe]"}],"origin":"Static Parser","attck_id":"T1134.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-574","type":2,"relevance":1,"name":"May contain SSL certificate","description":"\"-----BEGIN CERTIFICATE-----\" (Indicator: \"----begin certificate----\") in Source: scp.exe","description_v2":["\"-----BEGIN CERTIFICATE-----\" (Indicator: \"----begin certificate----\") in Source: scp.exe"],"description_v3":[{"type":"text","value":"\"-----BEGIN CERTIFICATE-----\" (Indicator: \"----begin certificate----\") in Source: scp.exe"}],"origin":"File/Memory","attck_id":"T1588.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1588/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-173","type":3,"relevance":1,"name":"Queries services related registry keys","description":"$71","description_v2":["\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"WINSOCK_REGISTRY_VERSION\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"NAMESPACE_CALLOUT\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"SERIAL_ACCESS_NUM\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NEXT_CATALOG_ENTRY_ID\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NUM_CATALOG_ENTRIES\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000001\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000002\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000003\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000004\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000005\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000006\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000007\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000008\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000009\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"WINSOCK_REGISTRY_VERSION\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"NAMESPACE_CALLOUT\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"SERIAL_ACCESS_NUM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NEXT_CATALOG_ENTRY_ID\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NUM_CATALOG_ENTRIES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000001\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000002\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000003\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000004\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000005\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000006\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000007\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000008\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000009\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-136","type":3,"relevance":3,"name":"Writes registry keys","description":"\"scp.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","description_v2":["\"scp.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")"],"description_v3":[{"type":"text","value":"\"scp.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"string-223","type":2,"relevance":1,"name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"scp.exe\")","description_v2":["Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"scp.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"scp.exe\")"}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"string-189","type":2,"relevance":3,"name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"scp.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"scp.exe\")","Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1529","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1529","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"string-354","type":2,"relevance":1,"name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"scp.exe\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"scp.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"scp.exe\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"scp.exe\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"scp.exe\")","Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"scp.exe\")","Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"scp.exe\")","Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"scp.exe\")","Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")","Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00000876.00000001.160828.013A0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"binary-37","type":8,"relevance":3,"name":"Drops files inside appdata directory","description":"Dropped file: \"winscp.rnd\" - Location: [%APPDATA%\\winscp.rnd]- [targetUID: 00000000-00000876]\n Dropped file: \"L8LSHBOEDLAM9IT78ETL.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp]- [targetUID: 00000000-00000876]","description_v2":["Dropped file: \"winscp.rnd\" - Location: [%APPDATA%\\winscp.rnd]- [targetUID: 00000000-00000876]","Dropped file: \"L8LSHBOEDLAM9IT78ETL.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp]- [targetUID: 00000000-00000876]"],"description_v3":[{"type":"text","value":"Dropped file: \"winscp.rnd\" - Location: [%APPDATA%\\winscp.rnd]- [targetUID: 00000000-00000876]"},{"type":"linebreak"},{"type":"text","value":"Dropped file: \"L8LSHBOEDLAM9IT78ETL.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp]- [targetUID: 00000000-00000876]"}],"origin":"Binary File","attck_id":"T1036","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1036","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"string-64","type":2,"relevance":10,"name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$72","description_v2":["Found string \"GetLogicalProcessorInformation\" (Source: scp.exe, API is part of module: KERNELBASE.DLL)","Found string \"GetThreadPreferredUILanguages\" (Source: scp.exe, API is part of module: KERNELBASE.DLL)","Found string \"SetThreadPreferredUILanguages\" (Source: scp.exe, API is part of module: KERNELBASE.DLL)","Found string \"GetThreadUILanguage\" (Source: scp.exe, API is part of module: KERNELBASE.DLL)","Found string \"VariantChangeTypeEx\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarNeg\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarNot\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarAdd\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarSub\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarMul\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarDiv\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarIdiv\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarMod\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarAnd\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarOr\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarXor\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarCmp\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarI4FromStr\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarR4FromStr\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarR8FromStr\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarDateFromStr\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarCyFromStr\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarBoolFromStr\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarBstrFromCy\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)","Found string \"VarBstrFromDate\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"],"description_v3":[{"type":"text","value":"Found string \"GetLogicalProcessorInformation\" (Source: scp.exe, API is part of module: KERNELBASE.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetThreadPreferredUILanguages\" (Source: scp.exe, API is part of module: KERNELBASE.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"SetThreadPreferredUILanguages\" (Source: scp.exe, API is part of module: KERNELBASE.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetThreadUILanguage\" (Source: scp.exe, API is part of module: KERNELBASE.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VariantChangeTypeEx\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarNeg\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarNot\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarAdd\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarSub\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarMul\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarDiv\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarIdiv\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarMod\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarAnd\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarOr\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarXor\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarCmp\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarI4FromStr\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarR4FromStr\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarR8FromStr\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarDateFromStr\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarCyFromStr\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarBoolFromStr\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarBstrFromCy\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"},{"type":"linebreak"},{"type":"text","value":"Found string \"VarBstrFromDate\" (Source: scp.exe, API is part of module: OLEAUT32.DLL)"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"string-65","type":2,"relevance":10,"name":"Possibly uses a Windows Server utility","description":"\"#c:\\windows\\system32\\licensingui.exe\" (Indicator: \"licensingui.exe\")","description_v2":["\"#c:\\windows\\system32\\licensingui.exe\" (Indicator: \"licensingui.exe\")"],"description_v3":[{"type":"text","value":"\"#%WINDIR%\\system32\\licensingui.exe\" (Indicator: \"licensingui.exe\")"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"registry-26","type":3,"relevance":2,"name":"Reads the windows installation language","description":"\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","description_v2":["\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")"],"description_v3":[{"type":"text","value":"\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")"}],"origin":"Registry Access","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"static-6","type":0,"relevance":1,"name":"Section contains high entropy","description":"\"scp.exe\" has section name .rsrc with entropy \"7.184942996188372\"","description_v2":["\"scp.exe\" has section name .rsrc with entropy \"7.184942996188372\""],"description_v3":[{"type":"text","value":"\"scp.exe\" has section name .rsrc with entropy \"7.184942996188372\""}],"origin":"Static Parser","attck_id":"T1027.009","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/009","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"static-92","type":0,"relevance":5,"name":"PE file has unusual entropy resources","description":"$73","description_v2":["\"scp.exe\" has resource with unusual entropy \"RT_ICON:7.923544392385863\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.891617099765174\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.89925043569334\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.889713526653796\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.887259735465478\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.88442980788853\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.874599304812917\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.885890135313418\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.889751406609193\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.88942514765703\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.883082577494332\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.896405211554697\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.893319927254322\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.885449370532904\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.8903324705750215\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.892886164295437\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.892591328792055\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.931386784798308\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.907206684492146\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.892028463012284\"","\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.861002056309858\""],"description_v3":[{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_ICON:7.923544392385863\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.891617099765174\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.89925043569334\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.889713526653796\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.887259735465478\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.88442980788853\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.874599304812917\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.885890135313418\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.889751406609193\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.88942514765703\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.883082577494332\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.896405211554697\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.893319927254322\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.885449370532904\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.8903324705750215\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.892886164295437\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.892591328792055\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.931386784798308\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.907206684492146\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.892028463012284\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" has resource with unusual entropy \"RT_RCDATA:7.861002056309858\""}],"origin":"Static Parser","attck_id":"T1027.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"api-6","type":6,"relevance":4,"name":"Reads configuration files (.ini files)","description":"\"scp.exe\" reads file \"C:\\Program Files (x86)\\desktop.ini\"\n \"scp.exe\" reads file \"C:\\scp.ini\"\n \"scp.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"\n \"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\3D Objects\\desktop.ini\"","description_v2":["\"scp.exe\" reads file \"C:\\Program Files (x86)\\desktop.ini\"","\"scp.exe\" reads file \"C:\\scp.ini\"","\"scp.exe\" reads file \"C:\\Users\\desktop.ini\"","\"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"","\"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","\"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"","\"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"","\"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"","\"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"","\"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","\"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"","\"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"","\"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"","\"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"","\"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"","\"scp.exe\" reads file \"C:\\Users\\%OSUSER%\\3D Objects\\desktop.ini\""],"description_v3":[{"type":"text","value":"\"scp.exe\" reads file \"%PROGRAMFILES%\\(x86)\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"C:\\scp.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"C:\\Users\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"C:\\Users\\%USERNAME%\\Documents\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"C:\\Users\\%USERNAME%\\Desktop\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"C:\\Users\\%USERNAME%\\Music\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"C:\\Users\\%USERNAME%\\Pictures\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"C:\\Users\\%USERNAME%\\Videos\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"C:\\Users\\%USERNAME%\\Downloads\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"C:\\Users\\%USERNAME%\\OneDrive\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"C:\\Users\\%USERNAME%\\Searches\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"C:\\Users\\%USERNAME%\\Contacts\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"C:\\Users\\%USERNAME%\\Favorites\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"C:\\Users\\%USERNAME%\\Links\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"C:\\Users\\%USERNAME%\\Saved Games\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" reads file \"C:\\Users\\%USERNAME%\\3D Objects\\desktop.ini\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"string-476","type":2,"relevance":1,"name":"Contains ability to use Webdav for network","description":"$74","description_v2":["Found string \"HttpForWebDAV\" (Indicator: \"webdav\"; File: \"scp.exe\")","Found string \"WinSCP: SFTP, FTP, WebDAV, S3 and SCP client\" (Indicator: \"webdav\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")","Found string \"WebDAV\" (Indicator: \"webdav\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")","Found string \"WebDavsLabel\" (Indicator: \"webdav\"; Source: \"00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.0A8D0000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.0A8D0000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.0A8D0000.00000004.mdmp\")","Found string \"WebDavsCombo\" (Indicator: \"webdav\"; Source: \"00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.0A8D0000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.0A8D0000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.0A8D0000.00000004.mdmp\")","Found string \"ystem.WebDavPath\" (Indicator: \"webdav\"; Source: \"00000000-00000876.00000001.160828.09130000.00000002.mdmp\")","Found string \"System.WebDavPath\" (Indicator: \"webdav\"; Source: \"00000000-00000876.00000001.160828.09190000.00000002.mdmp\")","Found string \"HttpForWebDAV=0\" (Indicator: \"webdav\"; Source: \"00000000-00000876.00000003.170180.07CD0000.00000004.mdmp\")","Found string \"HTTPFORWEBDAV\" (Indicator: \"webdav\"; Source: \"00000000-00000876.00000003.170180.07CD0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"HttpForWebDAV\" (Indicator: \"webdav\"; File: \"scp.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"WinSCP: SFTP, FTP, WebDAV, S3 and SCP client\" (Indicator: \"webdav\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"WebDAV\" (Indicator: \"webdav\"; Source: \"00000000-00000876.00000000.158908.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.04010000.00000004.mdmp, 00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"WebDavsLabel\" (Indicator: \"webdav\"; Source: \"00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.0A8D0000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.0A8D0000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.0A8D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"WebDavsCombo\" (Indicator: \"webdav\"; Source: \"00000000-00000876.00000001.160828.07490000.00000004.mdmp, 00000000-00000876.00000001.160828.0A8D0000.00000004.mdmp, 00000000-00000876.00000002.162748.07490000.00000004.mdmp, 00000000-00000876.00000002.162748.0A8D0000.00000004.mdmp, 00000000-00000876.00000003.170180.07490000.00000004.mdmp, 00000000-00000876.00000003.170180.0A8D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ystem.WebDavPath\" (Indicator: \"webdav\"; Source: \"00000000-00000876.00000001.160828.09130000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.WebDavPath\" (Indicator: \"webdav\"; Source: \"00000000-00000876.00000001.160828.09190000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"HttpForWebDAV=0\" (Indicator: \"webdav\"; Source: \"00000000-00000876.00000003.170180.07CD0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"HTTPFORWEBDAV\" (Indicator: \"webdav\"; Source: \"00000000-00000876.00000003.170180.07CD0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Remote Access Related","identifier":"registry-61","type":3,"relevance":10,"name":"Reads terminal service related keys (often RDP related)","description":"\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"GLASSSESSIONID\")","description_v2":["\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"GLASSSESSIONID\")"],"description_v3":[{"type":"text","value":"\"scp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"GLASSSESSIONID\")"}],"origin":"Registry Access","attck_id":"T1021.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1021/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"string-692","type":2,"relevance":1,"name":"Able to retrieve browser cookies using SQL","description":"Found string \"icrosoft\\Windows\\INetCookies\" (Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.040DC000.00000004.mdmp\")","description_v2":["Found string \"icrosoft\\Windows\\INetCookies\" (Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.040DC000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"icrosoft\\Windows\\INetCookies\" (Source: \"00000000-00000876.00000002.162748.04010000.00000004.mdmp, 00000000-00000876.00000003.170180.040DC000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1539","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1539","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"api-105","type":6,"relevance":5,"name":"Calls an API possibly used to take screenshots","description":"\"scp.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"250107d4\"\n \"cx\": \"8\"\n \"cy\": \"8\"}\n \"scp.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"250107d4\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"scp.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"b0107a3\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","description_v2":["\"scp.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"250107d4\"","\"cx\": \"8\"","\"cy\": \"8\"}","\"scp.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"250107d4\"","\"cx\": \"16\"","\"cy\": \"16\"}","\"scp.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"b0107a3\"","\"cx\": \"16\"","\"cy\": \"16\"}"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"250107d4\""},{"type":"linebreak"},{"type":"text","value":"\"cx\": \"8\""},{"type":"linebreak"},{"type":"text","value":"\"cy\": \"8\"}"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"250107d4\""},{"type":"linebreak"},{"type":"text","value":"\"cx\": \"16\""},{"type":"linebreak"},{"type":"text","value":"\"cy\": \"16\"}"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"b0107a3\""},{"type":"linebreak"},{"type":"text","value":"\"cx\": \"16\""},{"type":"linebreak"},{"type":"text","value":"\"cy\": \"16\"}"}],"origin":"API Call","attck_id":"T1113","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1113","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"api-40","type":6,"relevance":10,"name":"Calls an API typically used for keylogging","description":"\"scp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"27\"}","description_v2":["\"scp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"27\"}"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"27\"}"}],"origin":"API Call","attck_id":"T1056.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"api-104","type":6,"relevance":5,"name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"scp.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00000876)\n \"scp.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00000876)\n \"scp.exe\" called \"Process32NextW with parameter smss.exe\" (UID: 00000000-00000876)\n \"scp.exe\" called \"Process32NextW with parameter csrss.exe\" (UID: 00000000-00000876)\n \"scp.exe\" called \"Process32NextW with parameter wininit.exe\" (UID: 00000000-00000876)\n \"scp.exe\" called \"Process32NextW with parameter winlogon.exe\" (UID: 00000000-00000876)\n \"scp.exe\" called \"Process32NextW with parameter services.exe\" (UID: 00000000-00000876)\n \"scp.exe\" called \"Process32NextW with parameter lsass.exe\" (UID: 00000000-00000876)\n \"scp.exe\" called \"Process32NextW with parameter svchost.exe\" (UID: 00000000-00000876)\n \"scp.exe\" called \"Process32NextW with parameter fontdrvhost.exe\" (UID: 00000000-00000876)\n \"scp.exe\" called \"Process32NextW with parameter dwm.exe\" (UID: 00000000-00000876)","description_v2":["\"scp.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00000876)","\"scp.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00000876)","\"scp.exe\" called \"Process32NextW with parameter smss.exe\" (UID: 00000000-00000876)","\"scp.exe\" called \"Process32NextW with parameter csrss.exe\" (UID: 00000000-00000876)","\"scp.exe\" called \"Process32NextW with parameter wininit.exe\" (UID: 00000000-00000876)","\"scp.exe\" called \"Process32NextW with parameter winlogon.exe\" (UID: 00000000-00000876)","\"scp.exe\" called \"Process32NextW with parameter services.exe\" (UID: 00000000-00000876)","\"scp.exe\" called \"Process32NextW with parameter lsass.exe\" (UID: 00000000-00000876)","\"scp.exe\" called \"Process32NextW with parameter svchost.exe\" (UID: 00000000-00000876)","\"scp.exe\" called \"Process32NextW with parameter fontdrvhost.exe\" (UID: 00000000-00000876)","\"scp.exe\" called \"Process32NextW with parameter dwm.exe\" (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"Process32NextW with parameter smss.exe\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"Process32NextW with parameter csrss.exe\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"Process32NextW with parameter wininit.exe\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"Process32NextW with parameter winlogon.exe\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"Process32NextW with parameter services.exe\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"Process32NextW with parameter lsass.exe\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"Process32NextW with parameter svchost.exe\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"Process32NextW with parameter fontdrvhost.exe\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"Process32NextW with parameter dwm.exe\" (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"api-110","type":6,"relevance":10,"name":"Calls an API typically used to find and list the Windows drive types","description":"$75","description_v2":["\"scp.exe\" called \"GetDriveTypeW\" with parameter A:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter B:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter D:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter E:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter F:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter G:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter H:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter I:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter J:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter K:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter L:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter M:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter N:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter O:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter P:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter Q:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter R:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter S:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter T:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter U:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter V:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter W:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter X:\\ (UID: 00000000-00000876)","\"scp.exe\" called \"GetDriveTypeW\" with parameter Y:\\ (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter A:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter B:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter D:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter E:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter F:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter G:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter H:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter I:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter J:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter K:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter L:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter M:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter N:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter O:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter P:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter Q:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter R:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter S:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter T:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter U:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter V:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter W:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter X:\\ (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" called \"GetDriveTypeW\" with parameter Y:\\ (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"string-94","type":2,"relevance":5,"name":"Found Putty/Winscp session related registry strings","description":"\"Software\\SimonTatham\\PuTTY\\Sessions\" (Indicator: \"software\\simontatham\\putty\\sessions\") in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp","description_v2":["\"Software\\SimonTatham\\PuTTY\\Sessions\" (Indicator: \"software\\simontatham\\putty\\sessions\") in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\"Software\\SimonTatham\\PuTTY\\Sessions\" (Indicator: \"software\\simontatham\\putty\\sessions\") in Source: 00000000-00000876.00000003.170180.01211000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"registry-105","type":3,"relevance":5,"name":"Read windows product name from registry","description":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","description_v2":["\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")"],"description_v3":[{"type":"text","value":"\"scp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Destruction","identifier":"api-25","type":6,"relevance":7,"name":"Opens file with deletion access rights","description":"\"scp.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp\" with delete access","description_v2":["\"scp.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp\" with delete access"],"description_v3":[{"type":"text","value":"\"scp.exe\" opened \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\L8LSHBOEDLAM9IT78ETL.temp\" with delete access"}],"origin":"API Call","attck_id":"T1070.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"api-284","type":6,"relevance":1,"name":"Opens a handle to the specified local process","description":"\"scp.exe\" opens a process \"C:\\scp.exe\" (UID: 00000000-00000876)\n \"scp.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00000876)\n \"scp.exe\" opens a process \"C:\\VxStream\\VxKernelSvcNTMgr.exe\" (UID: 00000000-00000876)","description_v2":["\"scp.exe\" opens a process \"C:\\scp.exe\" (UID: 00000000-00000876)","\"scp.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00000876)","\"scp.exe\" opens a process \"C:\\VxStream\\VxKernelSvcNTMgr.exe\" (UID: 00000000-00000876)"],"description_v3":[{"type":"text","value":"\"scp.exe\" opens a process \"C:\\scp.exe\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" opens a process \"%WINDIR%\\explorer.exe\" (UID: 00000000-00000876)"},{"type":"linebreak"},{"type":"text","value":"\"scp.exe\" opens a process \"%VXDIR%\\VxKernelSvcNTMgr.exe\" (UID: 00000000-00000876)"}],"origin":"API Call","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-1","type":0,"relevance":1,"name":"Imports suspicious APIs","description":"$76","description_v2":["GetUserNameA","RegCreateKeyExA","RegCreateKeyExW","RegOpenKeyExA","RegOpenKeyExW","SetSecurityDescriptorDacl","RegEnumKeyA","RegDeleteValueW","OpenProcessToken","RegDeleteKeyW","RegCloseKey","RegEnumKeyExW","GetDriveTypeW","VirtualAlloc","LoadLibraryExW","MapViewOfFile","Process32FirstW","LockResource","GetModuleFileNameW","GetFileAttributesA","GetStartupInfoA","GetModuleHandleA","ExitThread","GetThreadContext","OpenFileMappingW","GetFileAttributesW","CopyFileW","DisconnectNamedPipe","FindResourceExW","GetVersionExA","GetTickCount","CreateToolhelp32Snapshot","DeleteFileW","GetModuleFileNameA","SleepEx","CreateDirectoryW","IsDebuggerPresent","FindFirstFileA","FindNextFileA","CreateFileW","Sleep","Process32NextW","FindResourceW","GetFileSize","DeleteFileA","ConnectNamedPipe","OpenProcess","TerminateProcess","GetModuleHandleExA","GetTempPathW","UnhandledExceptionFilter","LoadLibraryW","GetDriveTypeA","GetStartupInfoW","CreateFileMappingW","GetComputerNameW","GetFileAttributesExW","FindFirstFileExW","LoadLibraryExA","CreateFileMappingA","CreateThread","GetProcAddress","FindNextFileW","LoadLibraryA","VirtualProtect","GetSystemDirectoryA","GetModuleHandleW","GetCommandLineW","FindFirstFileW","CreateFileA","GetSystemInfo","GetVersionExW","CreateProcessA","CreateProcessW","WriteFile","WNetOpenEnumW","GetUserNameExW","ShellExecuteExW","ShellExecuteW","GetUpdateRect","FindWindowExW","GetLastActivePopup","FindWindowW","GetCursorPos","SetKeyboardState","GetClipboardData","SetWindowsHookExW","FindWindowA","GetWindowThreadProcessId","EnumPrintersW","WSAStartup","closesocket","listen","send","bind","accept","sendto","recv","recvfrom","connect","WSASend","socket"],"description_v3":[{"type":"text","value":"GetUserNameA"},{"type":"linebreak"},{"type":"text","value":"RegCreateKeyExA"},{"type":"linebreak"},{"type":"text","value":"RegCreateKeyExW"},{"type":"linebreak"},{"type":"text","value":"RegOpenKeyExA"},{"type":"linebreak"},{"type":"text","value":"RegOpenKeyExW"},{"type":"linebreak"},{"type":"text","value":"SetSecurityDescriptorDacl"},{"type":"linebreak"},{"type":"text","value":"RegEnumKeyA"},{"type":"linebreak"},{"type":"text","value":"RegDeleteValueW"},{"type":"linebreak"},{"type":"text","value":"OpenProcessToken"},{"type":"linebreak"},{"type":"text","value":"RegDeleteKeyW"},{"type":"linebreak"},{"type":"text","value":"RegCloseKey"},{"type":"linebreak"},{"type":"text","value":"RegEnumKeyExW"},{"type":"linebreak"},{"type":"text","value":"GetDriveTypeW"},{"type":"linebreak"},{"type":"text","value":"VirtualAlloc"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryExW"},{"type":"linebreak"},{"type":"text","value":"MapViewOfFile"},{"type":"linebreak"},{"type":"text","value":"Process32FirstW"},{"type":"linebreak"},{"type":"text","value":"LockResource"},{"type":"linebreak"},{"type":"text","value":"GetModuleFileNameW"},{"type":"linebreak"},{"type":"text","value":"GetFileAttributesA"},{"type":"linebreak"},{"type":"text","value":"GetStartupInfoA"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleA"},{"type":"linebreak"},{"type":"text","value":"ExitThread"},{"type":"linebreak"},{"type":"text","value":"GetThreadContext"},{"type":"linebreak"},{"type":"text","value":"OpenFileMappingW"},{"type":"linebreak"},{"type":"text","value":"GetFileAttributesW"},{"type":"linebreak"},{"type":"text","value":"CopyFileW"},{"type":"linebreak"},{"type":"text","value":"DisconnectNamedPipe"},{"type":"linebreak"},{"type":"text","value":"FindResourceExW"},{"type":"linebreak"},{"type":"text","value":"GetVersionExA"},{"type":"linebreak"},{"type":"text","value":"GetTickCount"},{"type":"linebreak"},{"type":"text","value":"CreateToolhelp32Snapshot"},{"type":"linebreak"},{"type":"text","value":"DeleteFileW"},{"type":"linebreak"},{"type":"text","value":"GetModuleFileNameA"},{"type":"linebreak"},{"type":"text","value":"SleepEx"},{"type":"linebreak"},{"type":"text","value":"CreateDirectoryW"},{"type":"linebreak"},{"type":"text","value":"IsDebuggerPresent"},{"type":"linebreak"},{"type":"text","value":"FindFirstFileA"},{"type":"linebreak"},{"type":"text","value":"FindNextFileA"},{"type":"linebreak"},{"type":"text","value":"CreateFileW"},{"type":"linebreak"},{"type":"text","value":"Sleep"},{"type":"linebreak"},{"type":"text","value":"Process32NextW"},{"type":"linebreak"},{"type":"text","value":"FindResourceW"},{"type":"linebreak"},{"type":"text","value":"GetFileSize"},{"type":"linebreak"},{"type":"text","value":"DeleteFileA"},{"type":"linebreak"},{"type":"text","value":"ConnectNamedPipe"},{"type":"linebreak"},{"type":"text","value":"OpenProcess"},{"type":"linebreak"},{"type":"text","value":"TerminateProcess"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleExA"},{"type":"linebreak"},{"type":"text","value":"GetTempPathW"},{"type":"linebreak"},{"type":"text","value":"UnhandledExceptionFilter"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryW"},{"type":"linebreak"},{"type":"text","value":"GetDriveTypeA"},{"type":"linebreak"},{"type":"text","value":"GetStartupInfoW"},{"type":"linebreak"},{"type":"text","value":"CreateFileMappingW"},{"type":"linebreak"},{"type":"text","value":"GetComputerNameW"},{"type":"linebreak"},{"type":"text","value":"GetFileAttributesExW"},{"type":"linebreak"},{"type":"text","value":"FindFirstFileExW"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryExA"},{"type":"linebreak"},{"type":"text","value":"CreateFileMappingA"},{"type":"linebreak"},{"type":"text","value":"CreateThread"},{"type":"linebreak"},{"type":"text","value":"GetProcAddress"},{"type":"linebreak"},{"type":"text","value":"FindNextFileW"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryA"},{"type":"linebreak"},{"type":"text","value":"VirtualProtect"},{"type":"linebreak"},{"type":"text","value":"GetSystemDirectoryA"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleW"},{"type":"linebreak"},{"type":"text","value":"GetCommandLineW"},{"type":"linebreak"},{"type":"text","value":"FindFirstFileW"},{"type":"linebreak"},{"type":"text","value":"CreateFileA"},{"type":"linebreak"},{"type":"text","value":"GetSystemInfo"},{"type":"linebreak"},{"type":"text","value":"GetVersionExW"},{"type":"linebreak"},{"type":"text","value":"CreateProcessA"},{"type":"linebreak"},{"type":"text","value":"CreateProcessW"},{"type":"linebreak"},{"type":"text","value":"WriteFile"},{"type":"linebreak"},{"type":"text","value":"WNetOpenEnumW"},{"type":"linebreak"},{"type":"text","value":"GetUserNameExW"},{"type":"linebreak"},{"type":"text","value":"ShellExecuteExW"},{"type":"linebreak"},{"type":"text","value":"ShellExecuteW"},{"type":"linebreak"},{"type":"text","value":"GetUpdateRect"},{"type":"linebreak"},{"type":"text","value":"FindWindowExW"},{"type":"linebreak"},{"type":"text","value":"GetLastActivePopup"},{"type":"linebreak"},{"type":"text","value":"FindWindowW"},{"type":"linebreak"},{"type":"text","value":"GetCursorPos"},{"type":"linebreak"},{"type":"text","value":"SetKeyboardState"},{"type":"linebreak"},{"type":"text","value":"GetClipboardData"},{"type":"linebreak"},{"type":"text","value":"SetWindowsHookExW"},{"type":"linebreak"},{"type":"text","value":"FindWindowA"},{"type":"linebreak"},{"type":"text","value":"GetWindowThreadProcessId"},{"type":"linebreak"},{"type":"text","value":"EnumPrintersW"},{"type":"linebreak"},{"type":"text","value":"WSAStartup"},{"type":"linebreak"},{"type":"text","value":"closesocket"},{"type":"linebreak"},{"type":"text","value":"listen"},{"type":"linebreak"},{"type":"text","value":"send"},{"type":"linebreak"},{"type":"text","value":"bind"},{"type":"linebreak"},{"type":"text","value":"accept"},{"type":"linebreak"},{"type":"text","value":"sendto"},{"type":"linebreak"},{"type":"text","value":"recv"},{"type":"linebreak"},{"type":"text","value":"recvfrom"},{"type":"linebreak"},{"type":"text","value":"connect"},{"type":"linebreak"},{"type":"text","value":"WSASend"},{"type":"linebreak"},{"type":"text","value":"socket"}],"origin":"Static Parser","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Installation/Persistence","identifier":"api-74","type":6,"relevance":10,"name":"Sets a computer-based training (CBT) hook","description":"\"scp.exe\" sets a callback procedure (6e0684) using filter \"WH_CBT\" for process ID: 36c","description_v2":["\"scp.exe\" sets a callback procedure (6e0684) using filter \"WH_CBT\" for process ID: 36c"],"description_v3":[{"type":"text","value":"\"scp.exe\" sets a callback procedure (6e0684) using filter \"WH_CBT\" for process ID: 36c"}],"origin":"API Call","attck_id":"T1056.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/004","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Spyware/Information Retrieval","identifier":"string-11","type":2,"relevance":6,"name":"Found FTP credentials location strings","description":"\"FileZilla\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: scp.exe","description_v2":["\"FileZilla\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: scp.exe"],"description_v3":[{"type":"text","value":"\"FileZilla\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: scp.exe"}],"origin":"File/Memory","attck_id":"T1552.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1552/001","stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":true,"allow_sample_tampering":true,"network_mode":"default","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":180,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":"Windows 10","windows_version_edition":"Professional","windows_version_service_pack":null,"windows_version_version":"10.0 (build 16299)","windows_version_bitness":"64","custom_date_time":null,"sandbox_version":"13.3.0","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[],"icon":"$77","visualization":"$78","classification":["55.3% (.SCR) Windows screen saver","19.0% (.EXE) Win32 Executable (generic)","8.5% (.EXE) OS/2 Executable (generic)","8.4% (.EXE) Generic Win/DOS Executable","8.4% (.EXE) DOS Executable Generic"],"dns_requests":[],"contacted_hosts":[],"contacted_countries":{"countries":[],"coordinates":[]},"port_infos":[],"extracted_strings":{"all":[{"value":"ISIjJCUmJyghKSorLC0uLzAn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"IyUuMnglLjJ4JS4yeA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JCpAQEAqJEBAQCQgKkBAKiAkQEAoJCopQC0kKkBAJC0qQEAkKi1AQCgqJClALSokQEAqLSRAQCokLUBALSogJEAtJCAqQCogJC1AJCAqLUAkIC0qQCotICRAKCQgKikoKiAkKQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JFJDU2ZpbGU6","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JFJFQ1lDTEUuQklO","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JFJldmlzaW9uJA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JFJldmlzaW9uOg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JFRBcnJheTxTeXN0ZW0uVHlwSW5mby5URWxlbWVudEFsaWFzPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JFRNdWx0aVJlYWRFeGNsdXNpdmVXcml0ZVN5bmNocm9uaXplcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JFRNdWx0aVJlYWRFeGNsdXNpdmVXcml0ZVN5bmNocm9uaXplciY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JSYnKCkqKyw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JSYnKCkqKywtLg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JS4yZCVzJS4yZCVzJS4yZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JTAuMGYlJSVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JTE6LjJkOiUyOi4yZDolMzouMmQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JWRfQXN5bmNNZXNzYWdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JUxPQ0FMQVBQREFUQSU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JW9wZXJhdGlvbk5hbWUl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXMgJXMgKCVzKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXMgKCVzKXwlMTpzfA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXMgKCouJXMpfCouJTE6cw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXMlLjRkLSUuMmQtJS4yZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXMlcyAlcyAvLyAiJXMiICIlcyIgJWQgJWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXMlcyUuMmQ6JS4yZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXMlcyVzJXMlcyVzJXMlcyVzJXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXMlcyVzOiAlZCVzJXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXMsIENsYXNzSUQ6ICVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXM6IE5vZGUgbm90IGFzc2lnbmVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXM7QCVzfCVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXNfZWRpdF9jb250cm9sXyVw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXUuJXUuJXUuJXU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jm9wX0FkZGl0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jm9wX0VxdWFsaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jm9wX0V4cGxpY2l0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jm9wX0dyZWF0ZXJUaGFu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jm9wX0dyZWF0ZXJUaGFuT3JFcXVhbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jm9wX0ltcGxpY2l0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jm9wX0luZXF1YWxpdHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jm9wX0xlc3NUaGFu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jm9wX0xlc3NUaGFuT3JFcXVhbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jm9wX011bHRpcGx5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jm9wX1N1YnRyYWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JlRBcnJheTxTeXN0ZW0uU3lzVXRpbHMuVFVuaXRIYXNoRW50cnk+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"JlRBcnJheTxTeXN0ZW0uVHlwSW5mby5URW51bUFsaWFzRW50cnk+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"KCVzIEAgJXAp","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"KCVzYXJyYXkgWzAuLiVkXSBvZiAlcyk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"KGJhc2ljKSBwcm9jZWR1cmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"KGNsYXNzICclcycgQCAlcCk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"KGludGVyZmFjZSBAICVwKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"KG1ldGhvZCBjb2RlPSVwLCBkYXRhPSVwKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"KG9ycGhhbiBwYWNrYWdlKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"KHBvaW50ZXIgQCAlcCk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"KHByb2NlZHVyZSBAICVwKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"KHNmdHB8c2NwfGZ0cFtlc118ZGF2W3NdfHMzKTovL1t1c2VyWzpwYXNzd29yZF1AXWhvc3RbOnBvcnRdWy9wYXRoL1tmaWxlXV0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"KHVua25vd24p","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"KHZhcmlhbnQp","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"KFpFSE5FUlRBU1RBVFVSKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"KUZyZXNoIFVXUC9zdG9yZSBpbnN0YWxsYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"LSBUb29sYmFyMjAwMCB2ZXJzaW9uIDIuMS42LCBDb3B5cmlnaHQgKEMpIDE5OTgtMjAwNSBieSBKb3JkYW4gUnVzc2VsbCAt","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"LS0tLS0tLUVtYnQtQm91bmRhcnktLQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"LURvY3VtZW50cw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"LUluZmluaXR5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lm1hbmlmZXN0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnRodW1ibmFpbGltYWdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"LldlYlZpZXcy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"L1RBcnJheTxTeXN0ZW0uU3lzVXRpbHMuVE1hcnNoYWxsZXIuVERpc3Bvc2VSZWM+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDAwMS0wMS0wMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDAwMS0wMS0wMVQwMDowMDowMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OUFCQ0RFRg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"MEJvZjM0MEtCaW4wb2Yz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"MS4yLjg0MC4xMTM1NDkuMS4xLjEx","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"MTIwMCAgKFVuaWNvZGUp","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"MTIwMSAgKFVuaWNvZGUgLSBCaWctRW5kaWFuKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"MTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFla","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"My8xMC8yMDIz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"Ni8xOC8yMDI0MzUxOjM0","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"OlxSRUNZQ0xFRA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlxSRUNZQ0xFUg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlN5c3RlbTo6SGVscGludGZzOjpJQ3VzdG9tSGVscFZpZXdlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlN5c3RlbTo6SGVscGludGZzOjpJSGVscFNlbGVjdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlRGb3JtYXRTZXR0aW5ncy46MTA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlRGb3JtYXRTZXR0aW5ncy46MjA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlRGb3JtYXRTZXR0aW5ncy46Mw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlRGb3JtYXRTZXR0aW5ncy46NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlRGb3JtYXRTZXR0aW5ncy46NQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlRJbnN0SGFzaE1hcC46MTw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlRJbnRlcm5hbEVyYUluZm9SZWNvcmQuOjE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlRMaXN0SGVscGVyLjox","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlRMaXN0SGVscGVyLjoz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlRMaXN0SGVscGVyLjo0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlRNdWx0aVdhaXRFdmVudC5UTXVsdGlXYWl0ZXIuOjE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlRQcm9wRGF0YS46MQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlRTdHJpbmdIZWxwZXIuOjE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlZjbDo6V2luaGVscHZpZXdlcjo6SVdpbkhlbHBUZXN0ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyBmaWxlbmFtZT0i","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ozw8PDw8PDw8PT09PT09PT09PT09PT09PT09PT09PT09PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"O0RvbWFpbj0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"O0V4cGlyZXM9","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"O0h0dHBPbmx5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"PEB0IVFTPCR0PCp0MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"PHVuZW5jcnlwdGVkPg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSBmdW5jdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSBwcm9jZWR1cmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QDpDdXN0b21TY3BFeHBsb3Jlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QDpDdXN0b21XaW5Db25maWd1cmF0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QDpHVUlDb25maWd1cmF0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QDpHVUlUb29scw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QDpOb25WaXN1YWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QDpTY3BDb21tYW5kZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QDpTY3BFeHBsb3Jlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QDpUZXJtaW5hbE1hbmFnZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QDpVc2VySW50ZXJmYWNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QDpXaW5Db25maWd1cmF0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QDpXaW5IZWxw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QDpXaW5JbnRlcmZhY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QDpXaW5TQ1A=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QEFCQ0RFRkdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QEdldFBhY2thZ2VJbmZvVGFibGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QEhhbmRsZUFueUV4Y2VwdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QEhhbmRsZUF1dG9FeGNlcHRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QEhhbmRsZUZpbmFsbHk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QEhhbmRsZU9uRXhjZXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QGtsbW4tb3BxQXJzdHU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QFJhaXNlRXhjZXB0JHFxcnY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QFN5c3RlbTpXaW5Db25maWd1cmF0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QHcrQVVVVVVVVQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"WyVwXSAlcyAoTGluZSAldSwgIiVzIiVzKSVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"WyVwXSAlcyVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Wy8lcz08bG9nZmlsZT4gWy9sb2dsZXZlbD08bGV2ZWw+XV0gWy8lcz1bPGNvdW50PiVzXTxzaXplPl0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Wy8lc1s9JXN8JXNdXSBbLyVzXQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Wy9jb25zb2xlXQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Wy9zY3JpcHQ9PGZpbGU+XSBbLyVzIGNtZDEuLi5dIFsvcGFyYW1ldGVyIC8vIHBhcmFtMS4uLl0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Wy94bWxsb2c9PGxvZ2ZpbGU+IFsveG1sZ3JvdXBzXV0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Wy94bWxsb2c9PGxvZ2ZpbGU+IFsveG1sZ3JvdXBzXV0gWy8lc10=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"W215c2Vzc2lvbl0gLyVzIFtsb2NhbF9kaXJdIFtyZW1vdGVfZGlyXSBbLyVzXQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"W215c2Vzc2lvbl0gLyVzIFtwYXRoXQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"W215c2Vzc2lvbl0gLyVzPTxuYW1lPg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"W215c2Vzc2lvbl0gLyVzWz08ZmlsZT5d","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"W215c2Vzc2lvbl0gL2VkaXQgPHBhdGg+","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"W215c2Vzc2lvbl0gL25ld2luc3RhbmNl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"W215c2Vzc2lvbl0gWy8lcz08ZmlsZT4gWy8lcz08cGFzc3BocmFzZT5dXQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"W215c2Vzc2lvbl0gWy8lcz08dXNlcj4gWy8lcz08cGFzc3dvcmQ+XV0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"W215c2Vzc2lvbl0gWy8lc10=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"W215c2Vzc2lvbl0gWy9jZXJ0aWZpY2F0ZT08ZmluZ2VycHJpbnQ+XQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"W215c2Vzc2lvbl0gWy9jbGllbnRjZXJ0PTxmaWxlPiBbLyVzPTxwYXNzcGhyYXNlPl1d","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"W215c2Vzc2lvbl0gWy9ob3N0a2V5PTxmaW5nZXJwcmludD5d","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"W215c2Vzc2lvbl0gWy9wYXNzaXZlWz1vbnxvZmZdXSBbL2ltcGxpY2l0fGV4cGxpY2l0XQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"W215c2Vzc2lvbl0gWy9yYXdzZXR0aW5ncyBzZXR0aW5nMT12YWx1ZTEgc2V0dGluZzI9dmFsdWUyIC4uLl0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"W215c2Vzc2lvbl0gWy90aW1lb3V0PTxzZWM+XQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"XC5DdXJyZW50","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"XC86Kj8iPD58","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"XE1JTUVcRGF0YWJhc2VcQ29udGVudCBUeXBlXA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFNZU1RFTVxDdXJyZW50Q29udHJvbFNldFxDb250cm9sXEtleWJvYXJkIExheW91dHNc","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"XV1dXV1dXV1dXV1d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"XV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"XV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"$79","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2RldmljZW1vZGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2RpX0lDdXN0b21EZXN0aW5hdGlvbkxpc3QgKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2RpX0lDdXN0b21IZWxwVmlld2VyICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2RpX0lEYXRhT2JqZWN0ICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2RpX0lEaXNwYXRjaCAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2RpX0lIZWxwU2VsZWN0b3IgKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2RpX0lTdHJlYW0gKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2RpX0lYTUxET01Eb2N1bWVudCAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2RpX1RMaXN0U29ydENvbXBhcmVGdW5jICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0Rpc2FibGVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0ZJTEVUSU1F","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0Z1bmN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0lNQUdFX0RBVEFfRElSRUNUT1JZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0lNQUdFX0RFQlVHX0RJUkVDVE9SWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0lNQUdFX0VYUE9SVF9ESVJFQ1RPUlko","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0lNQUdFX0ZJTEVfSEVBREVS","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0lNQUdFX05UX0hFQURFUlMzMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0lNQUdFX09QVElPTkFMX0hFQURFUjMy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0lNQUdFX09QVElPTkFMX0hFQURFUjY0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0lNQUdFX1NFQ1RJT05fSEVBREVSKA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0lNQUdFX1RIVU5LX0RBVEEzMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0lNQUdFX1RIVU5LX0RBVEE2NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0xJU1RfRU5UUlk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0xPQURFRF9JTUFHRTA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X05UX0FMVEVSTkFURV9TWU1CT0xfUEFUSA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X05UX1NZTUJPTF9QQVRI","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X09WRVJMQVBQRUQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc2VydmVkMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X1JUTF9DUklUSUNBTF9TRUNUSU9O","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X1JUTF9DUklUSUNBTF9TRUNUSU9OX0RFQlVH","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X1NFQ1VSSVRZX0FUVFJJQlVURVM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X1NZU1RFTVRJTUU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3RhZ09MRUNNRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X1RJTUVfWk9ORV9JTkZPUk1BVElPTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X1RQcm9wU2V0PFN5c3RlbS5UeXBJbmZvLkdldER5bkFycmF5UHJvcChTeXN0ZW0uVE9iamVjdCxTeXN0ZW0uVHlwSW5mby5QUHJvcEluZm8pLlREeW5hbWljQXJyYXk+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X1RQcm9wU2V0PFN5c3RlbS5UeXBJbmZvLkdldER5bkFycmF5UHJvcChTeXN0ZW0uVE9iamVjdCxTeXN0ZW0uVHlwSW5mby5QUHJvcEluZm8pLlREeW5hbWljQXJyYXk+Vg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X1RyYWNrTW91c2VFdmVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X1dJTjMyX0ZJTkRfREFUQVdQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"X1dJTl9DRVJUSUZJQ0FURQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YEBTeXN0ZW1AJVRDcHBJbnRlcmZhY2VkT2JqZWN0JDM1U3lzdGVtQENsYXNzZXNAVExpc3RTb3J0Q29tcGFyZUZ1bmM4SVVua25vd24xN1N5c3RlbUBJSW50ZXJmYWNlJTw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QSBub24tZXhpc3RpbmcgZmlsZW5hbWUgaXMgbWFwcGVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QSRIdElIdEZIdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUFjdGlvbkxpc3Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUF0dHJDbGFzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWJjP2RlZmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWJvdXQ6Ymxhbms=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUJ1aWxkZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YUNhcGFjaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWNjZW50Q29sb3I=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWNjZW50Q29sb3JJbmFjdGl2ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWNjZXB0LUNoYXJzZXQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWNjZXB0LUVuY29kaW5n","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWNjZXB0LUxhbmd1YWdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWNjZXB0LVJhbmdlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWNjZXNzaWJsZU9iamVjdEZyb21XaW5kb3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tTaGFyZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVLZXlib2FyZExheW91dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRGlzYWJsZWRJbWFnZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRGlzYWJsZWRJbWFnZXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRkSW1hZ2Vz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRkSW5zdEl0ZW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRkTWFza2Vk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc09mRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc09mRW50cnlQb2ludA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc09mRnVuY3Rpb25z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc09mTmFtZU9yZGluYWxz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc09mTmFtZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc09mUmF3RGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QURlZmF1bHRFbmNvZGluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0V2luZG93UmVjdEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWR2YXBpMzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUVuY29kaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUVTXzEyOA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUVTXzE5Mg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUVTXzI1Ng==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YUV4dGVuZGVkODA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWZ0ZXJDb25zdHJ1Y3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUhlbHBDb250ZXh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUluc3RhbmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb2NhdGVBbmRJbml0aWFsaXplU2lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb2NDb25zb2xl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb2NTdHJpbmdBc0Fuc2k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb2NTdHJpbmdBc1VuaWNvZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb2NTdHJpbmdBc1V0Zjg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dGcmVl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YU1heENhcGFjaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QW4gdW5leHBlY3RlZCBtZW1vcnkgbGVhayBoYXMgb2NjdXJyZWQu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QW5pbWF0ZVdpbmRvdw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QU5TSV9DSEFSU0VU","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QW5zaUNoYXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QW5zaVN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QW5zaVN0cmluZyAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YW55U2ltcGxlVHlwZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXBwZW5kRm9ybWF0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXBwZW5kTGluZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXBwZW5kTWVudVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXBwRXZlbnRzXFNjaGVtZXNcQXBwc1wuRGVmYXVsdFw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vYW5kcmV3LWluc2V0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vYXBwbGl4d2FyZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vYXRvbSt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vYXRvbWNhdCt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vYXRvbXN2Yyt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vYmluYXJ5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vYnNvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vY2N4bWwreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vY2RtaS1jYXBhYmlsaXR5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vY2RtaS1jb250YWluZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vY2RtaS1kb21haW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vY2RtaS1vYmplY3Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vY2RtaS1xdWV1ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vY3Utc2VlbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vZGF2bW91bnQreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vZG9jYm9vayt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vZHNzYytkZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vZHNzYyt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vZWNtYXNjcmlwdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vZW1tYSt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vZXB1Yit6aXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vZXhp","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vZm9udC10ZHBmcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vZ21sK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vZ3B4K3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vZ3hm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vaHlwZXJzdHVkaW8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vaW5rbWwreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vaXBmaXg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vamF2YS1hcmNoaXZl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vamF2YS1zZXJpYWxpemVkLW9iamVjdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vamF2YS12bQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vamF2YXNjcmlwdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vanNvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vanNvbm1sK2pzb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbG9zdCt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbWFjLWJpbmhleDQw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbWFjLWNvbXBhY3Rwcm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbWFkcyt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbWFyYw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbWFyY3htbCt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbWF0aGVtYXRpY2E=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbWF0aG1sK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbWJveA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbWVkaWFzZXJ2ZXJjb250cm9sK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbWV0YWxpbmsreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbWV0YWxpbms0K3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbWV0cyt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbW9kcyt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbXAyMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbXA0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbXN3b3Jk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vbXhm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vb2N0ZXQtc3RyZWFt","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vb2Rh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vb2VicHMtcGFja2FnZSt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vb2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vb21kb2MreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vb25lbm90ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vb3hwcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcGF0Y2gtb3BzLWVycm9yK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcGRm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcGdwLWVuY3J5cHRlZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcGdwLXNpZ25hdHVyZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcGljcy1ydWxlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcGtjczEw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcGtjczctbWltZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcGtjczctc2lnbmF0dXJl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcGtjczg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcGtpeC1hdHRyLWNlcnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcGtpeC1jZXJ0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcGtpeC1jcmw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcGtpeC1wa2lwYXRo","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcGtpeGNtcA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcGxzK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcG9zdHNjcmlwdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcHJzLmN3dw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcHNrYyt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcmRmK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcmVnaW5mbyt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcmVsYXgtbmctY29tcGFjdC1zeW50YXg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcmVzb3VyY2UtbGlzdHMreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcmVzb3VyY2UtbGlzdHMtZGlmZit4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcmxzLXNlcnZpY2VzK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcnBraS1naG9zdGJ1c3RlcnM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcnBraS1tYW5pZmVzdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcnBraS1yb2E=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcnNkK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcnNzK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vcnRm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc2JtbCt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc2N2cC1jdi1yZXF1ZXN0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc2N2cC1jdi1yZXNwb25zZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc2N2cC12cC1yZXF1ZXN0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc2N2cC12cC1yZXNwb25zZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc2Rw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc2V0LXBheW1lbnQtaW5pdGlhdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc2V0LXJlZ2lzdHJhdGlvbi1pbml0aWF0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc2hmK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc21pbCt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc29hcCt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc3BhcnFsLXF1ZXJ5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc3BhcnFsLXJlc3VsdHMreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc3Jncw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc3Jncyt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc3J1K3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc3NkbCt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vc3NtbCt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdGVpK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdGhyYXVkK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdGltZXN0YW1wZWQtZGF0YQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLjNncHAucGljLWJ3LWxhcmdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLjNncHAucGljLWJ3LXNtYWxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLjNncHAucGljLWJ3LXZhcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLjNncHAyLnRjYXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLjNtLnBvc3QtaXQtbm90ZXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFjY3BhYy5zaW1wbHkuYXNv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFjY3BhYy5zaW1wbHkuaW1w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFjdWNvYm9s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFjdWNvcnA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFkb2JlLmFpci1hcHBsaWNhdGlvbi1pbnN0YWxsZXItcGFja2FnZSt6aXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFkb2JlLmZvcm1zY2VudHJhbC5mY2R0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFkb2JlLmZ4cA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFkb2JlLnhkcCt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFkb2JlLnhmZGY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFoZWFkLnNwYWNl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFpcnppcC5maWxlc2VjdXJlLmF6Zg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFpcnppcC5maWxlc2VjdXJlLmF6cw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFtYXpvbi5lYm9vaw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFtZXJpY2FuZHluYW1pY3MuYWNj","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFtaWdhLmFtaQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFuZHJvaWQucGFja2FnZS1hcmNoaXZl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFuc2VyLXdlYi1jZXJ0aWZpY2F0ZS1pc3N1ZS1pbml0aWF0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFuc2VyLXdlYi1mdW5kcy10cmFuc2Zlci1pbml0aWF0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFudGl4LmdhbWUtY29tcG9uZW50","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFwcGxlLmluc3RhbGxlcit4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFwcGxlLm1wZWd1cmw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFyaXN0YW5ldHdvcmtzLnN3aQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmFzdHJhZWEtc29mdHdhcmUuaW90YQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmF1ZGlvZ3JhcGg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmJsdWVpY2UubXVsdGlwYXNz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmJtaQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmJ1c2luZXNzb2JqZWN0cw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNoZW1kcmF3K3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNoaXBudXRzLmthcmFva2UtbW1k","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNpbmRlcmVsbGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNsYXltb3Jl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNsb2FudG8ucnA5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNsb25rLmM0Z3JvdXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNsdWV0cnVzdC5jYXJ0b21vYmlsZS1jb25maWc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNsdWV0cnVzdC5jYXJ0b21vYmlsZS1jb25maWctcGtn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNvbW1vbnNwYWNl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNvbnRhY3QuY21zZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNvc21vY2FsbGVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNyaWNrLmNsaWNrZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNyaWNrLmNsaWNrZXIua2V5Ym9hcmQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNyaWNrLmNsaWNrZXIucGFsZXR0ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNyaWNrLmNsaWNrZXIudGVtcGxhdGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNyaWNrLmNsaWNrZXIud29yZGJhbms=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmNyaXRpY2FsdG9vbHMud2JzK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmN0Yy1wb3NtbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmN1cHMtcHBk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmN1cmwuY2Fy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmN1cmwucGN1cmw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmRhcnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmRhdGEtdmlzaW9uLnJkeg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmRlY2UuZGF0YQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmRlY2UudHRtbCt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmRlY2UudW5zcGVjaWZpZWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmRlY2Uuemlw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmRlbm92by5mY3NlbGF5b3V0LWxpbms=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmRuYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmRvbGJ5Lm1scA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmRwZ3JhcGg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmRyZWFtZmFjdG9yeQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmRzLWtleXBvaW50","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmR2Yi5haXQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmR2Yi5zZXJ2aWNl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmR5bmFnZW8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmVjb3dpbi5jaGFydA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmVtYmFyY2FkZXJvLmZpcmVkYWMrYmlu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmVtYmFyY2FkZXJvLmZpcmVkYWMranNvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmVtYmFyY2FkZXJvLmZpcmVkYWMreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmVubGl2ZW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmVwc29uLmVzZg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmVwc29uLm1zZg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmVwc29uLnF1aWNrYW5pbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmVwc29uLnNhbHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmVwc29uLnNzZg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmVzemlnbm8zK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmV6cGl4LWFsYnVt","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmV6cGl4LXBhY2thZ2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZkZg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZkc24ubXNlZWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZkc24uc2VlZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZsb2dyYXBoaXQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZsdXh0aW1lLmNsaXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZyYW1lbWFrZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZyb2dhbnMuZm5j","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZyb2dhbnMubHRm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZzYy53ZWJsYXVuY2g=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZ1aml0c3Uub2FzeXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZ1aml0c3Uub2FzeXMy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZ1aml0c3Uub2FzeXMz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZ1aml0c3Uub2FzeXNncA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZ1aml0c3Uub2FzeXNwcnM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZ1aml4ZXJveC5kZGQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZ1aml4ZXJveC5kb2N1d29ya3M=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZ1aml4ZXJveC5kb2N1d29ya3MuYmluZGVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmZ1enp5c2hlZXQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdlbm9tYXRpeC50dXhlZG8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdlb2dlYnJhLmZpbGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdlb2dlYnJhLnRvb2w=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdlb21ldHJ5LWV4cGxvcmVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdlb25leHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdlb3BsYW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdlb3NwYWNl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdteA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdvb2dsZS1lYXJ0aC5rbWwreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdvb2dsZS1lYXJ0aC5rbXo=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdyYWZlcQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdyb292ZS1hY2NvdW50","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdyb292ZS1oZWxw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdyb292ZS1pZGVudGl0eS1tZXNzYWdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdyb292ZS1pbmplY3Rvcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdyb292ZS10b29sLW1lc3NhZ2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdyb292ZS10b29sLXRlbXBsYXRl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmdyb292ZS12Y2FyZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmhhbCt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmhhbmRoZWxkLWVudGVydGFpbm1lbnQreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmhiY2k=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmhoZS5sZXNzb24tcGxheWVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmhwLWhwZ2w=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmhwLWhwaWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmhwLWhwcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmhwLWpseXQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmhwLXBjbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmhwLXBjbHhs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmh5ZHJvc3RhdGl4LnNvZi1kYXRh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmlibS5taW5pcGF5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmlibS5tb2RjYXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmlibS5yaWdodHMtbWFuYWdlbWVudA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmlibS5zZWN1cmUtY29udGFpbmVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmljY3Byb2ZpbGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmlnbG9hZGVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmltbWVydmlzaW9uLWl2cA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmltbWVydmlzaW9uLWl2dQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmluc29ycy5pZ20=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmludGVyY29uLmZvcm1uZXQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmludGVyZ2Vv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmludHUucWJv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmludHUucWZ4","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmlwdW5wbHVnZ2VkLnJjcHJvZmlsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmlyZXBvc2l0b3J5LnBhY2thZ2UreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmlzLXhwcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmlzYWMuZmNz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmphbQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmpjcC5qYXZhbWUubWlkbGV0LXJtcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmppc3A=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmpvb3N0LmpvZGEtYXJjaGl2ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmthaG9vdHo=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmtkZS5rYXJib24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmtkZS5rY2hhcnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmtkZS5rZm9ybXVsYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmtkZS5raXZpbw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmtkZS5rb250b3Vy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmtkZS5rcHJlc2VudGVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmtkZS5rc3ByZWFk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmtkZS5rd29yZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmtlbmFtZWFhcHA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmtpZHNwaXJhdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmtpbmFy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmtvYW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmtvZGFrLWRlc2NyaXB0b3I=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmxhcy5sYXMreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmxsYW1hZ3JhcGhpY3MubGlmZS1iYWxhbmNlLmRlc2t0b3A=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmxsYW1hZ3JhcGhpY3MubGlmZS1iYWxhbmNlLmV4Y2hhbmdlK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmxvdHVzLTEtMi0z","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmxvdHVzLWFwcHJvYWNo","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmxvdHVzLWZyZWVsYW5jZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmxvdHVzLW5vdGVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmxvdHVzLW9yZ2FuaXplcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmxvdHVzLXNjcmVlbmNhbQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLmxvdHVzLXdvcmRwcm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1hY3BvcnRzLnBvcnRwa2c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1jZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1lZGNhbGNkYXRh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1lZGlhc3RhdGlvbi5jZGtleQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1mZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1mbXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1pY3JvZ3JhZnguZmxv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1pY3JvZ3JhZnguaWd4","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1pZg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1vYml1cy5kYWY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1vYml1cy5kaXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1vYml1cy5tYms=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1vYml1cy5tcXk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1vYml1cy5tc2w=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1vYml1cy5wbGM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1vYml1cy50eGY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1vcGh1bi5hcHBsaWNhdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1vcGh1bi5jZXJ0aWZpY2F0ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1vemlsbGEueHVsK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLWFydGdhbHJ5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLWNhYi1jb21wcmVzc2Vk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLWV4Y2Vs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLWV4Y2VsLmFkZGluLm1hY3JvZW5hYmxlZC4xMg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLWV4Y2VsLnNoZWV0LmJpbmFyeS5tYWNyb2VuYWJsZWQuMTI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLWV4Y2VsLnNoZWV0Lm1hY3JvZW5hYmxlZC4xMg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLWV4Y2VsLnRlbXBsYXRlLm1hY3JvZW5hYmxlZC4xMg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLWZvbnRvYmplY3Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLWh0bWxoZWxw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLWltcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLWxybQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLW9mZmljZXRoZW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLXBraS5zZWNjYXQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLXBraS5zdGw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLXBvd2VycG9pbnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLXBvd2VycG9pbnQuYWRkaW4ubWFjcm9lbmFibGVkLjEy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLXBvd2VycG9pbnQucHJlc2VudGF0aW9uLm1hY3JvZW5hYmxlZC4xMg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLXBvd2VycG9pbnQuc2xpZGUubWFjcm9lbmFibGVkLjEy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLXBvd2VycG9pbnQuc2xpZGVzaG93Lm1hY3JvZW5hYmxlZC4xMg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLXBvd2VycG9pbnQudGVtcGxhdGUubWFjcm9lbmFibGVkLjEy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLXByb2plY3Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLXdvcmQuZG9jdW1lbnQubWFjcm9lbmFibGVkLjEy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLXdvcmQudGVtcGxhdGUubWFjcm9lbmFibGVkLjEy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLXdvcmtz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLXdwbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zLXhwc2RvY3VtZW50","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm1zZXE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm11c2ljaWFu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm11dmVlLnN0eWxl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm15bmZj","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm5ldXJvbGFuZ3VhZ2Uubmx1","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm5pdGY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm5vYmxlbmV0LWRpcmVjdG9yeQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm5vYmxlbmV0LXNlYWxlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm5vYmxlbmV0LXdlYg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm5va2lhLm4tZ2FnZS5kYXRh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm5va2lhLm4tZ2FnZS5zeW1iaWFuLmluc3RhbGw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm5va2lhLnJhZGlvLXByZXNldA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm5va2lhLnJhZGlvLXByZXNldHM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm5vdmFkaWdtLmVkbQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm5vdmFkaWdtLmVkeA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm5vdmFkaWdtLkZFeHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC5jaGFydA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC5jaGFydC10ZW1wbGF0ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC5kYXRhYmFzZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC5mb3JtdWxh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC5mb3JtdWxhLXRlbXBsYXRl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC5ncmFwaGljcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC5ncmFwaGljcy10ZW1wbGF0ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC5pbWFnZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC5pbWFnZS10ZW1wbGF0ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC5wcmVzZW50YXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC5wcmVzZW50YXRpb24tdGVtcGxhdGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC5zcHJlYWRzaGVldA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC5zcHJlYWRzaGVldC10ZW1wbGF0ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC50ZXh0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC50ZXh0LW1hc3Rlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC50ZXh0LXRlbXBsYXRl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9hc2lzLm9wZW5kb2N1bWVudC50ZXh0LXdlYg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9scGMtc3VnYXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9tYS5kZDIreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9wZW5vZmZpY2VvcmcuZXh0ZW5zaW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9wZW54bWxmb3JtYXRzLW9mZmljZWRvY3VtZW50LnByZXNlbnRhdGlvbm1sLnByZXNlbnRhdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9wZW54bWxmb3JtYXRzLW9mZmljZWRvY3VtZW50LnByZXNlbnRhdGlvbm1sLnNsaWRl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9wZW54bWxmb3JtYXRzLW9mZmljZWRvY3VtZW50LnByZXNlbnRhdGlvbm1sLnNsaWRlc2hvdw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9wZW54bWxmb3JtYXRzLW9mZmljZWRvY3VtZW50LnByZXNlbnRhdGlvbm1sLnRlbXBsYXRl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9wZW54bWxmb3JtYXRzLW9mZmljZWRvY3VtZW50LnNwcmVhZHNoZWV0bWwuc2hlZXQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9wZW54bWxmb3JtYXRzLW9mZmljZWRvY3VtZW50LnNwcmVhZHNoZWV0bWwudGVtcGxhdGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9wZW54bWxmb3JtYXRzLW9mZmljZWRvY3VtZW50LndvcmRwcm9jZXNzaW5nbWwuZG9jdW1lbnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9wZW54bWxmb3JtYXRzLW9mZmljZWRvY3VtZW50LndvcmRwcm9jZXNzaW5nbWwudGVtcGxhdGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9zZ2VvLm1hcGd1aWRlLnBhY2thZ2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9zZ2kuZHA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLm9zZ2kuc3Vic3lzdGVt","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnBhbG0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnBhd2FhZmlsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnBnLmZvcm1hdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnBnLm9zYXNsaQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnBpY3NlbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnBtaS53aWRnZXQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnBvY2tldGxlYXJu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnBvd2VyYnVpbGRlcjY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnByZXZpZXdzeXN0ZW1zLmJveA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnByb3RldXMubWFnYXppbmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnB1Ymxpc2hhcmUtZGVsdGEtdHJlZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnB2aS5wdGlkMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnF1YXJrLnF1YXJreHByZXNz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnJlYWx2bmMuYmVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnJlY29yZGFyZS5tdXNpY3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnJlY29yZGFyZS5tdXNpY3htbCt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnJpZy5jcnlwdG9ub3Rl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnJpbS5jb2Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnJuLXJlYWxtZWRpYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnJuLXJlYWxtZWRpYS12YnI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnJvdXRlNjYubGluazY2K3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnNhaWxpbmd0cmFja2VyLnRyYWNr","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnNlZW1haWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnNlbWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnNlbWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnNlbWY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnNoYW5hLmluZm9ybWVkLmZvcm1kYXRh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnNoYW5hLmluZm9ybWVkLmZvcm10ZW1wbGF0ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnNoYW5hLmluZm9ybWVkLmludGVyY2hhbmdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnNoYW5hLmluZm9ybWVkLnBhY2thZ2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnNpbXRlY2gtbWluZG1hcHBlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnNtYWY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnNtYXJ0LnRlYWNoZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnNvbGVudC5zZGttK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnNwb3RmaXJlLmR4cA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnNwb3RmaXJlLnNmcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN0YXJkaXZpc2lvbi5jYWxj","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN0YXJkaXZpc2lvbi5kcmF3","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN0YXJkaXZpc2lvbi5pbXByZXNz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN0YXJkaXZpc2lvbi5tYXRo","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN0YXJkaXZpc2lvbi53cml0ZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN0YXJkaXZpc2lvbi53cml0ZXItZ2xvYmFs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN0ZXBtYW5pYS5wYWNrYWdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN0ZXBtYW5pYS5zdGVwY2hhcnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN1bi54bWwuY2FsYw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN1bi54bWwuY2FsYy50ZW1wbGF0ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN1bi54bWwuZHJhdw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN1bi54bWwuZHJhdy50ZW1wbGF0ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN1bi54bWwuaW1wcmVzcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN1bi54bWwuaW1wcmVzcy50ZW1wbGF0ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN1bi54bWwubWF0aA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN1bi54bWwud3JpdGVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN1bi54bWwud3JpdGVyLmdsb2JhbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN1bi54bWwud3JpdGVyLnRlbXBsYXRl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN1cy1jYWxlbmRhcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN2ZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN5bWJpYW4uaW5zdGFsbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN5bmNtbCt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN5bmNtbC5kbSt3YnhtbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnN5bmNtbC5kbSt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnRhby5pbnRlbnQtbW9kdWxlLWFyY2hpdmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnRjcGR1bXAucGNhcA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnRtb2JpbGUtbGl2ZXR2","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnRyaWQudHB0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnRyaXNjYXBlLm14cw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnRydWVhcHA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnVmZGw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnVpcS50aGVtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnVtYWppbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnVuaXR5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnVvbWwreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnZjeA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnZpc2lv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnZpc2lvbmFyeQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnZzZg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLndhcC53YnhtbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLndhcC53bWxj","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLndhcC53bWxzY3JpcHRj","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLndlYnR1cmJv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLndvbGZyYW0ucGxheWVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLndvcmRwZXJmZWN0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLndxZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnd0LnN0Zg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnhhcmE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnhmZGw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnlhbWFoYS5odi1kaWM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnlhbWFoYS5odi1zY3JpcHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnlhbWFoYS5odi12b2ljZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnlhbWFoYS5vcGVuc2NvcmVmb3JtYXQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnlhbWFoYS5vcGVuc2NvcmVmb3JtYXQub3NmcHZnK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnlhbWFoYS5zbWFmLWF1ZGlv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnlhbWFoYS5zbWFmLXBocmFzZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnllbGxvd3JpdmVyLWN1c3RvbS1tZW51","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnp1bA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm5kLnp6YXp6LmRlY2sreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vdm9pY2V4bWwreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vd2lkZ2V0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vd2luaGxw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vd3NkbCt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vd3Nwb2xpY3kreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC03ei1jb21wcmVzc2Vk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1hYml3b3Jk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1hY2UtY29tcHJlc3NlZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1hcHBsZS1kaXNraW1hZ2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1hdXRob3J3YXJlLWJpbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1hdXRob3J3YXJlLW1hcA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1hdXRob3J3YXJlLXNlZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1iY3Bpbw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1iaXR0b3JyZW50","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1ibG9yYg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1iemlw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1iemlwMg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1jYnI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1jZGxpbms=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1jZnMtY29tcHJlc3NlZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1jaGF0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1jaGVzcy1wZ24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1jb25mZXJlbmNl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1jcGlv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1jc2g=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1kZWJpYW4tcGFja2FnZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1kZ2MtY29tcHJlc3NlZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1kaXJlY3Rvcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1kb29t","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1kdGJuY3greG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1kdGJvb2sreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1kdGJyZXNvdXJjZSt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1kdmk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1lbnZveQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1ldmE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1mb250LWJkZg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1mb250LWdob3N0c2NyaXB0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1mb250LWxpbnV4LXBzZg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1mb250LW90Zg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1mb250LXBjZg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1mb250LXNuZg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1mb250LXR0Zg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1mb250LXR5cGUx","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1mb250LXdvZmY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1mcmVlYXJj","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1mdXR1cmVzcGxhc2g=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1nY2EtY29tcHJlc3NlZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1nbHVseA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1nbnVtZXJpYw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1ncmFtcHMteG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1ndGFy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1oZGY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1pbnN0YWxsLWluc3RydWN0aW9ucw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1pc285NjYwLWltYWdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1qYXZhLWpubHAtZmlsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1sYXRleA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1semgtY29tcHJlc3NlZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1taWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tb2JpcG9ja2V0LWVib29r","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tcy1hcHBsaWNhdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tcy1zaG9ydGN1dA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tcy13bWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tcy13bXo=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tcy14YmFw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tc2FjY2Vzcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tc2JpbmRlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tc2NhcmRmaWxl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tc2NsaXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tc2Rvd25sb2Fk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tc21lZGlhdmlldw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tc21ldGFmaWxl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tc21vbmV5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tc3B1Ymxpc2hlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tc3NjaGVkdWxl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tc3Rlcm1pbmFs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1tc3dyaXRl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1uZXRjZGY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1uemI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1wa2NzMTI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1wa2NzNy1jZXJ0aWZpY2F0ZXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1wa2NzNy1jZXJ0cmVxcmVzcA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1yYXItY29tcHJlc3NlZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1yZXNlYXJjaC1pbmZvLXN5c3RlbXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1zaA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1zaGFy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1zaG9ja3dhdmUtZmxhc2g=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1zaWx2ZXJsaWdodC1hcHA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1zcWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1zdHVmZml0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1zdHVmZml0eA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1zdWJyaXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1zdjRjcGlv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC1zdjRjcmM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC10M3ZtLWltYWdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC10YWRz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC10YXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC10Y2w=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC10ZXg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC10ZXgtdGZt","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC10ZXhpbmZv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC10Z2lm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC11c3Rhcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC13YWlzLXNvdXJjZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkOyBjaGFyc2V0PQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC14NTA5LWNhLWNlcnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC14Zmln","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC14bGlmZit4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC14cGluc3RhbGw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC14eg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC15YW1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veC16bWFjaGluZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veGFtbCt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veGNhcC1kaWZmK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veGVuYyt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veGh0bWwreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veG1sLWR0ZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veG9wK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veHByb2MreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veHNsdCt4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veHNwZit4bWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veHYreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veWFuZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24veWluK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbGljYXRpb24vemlw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXBwc1VzZUxpZ2h0VGhlbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QVJBQklDX0NIQVJTRVQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXJndW1lbnRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXJyYXlEYXRh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXJyYXlUeXBlSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNCb29sZWFu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNDdXJyZW5jeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNFeHRlbmRlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNJbnN0YW5jZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNJbnRlZ2Vy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNJbnRlcmZhY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNPYmplY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNPcmRpbmFs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QVNwaW5Db3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNSZWNvcmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzaWduUHJvY2Vzc1RvSm9iT2JqZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QVN0YXJ0SW5kZXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNVSW50NjQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNWYXJpYW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNWYXJSZWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QVR5cGVJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vYWRwY20=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vYmFzaWM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vbWlkaQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vbXA0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vbXBlZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vb2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vczNt","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vc2lsaw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vdm5kLmRlY2UuYXVkaW8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vdm5kLmRpZ2l0YWwtd2luZHM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vdm5kLmRyYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vdm5kLmR0cw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vdm5kLmR0cy5oZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vdm5kLmx1Y2VudC52b2ljZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vdm5kLm1zLXBsYXlyZWFkeS5tZWRpYS5weWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vdm5kLm51ZXJhLmVjZWxwNDgwMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vdm5kLm51ZXJhLmVjZWxwNzQ3MA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vdm5kLm51ZXJhLmVjZWxwOTYwMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vdm5kLnJpcA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8vd2VibQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8veC1hYWM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8veC1haWZm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8veC1jYWY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8veC1mbGFj","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8veC1tYXRyb3NrYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8veC1tcGVndXJs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8veC1tcy13YXg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8veC1tcy13bWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8veC1wbi1yZWFsYXVkaW8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8veC1wbi1yZWFsYXVkaW8tcGx1Z2lu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8veC13YXY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXVkaW8veG0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aG9yaXphdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QVZhclR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXotQ3lybC1BWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXotTGF0bi1BWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QkFMVElDX0NIQVJTRVQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZTY0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZTY0QmluYXJ5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZUV4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZU9mQ29kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZU9mRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZVR5cGVA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmNkXV1dXV1dXV1dXQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YkNlcnRpZmljYXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QkRTVW50aGVtZWREZXNpZ25lcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmVmb3JlRGVzdHJ1Y3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5QYWludA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5SZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5Xcml0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmlCaXRDb3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmlDbHJJbXBvcnRhbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmlDbHJVc2Vk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmlDb21wcmVzc2lvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmlnRW5kaWFu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmluLmJhc2U2NA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5T3A=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YkluaGVyaXRIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmlQbGFuZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmlTaXplSW1hZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmlTeXN0ZW1NZW51YmlNaW5pbWl6ZWJpTWF4aW1pemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Qmx0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmlYUGVsc1Blck1ldGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmlZUGVsc1Blck1ldGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qmx1ZS1HcmF5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ym1CaXRzUGl4ZWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ym1IZWlnaHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ym1QbGFuZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ym1XaWR0aEJ5dGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qm90dG9tRGVzY3JpcHRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qm90dG9tUmlnaHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QnJpZ2h0IEdyZWVu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QnJpbmdXaW5kb3dUb1RvcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QlJPS0VOJTIuMmQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"QnJvd3NlZFVuY1BhdGg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YnMtQ3lybC1CQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YnMtTGF0bi1CQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YnN0ckRlc2NyaXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YnN0ckhlbHBGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YnN0clNvdXJjZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"YnVmZmVyIGVycm9yICgtNSk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qnl0ZUNvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Qnl0ZUluZGV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ynl0ZXM9MC0x","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2FGcmVlY2FNaW5pbWl6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbE5leHRIb29rRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFdpbmRvd1Byb2NX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y0FsdGVybmF0ZUZpbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuIHByb2Nlc3MgY29tbWFuZC1saW5lIGZyb20gb3RoZXIgaW5zdGFuY2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuJ3QgaW5zZXJ0IG93biBwYXJlbnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsIGV2ZW50","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2Fubm90IHByb2Nlc3MgY29tbWFuZC1saW5lIGZyb20gb3RoZXIgaW5zdGFuY2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2Fubm90IHJlZ2lzdGVyIHRoZW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2Fubm90IHJlbGVhc2UgdGhlbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2Fubm90IHVucmVnaXN0ZXIgdW5rbm93biB0aGVtZSAlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FzdFRvT2xl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FzdFRvVmFyUmVj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2F0ZWdvcnlidXR0b25z","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2F0ZWdvcnlwYW5lbGdyb3Vw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2JDbHNFeHRyYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2JXbmRFeHRyYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2MzMiVkbXQuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2NQYXNjYWxjY1N0ZENhbGxjY1NhZmVDYWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2VudGVyUG9pbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2VydENyZWF0ZUNlcnRpZmljYXRlQ2hhaW5FbmdpbmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2VydENyZWF0ZUNlcnRpZmljYXRlQ29udGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEZyZWVDZXJ0aWZpY2F0ZUNoYWlu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEZyZWVDZXJ0aWZpY2F0ZUNoYWluRW5naW5l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEdldENlcnRpZmljYXRlQ2hhaW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2VydFZlcmlmeUNlcnRpZmljYXRlQ2hhaW5Qb2xpY3k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2ZGb3JtYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y0ZpbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUGFzc3dvcmQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhcmFjdGVyaXN0aWNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhckNvZGVVbnVzZWRGaWxsZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhckNvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2hhckNvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhckluZGV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhckxvd2VyQnVmZkE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhckxvd2VyQnVmZlc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhckxvd2VyVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhck5leHRX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhclVwcGVyQnVmZkE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhclVwcGVyQnVmZlc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhclVwcGVyVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2hlY2tsaXN0Ym94","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tNZW51SXRlbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tTdW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tTdW1NYXBwZWRGaWxl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2hlbWljYWwveC1jZHg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2hlbWljYWwveC1jaWY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2hlbWljYWwveC1jbWRm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2hlbWljYWwveC1jbWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2hlbWljYWwveC1jc21s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2hlbWljYWwveC14eXo=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hpbGRXaW5kb3dGcm9tUG9pbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hpbGRXaW5kb3dGcm9tUG9pbnRFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q0hJTkVTRUJJRzVfQ0hBUlNFVA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hvb3NlQ29sb3JX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hvb3NlRm9udFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2wzRERrU2hhZG93","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2wzRExpZ2h0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhQWxpY2VibHVl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhQW50aXF1ZXdoaXRl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhQXF1YW1hcmluZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhQXp1cmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhQmlzcXVl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhQmxhbmNoZWRhbG1vbmQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhQmx1ZXZpb2xldA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhQnJvd24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhQnVybHl3b29k","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhQ2FkZXRibHVl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhQ2hhcnRyZXVzZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhQ2hvY29sYXRl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhQ29ybmZsb3dlcmJsdWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhQ29ybnNpbGs=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhQ3JpbXNvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xBY3RpdmVCb3JkZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xBY3RpdmVDYXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya2JsdWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya2N5YW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya2dvbGRlbnJvZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya2dyYXk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya2dyZWVu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya2dyZXk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya2toYWtp","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya21hZ2VudGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya29saXZlZ3JlZW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya29yYW5nZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya29yY2hpZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya3JlZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya3NhbG1vbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya3NlYWdyZWVu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya3NsYXRlYmx1ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya3NsYXRlZ3JheQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya3NsYXRlZ3JleQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya3R1cnF1b2lzZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGFya3Zpb2xldA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGVlcHBpbms=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGVlcHNreWJsdWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGltZ3JheQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRGltZ3JleQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRG9kZ2VyYmx1ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRmlyZWJyaWNr","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRmxvcmFsd2hpdGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRm9yZXN0Z3JlZW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhRnVjaHNpYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhR2FpbnNib3Jv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhR2hvc3R3aGl0ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhR29sZGVucm9k","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhR3JlZW55ZWxsb3c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhSG9uZXlkZXc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhSG90cGluaw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhSW5kaWFucmVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhSW5kaWdv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhSXZvcnk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGF2ZW5kZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGF2ZW5kZXJibHVzaA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGF3bmdyZWVu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGVtb25jaGlmZm9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGlnaHRibHVl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGlnaHRjb3JhbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGlnaHRjeWFu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGlnaHRnb2xkZW5yb2R5ZWxsb3c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGlnaHRncmF5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGlnaHRncmVlbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGlnaHRncmV5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGlnaHRwaW5r","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGlnaHRzYWxtb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGlnaHRzZWFncmVlbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGlnaHRza3libHVl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGlnaHRzbGF0ZWdyYXk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGlnaHRzbGF0ZWdyZXk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGlnaHRzdGVlbGJsdWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGlnaHR5ZWxsb3c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTGltZWdyZWVu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTWFnZW50YQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTWFyb29u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTWVkaXVtYXF1YW1hcmluZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTWVkaXVtYmx1ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTWVkaXVtb3JjaGlk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTWVkaXVtcHVycGxl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTWVkaXVtc2VhZ3JlZW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTWVkaXVtc2xhdGVibHVl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTWVkaXVtc3ByaW5nZ3JlZW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTWVkaXVtdHVycXVvaXNl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTWVkaXVtdmlvbGV0cmVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTWlkbmlnaHRibHVl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTWludGNyZWFt","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTWlzdHlyb3Nl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTW9jY2FzaW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhTmF2YWpvd2hpdGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhT2xkbGFjZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhT2xpdmVkcmFi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhT3Jhbmdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhT3JhbmdlcmVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhT3JjaGlk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhUGFsZWdvbGRlbnJvZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhUGFsZWdyZWVu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhUGFsZXR1cnF1b2lzZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhUGFsZXZpb2xldHJlZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhUGFwYXlhd2hpcA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhUGVhY2hwdWZm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhUG93ZGVyYmx1ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xBcHBXb3JrU3BhY2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhUHVycGxl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhUm9zeWJyb3du","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhUm95YWxibHVl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhU2FkZGxlYnJvd24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhU2FsbW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhU2FuZHlicm93bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhU2VhZ3JlZW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhU2Vhc2hlbGw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhU2llbm5h","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhU2lsdmVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhU2t5Ymx1ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhU2xhdGVibHVl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhU2xhdGVncmF5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhU2xhdGVncmV5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhU3ByaW5nZ3JlZW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3NJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3NOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3NOYW1lSXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3NQYXJlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3NSZWZBdHRyRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3NUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhU3RlZWxibHVl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhVGhpc3RsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhVG9tYXRv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhVHVycXVvaXNl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhVmlvbGV0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhV2hpdGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhV2hpdGVzbW9rZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhWWVsbG93","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xhWWVsbG93Z3JlZW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xCYWNrZ3JvdW5k","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xCdG5GYWNl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xCdG5IaWdobGlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xCdG5TaGFkb3c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xCdG5UZXh0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xDYXB0aW9uVGV4dA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xEZWZhdWx0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xlYW51cEluc3RhbmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xlYXJpbmcgY2xpcGJvYXJk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xlYXJpbmcgY2xpcGJvYXJkLCBkZWxldGVkIGNsaXBib2FyZCB0ZW1wb3JhcnkgZm9sZGVyICIlcyIgLSAlZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xGdWNoc2lh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xHcmFkaWVudEFjdGl2ZUNhcHRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xHcmFkaWVudEluYWN0aXZlQ2FwdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xHcmF5VGV4dA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xIaWdobGlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xIaWdobGlnaHRUZXh0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xIb3RMaWdodA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpZW50VG9TY3JlZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xJbmFjdGl2ZUJvcmRlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xJbmFjdGl2ZUNhcHRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xJbmFjdGl2ZUNhcHRpb25UZXh0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xJbmZvQms=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xJbmZvVGV4dA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpcEN1cnNvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xNZWRHcmF5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xNZW51QmFy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xNZW51SGlnaGxpZ2h0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xNZW51VGV4dA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xNb25leUdyZWVu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VFbmhNZXRhRmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VQcmludGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xvc2Vzb2NrZXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaGVtZURhdGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2luZyBtYWluIHdpbmRvdw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xTY3JvbGxCYXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q0xTSURfV0lDSW1hZ2luZ0ZhY3Rvcnk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q0xTSURGcm9tU3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xTa3lCbHVl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xXaW5kb3c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xXaW5kb3dGcmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xXaW5kb3dUZXh0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y25FeHRyYWN0ZWRjbkRlbGV0aW5nY25SZW1vdmVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y25FeHRyYWN0aW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29BZGRSZWZTZXJ2ZXJQcm9jZXNz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29kZUFkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29kZUluc3RhbmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29EaXNjb25uZWN0T2JqZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29GcmVlVW51c2VkTGlicmFyaWVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDbGFzc09iamVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplRXg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29sQWxpZ21lbnRz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29Mb2NrT2JqZWN0RXh0ZXJuYWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29sb3JQcmV2YWxlbmNl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29sdW1uIG9yZGVyIG91dCBvZiBib3VuZHM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29sV2lkdGhz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tYmluZVJnbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tYm9Cb3hFeDMy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y29tY3RsMzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y29tbWRsZ19GaW5kUmVwbGFjZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y29tbWRsZ19oZWxw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZUJyb3dzZXJWZXJzaW9ucw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZU9w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ09yZGluYWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHRocmVhZDo6VENvbXBUaHJlYWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdE5hbWVkUGlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y29uc3QgVENvcHlQYXJhbVJ1bGUgKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y29uc3QgVENvcHlQYXJhbVR5cGUgKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y29uc3QgVENvcHlQYXJhbVR5cGUgKlsyXQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y29uc3QgVEN1c3RvbUNvbW1hbmRUeXBlICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y29uc3QgVEVkaXRvclByZWZlcmVuY2VzICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y29uc3RydWN0b3I=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGVudCBUeXBl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGVudC1EaXNwb3NpdGlvbjogZm9ybS1kYXRhOyBuYW1lPSI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGVudC1FbmNvZGluZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGVudC1MYW5ndWFnZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGVudC1MZW5ndGg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGVudC1UeXBl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGVudC1UeXBlOg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGVudGlvbkNvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGludWF0aW9uc09uRXJyb3I=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udHJvbCBQYW5lbFxEZXNrdG9w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y29udHJvbGJhcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udHJvbENsYXNz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udHJvbERhdGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udHJvbGxlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udHJvbE9mcyUuOFglLjhY","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udmVydEZpYmVyVG9UaHJlYWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29udmVydFRocmVhZFRvRmliZXJFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29weUVuaE1ldGFGaWxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29weUljb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29weUltYWdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29weVBhcmFtQXV0b1NlbGVjdHM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29weVNpZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29SZWxlYXNlU2VydmVyUHJvY2Vzcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29SZXN1bWVDbGFzc09iamVjdHM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29TdXNwZW5kQ2xhc3NPYmplY3Rz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29UYXNrTWVtQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29UYXNrTWVtRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29VbmluaXRpYWxpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q291bnRDbGlwYm9hcmRGb3JtYXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29XYWl0Rm9yTXVsdGlwbGVIYW5kbGVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JBcHBTdGFydA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JEZWZhdWx0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQWNjZWxlcmF0b3JUYWJsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQmluZEN0eA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQml0bWFw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQnJ1c2hJbmRpcmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ2FyZXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29tcGF0aWJsZUJpdG1hcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29tcGF0aWJsZURD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29yZVdlYlZpZXcyRW52aXJvbm1lbnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29yZVdlYlZpZXcyRW52aXJvbm1lbnRXaXRoT3B0aW9ucw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlZCBmYWtlIGNsaXBib2FyZCBkaXJlY3RvcnkgIiVzIiBhbmQgc3RhcnRlZCBkcml2ZSBtb25pdG9ycw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRENX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRElCaXRtYXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRElCU2VjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JlYXRlRG9jdW1lbnRUeXBl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRW5oTWV0YUZpbGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXJyb3JJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmliZXJFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZU1hcHBpbmdB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZU1hcHBpbmdX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRm10","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRm10SGVscA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRm9udEluZGlyZWN0Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSGFsZnRvbmVQYWxldHRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSGVscA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSWNvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSWNvbkluZGlyZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSUNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSW9Db21wbGV0aW9uUG9ydA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTWVudQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTXV0ZXhB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTXV0ZXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTmFtZWRQaXBlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUGFsZXR0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUGF0dGVybkJydXNo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUGVu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUGVuSW5kaXJlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUGlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUG9wdXBNZW51","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJvY2Vzc0E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJvY2Vzc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUmVjdFJnbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUmVjdFJnbkluZGlyZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUmVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUmVzRm10","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUmVzRm10SGVscA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUmVzSGVscA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU29saWRCcnVzaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU3RyZWFtT25IR2xvYmFs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVVJMTW9uaWtlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2luZG93RXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRvckJhY2tUcmFjZUluZGV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JFcXVhbGNyR3JlYXRlclRoYW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JIYW5kUG9pbnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JIb3VyR2xhc3M=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JIU3BsaXQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JpdGljYWxTZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JMZXNzVGhhbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JNdWx0aURyYWc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JTaXplQWxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JTaXplTkVTVw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JTaXplTldTRQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JTaXplV0U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JTUUxXYWl0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JVcEFycm93","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3JWU3BsaXQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRBY3F1aXJlQ29udGV4dFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRHZW5SYW5kb20=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3J5cHRvbm90ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRSZWxlYXNlQ29udGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3VycmVuY3lEZWNpbWFscw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3VycmVuY3lGb3JtYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3VycmVuY3lTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3VycmVudEJ1aWxk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3VycmVudEJ1aWxkTnVtYmVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3VycmVudE1ham9yVmVyc2lvbk51bWJlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3VycmVudE1pbm9yVmVyc2lvbk51bWJlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3VycmVudFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3VzdG9tQ29tbWFuZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3VzdG9tZGlydmlldzo6VEZpbGVGaWx0ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGFyayBibHVl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGFyayBHcmVlbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGFyayBSZWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGFyayBUZWFs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGFyayBZZWxsb3c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGFya09mZmljZVhQ","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGF0YSBlcnJvciAoLTMp","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGF0YWJhc2UuYWNjY2I=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"RGF0YURpcmVjdG9yeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGF0YUluc3RhbmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGF0YW5hdmJ1dHRvbnM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGF0ZXBpY2tlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGF0ZVNlcGFyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGF2bW91bnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"REFYUGFya2luZ1dpbmRvdw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGF5bGlnaHRCaWFz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGF5bGlnaHREYXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGF5bGlnaHROYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGQgbW1tbSB5eXl5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGRkLCBkZCBtbW0geXl5eSBoaDpubjpzcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGRkZCwgZGQgTU1NTU0geXl5eSBISDpubjpzcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZERlbGV0ZSBmaWxl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RERNX1Byb2Nlc3NEcm9wcGVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVjaW1hbFNlcGFyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGVmYXVsdC4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"REVGQVVMVF9DSEFSU0VU","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdEhhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdHM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdFVzclB3","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdFVzclB3RG0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVmRnJhbWVQcm9jVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVmTURJQ2hpbGRQcm9jVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVmV2luZG93UHJvY1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlQ3JpdGljYWxTZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlREM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRW5oTWV0YUZpbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmliZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlTWVudQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlT2JqZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlVm9sdW1lTW91bnRQb2ludFc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVscGhpIENvbXBvbmVudA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVscGhpIFBpY3R1cmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVscGhpJS44WA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVscGhpSW50ZXJmYWNlPElDb21wYXJlcl9fMTxpbnQ+ID4gKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVscGhpSW50ZXJmYWNlPElDb21wYXJlcl9fMTxVbmljb2RlU3RyaW5nPiA+ICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVscGhpUk1fR2V0T2JqZWN0SW5zdGFuY2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVyZWdpc3RlckV2ZW50U291cmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"REVTQ1JJUFRJT04=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzaWduX1RpbWVfTG9jaw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzaWduU2l6ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzdGluYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzdGluYXRpb25JbmRleA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzdHJveUNhcmV0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzdHJveUN1cnNvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzdHJveUljb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzdHJveWluZyBtYWluIHdpbmRvdw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzdHJveU1lbnU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzdHJveVdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGVzdHJ1Y3Rvcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGltQ291bnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZGlyZWN0b3J5","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0b3J5bW9uaXRvcjo6VERpcmVjdG9yeU1vbml0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RElSVVAlMi4yZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsaW5nIHdpbmRvdw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlzY29ubmVjdE5hbWVkUGlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGF0Y2g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGF0Y2hNZXNzYWdlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGF0Y2hNZXNzYWdlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlzcG9zZU9m","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlzdGFuY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RExHVEVNUExBVEU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGxsQ2hhcmFjdGVyaXN0aWNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1BdXRvbWF0aWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1CaXRzUGVyUGVs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1Db2xsYXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1Db3BpZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1EZWZhdWx0U291cmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1EZXZpY2VOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1EaXNwbGF5RmxhZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1EaXNwbGF5RnJlcXVlbmN5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1EaXRoZXJUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1Ecml2ZXJFeHRyYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1Ecml2ZXJWZXJzaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1EdXBsZXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1Gb3JtTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1JQ0NNYW51ZmFjdHVyZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1JQ0NNb2RlbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1JQ01JbnRlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1JQ01NZXRob2Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1Mb2dQaXhlbHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1NZWRpYVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1PcmllbnRhdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1QYW5uaW5nSGVpZ2h0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1QYW5uaW5nV2lkdGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1QYXBlckxlbmd0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1QYXBlclNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1QYXBlcldpZHRo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1QZWxzSGVpZ2h0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1QZWxzV2lkdGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1QcmludFF1YWxpdHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1TcGVjVmVyc2lvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1UVE9wdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG1ZUmVzb2x1dGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG9jdW1lbnRQcm9wZXJ0aWVzVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG9jdW1lbnRz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"RG9jdW1lbnRz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"RG9EcmFnRHJvcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG9GdW5jdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RE9NVmVuZG9yRGVzYw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG9Pd25zS2V5cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG9Pd25zVmFsdWVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG9Qcm9jZWR1cmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG91YmxlQnVmZmVyZWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG93TG9jYWxlRGVmYXVsdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG93TW9uZGF5ZG93VHVlc2RheQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRlZCB0byBwYXN0ZSB0YXJnZXQuLi4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRlZEZpbGVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRpbmcgdG8gcGFzdGUgdGFyZ2V0Li4u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRzQ29tbWFuZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRzRHJhZ0Ryb3BFeHRlcm5hbEV4dA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRzRHJhZ0Ryb3BFeHRlcm5hbEV4dFRhcmdldFVua25vd24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRzRHJhZ0Ryb3BFeHRlcm5hbFRlbXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRzRHJhZ0Ryb3BGYWtlRmlsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRzRHJhZ0Ryb3BJbnRlcm5hbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RG93bmxvYWRzRHJhZ0Ryb3BRdWV1ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG93U2F0dXJkYXlkb3dTdW5kYXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG93VGh1cnNkYXlkb3dGcmlkYXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZG93V2VkbmVzZGF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ0FjY2VwdEZpbGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ2Ryb3A6OlREYXRhT2JqZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ2Ryb3A6OlREREludGVyZmFjZWRPYmplY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ2Ryb3A6OlREcmFnRHJvcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ2Ryb3BmaWxlc2V4OjpURGF0YU9iamVjdEZpbGVzRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ2Ryb3BmaWxlc2V4OjpURHJhZ0Ryb3BGaWxlc0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RFJBR0ZJTEVT","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ0ZpbmlzaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1F1ZXJ5RmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhd0NhcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhd0VkZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhd0ZvY3VzUmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhd0ZyYW1lQ29udHJvbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhd0ljb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhd0ljb25FeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhd01lbnVCYXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhd1RleHRFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhd1RleHRX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhd1RoZW1lQmFja2dyb3VuZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhd1RoZW1lRWRnZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhd1RoZW1lSWNvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhd1RoZW1lUGFyZW50QmFja2dyb3VuZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhd1RoZW1lVGV4dA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVzIGZvdW5kOiAlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHNiLURFLGRzYixoc2I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHNCaXRmaWVsZHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHNEcmFnRW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHNEcmFnTGVhdmVkc0RyYWdNb3Zl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHNoU2VjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHVwSWdub3JlZHVwQWNjZXB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHVwbGljYXRlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHVwc0FsbG93ZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHVyYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdBc3BlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdGaWxlQXR0cmlidXRlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdGaWxlRGF0ZUxT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdGaWxlRGF0ZU1T","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdGaWxlRmxhZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdGaWxlRmxhZ3NNYXNr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdGaWxlT1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdGaWxlU3VidHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdGaWxlVHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdGaWxlVmVyc2lvbkxT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdGaWxlVmVyc2lvbk1T","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdIZWxwQ29udGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdIaWdoRGF0ZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdMZW5ndGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdMb3dEYXRlVGltZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdQcm9kdWN0VmVyc2lvbkxT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdQcm9kdWN0VmVyc2lvbk1T","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdSZXNlcnZlZDA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdSZXNlcnZlZDE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdTaWduYXR1cmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHdTdHJ1Y1ZlcnNpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHluQXJyQXR0ckRhdGE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHluQXJyRWxUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHluVW5pdE5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHluVW5pdE5hbWVGbGQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZV1dXV1dXV1dXV1dXV1dXQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUFib3J0ICY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUFib3J0ICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUFic3RyYWN0RXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUFjY2Vzc1Zpb2xhdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUFjY2Vzc1Zpb2xhdGlvbiAm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUFjY2Vzc1Zpb2xhdGlvbiAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUFjY2Vzc1Zpb2xhdGlvbjw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUFyZ3VtZW50RXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUFyZ3VtZW50TmlsRXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUFyZ3VtZW50T3V0T2ZSYW5nZUV4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUFzc2VydGlvbkZhaWxlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUFTVEVVUk9QRV9DSEFSU0VU","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWNlbHA0ODAw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWNlbHA3NDcw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWNlbHA5NjAw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWNMb3dlckNhc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWNOb3JtYWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUNvbW1hbmQgKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUNvbnRyb2xDYA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUNvbnRyb2xDRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUNvbnZlcnRFcnJvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWNVcHBlckNhc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RURpcmVjdG9yeU5vdEZvdW5kRXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RWRpdGVkIHJlbW90ZSBmaWxlIHRpbWVzdGFtcDogJXMsIE9yaWdpbmFsIHRpbWVzdGFtcDogJXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RWRpdEluYWN0aXZlU2Vzc2lvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RWRpdEluYWN0aXZlU2Vzc2lvblJlb3BlbkFjY2VwdGVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RWRpdEluYWN0aXZlU2Vzc2lvblJlb3BlblJlamVjdGVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RWRpdG9yQXV0b0NvbmZpZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RURpdkJ5WmVybw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUVuY29kaW5nRXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUV4dGVybmFs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUV4dGVybmFsICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUV4dGVybmFsRXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUZpbGVNYXNrc0V4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUZpbGVNYXNrc0V4Y2VwdGlvbiAm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUZpbGVOb3RGb3VuZEV4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUhlYXBFeGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUhlYXBFeGNlcHRpb24s","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUluT3V0QXJndW1lbnRFeGNlcHRpb25B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUluT3V0QXJndW1lbnRFeGNlcHRpb25QVQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUluT3V0RXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUluT3V0RXJyb3JB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUluc3VmZmljaWVudFJ0dGk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUluc3VmZmljaWVudFJ0dGk8Xlg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUludEVycm9ydA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUludEVycm9yWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUludGZDYXN0RXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUludGZDYXN0RXJyb3JQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUludE92ZXJmbG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUludE92ZXJmbG93TA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUludmFsaWRDYXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUludmFsaWRPcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUludmFsaWRPcEV4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUludmFsaWRQb2ludGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUludmFsaWRQb2ludGVyOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUludm9jYXRpb25FcnJvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RWxlbWVudENvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RWxlbWVudFNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RUxpc3RFcnJvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU1hdGhFcnJvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW1iYXJjYWRlcm8gVVJJIENsaWVudC8xLjA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU1vbml0b3IgIVU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU1vbml0b3JMb2NrRXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW1wdHlBc0FueVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW1wdHlDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW1wdHlXb3JraW5nU2V0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTWVudUl0ZW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTm9uQ2xpZW50RHBpU2NhbGluZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlU2Nyb2xsQmFy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlVGhlbWVEaWFsb2dUZXh0dXJl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlVGhlbWluZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5jb2RpbmdOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU5DUllQVEVEJTIuMmQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5kV3JpdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU5vQ29uc3RydWN0RXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU5vQ29uc3RydWN0RXhjZXB0aW9ubA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU5vTW9uaXRvclN1cHBvcnRFeGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU5vTW9uaXRvclN1cHBvcnRFeGNlcHRpb258IlU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU5vblB1YmxpY1R5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU5vblB1YmxpY1R5cGV0X1g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU5vdEltcGxlbWVudGVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU5vdEltcGxlbWVudGVkRCNV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU5vdFN1cHBvcnRlZEV4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU5vdFN1cHBvcnRlZEV4Y2VwdGlvbkw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5zdXJlQ2FwYWNpdHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW50cnlDb3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bUNhbGVuZGFySW5mb0V4Vw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bUNhbGVuZGFySW5mb1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bUNoaWxkV2luZG93cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bUNsaXBib2FyZEZvcm1hdHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bURldmljZURyaXZlcnM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bURpc3BsYXlNb25pdG9ycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bWVyYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bUZvbnRGYW1pbGllc0V4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bUZvbnRzVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVByaW50ZXJzVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVByb2Nlc3Nlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVByb2Nlc3NNb2R1bGVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVJlc291cmNlTmFtZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVN5c3RlbUxvY2FsZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVRocmVhZFdpbmRvd3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVdpbmRvd3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU9iamVjdERpc3Bvc2Vk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU9wZXJhdGlvbkNhbmNlbGxlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU9TRXh0RXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU91dE9mTWVtb3J5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RU92ZXJmbG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVBhY2thZ2VFcnJvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVBhdGhUb29Mb25nRXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVBhdGhUb29Mb25nRXhjZXB0aW9uNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVByaXZpbGVnZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVByb3BlcnR5Q29udmVydEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVByb3BlcnR5RXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVByb3BSZWFkT25seQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVByb3BXcml0ZU9ubHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVByb3BXcml0ZU9ubHlA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXF1YWxSZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXF1YWxTaWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXJhQ291bnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVJhbmdlRXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXJhT2Zmc2V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JDaGFyYWN0ZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXJyb3JDb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JDb2Rl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JMaW5l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZXJyb3JNZXNzYWdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZXMtRVNfdHJhZG5s","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVNhZmVjYWxsRXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVNhZmVjYWxsRXhjZXB0aW9uaCBV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVNraXBGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVNraXBGaWxlICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVNzaEZhdGFs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVNzaEZhdGFsICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVNzaEZhdGFsUDA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVNzaFRlcm1pbmF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVNzaFRlcm1pbmF0ZSAm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVN0YWNrT3ZlcmZsb3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVRlcm1pbmFs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVRlcm1pbmFsICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVVuZGVyZmxvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZVVwbG9hZHNDb21tYW5k","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnRBcnJheUNyZWF0ZUVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnRBcnJheUNyZWF0ZUVycm9yRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnRBcnJheUxvY2tlZEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnRCYWRJbmRleEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnRCYWRWYXJUeXBlRXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnREaXNwYXRjaEVycm9yPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnREaXNwYXRjaEVycm9yZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnRFcnJvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnRJbnZhbGlkQXJnRXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnRJbnZhbGlkQXJnRXJyb3JI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnRJbnZhbGlkTnVsbE9wRXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnRJbnZhbGlkT3BFcnJvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnROb3RJbXBsRXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnRPdXRPZk1lbW9yeUVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnRPdmVyZmxvd0Vycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnRUeXBlQ2FzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnRVbmV4cGVjdGVkRXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVZhcmlhbnRVbmV4cGVjdGVkRXJyb3J8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRDb3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhjZXB0QWRkcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhjZXB0Q2xhc3N4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhjZXB0aW9uICY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhjZXB0aW9uICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhjZXB0aW9uICpbMl0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhjZXB0aW9uMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhjZXB0aW9uQWRkcmVzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhjZXB0aW9uQ29kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhjZXB0aW9uRmxhZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhjZXB0aW9uSW5mb3JtYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhjZXB0aW9uUmVjb3Jk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhjZXB0T2JqZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhjbHVkZUF0dHI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhjbHVkZUNsaXBSZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVhFLExOSyxJQ08sQU5JLENVUixQSUYsSk9CLENQTA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhlY3V0aW5nLi4u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhlY3V0aW9uIGRvbmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdCBjb2RlOiAlZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFRocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFdpbmRvd3NFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhwYW5kZWRIZWlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhwYW5kRW52aXJvbm1lbnRTdHJpbmdzVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhwbGljaXRIZWlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhwbGljaXRMZWZ0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhwbGljaXRUb3A=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhwbGljaXRXaWR0aA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZXhwbG9yZXJiYXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXh0Q3JlYXRlUGVu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXh0ZW5kZWRJbWFnZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXh0ZW5zaW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXh0RXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXh0RXhjZXB0aW9uICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXh0RXhjZXB0aW9uICpbMl0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXh0RXhjZXB0aW9uYA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXh0Rmxvb2RGaWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXh0cmFjdFJhd0RhdGE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXh0cmFjdFJhd0RhdGFOb0NvcHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXh0VGV4dE91dFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVplcm9EaXZpZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RVplcm9EaXZpZGVE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Zl1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkFjcXVpcmVJbm5lckV4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmFrZSBjbGlwYm9hcmQgZGlyZWN0b3J5IHBhc3RlZCB0byAiJXMi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkFzRG91Ymxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkFzRXh0ZW5kZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkFzTWV0aG9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkFzT2JqZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkFzUG9pbnRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkFzU0J5dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkFzU2luZ2xl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkFzU0ludDY0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkFzU0xvbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkFzU1dvcmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkFzVUJ5dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkFzVUludDY0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkFzVUxvbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkFzVVdvcmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkF0dHJpYnV0ZUdldHRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmI6QysrSE9PSw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkJ1Y2tldHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkNvZGVQYWdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkNvbnRyb2xsZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkRpc3Bvc2Vy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZkRPU0ltYWdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmVfbGF1bmNo","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkZpZWxkVHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkZyZWVDb3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkZyZWVJbnN0SXRlbXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkdISUpLTE1OJk9QUVJT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rkhhc2hUYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkhlbHBDb250ZXh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmllbGRBZGRyZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmllbGRPZmZzZXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZmlsZSBlcnJvciAoLTEp","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZSBtYXBwaW5n","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUFsaWdubWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUVkaXRTdHlsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUZpbmRz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZWZvbGRlcg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUhlYWRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZU1hc2tVc2Vz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZU5hbWVNYXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZU5hbWVNYXBX","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZW9wZXJhdG9yOjpURmlsZU9wZXJhdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVRpbWVUb0Rvc0RhdGVUaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVRpbWVUb0xvY2FsRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVRpbWVUb1N5c3RlbVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsbFJlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluYWxpemluZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluYWxpemluZyBkb25l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZENsb3Nl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZENsb3NlQ2hhbmdlTm90aWZpY2F0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEV4ZWN1dGFibGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0Q2hhbmdlTm90aWZpY2F0aW9uVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEhhbmRsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEluc3RJdGVt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE1pbWVGcm9tRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRDaGFuZ2VOb3RpZmljYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZFJlc291cmNlRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZFJlc291cmNlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZFRleHRX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZFdpbmRvd0E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZFdpbmRvd0V4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZFdpbmRvd1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkluaXRpYWxpemVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkluaXRMb2Nr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RklubmVyRXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rkluc3RhbmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rkluc3RJdGVtcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlyZWRFdmVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmlyc3QgYXR0ZW1wdCB0byBkZWxldGUgcGFzdGVkIGZha2UgY2xpcGJvYXJkIGRpcmVjdG9yeSAiJXMiIC0gJWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmlyc3QgcnVuLCBzY2hlZHVsaW5nIHVwZGF0ZXMgY2hlY2sgZm9yIHRoZSBuZXh0IHJ1bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RklzU2luZ2xlQnl0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RklVbmtub3du","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rml4U3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmxhc2hXaW5kb3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxhdFNCX0VuYWJsZVNjcm9sbEJhcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxhdFNCX0dldFNjcm9sbEluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxhdFNCX0dldFNjcm9sbFBvcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxhdFNCX0dldFNjcm9sbFByb3A=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxhdFNCX0dldFNjcm9sbFJhbmdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxhdFNCX1NldFNjcm9sbEluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxhdFNCX1NldFNjcm9sbFBvcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxhdFNCX1NldFNjcm9sbFByb3A=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxhdFNCX1NldFNjcm9sbFJhbmdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxhdFNCX1Nob3dTY3JvbGxCYXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxkT2Zmc2V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxvYXRMZWZ0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxvYXRUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkxvY2FsZU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkxvY2tDb3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RkxvY2tFdmVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hDb25zb2xlSW5wdXRCdWZmZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hGaWxlQnVmZmVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hJbnN0cnVjdGlvbkNhY2hl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rk1heENhcGFjaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rk1heENoYXJTaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rk1CVG9XQ2hhckZsYWdz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rk1ldGhvZEJ1Y2tldHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyXFNoZWxsRXhcRHJhZ0Ryb3BIYW5kbGVycw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyXFNoZWxsRXhcRHJhZ0Ryb3BIYW5kbGVyc1w=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybWF0TWVzc2FnZUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybWF0TWVzc2FnZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rm9yd2FyZGVyU3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rk92ZXJmbG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rk93bmluZ1RocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnBEZWZhdWx0ZnBWYXJpYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnFDbGVhclR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnFDbGVhclR5cGVOYXR1cmFs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnFEZWZhdWx0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnFOb25BbnRpYWxpYXNlZGZxQW50aWFsaWFzZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlF1ZXVlTG9jaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJhY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVSZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVSZ24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlJlYWRTaWduYWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlJlY3Vyc2lvbkNvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlZWFkZHJpbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUNvbnNvbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUVuY29kaW5ncw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUVudmlyb25tZW50U3RyaW5nc0E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUVudmlyb25tZW50U3RyaW5nc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUluc3RhbmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZVJlc291cmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlJlZkNvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlc2ggc3RhbmRhcmQgaW5zdGFsbGF0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlJldmlzaW9uTGV2ZWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbUFuc2k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbUFycmF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbUJlZ2lubmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbU9yZGluYWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbVVuaWNvZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbVZhcmlhbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbVZhclJlYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlJ0dGlEYXRhU2l6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlNlbnRpbmVs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnNJdGFsaWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnNORGVub3JtYWxmc1Bvc2l0aXZlZnNOZWdhdGl2ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnNOWmVyb2ZzRGVub3JtYWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlNwaW5Db3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnNTdHJpa2VPdXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlN0YWNrSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnNVbmRlcmxpbmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlN5c0xhbmdz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlN5c3RlbTo6SUludGVyZmFjZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZlN5c3RlbUltYWdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlRhZ0NvdW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnRDcmVhdGlvblRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnREb3VibGVmdEV4dGVuZGVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnRMYXN0QWNjZXNzVGltZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnRMYXN0V3JpdGVUaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnRTaW5nbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlR5cGVJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlZhbHVlRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RlZhclR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RldhaXRRdWV1ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RldhaXRSZWN5Y2xl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RldDaGFyVG9NQkZsYWdz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RldyaXRlUmVjdXJzaW9uQ291bnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RldyaXRlcklE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"RldyaXRlU2lnbmFs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZyVzfCVzOiVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZyouanBnOyouanBlZzsqLmdpZjsqLnBuZzsqLnN2ZzsqLmJtcDsqLnJhdzsqLmljbzsqLmhlaWM7Ki53ZWJw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R0IyMzEyX0NIQVJTRVQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2RpRmx1c2g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R0VTVFVSRUNPTkZJRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2ludGVybmFsU3Vic2V0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X293bmVyRWxlbWVudA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3B1YmxpY0lk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X3N5c3RlbUlk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QUNQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWN0aXZlT2JqZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWN0aXZlV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0YWRkcmluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QW5jZXN0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QXJyYXlFbGVtZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QXJyYXlMZW5ndGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QXN5bmNLZXlTdGF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QXR0cmlidXRlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QXZhaWxhYmxlQ29yZVdlYlZpZXcyQnJvd3NlclZlcnNpb25TdHJpbmc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QmFzZUV4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Qml0bWFwQml0cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QnJ1c2hPcmdFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QnVmZmVyRW5jb2Rpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Qnl0ZUNvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2FsZW5kYXJJbmZvQQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2FsZW5kYXJJbmZvVw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2FwdHVyZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2FyZXRQb3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2hhckNvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2hhcnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xhc3NJbmZvVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xhc3NMb25nVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xhc3NOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpZW50UmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpcGJvYXJkRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpcGJvYXJkT3duZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpcEJveA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q1BJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q1BJbmZvRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudERpcmVjdG9yeUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudERpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudE9iamVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBvc2l0aW9uRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRoZW1lTmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3Vyc29y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3Vyc29yUG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGF0ZUZvcm1hdEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGF0ZUZvcm1hdFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0REM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RENFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGVjbGFyZWRGaWVsZHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGVjbGFyZWRJbmRleGVkUHJvcGVydGllcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGVjbGFyZWRNZXRob2Rz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGVjbGFyZWRQcm9wZXJ0aWVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGVza3RvcFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGV2aWNlQ2Fwcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGV2aWNlRHJpdmVyQmFzZU5hbWVB","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGV2aWNlRHJpdmVyQmFzZU5hbWVX","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGV2aWNlRHJpdmVyRmlsZU5hbWVB","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGV2aWNlRHJpdmVyRmlsZU5hbWVX","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RElCQ29sb3JUYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RElCaXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlyUGF0aA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZUV4Vw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlzcGxheU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGxnQ3RybElE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGxnSXRlbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RG91YmxlQ2xpY2tUaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHBpRm9yTW9uaXRvcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHJpdmVUeXBlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHJpdmVUeXBlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0RWxlbWVudEJ5SWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0RWxlbWVudHNCeVRhZ05hbWVOUw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5jb2Rpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5oTWV0YUZpbGVCaXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5oTWV0YUZpbGVEZXNjcmlwdGlvblc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5oTWV0YUZpbGVIZWFkZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5oTWV0YUZpbGVQYWxldHRlRW50cmllcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW51bWVyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRTdHJpbmdz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRTdHJpbmdzVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXJhWWVhck9mZnNldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXJyb3JJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVQcm9jZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVUaHJlYWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmllbGRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvU2l6ZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9jdXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9yZWdyb3VuZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1lQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0SGFzaENvZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0aG9zdGJ5bmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0SWNvbkluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0SW1hZ2VVbnVzZWRIZWFkZXJCeXRlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0SW5kZXhlZFByb3BlcnRpZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0SW5kZXhlZFByb3BlcnR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0SW50ZXJmYWNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0SW50ZXJmYWNlRW50cnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0SW50ZXJmYWNlVGFibGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5Ym9hcmRMYXlvdXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5Ym9hcmRMYXlvdXRMaXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5Ym9hcmRMYXlvdXROYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5Ym9hcmRTdGF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5TmFtZVRleHRX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5U3RhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEFjdGl2ZVBvcHVw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGVuZ3RoU2lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSUQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSURGcm9tTG9jYWxlTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSURGcm9tTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxUaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9naWNhbERyaXZlU3RyaW5nc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9naWNhbFByb2Nlc3NvckluZm9ybWF0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9uZ1BhdGhOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWFwcGVkRmlsZU5hbWVB","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWFwcGVkRmlsZU5hbWVX","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWF4Qnl0ZUNvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWF4Q2hhckNvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVudQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVudURlZmF1bHRJdGVt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVudUl0ZW1Db3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVudUl0ZW1JRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVudUl0ZW1JbmZvVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVudVN0YXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVudVN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVzc2FnZUV4dHJhSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVzc2FnZVBvcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVzc2FnZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVzc2FnZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWV0aG9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWV0aG9kcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlQmFzZU5hbWVB","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlQmFzZU5hbWVX","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVFeA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVFeEE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVFeFc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlRXhB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSW5mb3JtYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9uaXRvckluZm9X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmFtZUZyb21MQ0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmFtZUZyb21Mb2NhbGVJRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0bmFtZWluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmVhcmVzdENvbG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmVhcmVzdFBhbGV0dGVJbmRleA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0T2JqZWN0Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0T0VNQ1A=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0T3BlbkZpbGVOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0T3ZlcmxhcHBlZFJlc3VsdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UGFsZXR0ZUVudHJpZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UGFyZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0cGVlcm5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJlYW1ibGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJpdmF0ZVByb2ZpbGVTdHJpbmdX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0hlYXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc01lbW9yeUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1RpbWVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1dpbmRvd1N0YXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvZHVjdEluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvcGVydGllcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvcGVydHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvcFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UXVldWVkQ29tcGxldGlvblN0YXR1cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UXVldWVTdGF0dXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmVmZXJlbmNlVG9SYXdBcnJheUVsZW1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmVmZXJlbmNlVG9SYXdEYXRh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmduQm94","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U2F2ZUZpbGVOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U2Nyb2xsQmFySW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U2Nyb2xsSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U2Nyb2xsUG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U2Nyb2xsUmFuZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0c2VydmJ5bmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U2hvcnRQYXRoTmFtZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0c29ja25hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0c29ja29wdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RhcnR1cEluZm9B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RhcnR1cEluZm9X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RvY2tPYmplY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyZXRjaEJsdE1vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyaW5nVHlwZUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyaW5nVHlwZUV4QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyaW5nVHlwZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyaW5nVHlwZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3ViTWVudQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzQ29sb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzQ29sb3JCcnVzaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGVmYXVsdExhbmdJRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGVmYXVsdFVJTGFuZ3VhZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtTWVudQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtTWV0cmljcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtTWV0cmljc0ZvckRwaQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtUGFsZXR0ZUVudHJpZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGV4dENvbG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGV4dEV4dGVudFBvaW50MzJX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGV4dEV4dGVudFBvaW50Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGV4dE1ldHJpY3NX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVBcHBQcm9wZXJ0aWVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVCYWNrZ3JvdW5kQ29udGVudFJlY3Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVCYWNrZ3JvdW5kRXh0ZW50","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVCYWNrZ3JvdW5kUmVnaW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVCb29s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVDb2xvcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVEb2N1bWVudGF0aW9uUHJvcGVydHk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVFbnVtVmFsdWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVGaWxlbmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVGb250","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVJbnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVJbnRMaXN0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVNYXJnaW5z","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVNZXRyaWM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVQYXJ0U2l6ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVQb3NpdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVQcm9wZXJ0eU9yaWdpbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVSZWN0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVTdHJpbmc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVTeXNCb29s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVTeXNDb2xvcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVTeXNDb2xvckJydXNo","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVTeXNGb250","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVTeXNJbnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVTeXNTaXpl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVTeXNTdHJpbmc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVUZXh0RXh0ZW50","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhlbWVUZXh0TWV0cmljcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkQ29udGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkTG9jYWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkUHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkUHJpb3JpdHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkVGltZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkVUlMYW5ndWFnZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50NjQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZVpvbmVJbmZvcm1hdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9wV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXBkYXRlUmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMQ0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRVSUxhbmd1YWdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck9iamVjdEluZm9ybWF0aW9uVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VmVyc2lvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VmVyc2lvbkV4QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VmVyc2lvbkV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Vm9sdW1lSW5mb3JtYXRpb25X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Vm9sdW1lTmFtZUZvclZvbHVtZU1vdW50UG9pbnRX","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93REM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93TG9uZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93T3JnRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93UGxhY2VtZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93UmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93c0RpcmVjdG9yeUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93c0RpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGhlbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGhyZWFkUHJvY2Vzc0lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luTWV0YUZpbGVCaXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xhc3NTZXNzaW9uSWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsQWRkQXRvbVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRGVsZXRlQXRvbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRmFpbHVyZXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRmluZEF0b21X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsTG9jaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsTWVtb3J5U3RhdHVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2l6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsVW5sb2Nr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z01vbnRoRGF5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z251bWVyaWM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R3JheS0yNSU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R3JheS00MCU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R3JheS01MCU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R3JheS04MCU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"R1JFRUtfQ0hBUlNFVA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z3JmTG9ja3NTdXBwb3J0ZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z3JmU3RhdGVCaXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z1llYXJNb250aA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aGEtTGF0bi1ORw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SEFOR0VVTF9DSEFSU0VU","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGFzQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aGJyQmFja2dyb3VuZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcDMyRmlyc3Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcDMyTGlzdEZpcnN0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcDMyTGlzdE5leHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcDMyTmV4dA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEFsbG9j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcENyZWF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcERlc3Ryb3k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEZyZWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SEVCUkVXX0NIQVJTRVQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVscENvbnRleHR4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aEVuaE1ldGFGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aGV4QmluYXJ5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SEZBRWxlbWVudENvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SEZBRWxlbWVudFR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUNhcmV0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aGlqQGtsbW4tb3BxQXJzdHU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aGlqQGtsbW4tb3BxQXJzdHVCd3h5ent8fX4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aEluc3RhbmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGl0VGVzdFRoZW1lQmFja2dyb3VuZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SEtFWV9DTEFTU0VTX1JPT1Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SEtFWV9DVVJSRU5UX0NPTkZJRw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SEtFWV9DVVJSRU5UX1VTRVI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SEtFWV9EWU5fREFUQQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SEtFWV9MT0NBTF9NQUNISU5F","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SEtFWV9QRVJGT1JNQU5DRV9EQVRB","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SEtFWV9VU0VSUw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aE1ldGFGaWxlUGljdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SG9yaXpvbnRhbE9mZnNldA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SFBQR0VOQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SFBQR0VOQXR0cmlidXRlNQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHRvbmw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHRvbnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL2RpcmVjdDo4MA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvc29hcC9lbmNvZGluZy8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvc29hcC9lbnZlbG9wZS8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3d3dy5ib3JsYW5kLmNvbS9uYW1lc3BhY2VzL1R5cGVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3d3dy53My5vcmcvMTk5OS9YTUxTY2hlbWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3d3dy53My5vcmcvMjAwMC8xMC9YTUxTY2hlbWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3d3dy53My5vcmcvMjAwMC94bWxucy8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3d3dy53My5vcmcvMjAwMy8wNS9zb2FwLWVuY29kaW5n","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3d3dy53My5vcmcvMjAwMy8wNS9zb2FwLWVudmVsb3Bl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aHduZEZyb20=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUFkdmlzZVNpbmsw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUFzeW5jUmVzdWx0MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUNvbXBhcmVyPFN5c3RlbS5zdHJpbmc+MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUN1c3RvbUhlbHBWaWV3ZXIw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SURhdGFPYmplY3Qw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SWRlbnRpZmllcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SURpc3BhdGNoMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SURvY0hvc3RVSUhhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SURyb3BTb3VyY2Uw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SURyb3BUYXJnZXQw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUUoQUwoIiVzIiw0KSwiQUwoXCIlMDpzXCIsMykiLCJKSyhcIiUxOnNcIixcIiUwOnNcIikiKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1lcmFibGUw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1GT1JNQVRFVEMw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1TVEFUREFUQTA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1TdHJpbmcw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUVxdWFsaXR5Q29tcGFyZXI8U3lzdGVtLnN0cmluZz4w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWZfaW5kZXh0b25hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWZfbmFtZXRvaW5kZXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWZEaXNwSW50ZXJmYWNlaWZEaXNwYXRjaGlmSGFzUnR0aWlmVW51c2VkMWlmVW51c2VkMmlmTWV0aFJlZmlmVW51c2VkMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWZIYXNHdWlk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SWdub3JlRm9udFByb3BlcnR5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUhlbHBTZWxlY3RvcjA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUludGVyZmFjZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SUpLTE1OT1BRUlNUVVZXWFlaW1xdXl9gYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aUxvY2FsTG9jYWxEZWxldGVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UvYm1w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UvY2dt","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UvZzNmYXg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UvZ2lm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UvaWVm","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UvanBlZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uva3R4","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UvcG5n","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UvcHJzLmJ0aWY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvc2dp","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvc3ZnK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UvdGlmZg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvdm5kLmFkb2JlLnBob3Rvc2hvcA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvdm5kLmRlY2UuZ3JhcGhpYw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvdm5kLmRqdnU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvdm5kLmR2Yi5zdWJ0aXRsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvdm5kLmR3Zw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvdm5kLmR4Zg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvdm5kLmZhc3RiaWRzaGVldA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvdm5kLmZweA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvdm5kLmZzdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvdm5kLmZ1aml4ZXJveC5lZG1pY3MtbW1y","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvdm5kLmZ1aml4ZXJveC5lZG1pY3Mtcmxj","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvdm5kLm1zLW1vZGk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvdm5kLm1zLXBob3Rv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvdm5kLm5ldC1mcHg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvdm5kLndhcC53Ym1w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvdm5kLnhpZmY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2Uvd2VicA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC0zZHM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC1jbXUtcmFzdGVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC1jbXg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC1mcmVlaGFuZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC1pY29u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC1tcnNpZC1pbWFnZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC1wY3g=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC1waWN0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC1wb3J0YWJsZS1hbnltYXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC1wb3J0YWJsZS1iaXRtYXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC1wb3J0YWJsZS1ncmF5bWFw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC1wb3J0YWJsZS1waXhtYXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC1yZ2I=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC10Z2E=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC14Yml0bWFw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC14cGl4bWFw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2UveC14d2luZG93ZHVtcA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VCYXNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VEaXJlY3RvcnlFbnRyeVRvRGF0YQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1hZ2VobHAuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0FkZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0JlZ2luRHJhZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0NvcHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0NyZWF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0Rlc3Ryb3k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0RyYWdFbnRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0RyYWdMZWF2ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0RyYWdNb3Zl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0RyYWdTaG93Tm9sb2Nr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0RyYXc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0RyYXdFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0RyYXdJbmRpcmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0VuZERyYWc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0dldEJrQ29sb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0dldERyYWdJbWFnZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0dldEljb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0dldEljb25TaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0dldEltYWdlQ291bnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0dldEltYWdlSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X0xvYWRJbWFnZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X1JlYWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X1JlbW92ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X1JlcGxhY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X1JlcGxhY2VJY29u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X1NldEJrQ29sb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X1NldEljb25TaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X1NldEltYWdlQ291bnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X1NldE92ZXJsYXlJbWFnZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X1dyaXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VMaXN0X1dyaXRlRXg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VSdmFUb1NlY3Rpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2VSdmFUb1Zh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1tMzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SU1vbmlrZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1wbEdldHRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW1wb3J0Tm9kZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW5jb21wYXRpYmxlIHZlcnNpb24gKC02KQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5kZXggb3V0IG9mIGJvdW5kcy4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5kaXJlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW5ldF9hZGRy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW5ldF9udG9h","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW5ldF9udG9w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW5ldF9wdG9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5mbGF0ZVJlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW5oZXJpdGVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5oZXJpdHNGcm9t","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdENvbW1vbkNvbnRyb2xzRXg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNvbmRpdGlvblZhcmlhYmxl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUZsYXRTQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVByb2Nlc3NGb3JXc1dhdGNo","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNlY3VyaXR5RGVzY3JpcHRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNSV0xvY2s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdEluc3RhbmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5uZXJFeGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5PdXRTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5zZXJ0SWNvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5zZXJ0TWFza2Vk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5zZXJ0TWVudUl0ZW1X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5zZXJ0TWVudVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFuY2VTaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFuY2VUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW5zdWZmaWNpZW50IG1lbW9yeSAoLTQp","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50NjRBdHRyRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJmYWNl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRDb21wYXJlRXhjaGFuZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWREZWNyZW1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRFeGNoYW5nZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRFeGNoYW5nZUFkZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRJbmNyZW1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJuYWxDb21tYW5kVXBkYXRlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJuYWxIaWdo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJuYWxOYW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJuZXQgRXhwbG9yZXJfU2VydmVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJzZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJzZWN0Q2xpcFJlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJzZWN0c1dpdGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJ2YWwgc2luY2UgdGhlIGxhc3QgdXBkYXRlcyBjaGVjazogJS4yZg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZkZsYWdz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50Zkd1aWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50Zk1ldGhvZHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZlBhcmVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZlVuaXRGbGQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW52YWxpZCBpdGVtIGluZGV4","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW52YWxpZCBaU3RyZWFtIG9wZXJhdGlvbiE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW52YWxpZGF0ZVJlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW52YXJpYW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW9jdGxzb2NrZXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SU9sZUNsaWVudFNpdGUw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SU9sZUNvbW1hbmRUYXJnZXQw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SU9sZUNvbnRyb2ww","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SU9sZUNvbnRyb2xTaXRlMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SU9sZUluUGxhY2VBY3RpdmVPYmplY3Q8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SU9sZUluUGxhY2VGcmFtZXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SU9sZUluUGxhY2VPYmplY3Q8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SU9sZUluUGxhY2VTaXRlPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SU9sZUluUGxhY2VVSVdpbmRvdzw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SU9sZU9iamVjdDA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SU9sZVdpbmRvdzA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aU9wZW5lZCBleHRlcm5hbCBlZGl0b3Igd2l0aCByZW1vdGUgZmlsZSAiJXMiLg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVBlclByb3BlcnR5QnJvd3Npbmcw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVBlcnNpc3Qw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVBlcnNpc3RTdHJlYW1c","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVBlcnNpc3RTdHJlYW1Jbml0XA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVBpY3R1cmUw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVByb3BlcnR5Tm90aWZ5U2luazA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVJlYWRXcml0ZVN5bmMw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXMgYnVzeSwgY2Fubm90IHBhc3Rl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNBY2NlbGVyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNBcHBUaGVtZWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNCYWRSZWFkUHRy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNCYWRXcml0ZVB0cg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNDaGFyQWxwaGFOdW1lcmljVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNDaGFyQWxwaGFX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNDaGlsZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNDbGlwYm9hcmRGb3JtYXRBdmFpbGFibGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNDb250cm9s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNEQkNTTGVhZEJ5dGVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNEZWJ1Z2dlclByZXNlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNEaWFsb2dNZXNzYWdlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNEaWFsb2dNZXNzYWdlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNFcXVhbEdVSUQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVNlcXVlbnRpYWxTdHJlYW0w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVNlcnZpY2VQcm92aWRlcjA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNJY29uaWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVNpbXBsZUZyYW1lU2l0ZTA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNJbnN0YW5jZTw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNJbnN0YW5jZU9m","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNNYW5hZ2Vk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNPYmplY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNPYmplY3RJbnN0YW5jZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNPcmRpbmFs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNQdWJsaWNUeXBlXDVT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNSZWNvcmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNSZWN0RW1wdHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNSZWdpc3RlcmVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNTaW5nbGVCeXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNTdGFuZGFyZEVuY29kaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNUaGVtZUFjdGl2ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNUaGVtZUJhY2tncm91bmRQYXJ0aWFsbHlUcmFuc3BhcmVudA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNUaGVtZURpYWxvZ1RleHR1cmVFbmFibGVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNUaGVtZVBhcnREZWZpbmVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVN0cmVhbUQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWxpZENvZGVQYWdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWxpZExvY2FsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNXaW5kb3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNXaW5kb3dFbmFibGVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNXaW5kb3dVbmljb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNXaW5kb3dWaXNpYmxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNXb3c2NFByb2Nlc3M=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNab29tZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXRlbXMuSXRlbURhdGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXRlbXNWaWV3","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVR5cGVJbmZvMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aXUtQ2Fucy1DQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"aXUtTGF0bi1DQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVZhbHVlRGF0YTA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVZhckluc3RhbmNlUmVmZXJlbmNlMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVZhckludm9rZWFibGUw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVdpbkhlbHBUZXN0ZXIw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Slw7S0B3czM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SkNMXHNvdXJjZVxjb21tb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SkNMXHNvdXJjZVx3aW5kb3dz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SkNMREVCVUc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SmNsZGVidWc6OlRKY2xTdGFja0Jhc2VMaXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SmNsZGVidWc6OlRKY2xTdGFja0luZm9MaXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ampqampqampqampqampq","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"ampqampqampqampqampqag==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Sk9IQUJfQ0hBUlNFVA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SnNlcnNcSEFQVUJXU1xEb2N1bWVudHNc","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"SnVtcElEKCIiLCIlcyIp","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"SzMyR2V0TW9kdWxlRmlsZU5hbWVFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"S2JkTGF5ZXJEZXNjcmlwdG9y","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"S2VlcFVwVG9EYXRl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"S2VybmVsMzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"S2V5Ym9hcmRTZWxlY3Rpb25z","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"S2V5RGF0YUZpbGxlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"S2lsbFRpbWVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGFzdC1Nb2RpZmllZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGFzdERvY2s=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGFzdFJ2YVNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGF5b3V0IEZpbGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bGF5b3V0IHRleHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVhdmVDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxDb3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxUcmFkZU1hcmtz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bGZDaGFyU2V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bGZDbGlwUHJlY2lzaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bGZFc2NhcGVtZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bGZGYWNlTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bGZIZWlnaHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bGZPcmllbnRhdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bGZPdXRQcmVjaXNpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bGZQaXRjaEFuZEZhbWlseQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bGZRdWFsaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bGZTdHJpa2VPdXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bGZVbmRlcmxpbmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bGZXZWlnaHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGliTW9kdWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGlnaHQgQmx1ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGlnaHQgR3JlZW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGlnaHQgT3Jhbmdl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGlnaHQgVHVycXVvaXNl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGlnaHQgWWVsbG93","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TElOSyUyLjJk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bGlzdDM4MjA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGlzdFNlcGFyYXRvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bG1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEJpdG1hcFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEN1cnNvclc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZGVyRmxhZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEljb25X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEltYWdlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZGluZyBkcml2ZXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEtleWJvYXJkTGF5b3V0Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFJlc291cmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxDb21tYW5kcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxDdXN0b21Db21tYW5kUnVuczI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxlSUQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxlSURGcm9tTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxlTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGaWxlVGltZVRvRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxMb2NhbENvcGllc0NvbW1hbmQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxMb2NhbENvcGllc0RyYWdEcm9wSW50ZXJwYW5lbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxMb2NhbE1vdmVzQ29tbWFuZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxMb2NhbE1vdmVzRHJhZ0Ryb3BJbnRlcnBhbmVs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxTaG9ydGN1dHNDcmVhdGVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9ja0NvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9ja0ZpbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9ja1Jlc291cmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9ja1NlbWFwaG9yZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9ja1NldEZvcmVncm91bmRXaW5kb3c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9ja1dpbmRvd1VwZGF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bG9uZyBkb3VibGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ0RhdGVGb3JtYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ0RheU5hbWVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ01vbnRoTmFtZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ1RpbWVGb3JtYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwUHJpdmlsZWdlVmFsdWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TFBhcmFtRmlsbGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHBmblduZFByb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHBTZWN1cml0eURlc2NyaXB0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHBzekNsYXNzTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHBzekZpbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHBzek1lbnVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"THJlc3VsdEZyb21PYmplY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHN0cmNtcGlX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHN0cmNtcFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHN0cmNweW5X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHN0cmNweVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHN0cmxlbkE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHN0cmxlblc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWFBY3RpdmF0ZUFuZEVhdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TUFDX0NIQVJTRVQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWFEZWZhdWx0bWFBY3RpdmF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFnZWxsYW4gTVNXSEVFTA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFpbiB3aW5kb3cgZGVzdHJveWVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFpbiB3aW5kb3cgV01fQ0xPU0U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFqb3JJbWFnZVZlcnNpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFqb3JMaW5rZXJWZXJzaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFqb3JPcGVyYXRpbmdTeXN0ZW1WZXJzaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFqb3JTdWJzeXN0ZW1WZXJzaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFqb3JWZXJzaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFrZVdpdGhvdXRDb3B5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlZEZsZENvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWFuaWZlc3Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWFOb0FjdGl2YXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWFOb0FjdGl2YXRlQW5kRWF0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwQW5kTG9hZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwcGVkQWRkcmVzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlld09mRmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlydHVhbEtleVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwV2luZG93UG9pbnRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFza1NlbGVjdGlvbnM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWF4IHJvdW5kdHJpcDogJWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q2FwYWNpdHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q2hhcnNJbmNOdWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWF4SW50NjRWYWx1ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWF4TGVuZ3Ro","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWF4T3BlbmVkU2Vzc2lvbnM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWF4UXVldWVMZW5ndGg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TUJUb1dDaGFyRmxhZ3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TURJQ0xJRU5U","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWVudUNvbW1hbmQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWVudUZsYWc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWVudVBvcHVw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWVudVNob3dEZWxheQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWVzc2FnZS9yZmM4MjI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWVzc2FnZUJlZXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWVzc2FnZUJveFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWV0YWxpbms=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0aG9kQWRkcmVzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0aG9kS2luZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWV0aG9kTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IFNhbnMgU2VyaWY=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWluSW50NjRWYWx1ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWlub3JJbWFnZVZlcnNpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWlub3JMaW5rZXJWZXJzaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWlub3JPcGVyYXRpbmdTeXN0ZW1WZXJzaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWlub3JTdWJzeXN0ZW1WZXJzaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWlub3JWZXJzaW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWluVmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWtDbGFzc0NvbnN0cnVjdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWtDbGFzc0Rlc3RydWN0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWtDbGFzc0Z1bmN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWtDbGFzc1Byb2NlZHVyZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWtEZXN0cnVjdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWtPcGVyYXRvck92ZXJsb2Fk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWtQcm9jZWR1cmVta0Z1bmN0aW9ubWtDb25zdHJ1Y3Rvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWtTYWZlRnVuY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bWtTYWZlUHJvY2VkdXJl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TU0vZGQveXl5eQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW1tbSBkLCB5eXl5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW4tTU4sbW4tQ3lybCxtbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW4tTW9uZy1DTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW9kZWwvaWdlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW9kZWwvbWVzaA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW9kZWwvdm5kLmNvbGxhZGEreG1s","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW9kZWwvdm5kLmR3Zg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW9kZWwvdm5kLmdkbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW9kZWwvdm5kLmd0dw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW9kZWwvdm5kLm10cw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW9kZWwvdm5kLnZ0dQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW9kZWwvdnJtbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW9kZWwveDNkK2JpbmFyeQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW9kZWwveDNkK3ZybWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW9kZWwveDNkK3htbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9kdWxlMzJGaXJzdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9kdWxlMzJGaXJzdFc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9kdWxlMzJOZXh0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9kdWxlMzJOZXh0Vw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9kdWxlTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9uaXRvckZyb21Qb2ludA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9uaXRvckZyb21SZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9uaXRvckZyb21XaW5kb3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW9udGhjYWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW91c2Ugd2hlZWw6ICVzLCBtc2c6ICVkLCBzY3JvbGwgbGluZXM6ICVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW91c2U6ICVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW91c2VTZWxlY3Rpb25z","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW92ZUZpbGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW92ZVdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXBsYXllcmJ1dHRvbnM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TVMgU2FucyBTZXJpZg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TVMgU2hlbGwgRGxnIDI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TVNfV0lOSEVMUA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TXNjdGYuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXNjdGxzX2hvdGtleTMy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXNjdGxzX3Byb2dyZXNzMzI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXNjdGxzX3N0YXR1c2JhcjMy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXNjdGxzX3RyYWNrYmFyMzI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXNjdGxzX3VwZG93bjMy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TVNGVEVESVQuRExM","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TVNHX0VSUk9S","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TVNHX0lORk8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TVNHX1dBUk5JTkc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TXNnRmlsbGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TXNnV2FpdEZvck11bHRpcGxlT2JqZWN0cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TXNnV2FpdEZvck11bHRpcGxlT2JqZWN0c0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TVNIX1NDUk9MTF9MSU5FU19NU0c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TVNIX1dIRUVMU1VQUE9SVF9NU0c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TXNodG1sOjpfZGlfSUhUTUxEb2N1bWVudDIgKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TVNXSEVFTF9ST0xMTVNH","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TXVsRGl2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TXVsdGlCeXRlVG9XaWRlQ2hhcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXVsdGlwYXJ0L2Zvcm0tZGF0YTsgYm91bmRhcnk9","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXVzdFVuZGVyc3RhbmQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TXV0ZXhOUEFfVW5pdFZlcnNpb25pbmdf","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXZQcml2YXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXZQcm90ZWN0ZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXZQdWJsaWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXZQdWJsaXNoZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZUZyb21MQ0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZUZyb21Mb2NhbGVJRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZUluZGV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZUxpc3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZUxpc3RGbGQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmF0aXZlSW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmF0aXZlVUludA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmF2aWdhdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmItTk8sbmIsbm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TkJGbG9hdGluZ1dpbmRvd1BhcmVudF8lLjh4","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmVlZCBkaWN0aW9uYXJ5ICgyKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmVnYXRpdmVJbnRlZ2Vy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmVnQ3VyckZvcm1hdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmV0YXBpMzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmV0QXBpQnVmZmVyRnJlZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmV0R3JvdXBBZGQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmV0R3JvdXBEZWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmV0R3JvdXBFbnVt","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmV0TG9jYWxHcm91cEFkZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmV0TG9jYWxHcm91cEFkZE1lbWJlcnM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmV0TG9jYWxHcm91cERlbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmV0TG9jYWxHcm91cEVudW0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmV0VXNlckFkZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmV0VXNlckRlbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmV3IHZlcnNpb24gZGV0ZWN0ZWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TmV3SW5zdGFuY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bkZpbGVTaXplSGlnaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bkZpbGVTaXplTG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TklMIExpc3RWaWV3IHBvaW50ZXIu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm4tTk8sbm4sbm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm9dXV1dXV1dXV1wXV1dXV1dXV1dXV1dXV1dXV1dXXFyc3R1dnd4Jyd5XV1dXV16e3xdXV1dXX1+XV0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Tm9Ecml2ZXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Tm9Ecml2ZXMgbWFzazogJWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Tm9JbnRlcmFjdGl2ZUlucHV0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm9OYW1lc3BhY2VTY2hlbWFMb2NhdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm9uTmVnYXRpdmVJbnRlZ2Vy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm9uUG9zaXRpdmVJbnRlZ2Vy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Tm9ybWFsaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm9ybWFsaXpl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Tm9ybWFsaXplZExvY2FsZU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bm9ybWFsaXplZFN0cmluZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Tm9ybWFsaXplUmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Tm90aWZ5V2luRXZlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Tm9WaWV3T25Ecml2ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Tm9WaWV3T25Ecml2ZSBtYXNrOiAlZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bnRkbGwuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TlRETEwuRExM","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"bnRvaHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeUluZm9ybWF0aW9uVGhyZWFk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeU9iamVjdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnVtYmVyT2ZGdW5jdGlvbnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnVtYmVyT2ZMaW5lbnVtYmVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnVtYmVyT2ZOYW1lcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnVtYmVyT2ZSZWxvY2F0aW9ucw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnVtYmVyT2ZSdmFBbmRTaXplcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnVtYmVyT2ZTZWN0aW9ucw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnVtYmVyT2ZTeW1ib2xz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnVtYmVyUGFyYW1ldGVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2RDb21ib0JveEVkaXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2RHcmF5ZWRvZERpc2FibGVkb2RDaGVja2Vkb2RGb2N1c2Vkb2REZWZhdWx0b2RIb3RMaWdodG9kSW5hY3RpdmVvZE5vQWNjZWxvZE5vRm9jdXNSZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2RSZXNlcnZlZDE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2RSZXNlcnZlZDI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2RTZWxlY3RlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T0VNX0NIQVJTRVQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2Ygb2JqZWN0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZBbGxvd011bHRpU2VsZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZDcmVhdGVQcm9tcHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZEb250QWRkVG9SZWNlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZFbmFibGVJbmNsdWRlTm90aWZ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZFbmFibGVTaXppbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZFeE5vUGxhY2VzQmFy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZFeHRlbnNpb25EaWZmZXJlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZGaWxlTXVzdEV4aXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZGb3JjZVNob3dIaWRkZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2Zmc2V0Q2xpcFJnbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2Zmc2V0SGlnaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2Zmc2V0UmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2Zmc2V0V2luZG93T3JnRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZIaWRlUmVhZE9ubHlvZk5vQ2hhbmdlRGlyb2ZTaG93SGVscA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZOb0RlcmVmZXJlbmNlTGlua3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZOb05ldHdvcmtCdXR0b25vZk5vTG9uZ05hbWVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZOb1JlYWRPbmx5UmV0dXJu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZOb1Rlc3RGaWxlQ3JlYXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZOb1ZhbGlkYXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZPbGRTdHlsZURpYWxvZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZPdmVyd3JpdGVQcm9tcHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZQYXRoTXVzdEV4aXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZSZWFkT25seQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2ZTaGFyZUF3YXJl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xkQ3JlYXRlT3JkZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2xlMzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xlMzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2xlYXV0MzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xlQ3JlYXRlRm9udEluZGlyZWN0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xlQ3JlYXRlUGljdHVyZUluZGlyZWN0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xlQ3JlYXRlUHJvcGVydHlGcmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xlRHJhdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xlR2V0Q2xpcGJvYXJk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xlSW5pdGlhbGl6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xlTG9hZFBpY3R1cmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xlTWFpblRocmVhZFduZENsYXNz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2xlcHJvMzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xlUmVnRW51bVZlcmJz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xlU2V0Q2xpcGJvYXJk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xlU2V0TWVudURlc2NyaXB0b3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xlVW5pbml0aWFsaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xlVmFyaWFudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xpdmUgR3JlZW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkNsaXBib2FyZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlbmVkIGludGVybmFsIGVkaXRvciB3aXRoICIlcyI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlbmVkV29ya3NwYWNlc0F1dG8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkV2ZW50Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkZpbGVNYXBwaW5nVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkpvYk9iamVjdFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3Blbk11dGV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByaW50ZXJX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblRoZW1lRGF0YQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblRocmVhZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlcmF0aW9uTWFza1VzZXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3B0aW9uYWxIZWFkZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3JpZ2luYWxGaWxlbmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3V0U3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3ZlcndyaXRl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3duaW5nVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEFDS0FHRUlORk8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEFDS0FHRU9QVElPTlM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFpbnRCb3g=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFpbnRQYW5lbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFsZSBCbHVl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEFuc2lDaGFy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEFuc2lTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFyYW1Db3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFyYW1MaXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFyYW1UeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFyZW50RG91YmxlQnVmZmVyZWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFyZW50SW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEFycmF5UHJvcEluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEFSVElBTCUyLjJk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGFzc3dvcmQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFzc3dvcmRDaGFuZ2Vz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFzc3dvcmRDaGFuZ2VzRmFpbGVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGFzc3dvcmRzZnJvbWZpbGVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFzdG9vbHM6OlRDdXN0b21Db250cm9sU2Nyb2xsT25EcmFnT3Zlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFzdG9vbHM6OlRMaXN0Vmlld1Njcm9sbE9uRHJhZ092ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEFUQ0hUWVBF","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGF0aElzUmVsYXRpdmVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGF0aFNraXBSb290Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEF0dHJEYXRh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGNDb2xsYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGNDb3BpZXNwY09yaWVudGF0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEN1cnJlbmN5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UERldmljZU1vZGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UERpc3BJRExpc3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UERWVGFyZ2V0RGV2aWNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGVla0NvbnNvbGVJbnB1dFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGVla01lc3NhZ2VB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGVla01lc3NhZ2VX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGVla05hbWVkUGlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEV4Y2VwSW5mb3w=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEV4Y2VwdGlvblJlY29yZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEV4dGVuZGVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGZBcnJheXBmQWRkcmVzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEZpZWxkRXhFbnRyeUg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEZpeGVkVUludA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGZuRGVmZXJyZWRGaWxsSW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGZSZWZlcmVuY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cGZSZXN1bHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGh5c2ljYWxBZGRyZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGljdHVyZUxhYmVs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGljdHVyZVBhbmVs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UElNQUdFX1RIVU5LX0RBVEEzMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UElNQUdFX1RIVU5LX0RBVEE2NFRcVA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEltYWdlTnRIZWFkZXJzMzIgZVQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEltYWdlU2VjdGlvbkhlYWRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEluc3RJdGVt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEludGVyZmFjZUVudHJ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEludGVyZmFjZVRhYmxldA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEludGZNZXRob2RFbnRyeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEludGZNZXRob2RFbnRyeVRhaWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEludGZNZXRob2RUYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGl4ZWxzUGVySW5jaA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGl4ZWxzUGVySW5jaENoYW5nZWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGl4ZWxzUGVySW5jaE1haW5XaW5kb3c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGxheUVuaE1ldGFGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGxheVNvdW5kQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGxheVNvdW5kVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UExpYk1vZHVsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UExJU1RfRU5UUlk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG5nSW1hZ2UlZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9pbnRlclRvTGluZW51bWJlcnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9pbnRlclRvUmF3RGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9pbnRlclRvUmVsb2NhdGlvbnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9pbnRlclRvU3ltYm9sVGFibGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9pbnRJbkNpcmNsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cG9MYW5kc2NhcGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9seUJlemllcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9seUJlemllclRv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9seVBvbHlsaW5l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cG9Qb3J0cmFpdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9ydGFibGUgTmV0d29yayBHcmFwaGljcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cG9zaXRpdmVJbnRlZ2Vy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9zdGluZyBuZXcgdmVyc2lvbiBvciBjcml0aWNhbCBtZXNzYWdlIG5vdGlmaWNhdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9zdGluZyBub24tY3JpdGljYWwgdXBkYXRlcyBub3Rl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9zdE1lc3NhZ2VX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9zdFF1ZXVlZENvbXBsZXRpb25TdGF0dXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9zdFF1aXRNZXNzYWdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9zdFRocmVhZE1lc3NhZ2VX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UE92ZXJsYXBwZWRsa1Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFBhY2thZ2VUeXBlSW5mb2BRUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFBvaW50bCtU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFByb2NlZHVyZVBhcmFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFByb2NlZHVyZVNpZ25hdHVyZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFByb3BEYXRh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFByb3BJbmZvOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFByb3BJbmZvRXg0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFBUeXBlSW5mb3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFJlY29yZFR5cGVGaWVsZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkIERyb3BFZmZlY3Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFJlc1N0cmluZ0hhc2hJdGVt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFJlc1N0cmluZ1JlYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJldmlld0J1dHRvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJldmlld0Zvcm0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFJFVklFV0dMWVBI","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUJ1aWxk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cHJpdmF0ZWtleQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY0F0dHJEYXRh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cHJvY2VkdXJl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyRmlyc3Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyRmlyc3RX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyTmV4dA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyTmV4dFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczogJWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc0xvY2tzTGlzdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdE5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ0lERnJvbUNMU0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvaGliaXREVEQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvcENvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cHJvcGVydGllcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvcGVydHkgIiVzIiBpcyBub3Qgc3VwcG9ydGVkLg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvcExpc3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cHJvdG9jb2w6","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"UHJveHktQXV0aGVudGljYXRl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJveHktQXV0aG9yaXphdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFJUTENyaXRpY2FsU2VjdGlvbkRlYnVnbGhU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFJUTENyaXRpY2FsU2VjdGlvbkxpVA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFNBUEkuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHNhcGkuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFNlY3VyaXR5QXR0cmlidXRlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFNob3J0U3RyaW5n","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cHNOb0hhbmRsZXBzSGFuZGxlSUNwc0hhbmRsZURD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFRocmVhZEluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHRJblJlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHRyQXR0ckRhdGE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFR5cGVEYXRhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFR5cGVJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFR5cGVUYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFVJbnQ2NCQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFVuaWNvZGVTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFVuaXRIYXNoRW50cnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFZhckFycmF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFZtdEZpZWxkQ2xhc3NUYWI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFZtdEZpZWxkRW50cnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFZtdE1ldGhvZEVudHJ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFZtdE1ldGhvZEVudHJ5VGFpbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFZtdE1ldGhvZEV4RW50cnlM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cHZSZXNlcnZlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFZTRml4ZWRGaWxlSW5mb3h6VA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cHdjc05hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFdpZGVDaGFyPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFdpZGVTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cXBzLXBsb2MsZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cXBzLXBsb2NhLGph","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cXBzLXBsb2NtLGFy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UVFRUVFRUVNWVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVhbGlmaWVkQ2xhc3NOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVhbGlmaWVkTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlEb3NEZXZpY2VX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGdWxsUHJvY2Vzc0ltYWdlTmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGdWxsUHJvY2Vzc0ltYWdlTmFtZVc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUNvdW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUZyZXF1ZW5jeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlXb3JraW5nU2V0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VFeGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VPdXRlckV4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmF3Qnl0ZVN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmF3Qnl0ZVN0cmluZyAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cmF3dHJhbnNmZXJzZXR0aW5ncw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cmNwcm9maWxl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmUtZW5hYmxpbmcgd2luZG93","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZENvbnNvbGVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZENvbnNvbGVJbnB1dFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZENvbnNvbGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZERpcmVjdG9yeUNoYW5nZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEZpbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEluZGV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEludDE2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEludDMy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEludDY0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZFN0cmluZ0FzQW5zaQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZFN0cmluZ0FzQW5zaVVwVG8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZFN0cmluZ0FzVW5pY29kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZFN0cmluZ0FzVW5pY29kZVVwVG8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZFN0cmluZ0FzVXRmOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZFN0cmluZ0FzVXRmOFVwVG8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhbGl6ZVBhbGV0dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhbGxvY01lbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVCYXJXaW5kb3czMg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVjZWl2ZWQgY29weSBkYXRhIG1lc3NhZ2Ugd2l0aCBzaXplICVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVjdGFuZ2xl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVjdFZpc2libGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVjdXJzaW9uQ291bnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cmVjdmZyb20=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVkcmF3V2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVmQ291bnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ29ubmVjdFJlZ2lzdHJ5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ3JlYXRlS2V5RXhB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ3JlYXRlS2V5RXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnRGVsZXRlS2V5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnRGVsZXRlVmFsdWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bUtleUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bUtleUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bVZhbHVlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnRmx1c2hLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJDbGFzc0V4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJDbGFzc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJDbGlwYm9hcmRGb3JtYXRX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJEZXZpY2VOb3RpZmljYXRpb25X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJEcmFnRHJvcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJFdmVudFNvdXJjZUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXZWFrTWV0aG9kUmVm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXZWFrUmVm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXaW5kb3dNZXNzYWdlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnTG9hZEtleVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlJbmZvS2V5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnUmVwbGFjZUtleVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnUmVzdG9yZUtleVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnU2F2ZUtleVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnU2V0VmFsdWVFeEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnU2V0VmFsdWVFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnVW5Mb2FkS2V5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVsYXRpb25zaGlw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZUNhcHR1cmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZURD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZUlk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZU11dGV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZVNlbWFwaG9yZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZVNSV0xvY2tTaGFyZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZVN0Z01lZGl1bQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVtTGVuZ3Ro","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlQ3VzdG9tQ29tbWFuZFJ1bnMy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlTGlua3NDcmVhdGVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3ZlRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3ZlSW5zdEl0ZW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3ZlTWVudQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3ZlUHJvcFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVwZWF0Q291bnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVwbGFjZUljb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVwbGFjZU1hc2tlZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVwbGFjZVRleHRX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVwb3J0RXZlbnRB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVxdWVzdCBldmVudA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVxdWVzdGVkVmFyVHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzZXJ2ZWQx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzZXJ2ZWQy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzZXJ2ZWQz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzZXRFdmVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzSW5zdGFuY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzaXplUGFsZXR0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzcG9uc2UgZXZlbnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzU3RyaW5nUmVj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzdG9yZURD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzdWx0O1JldHVybg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzdWx0RmlsbGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzdWx0SGk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzdWx0TG8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzdWx0VHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzdW1lVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmV2aXNpb25MZXZlbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmV2b2tlRHJhZ0Ryb3A=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"cmdiUmVzZXJ2ZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UklDSEVESVQ1MFc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Um91bmRSZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"Um93SGVpZ2h0cw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsQ29tcGFyZVVuaWNvZGVTdHJpbmc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsVW53aW5k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnR0aUNvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnR0aURhdGFTaXplYGxY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"UlVTU0lBTl9DSEFSU0VU","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5QWNjZXNzRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5Q3JlYXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0RWxlbWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0TEJvdW5k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0VUJvdW5k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5UHRyT2ZJbmRleA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5UHV0RWxlbWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5UmVkaW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5VW5hY2Nlc3NEYXRh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUNhbGxFeGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2F2ZWRBdFJ1blRpbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2NFbmRTY3JvbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2NoZWR1bGVkIHNlc3Npb24gcmVjb25uZWN0LCB3aWxsIHJldHJ5IHRoZSB1cGxvYWQgbGF0ZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2NoZW1hTG9jYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2NMaW5lVXBzY0xpbmVEb3du","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2NQYWdlVXBzY1BhZ2VEb3duc2NQb3NpdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2NyZWVuVG9DbGllbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0NST0xMQkFS","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2Nyb2xsYmFy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2Nyb2xsSGVpZ2h0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2Nyb2xsTGVmdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2Nyb2xsVG9w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2Nyb2xsV2lkdGg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2Nyb2xsV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2Nyb2xsV2luZG93RXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VhIEdyZWVu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2VhcmNoaW5kaWNhdG9ycw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VhcmNoUGF0aFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2Vjb25kIGF0dGVtcHQgdG8gZGVsZXRlIHBhc3RlZCBmYWtlIGNsaXBib2FyZCBkaXJlY3RvcnkgIiVzIiAtICVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdGlvbkFsaWdubWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdGlvbnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VsZWN0Q2xpcFJnbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VsZWN0T2JqZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VsZWN0UGFsZXR0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VuZERsZ0l0ZW1NZXNzYWdlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VuZE1lc3NhZ2VB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VuZE1lc3NhZ2VUaW1lb3V0Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VuZE1lc3NhZ2VX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VuZE5vdGlmeU1lc3NhZ2VX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvbk5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvblRhYk1vdmVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0LUNvb2tpZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0QWJvcnRQcm9j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0QWN0aXZlV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0QXJyYXlFbGVtZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0QmtDb2xvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0QmtNb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0QnJ1c2hPcmdFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q2FwdHVyZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q2FyZXRQb3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q2hhcnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q2xhc3NMb25nVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q2xpcGJvYXJkRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN0cmxIYW5kbGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN1cnNvclBvc2l0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVRpdGxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q3VycmVudERpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q3Vyc29y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q3Vyc29yUG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RENQZW5Db2xvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RGVmYXVsdERsbERpcmVjdG9yaWVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RElCQ29sb3JUYWJsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RElCaXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW5kT2ZGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW5oTWV0YUZpbGVCaXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RXJyb3JJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RXJyb3JNb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RXZlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Rm9jdXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Rm9yZWdyb3VuZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0SGFuZGxlQ291bnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0SGFuZGxlSW5mb3JtYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0SW5wdXRTY29wZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0S2V5Ym9hcmRTdGF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGF5ZXJlZFdpbmRvd0F0dHJpYnV0ZXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TG9jYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TWFwTW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TWVudQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TWVudUl0ZW1JbmZvVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TmFtZWRTZWN1cml0eUluZm9X","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UGFsZXR0ZUVudHJpZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UGFyZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UGl4ZWxW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UHJvcGVydHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UHJvcFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UmVjdEVtcHR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UmVjdFJnbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0U2Nyb2xsSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0U2Nyb2xsUG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0U2Nyb2xsUmFuZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0U2VjdXJpdHlEZXNjcmlwdG9yRGFjbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0U2VjdXJpdHlEZXNjcmlwdG9yT3duZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0c29ja29wdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0U3BpbkNvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0U3RyZXRjaEJsdE1vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0U3VzcGVuZFN0YXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0U3lzQ29sb3JzVGVtcA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGV4dEFsaWdu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGV4dENvbG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhlbWVBcHBQcm9wZXJ0aWVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkRXhlY3V0aW9uU3RhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkTG9jYWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkUHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkUHJpb3JpdHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGltZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VHlwZU9yU2l6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Vmlld3BvcnRFeHRFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Vmlld3BvcnRPcmdFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Vm9sdW1lTW91bnRQb2ludFc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2FpdGFibGVUaW1lcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93RXh0RXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93TG9uZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93T3JnRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93UGxhY2VtZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93UG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93Umdu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93c0hvb2tFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93VGV4dFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93VGhlbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luTWV0YUZpbGVCaXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2ZkLWhkc3R4","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0ZUUA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"c2hhMjU2V2l0aFJTQUVuY3J5cHRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hBcHBCYXJNZXNzYWdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hCcm93c2VGb3JGb2xkZXJX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hDaGFuZ2VOb3RpZnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hDcmVhdGVTdHJlYW1PbkZpbGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hkb2N2dzo6VFdlYkJyb3dzZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGwgSURMaXN0IEFycmF5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxfTm90aWZ5SWNvblc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxEaWFsb2dzQ2FsbEJhY2s=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxEaWFsb2dzQ2FsbEJhY2tQcm9jZXNzb3I=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFeGVjdXRlRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFeGVjdXRlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hGaWxlT3BlcmF0aW9uVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hGcmVlTmFtZU1hcHBpbmdz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXREZXNrdG9wRm9sZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGaWxlSW5mb1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGb2xkZXJQYXRoVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRJbWFnZUxpc3Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRNYWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRQYXRoRnJvbUlETGlzdFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRTcGVjaWFsRm9sZGVyTG9jYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hJRlRKSVNfQ0hBUlNFVA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2htTlBBX1VuaXRWZXJzaW9uaW5nXw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U0hPcGVuRm9sZGVyQW5kU2VsZWN0SXRlbXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvcnRDdXRUZXh0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvcnREYXRlRm9ybWF0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvcnREYXlOYW1lcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvcnRNb250aE5hbWVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvcnRTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvcnRUaW1lRm9ybWF0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0NhcmV0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0N1cnNvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd093bmVkUG9wdXBz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1Njcm9sbEJhcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1dpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2h1dGRvd24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2lnbmFsT2JqZWN0QW5kV2FpdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2lnbmF0dXJl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2lnbmVkIGNoYXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c0ltbWVyc2l2ZUNvbG9yU2V0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2l0ZXx3b3Jrc3BhY2V8Zm9sZGVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2l6ZU9mQ29kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2l6ZU9mRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2l6ZU9mSGVhZGVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2l6ZU9mSGVhcENvbW1pdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2l6ZU9mSGVhcFJlc2VydmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2l6ZU9mSW1hZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2l6ZU9mSW5pdGlhbGl6ZWREYXRh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2l6ZU9mT3B0aW9uYWxIZWFkZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2l6ZU9mUmF3RGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2l6ZW9mUmVzb3VyY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2l6ZU9mU3RhY2tDb21taXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2l6ZU9mU3RhY2tSZXNlcnZl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2l6ZU9mVW5pbml0aWFsaXplZERhdGE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2t5IEJsdWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZUNT","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c21hLU5PLHNtYSxzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c21hLVNFLHNtYSxzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c21qLU5PLHNtaixzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c21qLVNFLHNtaixzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c21uLUZJLHNtbixzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c21zLUZJLHNtcyxzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29mdHdhcmVcQm9ybGFuZFxEZWxwaGlcTG9jYWxlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29mdHdhcmVcQm9ybGFuZFxMb2NhbGVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29mdHdhcmVcQ29kZUdlYXJcTG9jYWxlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29mdHdhcmVcRW1iYXJjYWRlcm9cTG9jYWxlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cRm9udFN1YnN0aXR1dGVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUG9saWNpZXNcRXhwbG9yZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVGhlbWVzXFBlcnNvbmFsaXpl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcRFdN","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29tZSBmaWx0ZXIgY29uZGl0aW9uIG11c3QgYmUgc2V0Lg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U29tZVRleHRGb3JTaXppbmc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U291cmNlSW5kZXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3BhY2VBdmFpbGFibGVDaGVja3M=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3BlY2lhbEJ1aWxk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3BlY2lhbFR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3BlZWRMaW1pdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3BsaXRSZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3BsaXRUeXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3ItQ3lybC1CQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3ItQ3lybC1DUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3ItQ3lybC1NRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3ItQ3lybC1SUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3ItTGF0bi1CQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3ItTGF0bi1DUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3ItTGF0bi1NRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3ItTGF0bi1SUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3NIb3Jpem9udGFsc3NWZXJ0aWNhbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RhY2tJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RhY2tUcmFjZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RhbmRhbG9uZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RhbmRhcmQgaW5zdGFsbGF0aW9uIG1pZ3JhdGVkIHRvIHN0b3JlIGluc3RhbGxhdGlvbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RhbmRhcmRCaWFz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RhbmRhcmREYXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RhbmRhcmROYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RhcnREb2NX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RhcnRJbmRleA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RhcnRJbmRleA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RhcnRpbmcuLi4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RhcnRQYWdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RhcnRwYW5lbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfQnZlY3RvciAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfQ29udGFpbmVyX2Jhc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfRGVxdWVfbWFwPFRSZW1vdGVUaHVtYm5haWxOZWVkZWQsc3RkOjphbGxvY2F0b3I8VFJlbW90ZVRodW1ibmFpbE5lZWRlZD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfRGVxdWVfdmFsPFRSZW1vdGVUaHVtYm5haWxOZWVkZWQsc3RkOjphbGxvY2F0b3I8VFJlbW90ZVRodW1ibmFpbE5lZWRlZD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfU3RyaW5nX2Jhc2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfU3RyaW5nX3ZhbDxjaGFyLHN0ZDo6YWxsb2NhdG9yPGNoYXI+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVG1hcF90cmFpdHM8aW50LFBuZ2ltYWdlbGlzdDo6VFBuZ0ltYWdlTGlzdCAqLHN0ZDo6bGVzczxpbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBpbnQsUG5naW1hZ2VsaXN0OjpUUG5nSW1hZ2VMaXN0ICo+ID4sMD4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVG1hcF90cmFpdHM8aW50LFRSZW1vdGVUaHVtYm5haWxEYXRhLHN0ZDo6bGVzczxpbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBpbnQsVFJlbW90ZVRodW1ibmFpbERhdGE+ID4sMD4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVG1hcF90cmFpdHM8aW50LHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8aW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgaW50LHVuc2lnbmVkIGludD4gPiwwPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVG1hcF90cmFpdHM8aW50LFZjbDo6Q29udHJvbHM6OlRJbWFnZUxpc3QgKixzdGQ6Omxlc3M8aW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgaW50LFZjbDo6Q29udHJvbHM6OlRJbWFnZUxpc3QgKj4gPiwwPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVaXR5cGVzOjpUQ29sb3IsaW50LHN0ZDo6bGVzczxTeXN0ZW06OlVpdHlwZXM6OlRDb2xvcj4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VWl0eXBlczo6VENvbG9yLGludD4gPiwwPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHN0ZDo6cGFpcjxpbnQsdW5zaWduZWQgbG9uZz4sc3RkOjpsZXNzPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyxzdGQ6OnBhaXI8aW50LHVuc2lnbmVkIGxvbmc+ID4gPiwwPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFN5c3RlbTo6VW5pY29kZVN0cmluZyxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLFN5c3RlbTo6VW5pY29kZVN0cmluZz4gPiwwPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFROb3RpZnlFdmVudCxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLFROb3RpZnlFdmVudD4gPiwwPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFRQYXJhbGxlbE9wZXJhdGlvbjo6VERpcmVjdG9yeURhdGEsc3RkOjpsZXNzPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyxUUGFyYWxsZWxPcGVyYXRpb246OlREaXJlY3RvcnlEYXRhPiA+LDA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLHVuc2lnbmVkIGludD4gPiwwPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVG1hcF90cmFpdHM8dW5zaWduZWQgaW50LHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8dW5zaWduZWQgaW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgdW5zaWduZWQgaW50LHVuc2lnbmVkIGludD4gPiwwPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVG1hcF90cmFpdHM8dW5zaWduZWQgbG9uZyxzdGQ6OnZlY3RvcjxIV05EX18gKixzdGQ6OmFsbG9jYXRvcjxIV05EX18gKj4gPixzdGQ6Omxlc3M8dW5zaWduZWQgbG9uZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IHVuc2lnbmVkIGxvbmcsc3RkOjp2ZWN0b3I8SFdORF9fICosc3RkOjphbGxvY2F0b3I8SFdORF9fICo+ID4gPiA+LDA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVG1hcF90cmFpdHM8dW5zaWduZWQgbG9uZyxTeXN0ZW06OkNsYXNzZXM6OlRTdHJpbmdzICosc3RkOjpsZXNzPHVuc2lnbmVkIGxvbmc+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCB1bnNpZ25lZCBsb25nLFN5c3RlbTo6Q2xhc3Nlczo6VFN0cmluZ3MgKj4gPiwwPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9UbWFwX3RyYWl0czxpbnQsUG5naW1hZ2VsaXN0OjpUUG5nSW1hZ2VMaXN0ICosc3RkOjpsZXNzPGludD4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IGludCxQbmdpbWFnZWxpc3Q6OlRQbmdJbWFnZUxpc3QgKj4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9UbWFwX3RyYWl0czxpbnQsVFJlbW90ZVRodW1ibmFpbERhdGEsc3RkOjpsZXNzPGludD4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IGludCxUUmVtb3RlVGh1bWJuYWlsRGF0YT4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9UbWFwX3RyYWl0czxpbnQsVFJlbW90ZVRodW1ibmFpbERhdGEsc3RkOjpsZXNzPGludD4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IGludCxUUmVtb3RlVGh1bWJuYWlsRGF0YT4gPiwwPiA+ICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9UbWFwX3RyYWl0czxpbnQsdW5zaWduZWQgaW50LHN0ZDo6bGVzczxpbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBpbnQsdW5zaWduZWQgaW50PiA+LDA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9UbWFwX3RyYWl0czxpbnQsVmNsOjpDb250cm9sczo6VEltYWdlTGlzdCAqLHN0ZDo6bGVzczxpbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBpbnQsVmNsOjpDb250cm9sczo6VEltYWdlTGlzdCAqPiA+LDA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9UbWFwX3RyYWl0czxTeXN0ZW06OlVpdHlwZXM6OlRDb2xvcixpbnQsc3RkOjpsZXNzPFN5c3RlbTo6VWl0eXBlczo6VENvbG9yPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVaXR5cGVzOjpUQ29sb3IsaW50PiA+LDA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9UbWFwX3RyYWl0czxTeXN0ZW06OlVuaWNvZGVTdHJpbmcsc3RkOjpwYWlyPGludCx1bnNpZ25lZCBsb25nPixzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLHN0ZDo6cGFpcjxpbnQsdW5zaWduZWQgbG9uZz4gPiA+LDA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9UbWFwX3RyYWl0czxTeXN0ZW06OlVuaWNvZGVTdHJpbmcsU3lzdGVtOjpVbmljb2RlU3RyaW5nLHN0ZDo6bGVzczxTeXN0ZW06OlVuaWNvZGVTdHJpbmc+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBTeXN0ZW06OlVuaWNvZGVTdHJpbmcsU3lzdGVtOjpVbmljb2RlU3RyaW5nPiA+LDA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9UbWFwX3RyYWl0czxTeXN0ZW06OlVuaWNvZGVTdHJpbmcsVE5vdGlmeUV2ZW50LHN0ZDo6bGVzczxTeXN0ZW06OlVuaWNvZGVTdHJpbmc+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBTeXN0ZW06OlVuaWNvZGVTdHJpbmcsVE5vdGlmeUV2ZW50PiA+LDA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9UbWFwX3RyYWl0czxTeXN0ZW06OlVuaWNvZGVTdHJpbmcsVFBhcmFsbGVsT3BlcmF0aW9uOjpURGlyZWN0b3J5RGF0YSxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLFRQYXJhbGxlbE9wZXJhdGlvbjo6VERpcmVjdG9yeURhdGE+ID4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9UbWFwX3RyYWl0czxTeXN0ZW06OlVuaWNvZGVTdHJpbmcsdW5zaWduZWQgaW50LHN0ZDo6bGVzczxTeXN0ZW06OlVuaWNvZGVTdHJpbmc+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBTeXN0ZW06OlVuaWNvZGVTdHJpbmcsdW5zaWduZWQgaW50PiA+LDA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9UbWFwX3RyYWl0czxUQ29sb3IsaW50LHN0ZDo6bGVzczxUQ29sb3I+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBUQ29sb3IsaW50PiA+LDA+ID4gKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9UbWFwX3RyYWl0czx1bnNpZ25lZCBpbnQsdW5zaWduZWQgaW50LHN0ZDo6bGVzczx1bnNpZ25lZCBpbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCB1bnNpZ25lZCBpbnQsdW5zaWduZWQgaW50PiA+LDA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9UbWFwX3RyYWl0czx1bnNpZ25lZCBsb25nLHN0ZDo6dmVjdG9yPEhXTkRfXyAqLHN0ZDo6YWxsb2NhdG9yPEhXTkRfXyAqPiA+LHN0ZDo6bGVzczx1bnNpZ25lZCBsb25nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgdW5zaWduZWQgbG9uZyxzdGQ6OnZlY3RvcjxIV05EX18gKixzdGQ6OmFsbG9jYXRvcjxIV05EX18gKj4gPiA+ID4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9UbWFwX3RyYWl0czx1bnNpZ25lZCBsb25nLFN5c3RlbTo6Q2xhc3Nlczo6VFN0cmluZ3MgKixzdGQ6Omxlc3M8dW5zaWduZWQgbG9uZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IHVuc2lnbmVkIGxvbmcsU3lzdGVtOjpDbGFzc2VzOjpUU3RyaW5ncyAqPiA+LDA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9Uc2V0X3RyYWl0czxTeXN0ZW06OkNsYXNzZXM6OlREYXRhTW9kdWxlICosc3RkOjpsZXNzPFN5c3RlbTo6Q2xhc3Nlczo6VERhdGFNb2R1bGUgKj4sc3RkOjphbGxvY2F0b3I8U3lzdGVtOjpDbGFzc2VzOjpURGF0YU1vZHVsZSAqPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9Uc2V0X3RyYWl0czxTeXN0ZW06OlVuaWNvZGVTdHJpbmcsc3RkOjpsZXNzPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sc3RkOjphbGxvY2F0b3I8U3lzdGVtOjpVbmljb2RlU3RyaW5nPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZTxzdGQ6Ol9Uc2V0X3RyYWl0czxUYjJpdGVtOjpUVEJDdXN0b21JdGVtICosc3RkOjpsZXNzPFRiMml0ZW06OlRUQkN1c3RvbUl0ZW0gKj4sc3RkOjphbGxvY2F0b3I8VGIyaXRlbTo6VFRCQ3VzdG9tSXRlbSAqPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8aW50LFBuZ2ltYWdlbGlzdDo6VFBuZ0ltYWdlTGlzdCAqLHN0ZDo6bGVzczxpbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBpbnQsUG5naW1hZ2VsaXN0OjpUUG5nSW1hZ2VMaXN0ICo+ID4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8aW50LFBuZ2ltYWdlbGlzdDo6VFBuZ0ltYWdlTGlzdCAqLHN0ZDo6bGVzczxpbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBpbnQsUG5naW1hZ2VsaXN0OjpUUG5nSW1hZ2VMaXN0ICo+ID4sMD4gPjo6X05vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8aW50LFRJbWFnZUxpc3QgKixzdGQ6Omxlc3M8aW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgaW50LFRJbWFnZUxpc3QgKj4gPiwwPiA+OjpfTm9kZSAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8aW50LFRQbmdJbWFnZUxpc3QgKixzdGQ6Omxlc3M8aW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgaW50LFRQbmdJbWFnZUxpc3QgKj4gPiwwPiA+OjpfTm9kZSAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8aW50LFRSZW1vdGVUaHVtYm5haWxEYXRhLHN0ZDo6bGVzczxpbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBpbnQsVFJlbW90ZVRodW1ibmFpbERhdGE+ID4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8aW50LFRSZW1vdGVUaHVtYm5haWxEYXRhLHN0ZDo6bGVzczxpbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBpbnQsVFJlbW90ZVRodW1ibmFpbERhdGE+ID4sMD4gPjo6X05vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8aW50LFRSZW1vdGVUaHVtYm5haWxEYXRhLHN0ZDo6bGVzczxpbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBpbnQsVFJlbW90ZVRodW1ibmFpbERhdGE+ID4sMD4gPjo6X05vZGUgKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8aW50LHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8aW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgaW50LHVuc2lnbmVkIGludD4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8aW50LHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8aW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgaW50LHVuc2lnbmVkIGludD4gPiwwPiA+OjpfTm9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8aW50LHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8aW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgaW50LHVuc2lnbmVkIGludD4gPiwwPiA+OjpfTm9kZSAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8aW50LFZjbDo6Q29udHJvbHM6OlRJbWFnZUxpc3QgKixzdGQ6Omxlc3M8aW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgaW50LFZjbDo6Q29udHJvbHM6OlRJbWFnZUxpc3QgKj4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8aW50LFZjbDo6Q29udHJvbHM6OlRJbWFnZUxpc3QgKixzdGQ6Omxlc3M8aW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgaW50LFZjbDo6Q29udHJvbHM6OlRJbWFnZUxpc3QgKj4gPiwwPiA+OjpfTm9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVaXR5cGVzOjpUQ29sb3IsaW50LHN0ZDo6bGVzczxTeXN0ZW06OlVpdHlwZXM6OlRDb2xvcj4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VWl0eXBlczo6VENvbG9yLGludD4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVaXR5cGVzOjpUQ29sb3IsaW50LHN0ZDo6bGVzczxTeXN0ZW06OlVpdHlwZXM6OlRDb2xvcj4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VWl0eXBlczo6VENvbG9yLGludD4gPiwwPiA+OjpfTm9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHN0ZDo6cGFpcjxpbnQsdW5zaWduZWQgbG9uZz4sc3RkOjpsZXNzPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyxzdGQ6OnBhaXI8aW50LHVuc2lnbmVkIGxvbmc+ID4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHN0ZDo6cGFpcjxpbnQsdW5zaWduZWQgbG9uZz4sc3RkOjpsZXNzPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyxzdGQ6OnBhaXI8aW50LHVuc2lnbmVkIGxvbmc+ID4gPiwwPiA+OjpfTm9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFN5c3RlbTo6VW5pY29kZVN0cmluZyxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLFN5c3RlbTo6VW5pY29kZVN0cmluZz4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFN5c3RlbTo6VW5pY29kZVN0cmluZyxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLFN5c3RlbTo6VW5pY29kZVN0cmluZz4gPiwwPiA+OjpfTm9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFROb3RpZnlFdmVudCxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLFROb3RpZnlFdmVudD4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFROb3RpZnlFdmVudCxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLFROb3RpZnlFdmVudD4gPiwwPiA+OjpfTm9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFRQYXJhbGxlbE9wZXJhdGlvbjo6VERpcmVjdG9yeURhdGEsc3RkOjpsZXNzPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyxUUGFyYWxsZWxPcGVyYXRpb246OlREaXJlY3RvcnlEYXRhPiA+LDA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFRQYXJhbGxlbE9wZXJhdGlvbjo6VERpcmVjdG9yeURhdGEsc3RkOjpsZXNzPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyxUUGFyYWxsZWxPcGVyYXRpb246OlREaXJlY3RvcnlEYXRhPiA+LDA+ID46Ol9Ob2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLHVuc2lnbmVkIGludD4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLHVuc2lnbmVkIGludD4gPiwwPiA+OjpfTm9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8VENvbG9yLGludCxzdGQ6Omxlc3M8VENvbG9yPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgVENvbG9yLGludD4gPiwwPiA+OjpfTm9kZSAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8VW5pY29kZVN0cmluZyxzdGQ6OnBhaXI8aW50LHVuc2lnbmVkIGxvbmc+LHN0ZDo6bGVzczxVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgVW5pY29kZVN0cmluZyxzdGQ6OnBhaXI8aW50LHVuc2lnbmVkIGxvbmc+ID4gPiwwPiA+OjpfTm9kZSAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8VW5pY29kZVN0cmluZyxUTm90aWZ5RXZlbnQsc3RkOjpsZXNzPFVuaWNvZGVTdHJpbmc+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBVbmljb2RlU3RyaW5nLFROb3RpZnlFdmVudD4gPiwwPiA+OjpfTm9kZSAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8VW5pY29kZVN0cmluZyxUUGFyYWxsZWxPcGVyYXRpb246OlREaXJlY3RvcnlEYXRhLHN0ZDo6bGVzczxVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgVW5pY29kZVN0cmluZyxUUGFyYWxsZWxPcGVyYXRpb246OlREaXJlY3RvcnlEYXRhPiA+LDA+ID46Ol9Ob2RlICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8VW5pY29kZVN0cmluZyxVbmljb2RlU3RyaW5nLHN0ZDo6bGVzczxVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgVW5pY29kZVN0cmluZyxVbmljb2RlU3RyaW5nPiA+LDA+ID46Ol9Ob2RlICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8VW5pY29kZVN0cmluZyx1bnNpZ25lZCBpbnQsc3RkOjpsZXNzPFVuaWNvZGVTdHJpbmc+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBVbmljb2RlU3RyaW5nLHVuc2lnbmVkIGludD4gPiwwPiA+OjpfTm9kZSAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8dW5zaWduZWQgaW50LHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8dW5zaWduZWQgaW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgdW5zaWduZWQgaW50LHVuc2lnbmVkIGludD4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8dW5zaWduZWQgbG9uZyxzdGQ6OnZlY3RvcjxIV05EX18gKixzdGQ6OmFsbG9jYXRvcjxIV05EX18gKj4gPixzdGQ6Omxlc3M8dW5zaWduZWQgbG9uZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IHVuc2lnbmVkIGxvbmcsc3RkOjp2ZWN0b3I8SFdORF9fICosc3RkOjphbGxvY2F0b3I8SFdORF9fICo+ID4gPiA+LDA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8dW5zaWduZWQgbG9uZyxzdGQ6OnZlY3RvcjxIV05EX18gKixzdGQ6OmFsbG9jYXRvcjxIV05EX18gKj4gPixzdGQ6Omxlc3M8dW5zaWduZWQgbG9uZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IHVuc2lnbmVkIGxvbmcsc3RkOjp2ZWN0b3I8SFdORF9fICosc3RkOjphbGxvY2F0b3I8SFdORF9fICo+ID4gPiA+LDA+ID46Ol9Ob2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8dW5zaWduZWQgbG9uZyxTeXN0ZW06OkNsYXNzZXM6OlRTdHJpbmdzICosc3RkOjpsZXNzPHVuc2lnbmVkIGxvbmc+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCB1bnNpZ25lZCBsb25nLFN5c3RlbTo6Q2xhc3Nlczo6VFN0cmluZ3MgKj4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8dW5zaWduZWQgbG9uZyxTeXN0ZW06OkNsYXNzZXM6OlRTdHJpbmdzICosc3RkOjpsZXNzPHVuc2lnbmVkIGxvbmc+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCB1bnNpZ25lZCBsb25nLFN5c3RlbTo6Q2xhc3Nlczo6VFN0cmluZ3MgKj4gPiwwPiA+OjpfTm9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8dW5zaWduZWQgbG9uZyxUSGFuZGxlcyxzdGQ6Omxlc3M8dW5zaWduZWQgbG9uZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IHVuc2lnbmVkIGxvbmcsVEhhbmRsZXM+ID4sMD4gPjo6X05vZGUgKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVG1hcF90cmFpdHM8dW5zaWduZWQgbG9uZyxUU3RyaW5ncyAqLHN0ZDo6bGVzczx1bnNpZ25lZCBsb25nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgdW5zaWduZWQgbG9uZyxUU3RyaW5ncyAqPiA+LDA+ID46Ol9Ob2RlICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVHNldF90cmFpdHM8U3lzdGVtOjpDbGFzc2VzOjpURGF0YU1vZHVsZSAqLHN0ZDo6bGVzczxTeXN0ZW06OkNsYXNzZXM6OlREYXRhTW9kdWxlICo+LHN0ZDo6YWxsb2NhdG9yPFN5c3RlbTo6Q2xhc3Nlczo6VERhdGFNb2R1bGUgKj4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVHNldF90cmFpdHM8U3lzdGVtOjpDbGFzc2VzOjpURGF0YU1vZHVsZSAqLHN0ZDo6bGVzczxTeXN0ZW06OkNsYXNzZXM6OlREYXRhTW9kdWxlICo+LHN0ZDo6YWxsb2NhdG9yPFN5c3RlbTo6Q2xhc3Nlczo6VERhdGFNb2R1bGUgKj4sMD4gPjo6X05vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVHNldF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHN0ZDo6bGVzczxTeXN0ZW06OlVuaWNvZGVTdHJpbmc+LHN0ZDo6YWxsb2NhdG9yPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVHNldF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHN0ZDo6bGVzczxTeXN0ZW06OlVuaWNvZGVTdHJpbmc+LHN0ZDo6YWxsb2NhdG9yPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sMD4gPjo6X05vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVHNldF90cmFpdHM8VGIyaXRlbTo6VFRCQ3VzdG9tSXRlbSAqLHN0ZDo6bGVzczxUYjJpdGVtOjpUVEJDdXN0b21JdGVtICo+LHN0ZDo6YWxsb2NhdG9yPFRiMml0ZW06OlRUQkN1c3RvbUl0ZW0gKj4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVHNldF90cmFpdHM8VGIyaXRlbTo6VFRCQ3VzdG9tSXRlbSAqLHN0ZDo6bGVzczxUYjJpdGVtOjpUVEJDdXN0b21JdGVtICo+LHN0ZDo6YWxsb2NhdG9yPFRiMml0ZW06OlRUQkN1c3RvbUl0ZW0gKj4sMD4gPjo6X05vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVHNldF90cmFpdHM8VERhdGFNb2R1bGUgKixzdGQ6Omxlc3M8VERhdGFNb2R1bGUgKj4sc3RkOjphbGxvY2F0b3I8VERhdGFNb2R1bGUgKj4sMD4gPjo6X05vZGUgKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVHNldF90cmFpdHM8VFRCQ3VzdG9tSXRlbSAqLHN0ZDo6bGVzczxUVEJDdXN0b21JdGVtICo+LHN0ZDo6YWxsb2NhdG9yPFRUQkN1c3RvbUl0ZW0gKj4sMD4gPjo6X05vZGUgKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9ub2Q8c3RkOjpfVHNldF90cmFpdHM8VW5pY29kZVN0cmluZyxzdGQ6Omxlc3M8VW5pY29kZVN0cmluZz4sc3RkOjphbGxvY2F0b3I8VW5pY29kZVN0cmluZz4sMD4gPjo6X05vZGUgKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9wdHI8c3RkOjpfVG1hcF90cmFpdHM8aW50LFBuZ2ltYWdlbGlzdDo6VFBuZ0ltYWdlTGlzdCAqLHN0ZDo6bGVzczxpbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBpbnQsUG5naW1hZ2VsaXN0OjpUUG5nSW1hZ2VMaXN0ICo+ID4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9wdHI8c3RkOjpfVG1hcF90cmFpdHM8aW50LFRSZW1vdGVUaHVtYm5haWxEYXRhLHN0ZDo6bGVzczxpbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBpbnQsVFJlbW90ZVRodW1ibmFpbERhdGE+ID4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9wdHI8c3RkOjpfVG1hcF90cmFpdHM8aW50LHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8aW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgaW50LHVuc2lnbmVkIGludD4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9wdHI8c3RkOjpfVG1hcF90cmFpdHM8aW50LFZjbDo6Q29udHJvbHM6OlRJbWFnZUxpc3QgKixzdGQ6Omxlc3M8aW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgaW50LFZjbDo6Q29udHJvbHM6OlRJbWFnZUxpc3QgKj4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9wdHI8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVaXR5cGVzOjpUQ29sb3IsaW50LHN0ZDo6bGVzczxTeXN0ZW06OlVpdHlwZXM6OlRDb2xvcj4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VWl0eXBlczo6VENvbG9yLGludD4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9wdHI8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHN0ZDo6cGFpcjxpbnQsdW5zaWduZWQgbG9uZz4sc3RkOjpsZXNzPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyxzdGQ6OnBhaXI8aW50LHVuc2lnbmVkIGxvbmc+ID4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9wdHI8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFN5c3RlbTo6VW5pY29kZVN0cmluZyxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLFN5c3RlbTo6VW5pY29kZVN0cmluZz4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9wdHI8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFROb3RpZnlFdmVudCxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLFROb3RpZnlFdmVudD4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9wdHI8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFRQYXJhbGxlbE9wZXJhdGlvbjo6VERpcmVjdG9yeURhdGEsc3RkOjpsZXNzPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyxUUGFyYWxsZWxPcGVyYXRpb246OlREaXJlY3RvcnlEYXRhPiA+LDA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9wdHI8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLHVuc2lnbmVkIGludD4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9wdHI8c3RkOjpfVG1hcF90cmFpdHM8dW5zaWduZWQgaW50LHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8dW5zaWduZWQgaW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgdW5zaWduZWQgaW50LHVuc2lnbmVkIGludD4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9wdHI8c3RkOjpfVG1hcF90cmFpdHM8dW5zaWduZWQgbG9uZyxzdGQ6OnZlY3RvcjxIV05EX18gKixzdGQ6OmFsbG9jYXRvcjxIV05EX18gKj4gPixzdGQ6Omxlc3M8dW5zaWduZWQgbG9uZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IHVuc2lnbmVkIGxvbmcsc3RkOjp2ZWN0b3I8SFdORF9fICosc3RkOjphbGxvY2F0b3I8SFdORF9fICo+ID4gPiA+LDA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9wdHI8c3RkOjpfVG1hcF90cmFpdHM8dW5zaWduZWQgbG9uZyxTeXN0ZW06OkNsYXNzZXM6OlRTdHJpbmdzICosc3RkOjpsZXNzPHVuc2lnbmVkIGxvbmc+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCB1bnNpZ25lZCBsb25nLFN5c3RlbTo6Q2xhc3Nlczo6VFN0cmluZ3MgKj4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9wdHI8c3RkOjpfVHNldF90cmFpdHM8U3lzdGVtOjpDbGFzc2VzOjpURGF0YU1vZHVsZSAqLHN0ZDo6bGVzczxTeXN0ZW06OkNsYXNzZXM6OlREYXRhTW9kdWxlICo+LHN0ZDo6YWxsb2NhdG9yPFN5c3RlbTo6Q2xhc3Nlczo6VERhdGFNb2R1bGUgKj4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9wdHI8c3RkOjpfVHNldF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHN0ZDo6bGVzczxTeXN0ZW06OlVuaWNvZGVTdHJpbmc+LHN0ZDo6YWxsb2NhdG9yPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV9wdHI8c3RkOjpfVHNldF90cmFpdHM8VGIyaXRlbTo6VFRCQ3VzdG9tSXRlbSAqLHN0ZDo6bGVzczxUYjJpdGVtOjpUVEJDdXN0b21JdGVtICo+LHN0ZDo6YWxsb2NhdG9yPFRiMml0ZW06OlRUQkN1c3RvbUl0ZW0gKj4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV92YWw8c3RkOjpfVG1hcF90cmFpdHM8aW50LFBuZ2ltYWdlbGlzdDo6VFBuZ0ltYWdlTGlzdCAqLHN0ZDo6bGVzczxpbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBpbnQsUG5naW1hZ2VsaXN0OjpUUG5nSW1hZ2VMaXN0ICo+ID4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV92YWw8c3RkOjpfVG1hcF90cmFpdHM8aW50LFRSZW1vdGVUaHVtYm5haWxEYXRhLHN0ZDo6bGVzczxpbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBpbnQsVFJlbW90ZVRodW1ibmFpbERhdGE+ID4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV92YWw8c3RkOjpfVG1hcF90cmFpdHM8aW50LHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8aW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgaW50LHVuc2lnbmVkIGludD4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV92YWw8c3RkOjpfVG1hcF90cmFpdHM8aW50LFZjbDo6Q29udHJvbHM6OlRJbWFnZUxpc3QgKixzdGQ6Omxlc3M8aW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgaW50LFZjbDo6Q29udHJvbHM6OlRJbWFnZUxpc3QgKj4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV92YWw8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVaXR5cGVzOjpUQ29sb3IsaW50LHN0ZDo6bGVzczxTeXN0ZW06OlVpdHlwZXM6OlRDb2xvcj4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VWl0eXBlczo6VENvbG9yLGludD4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV92YWw8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHN0ZDo6cGFpcjxpbnQsdW5zaWduZWQgbG9uZz4sc3RkOjpsZXNzPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyxzdGQ6OnBhaXI8aW50LHVuc2lnbmVkIGxvbmc+ID4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV92YWw8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFN5c3RlbTo6VW5pY29kZVN0cmluZyxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLFN5c3RlbTo6VW5pY29kZVN0cmluZz4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV92YWw8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFROb3RpZnlFdmVudCxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLFROb3RpZnlFdmVudD4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV92YWw8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFRQYXJhbGxlbE9wZXJhdGlvbjo6VERpcmVjdG9yeURhdGEsc3RkOjpsZXNzPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyxUUGFyYWxsZWxPcGVyYXRpb246OlREaXJlY3RvcnlEYXRhPiA+LDA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV92YWw8c3RkOjpfVG1hcF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLHVuc2lnbmVkIGludD4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV92YWw8c3RkOjpfVG1hcF90cmFpdHM8dW5zaWduZWQgaW50LHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8dW5zaWduZWQgaW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgdW5zaWduZWQgaW50LHVuc2lnbmVkIGludD4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV92YWw8c3RkOjpfVG1hcF90cmFpdHM8dW5zaWduZWQgbG9uZyxzdGQ6OnZlY3RvcjxIV05EX18gKixzdGQ6OmFsbG9jYXRvcjxIV05EX18gKj4gPixzdGQ6Omxlc3M8dW5zaWduZWQgbG9uZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IHVuc2lnbmVkIGxvbmcsc3RkOjp2ZWN0b3I8SFdORF9fICosc3RkOjphbGxvY2F0b3I8SFdORF9fICo+ID4gPiA+LDA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV92YWw8c3RkOjpfVG1hcF90cmFpdHM8dW5zaWduZWQgbG9uZyxTeXN0ZW06OkNsYXNzZXM6OlRTdHJpbmdzICosc3RkOjpsZXNzPHVuc2lnbmVkIGxvbmc+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCB1bnNpZ25lZCBsb25nLFN5c3RlbTo6Q2xhc3Nlczo6VFN0cmluZ3MgKj4gPiwwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV92YWw8c3RkOjpfVHNldF90cmFpdHM8U3lzdGVtOjpDbGFzc2VzOjpURGF0YU1vZHVsZSAqLHN0ZDo6bGVzczxTeXN0ZW06OkNsYXNzZXM6OlREYXRhTW9kdWxlICo+LHN0ZDo6YWxsb2NhdG9yPFN5c3RlbTo6Q2xhc3Nlczo6VERhdGFNb2R1bGUgKj4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV92YWw8c3RkOjpfVHNldF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHN0ZDo6bGVzczxTeXN0ZW06OlVuaWNvZGVTdHJpbmc+LHN0ZDo6YWxsb2NhdG9yPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHJlZV92YWw8c3RkOjpfVHNldF90cmFpdHM8VGIyaXRlbTo6VFRCQ3VzdG9tSXRlbSAqLHN0ZDo6bGVzczxUYjJpdGVtOjpUVEJDdXN0b21JdGVtICo+LHN0ZDo6YWxsb2NhdG9yPFRiMml0ZW06OlRUQkN1c3RvbUl0ZW0gKj4sMD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHNldF90cmFpdHM8U3lzdGVtOjpDbGFzc2VzOjpURGF0YU1vZHVsZSAqLHN0ZDo6bGVzczxTeXN0ZW06OkNsYXNzZXM6OlREYXRhTW9kdWxlICo+LHN0ZDo6YWxsb2NhdG9yPFN5c3RlbTo6Q2xhc3Nlczo6VERhdGFNb2R1bGUgKj4sMD4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHNldF90cmFpdHM8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHN0ZDo6bGVzczxTeXN0ZW06OlVuaWNvZGVTdHJpbmc+LHN0ZDo6YWxsb2NhdG9yPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sMD4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVHNldF90cmFpdHM8VGIyaXRlbTo6VFRCQ3VzdG9tSXRlbSAqLHN0ZDo6bGVzczxUYjJpdGVtOjpUVEJDdXN0b21JdGVtICo+LHN0ZDo6YWxsb2NhdG9yPFRiMml0ZW06OlRUQkN1c3RvbUl0ZW0gKj4sMD4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPERpcmVjdG9yeW1vbml0b3I6OlREaXJlY3RvcnlNb25pdG9yLHN0ZDo6ZGVmYXVsdF9kZWxldGU8RGlyZWN0b3J5bW9uaXRvcjo6VERpcmVjdG9yeU1vbml0b3I+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPERyYWdkcm9wZmlsZXNleDo6VERyYWdEcm9wRmlsZXNFeCxzdGQ6OmRlZmF1bHRfZGVsZXRlPERyYWdkcm9wZmlsZXNleDo6VERyYWdEcm9wRmlsZXNFeD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPEV4dEV4Y2VwdGlvbixzdGQ6OmRlZmF1bHRfZGVsZXRlPEV4dEV4Y2VwdGlvbj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPEZpbGVvcGVyYXRvcjo6VEZpbGVPcGVyYXRvcixzdGQ6OmRlZmF1bHRfZGVsZXRlPEZpbGVvcGVyYXRvcjo6VEZpbGVPcGVyYXRvcj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFN5c3RlbTo6Q2xhc3Nlczo6VEZpbGVTdHJlYW0sc3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OkNsYXNzZXM6OlRGaWxlU3RyZWFtPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFN5c3RlbTo6Q2xhc3Nlczo6VE1lbW9yeVN0cmVhbSxzdGQ6OmRlZmF1bHRfZGVsZXRlPFN5c3RlbTo6Q2xhc3Nlczo6VE1lbW9yeVN0cmVhbT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFN5c3RlbTo6Q2xhc3Nlczo6VFN0cmluZ0xpc3Qsc3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OkNsYXNzZXM6OlRTdHJpbmdMaXN0PiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFN5c3RlbTo6Q2xhc3Nlczo6VFN0cmluZ3Msc3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OkNsYXNzZXM6OlRTdHJpbmdzPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFN5c3RlbTo6Q29udG5yczo6VE9iamVjdExpc3Qsc3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OkNvbnRucnM6OlRPYmplY3RMaXN0PiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFN5c3RlbTo6U3luY29ianM6OlRDcml0aWNhbFNlY3Rpb24sc3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OlN5bmNvYmpzOjpUQ3JpdGljYWxTZWN0aW9uPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFN5c3RlbTo6U3lzdXRpbHM6OkV4Y2VwdGlvbixzdGQ6OmRlZmF1bHRfZGVsZXRlPFN5c3RlbTo6U3lzdXRpbHM6OkV4Y2VwdGlvbj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFN5c3RlbTo6VE9iamVjdCxzdGQ6OmRlZmF1bHRfZGVsZXRlPFN5c3RlbTo6VE9iamVjdD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFN5c3RlbTo6VW5pY29kZVN0cmluZyxzdGQ6OmRlZmF1bHRfZGVsZXRlPFN5c3RlbTo6VW5pY29kZVN0cmluZz4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFN5c3RlbTo6V2luOjpSZWdpc3RyeTo6VFJlZ2lzdHJ5LHN0ZDo6ZGVmYXVsdF9kZWxldGU8U3lzdGVtOjpXaW46OlJlZ2lzdHJ5OjpUUmVnaXN0cnk+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRBY3Rpb25Mb2csc3RkOjpkZWZhdWx0X2RlbGV0ZTxUQWN0aW9uTG9nPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRiMml0ZW06OlRUQkN1c3RvbUl0ZW0sc3RkOjpkZWZhdWx0X2RlbGV0ZTxUYjJpdGVtOjpUVEJDdXN0b21JdGVtPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRieDo6VFRCWFBvcHVwTWVudSxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRieDo6VFRCWFBvcHVwTWVudT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRieHRvb2xwYWxzOjpUVEJYQ29sb3JQYWxldHRlLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VGJ4dG9vbHBhbHM6OlRUQlhDb2xvclBhbGV0dGU+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRDYWxsc3RhY2tUaHJlYWQsc3RkOjpkZWZhdWx0X2RlbGV0ZTxUQ2FsbHN0YWNrVGhyZWFkPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRDb3B5UGFyYW1MaXN0LHN0ZDo6ZGVmYXVsdF9kZWxldGU8VENvcHlQYXJhbUxpc3Q+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRDdXN0b21Db21tYW5kLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VEN1c3RvbUNvbW1hbmQ+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRDdXN0b21Db21tYW5kUHJvbXB0c0RpYWxvZyxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRDdXN0b21Db21tYW5kUHJvbXB0c0RpYWxvZz4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRDdXN0b21Db21tYW5kVHlwZSxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRDdXN0b21Db21tYW5kVHlwZT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRFZGl0ZWRGaWxlRGF0YSxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRFZGl0ZWRGaWxlRGF0YT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRIaWVyYXJjaGljYWxTdG9yYWdlLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VEhpZXJhcmNoaWNhbFN0b3JhZ2U+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRIaXN0b3J5U3RyaW5ncyxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRIaXN0b3J5U3RyaW5ncz4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRIdHRwLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VEh0dHA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRMb2NhbGVJbmZvLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VExvY2FsZUluZm8+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRPcHRpb25zU3RvcmFnZSxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRPcHRpb25zU3RvcmFnZT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRQYXJhbGxlbE9wZXJhdGlvbixzdGQ6OmRlZmF1bHRfZGVsZXRlPFRQYXJhbGxlbE9wZXJhdGlvbj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRQcmVmZXJlbmNlc0RpYWxvZ0RhdGEsc3RkOjpkZWZhdWx0X2RlbGV0ZTxUUHJlZmVyZW5jZXNEaWFsb2dEYXRhPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRQcm9ncmFtUGFyYW1zLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VFByb2dyYW1QYXJhbXM+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRRdWV1ZUZpbGVMaXN0LHN0ZDo6ZGVmYXVsdF9kZWxldGU8VFF1ZXVlRmlsZUxpc3Q+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRSZWdpc3RyeVN0b3JhZ2Usc3RkOjpkZWZhdWx0X2RlbGV0ZTxUUmVnaXN0cnlTdG9yYWdlPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRSZW1vdGVGaWxlLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VFJlbW90ZUZpbGU+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRTZXNzaW9uRGF0YSxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRTZXNzaW9uRGF0YT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRTc2hIb3N0Q0FMaXN0LHN0ZDo6ZGVmYXVsdF9kZWxldGU8VFNzaEhvc3RDQUxpc3Q+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRTdGFydHVwVGhyZWFkLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VFN0YXJ0dXBUaHJlYWQ+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRTdG9yZWRTZXNzaW9uTGlzdCxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRTdG9yZWRTZXNzaW9uTGlzdD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRUZXJtaW5hbCxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRUZXJtaW5hbD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFRUaXBzRGF0YSxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRUaXBzRGF0YT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFZjbDo6QXBwZXZudHM6OlRBcHBsaWNhdGlvbkV2ZW50cyxzdGQ6OmRlZmF1bHRfZGVsZXRlPFZjbDo6QXBwZXZudHM6OlRBcHBsaWNhdGlvbkV2ZW50cz4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFZjbDo6RGlhbG9nczo6VENvbG9yRGlhbG9nLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VmNsOjpEaWFsb2dzOjpUQ29sb3JEaWFsb2c+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFZjbDo6RGlhbG9nczo6VE9wZW5EaWFsb2csc3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6OkRpYWxvZ3M6OlRPcGVuRGlhbG9nPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFZjbDo6Rm9ybXM6OlRGb3JtLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VmNsOjpGb3Jtczo6VEZvcm0+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFZjbDo6R3JhcGhpY3M6OlRCaXRtYXAsc3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6OkdyYXBoaWNzOjpUQml0bWFwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFZjbDo6R3JhcGhpY3M6OlRDYW52YXMsc3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6OkdyYXBoaWNzOjpUQ2FudmFzPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFZjbDo6R3JhcGhpY3M6OlRGb250LHN0ZDo6ZGVmYXVsdF9kZWxldGU8VmNsOjpHcmFwaGljczo6VEZvbnQ+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFZjbDo6SW1hZ2luZzo6UG5naW1hZ2U6OlRQbmdJbWFnZSxzdGQ6OmRlZmF1bHRfZGVsZXRlPFZjbDo6SW1hZ2luZzo6UG5naW1hZ2U6OlRQbmdJbWFnZT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVW5pcXVlX3B0cl9iYXNlPFZjbDo6TWVudXM6OlRQb3B1cE1lbnUsc3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6Ok1lbnVzOjpUUG9wdXBNZW51PiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxfX2ludDY0LHN0ZDo6YWxsb2NhdG9yPF9faW50NjQ+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxIaXN0b3J5Y29tYm9ib3g6OlRIaXN0b3J5Q29tYm9Cb3ggKixzdGQ6OmFsbG9jYXRvcjxIaXN0b3J5Y29tYm9ib3g6OlRIaXN0b3J5Q29tYm9Cb3ggKj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxIV05EX18gKixzdGQ6OmFsbG9jYXRvcjxIV05EX18gKj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxzdGQ6OnBhaXI8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFN5c3RlbTo6VW5pY29kZVN0cmluZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPFN5c3RlbTo6VW5pY29kZVN0cmluZyxTeXN0ZW06OlVuaWNvZGVTdHJpbmc+ID4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxzdGQ6OnBhaXI8VFRlcm1pbmFsUXVldWUgKixUUXVldWVFdmVudD4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPFRUZXJtaW5hbFF1ZXVlICosVFF1ZXVlRXZlbnQ+ID4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxTeXN0ZW06OlREYXRlVGltZSxzdGQ6OmFsbG9jYXRvcjxTeXN0ZW06OlREYXRlVGltZT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxTeXN0ZW06OlVpdHlwZXM6OlRDb2xvcixzdGQ6OmFsbG9jYXRvcjxTeXN0ZW06OlVpdHlwZXM6OlRDb2xvcj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxTeXN0ZW06OlVuaWNvZGVTdHJpbmcsc3RkOjphbGxvY2F0b3I8U3lzdGVtOjpVbmljb2RlU3RyaW5nPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxUQnV0dG9uU3VibWl0RXZlbnQsc3RkOjphbGxvY2F0b3I8VEJ1dHRvblN1Ym1pdEV2ZW50PiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxUQ3VzdG9tQ29tbWFuZFR5cGU6OlRPcHRpb24sc3RkOjphbGxvY2F0b3I8VEN1c3RvbUNvbW1hbmRUeXBlOjpUT3B0aW9uPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxURWRpdG9yTWFuYWdlcjo6VEZpbGVEYXRhLHN0ZDo6YWxsb2NhdG9yPFRFZGl0b3JNYW5hZ2VyOjpURmlsZURhdGE+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxURmlsZUNvbG9yRGF0YSxzdGQ6OmFsbG9jYXRvcjxURmlsZUNvbG9yRGF0YT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxURmlsZU1hc2tzOjpUTWFzayxzdGQ6OmFsbG9jYXRvcjxURmlsZU1hc2tzOjpUTWFzaz4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxUSGllcmFyY2hpY2FsU3RvcmFnZTo6VEtleUVudHJ5LHN0ZDo6YWxsb2NhdG9yPFRIaWVyYXJjaGljYWxTdG9yYWdlOjpUS2V5RW50cnk+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxUT3B0aW9uczo6VE9wdGlvbixzdGQ6OmFsbG9jYXRvcjxUT3B0aW9uczo6VE9wdGlvbj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxUUmVtb3RlVG9rZW4sc3RkOjphbGxvY2F0b3I8VFJlbW90ZVRva2VuPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxUU3NoSG9zdENBLHN0ZDo6YWxsb2NhdG9yPFRTc2hIb3N0Q0E+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDx1bnNpZ25lZCBpbnQsc3RkOjphbGxvY2F0b3I8dW5zaWduZWQgaW50PiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDx1bnNpZ25lZCBsb25nLHN0ZDo6YWxsb2NhdG9yPHVuc2lnbmVkIGxvbmc+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDxWY2w6OkNvbWN0cmxzOjpUTGlzdEl0ZW0gKixzdGQ6OmFsbG9jYXRvcjxWY2w6OkNvbWN0cmxzOjpUTGlzdEl0ZW0gKj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpfVmVjdG9yX3ZhbDx2b2lkICosc3RkOjphbGxvY2F0b3I8dm9pZCAqPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpiYXNpY19zdHJpbmc8Y2hhcixzdGQ6OmNoYXJfdHJhaXRzPGNoYXI+LHN0ZDo6YWxsb2NhdG9yPGNoYXI+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxEaXJlY3Rvcnltb25pdG9yOjpURGlyZWN0b3J5TW9uaXRvcj4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxEcmFnZHJvcGZpbGVzZXg6OlREcmFnRHJvcEZpbGVzRXg+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxFeHRFeGNlcHRpb24+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxGaWxlb3BlcmF0b3I6OlRGaWxlT3BlcmF0b3I+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OkNsYXNzZXM6OlRGaWxlU3RyZWFtPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OkNsYXNzZXM6OlRNZW1vcnlTdHJlYW0+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OkNsYXNzZXM6OlRTdHJpbmdMaXN0Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OkNsYXNzZXM6OlRTdHJpbmdzPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OkNvbnRucnM6OlRPYmplY3RMaXN0Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OlN5bmNvYmpzOjpUQ3JpdGljYWxTZWN0aW9uPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OlN5c3V0aWxzOjpFeGNlcHRpb24+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OlRPYmplY3Q+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OlVuaWNvZGVTdHJpbmc+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06Oldpbjo6UmVnaXN0cnk6OlRSZWdpc3RyeT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUQWN0aW9uTG9nPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUYjJpdGVtOjpUVEJDdXN0b21JdGVtPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUYng6OlRUQlhQb3B1cE1lbnU+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUYnh0b29scGFsczo6VFRCWENvbG9yUGFsZXR0ZT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUQ2FsbHN0YWNrVGhyZWFkPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUQ29weVBhcmFtTGlzdD4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUQ3VzdG9tQ29tbWFuZD4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUQ3VzdG9tQ29tbWFuZFByb21wdHNEaWFsb2c+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUQ3VzdG9tQ29tbWFuZFR5cGU+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxURWRpdGVkRmlsZURhdGE+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUSGllcmFyY2hpY2FsU3RvcmFnZT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUSGlzdG9yeVN0cmluZ3M+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUSHR0cD4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUTG9jYWxlSW5mbz4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUT3B0aW9uc1N0b3JhZ2U+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUUGFyYWxsZWxPcGVyYXRpb24+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUUHJlZmVyZW5jZXNEaWFsb2dEYXRhPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUUHJvZ3JhbVBhcmFtcz4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUUXVldWVGaWxlTGlzdD4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUUmVnaXN0cnlTdG9yYWdlPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUUmVtb3RlRmlsZT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUU2Vzc2lvbkRhdGE+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUU3NoSG9zdENBTGlzdD4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUU3RhcnR1cFRocmVhZD4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUU3RvcmVkU2Vzc2lvbkxpc3Q+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUVGVybWluYWw+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxUVGlwc0RhdGE+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6OkFwcGV2bnRzOjpUQXBwbGljYXRpb25FdmVudHM+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6OkRpYWxvZ3M6OlRDb2xvckRpYWxvZz4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6OkRpYWxvZ3M6OlRPcGVuRGlhbG9nPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6OkZvcm1zOjpURm9ybT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6OkdyYXBoaWNzOjpUQml0bWFwPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6OkdyYXBoaWNzOjpUQ2FudmFzPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6OkdyYXBoaWNzOjpURm9udD4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6OkltYWdpbmc6OlBuZ2ltYWdlOjpUUG5nSW1hZ2U+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6Ok1lbnVzOjpUUG9wdXBNZW51Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpkZXF1ZTxUUmVtb3RlVGh1bWJuYWlsTmVlZGVkLHN0ZDo6YWxsb2NhdG9yPFRSZW1vdGVUaHVtYm5haWxOZWVkZWQ+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpleGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpleGNlcHRpb24gKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpsZW5ndGhfZXJyb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpsZW5ndGhfZXJyb3IgKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpsb2dpY19lcnJvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpsb2dpY19lcnJvciAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjptYXA8aW50LFBuZ2ltYWdlbGlzdDo6VFBuZ0ltYWdlTGlzdCAqLHN0ZDo6bGVzczxpbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBpbnQsUG5naW1hZ2VsaXN0OjpUUG5nSW1hZ2VMaXN0ICo+ID4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjptYXA8aW50LFRSZW1vdGVUaHVtYm5haWxEYXRhLHN0ZDo6bGVzczxpbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCBpbnQsVFJlbW90ZVRodW1ibmFpbERhdGE+ID4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjptYXA8aW50LHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8aW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgaW50LHVuc2lnbmVkIGludD4gPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjptYXA8aW50LFZjbDo6Q29udHJvbHM6OlRJbWFnZUxpc3QgKixzdGQ6Omxlc3M8aW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgaW50LFZjbDo6Q29udHJvbHM6OlRJbWFnZUxpc3QgKj4gPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjptYXA8U3lzdGVtOjpVaXR5cGVzOjpUQ29sb3IsaW50LHN0ZDo6bGVzczxTeXN0ZW06OlVpdHlwZXM6OlRDb2xvcj4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VWl0eXBlczo6VENvbG9yLGludD4gPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjptYXA8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHN0ZDo6cGFpcjxpbnQsdW5zaWduZWQgbG9uZz4sc3RkOjpsZXNzPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyxzdGQ6OnBhaXI8aW50LHVuc2lnbmVkIGxvbmc+ID4gPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjptYXA8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFN5c3RlbTo6VW5pY29kZVN0cmluZyxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLFN5c3RlbTo6VW5pY29kZVN0cmluZz4gPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjptYXA8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFROb3RpZnlFdmVudCxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLFROb3RpZnlFdmVudD4gPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjptYXA8U3lzdGVtOjpVbmljb2RlU3RyaW5nLFRQYXJhbGxlbE9wZXJhdGlvbjo6VERpcmVjdG9yeURhdGEsc3RkOjpsZXNzPFN5c3RlbTo6VW5pY29kZVN0cmluZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyxUUGFyYWxsZWxPcGVyYXRpb246OlREaXJlY3RvcnlEYXRhPiA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjptYXA8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8U3lzdGVtOjpVbmljb2RlU3RyaW5nPixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgU3lzdGVtOjpVbmljb2RlU3RyaW5nLHVuc2lnbmVkIGludD4gPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjptYXA8dW5zaWduZWQgaW50LHVuc2lnbmVkIGludCxzdGQ6Omxlc3M8dW5zaWduZWQgaW50PixzdGQ6OmFsbG9jYXRvcjxzdGQ6OnBhaXI8Y29uc3QgdW5zaWduZWQgaW50LHVuc2lnbmVkIGludD4gPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjptYXA8dW5zaWduZWQgbG9uZyxzdGQ6OnZlY3RvcjxIV05EX18gKixzdGQ6OmFsbG9jYXRvcjxIV05EX18gKj4gPixzdGQ6Omxlc3M8dW5zaWduZWQgbG9uZz4sc3RkOjphbGxvY2F0b3I8c3RkOjpwYWlyPGNvbnN0IHVuc2lnbmVkIGxvbmcsc3RkOjp2ZWN0b3I8SFdORF9fICosc3RkOjphbGxvY2F0b3I8SFdORF9fICo+ID4gPiA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjptYXA8dW5zaWduZWQgbG9uZyxTeXN0ZW06OkNsYXNzZXM6OlRTdHJpbmdzICosc3RkOjpsZXNzPHVuc2lnbmVkIGxvbmc+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxjb25zdCB1bnNpZ25lZCBsb25nLFN5c3RlbTo6Q2xhc3Nlczo6VFN0cmluZ3MgKj4gPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpvdXRfb2ZfcmFuZ2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpvdXRfb2ZfcmFuZ2UgKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPGNvbnN0IGludCxUUmVtb3RlVGh1bWJuYWlsRGF0YT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyxzdGQ6OnBhaXI8aW50LHVuc2lnbmVkIGxvbmc+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyxTeXN0ZW06OlVuaWNvZGVTdHJpbmc+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyxUTm90aWZ5RXZlbnQ+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyxUUGFyYWxsZWxPcGVyYXRpb246OlREaXJlY3RvcnlEYXRhPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPGNvbnN0IFN5c3RlbTo6VW5pY29kZVN0cmluZyx1bnNpZ25lZCBpbnQ+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPGNvbnN0IHVuc2lnbmVkIGxvbmcsc3RkOjp2ZWN0b3I8SFdORF9fICosc3RkOjphbGxvY2F0b3I8SFdORF9fICo+ID4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPGludCxTeXN0ZW06OlVuaWNvZGVTdHJpbmc+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPGludCxUUmVtb3RlVGh1bWJuYWlsRGF0YT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPGludCxUUmVtb3RlVGh1bWJuYWlsRGF0YT4gKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPFN5c3RlbTo6VW5pY29kZVN0cmluZyxzdGQ6OnBhaXI8aW50LHVuc2lnbmVkIGxvbmc+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPFN5c3RlbTo6VW5pY29kZVN0cmluZyxTeXN0ZW06OlVuaWNvZGVTdHJpbmc+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPFN5c3RlbTo6VW5pY29kZVN0cmluZyxUTm90aWZ5RXZlbnQ+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPFRUZXJtaW5hbFF1ZXVlICosVFF1ZXVlRXZlbnQ+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPFRUZXJtaW5hbFF1ZXVlICosVFF1ZXVlRXZlbnQ+ICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPFVuaWNvZGVTdHJpbmcsc3RkOjpwYWlyPGludCx1bnNpZ25lZCBsb25nPiA+ICo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPFVuaWNvZGVTdHJpbmcsVE5vdGlmeUV2ZW50PiAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpwYWlyPFVuaWNvZGVTdHJpbmcsVW5pY29kZVN0cmluZz4gKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpzZXQ8U3lzdGVtOjpDbGFzc2VzOjpURGF0YU1vZHVsZSAqLHN0ZDo6bGVzczxTeXN0ZW06OkNsYXNzZXM6OlREYXRhTW9kdWxlICo+LHN0ZDo6YWxsb2NhdG9yPFN5c3RlbTo6Q2xhc3Nlczo6VERhdGFNb2R1bGUgKj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpzZXQ8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHN0ZDo6bGVzczxTeXN0ZW06OlVuaWNvZGVTdHJpbmc+LHN0ZDo6YWxsb2NhdG9yPFN5c3RlbTo6VW5pY29kZVN0cmluZz4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpzZXQ8VGIyaXRlbTo6VFRCQ3VzdG9tSXRlbSAqLHN0ZDo6bGVzczxUYjJpdGVtOjpUVEJDdXN0b21JdGVtICo+LHN0ZDo6YWxsb2NhdG9yPFRiMml0ZW06OlRUQkN1c3RvbUl0ZW0gKj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPERpcmVjdG9yeW1vbml0b3I6OlREaXJlY3RvcnlNb25pdG9yLHN0ZDo6ZGVmYXVsdF9kZWxldGU8RGlyZWN0b3J5bW9uaXRvcjo6VERpcmVjdG9yeU1vbml0b3I+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPERyYWdkcm9wZmlsZXNleDo6VERyYWdEcm9wRmlsZXNFeCxzdGQ6OmRlZmF1bHRfZGVsZXRlPERyYWdkcm9wZmlsZXNleDo6VERyYWdEcm9wRmlsZXNFeD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPEV4dEV4Y2VwdGlvbixzdGQ6OmRlZmF1bHRfZGVsZXRlPEV4dEV4Y2VwdGlvbj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPEZpbGVvcGVyYXRvcjo6VEZpbGVPcGVyYXRvcixzdGQ6OmRlZmF1bHRfZGVsZXRlPEZpbGVvcGVyYXRvcjo6VEZpbGVPcGVyYXRvcj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFN5c3RlbTo6Q2xhc3Nlczo6VEZpbGVTdHJlYW0sc3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OkNsYXNzZXM6OlRGaWxlU3RyZWFtPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFN5c3RlbTo6Q2xhc3Nlczo6VE1lbW9yeVN0cmVhbSxzdGQ6OmRlZmF1bHRfZGVsZXRlPFN5c3RlbTo6Q2xhc3Nlczo6VE1lbW9yeVN0cmVhbT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFN5c3RlbTo6Q2xhc3Nlczo6VFN0cmluZ0xpc3Qsc3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OkNsYXNzZXM6OlRTdHJpbmdMaXN0PiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFN5c3RlbTo6Q2xhc3Nlczo6VFN0cmluZ3Msc3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OkNsYXNzZXM6OlRTdHJpbmdzPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFN5c3RlbTo6Q29udG5yczo6VE9iamVjdExpc3Qsc3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OkNvbnRucnM6OlRPYmplY3RMaXN0PiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFN5c3RlbTo6U3luY29ianM6OlRDcml0aWNhbFNlY3Rpb24sc3RkOjpkZWZhdWx0X2RlbGV0ZTxTeXN0ZW06OlN5bmNvYmpzOjpUQ3JpdGljYWxTZWN0aW9uPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFN5c3RlbTo6U3lzdXRpbHM6OkV4Y2VwdGlvbixzdGQ6OmRlZmF1bHRfZGVsZXRlPFN5c3RlbTo6U3lzdXRpbHM6OkV4Y2VwdGlvbj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFN5c3RlbTo6VE9iamVjdCxzdGQ6OmRlZmF1bHRfZGVsZXRlPFN5c3RlbTo6VE9iamVjdD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFN5c3RlbTo6VW5pY29kZVN0cmluZyxzdGQ6OmRlZmF1bHRfZGVsZXRlPFN5c3RlbTo6VW5pY29kZVN0cmluZz4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFN5c3RlbTo6V2luOjpSZWdpc3RyeTo6VFJlZ2lzdHJ5LHN0ZDo6ZGVmYXVsdF9kZWxldGU8U3lzdGVtOjpXaW46OlJlZ2lzdHJ5OjpUUmVnaXN0cnk+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRBY3Rpb25Mb2csc3RkOjpkZWZhdWx0X2RlbGV0ZTxUQWN0aW9uTG9nPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRiMml0ZW06OlRUQkN1c3RvbUl0ZW0sc3RkOjpkZWZhdWx0X2RlbGV0ZTxUYjJpdGVtOjpUVEJDdXN0b21JdGVtPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRieDo6VFRCWFBvcHVwTWVudSxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRieDo6VFRCWFBvcHVwTWVudT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRieHRvb2xwYWxzOjpUVEJYQ29sb3JQYWxldHRlLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VGJ4dG9vbHBhbHM6OlRUQlhDb2xvclBhbGV0dGU+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRDYWxsc3RhY2tUaHJlYWQsc3RkOjpkZWZhdWx0X2RlbGV0ZTxUQ2FsbHN0YWNrVGhyZWFkPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRDb3B5UGFyYW1MaXN0LHN0ZDo6ZGVmYXVsdF9kZWxldGU8VENvcHlQYXJhbUxpc3Q+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRDdXN0b21Db21tYW5kLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VEN1c3RvbUNvbW1hbmQ+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRDdXN0b21Db21tYW5kUHJvbXB0c0RpYWxvZyxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRDdXN0b21Db21tYW5kUHJvbXB0c0RpYWxvZz4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRDdXN0b21Db21tYW5kVHlwZSxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRDdXN0b21Db21tYW5kVHlwZT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRFZGl0ZWRGaWxlRGF0YSxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRFZGl0ZWRGaWxlRGF0YT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRIaWVyYXJjaGljYWxTdG9yYWdlLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VEhpZXJhcmNoaWNhbFN0b3JhZ2U+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRIaXN0b3J5U3RyaW5ncyxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRIaXN0b3J5U3RyaW5ncz4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRIdHRwLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VEh0dHA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRMb2NhbGVJbmZvLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VExvY2FsZUluZm8+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRPcHRpb25zU3RvcmFnZSxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRPcHRpb25zU3RvcmFnZT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRQYXJhbGxlbE9wZXJhdGlvbixzdGQ6OmRlZmF1bHRfZGVsZXRlPFRQYXJhbGxlbE9wZXJhdGlvbj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRQcmVmZXJlbmNlc0RpYWxvZ0RhdGEsc3RkOjpkZWZhdWx0X2RlbGV0ZTxUUHJlZmVyZW5jZXNEaWFsb2dEYXRhPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRQcm9ncmFtUGFyYW1zLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VFByb2dyYW1QYXJhbXM+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRRdWV1ZUZpbGVMaXN0LHN0ZDo6ZGVmYXVsdF9kZWxldGU8VFF1ZXVlRmlsZUxpc3Q+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRSZWdpc3RyeVN0b3JhZ2Usc3RkOjpkZWZhdWx0X2RlbGV0ZTxUUmVnaXN0cnlTdG9yYWdlPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRSZW1vdGVGaWxlLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VFJlbW90ZUZpbGU+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRTZXNzaW9uRGF0YSxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRTZXNzaW9uRGF0YT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRTc2hIb3N0Q0FMaXN0LHN0ZDo6ZGVmYXVsdF9kZWxldGU8VFNzaEhvc3RDQUxpc3Q+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRTdGFydHVwVGhyZWFkLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VFN0YXJ0dXBUaHJlYWQ+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRTdG9yZWRTZXNzaW9uTGlzdCxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRTdG9yZWRTZXNzaW9uTGlzdD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRUZXJtaW5hbCxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRUZXJtaW5hbD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFRUaXBzRGF0YSxzdGQ6OmRlZmF1bHRfZGVsZXRlPFRUaXBzRGF0YT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFZjbDo6QXBwZXZudHM6OlRBcHBsaWNhdGlvbkV2ZW50cyxzdGQ6OmRlZmF1bHRfZGVsZXRlPFZjbDo6QXBwZXZudHM6OlRBcHBsaWNhdGlvbkV2ZW50cz4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFZjbDo6RGlhbG9nczo6VENvbG9yRGlhbG9nLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VmNsOjpEaWFsb2dzOjpUQ29sb3JEaWFsb2c+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFZjbDo6RGlhbG9nczo6VE9wZW5EaWFsb2csc3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6OkRpYWxvZ3M6OlRPcGVuRGlhbG9nPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFZjbDo6Rm9ybXM6OlRGb3JtLHN0ZDo6ZGVmYXVsdF9kZWxldGU8VmNsOjpGb3Jtczo6VEZvcm0+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFZjbDo6R3JhcGhpY3M6OlRCaXRtYXAsc3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6OkdyYXBoaWNzOjpUQml0bWFwPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFZjbDo6R3JhcGhpY3M6OlRDYW52YXMsc3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6OkdyYXBoaWNzOjpUQ2FudmFzPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFZjbDo6R3JhcGhpY3M6OlRGb250LHN0ZDo6ZGVmYXVsdF9kZWxldGU8VmNsOjpHcmFwaGljczo6VEZvbnQ+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFZjbDo6SW1hZ2luZzo6UG5naW1hZ2U6OlRQbmdJbWFnZSxzdGQ6OmRlZmF1bHRfZGVsZXRlPFZjbDo6SW1hZ2luZzo6UG5naW1hZ2U6OlRQbmdJbWFnZT4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp1bmlxdWVfcHRyPFZjbDo6TWVudXM6OlRQb3B1cE1lbnUsc3RkOjpkZWZhdWx0X2RlbGV0ZTxWY2w6Ok1lbnVzOjpUUG9wdXBNZW51PiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8X19pbnQ2NCxzdGQ6OmFsbG9jYXRvcjxfX2ludDY0PiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8SGlzdG9yeWNvbWJvYm94OjpUSGlzdG9yeUNvbWJvQm94ICosc3RkOjphbGxvY2F0b3I8SGlzdG9yeWNvbWJvYm94OjpUSGlzdG9yeUNvbWJvQm94ICo+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8SFdORF9fICosc3RkOjphbGxvY2F0b3I8SFdORF9fICo+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8c3RkOjphbGxvY2F0b3I8Ym9vbD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8c3RkOjpwYWlyPFN5c3RlbTo6VW5pY29kZVN0cmluZyxTeXN0ZW06OlVuaWNvZGVTdHJpbmc+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxTeXN0ZW06OlVuaWNvZGVTdHJpbmcsU3lzdGVtOjpVbmljb2RlU3RyaW5nPiA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8c3RkOjpwYWlyPFRUZXJtaW5hbFF1ZXVlICosVFF1ZXVlRXZlbnQ+LHN0ZDo6YWxsb2NhdG9yPHN0ZDo6cGFpcjxUVGVybWluYWxRdWV1ZSAqLFRRdWV1ZUV2ZW50PiA+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8U3lzdGVtOjpURGF0ZVRpbWUsc3RkOjphbGxvY2F0b3I8U3lzdGVtOjpURGF0ZVRpbWU+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8U3lzdGVtOjpVaXR5cGVzOjpUQ29sb3Isc3RkOjphbGxvY2F0b3I8U3lzdGVtOjpVaXR5cGVzOjpUQ29sb3I+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8U3lzdGVtOjpVbmljb2RlU3RyaW5nLHN0ZDo6YWxsb2NhdG9yPFN5c3RlbTo6VW5pY29kZVN0cmluZz4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8VEJ1dHRvblN1Ym1pdEV2ZW50LHN0ZDo6YWxsb2NhdG9yPFRCdXR0b25TdWJtaXRFdmVudD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8VEN1c3RvbUNvbW1hbmRUeXBlOjpUT3B0aW9uLHN0ZDo6YWxsb2NhdG9yPFRDdXN0b21Db21tYW5kVHlwZTo6VE9wdGlvbj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8VEN1c3RvbUNvbW1hbmRUeXBlOjpUT3B0aW9uLHN0ZDo6YWxsb2NhdG9yPFRDdXN0b21Db21tYW5kVHlwZTo6VE9wdGlvbj4gPiAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8VEVkaXRvck1hbmFnZXI6OlRGaWxlRGF0YSxzdGQ6OmFsbG9jYXRvcjxURWRpdG9yTWFuYWdlcjo6VEZpbGVEYXRhPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8VEZpbGVDb2xvckRhdGEsc3RkOjphbGxvY2F0b3I8VEZpbGVDb2xvckRhdGE+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8VEZpbGVNYXNrczo6VE1hc2ssc3RkOjphbGxvY2F0b3I8VEZpbGVNYXNrczo6VE1hc2s+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8VEZpbGVNYXNrczo6VE1hc2ssc3RkOjphbGxvY2F0b3I8VEZpbGVNYXNrczo6VE1hc2s+ID5bNF0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8VEhpZXJhcmNoaWNhbFN0b3JhZ2U6OlRLZXlFbnRyeSxzdGQ6OmFsbG9jYXRvcjxUSGllcmFyY2hpY2FsU3RvcmFnZTo6VEtleUVudHJ5PiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8VE9wdGlvbnM6OlRPcHRpb24sc3RkOjphbGxvY2F0b3I8VE9wdGlvbnM6OlRPcHRpb24+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8VFJlbW90ZVRva2VuLHN0ZDo6YWxsb2NhdG9yPFRSZW1vdGVUb2tlbj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8VFNzaEhvc3RDQSxzdGQ6OmFsbG9jYXRvcjxUU3NoSG9zdENBPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8dW5zaWduZWQgaW50LHN0ZDo6YWxsb2NhdG9yPHVuc2lnbmVkIGludD4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8dW5zaWduZWQgbG9uZyxzdGQ6OmFsbG9jYXRvcjx1bnNpZ25lZCBsb25nPiA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8VmNsOjpDb21jdHJsczo6VExpc3RJdGVtICosc3RkOjphbGxvY2F0b3I8VmNsOjpDb21jdHJsczo6VExpc3RJdGVtICo+ID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjp2ZWN0b3I8dm9pZCAqLHN0ZDo6YWxsb2NhdG9yPHZvaWQgKj4gPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c1RJTUVTVEFNUA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmFnZUhhbmRsZXJGbGFn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmFnZUhhbmRsZXJOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVkQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVkQXR0cmlidXRlJg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVkUHJvYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmluZyBtYWluIHdpbmRvdyBjb25maWd1cmF0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyQ21wTG9naWNhbFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RyZWFtIGVuZCAoMSk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RyZWFtIGVycm9yICgtMik=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyZXRjaEJsdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyZXRjaERJQml0cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nQmFzZUluZGV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nQnVpbGRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRnJvbUNMU0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRnJvbUdVSUQy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyTGVuZ3Ro","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3R5bGVIb29rQ2xhc3M=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3VibWVudUl0ZW0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3Vic2V0VGl0bGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3Vic3lzdGVt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3VzcGVuZFRocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3dpdGNoVG9GaWJlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3dpdGNoVG9UaHJlYWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U1lNQk9MX0NIQVJTRVQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3ltQ2xlYW51cA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3ltR2V0TGluZUZyb21BZGRy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3ltR2V0TGluZUZyb21BZGRyVw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3ltR2V0TW9kdWxlSW5mbw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3ltR2V0TW9kdWxlSW5mb1c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3ltR2V0T3B0aW9ucw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3ltR2V0U3ltRnJvbUFkZHI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3ltR2V0U3ltRnJvbUFkZHJX","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3ltSW5pdGlhbGl6ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3ltSW5pdGlhbGl6ZVc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3ltTG9hZE1vZHVsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3ltU2V0T3B0aW9ucw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3luY2hyb25pemF0aW9ucw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3luY2hyb25pemU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3luY2hyb25pemVCcm93c2luZ0VuYWJsZWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzQWxsb2NTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzQWxsb2NTdHJpbmdMZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzRGF0ZVRpbWVQaWNrMzI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzRnJlZVN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzSGVhZGVyMzI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzTGlzdFZpZXczMg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzUGFnZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzUmVBbGxvY1N0cmluZ0xlbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzU2V0UmVkcmF3","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzVGFiQ29udHJvbDMy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdlbmVyaWNzLkNvbGxlY3Rpb25z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdlbmVyaWNzLkNvbGxlY3Rpb25zJA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdlbmVyaWNzLkRlZmF1bHRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlJ0dGk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlN5c1V0aWxz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlN5c1V0aWxzPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlN5c1V0aWxzSCVV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlR5cGVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlR5cEluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlVJVHlwZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlZhcmlhbnRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlZhcmlhbnRzRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlZhcmlhbnRzaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpfZGlfSUludGVyZmFjZSAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpBbnNpU3RyaW5nQmFzZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpBbnNpU3RyaW5nQmFzZSAq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpBbnNpU3RyaW5nVDwwPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpBbnNpU3RyaW5nVDw2NTAwMT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpBbnNpU3RyaW5nVDw2NTUzNT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpDbGFzc2VzOjpUQ29tcG9uZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpDbGFzc2VzOjpUQ3VzdG9tTWVtb3J5U3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpDbGFzc2VzOjpURGF0YU1vZHVsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpDbGFzc2VzOjpURmlsZVN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpDbGFzc2VzOjpUSGFuZGxlU3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpDbGFzc2VzOjpUSW50ZXJmYWNlZFBlcnNpc3RlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpDbGFzc2VzOjpUTGlzdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpDbGFzc2VzOjpUTGlzdFNvcnRDb21wYXJlRnVuYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpDbGFzc2VzOjpUTWVtb3J5U3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpDbGFzc2VzOjpUUGVyc2lzdGVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpDbGFzc2VzOjpUU3RyZWFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpDbGFzc2VzOjpUU3RyaW5nSXRlbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpDbGFzc2VzOjpUU3RyaW5nTGlzdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpDbGFzc2VzOjpUU3RyaW5ncw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpDb250bnJzOjpUT2JqZWN0TGlzdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpEZWxwaGlJbnRlcmZhY2U8SUN1c3RvbURlc3RpbmF0aW9uTGlzdD4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"scp.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtOjpEZWxwaGlJbnRlcmZhY2U8SURhdGFPYmplY3Q+","type":"Ansi","source":"Memory/File Scan","p