26:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/23qlsjvno4-wq.js","/_next/static/chunks/11pkz44bx8x1b.js","/_next/static/chunks/04k_7k5p4krw4.js"],"ReportDetailWrapper"] 62:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 25:T4b8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 67f14d588cdd… — Score 100/100 — Sample ed01ebfbc9eb…","description":"Malicious verdict for sandbox report 67f14d588cdd…. Threat score 100/100. 7 malicious and 15 suspicious behavioral indicators across 230 signatures. Detonated in Windows 11 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa/67f14d588cdd2a74670f9f6b","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa"],"about":{"@type":"SoftwareApplication","name":"WannaCry.exe.sample","applicationCategory":"PE32 executable (GUI) Intel 80386, for MS Windows","identifier":"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa","additionalType":"Malicious sample"},"threatScore":100,"sandboxEnvironment":"Windows 11 64 bit","behavioralIndicators":{"malicious":7,"suspicious":15,"totalSignatures":230},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T590,Found reference to "- bpo-40645: The :class:`hmac.HMAC` exposes internal implementation details." (Indicator: "HMAC"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found reference to "HMAC API. The new code will be used in Python 3.10 after the internal" (Indicator: "HMAC"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found reference to "implementation details of the pure Python HMAC module are no longer part" (Indicator: "HMAC"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found reference to "- bpo-33604: Fixed `hmac.new` and `hmac.HMAC` to raise TypeError instead of" (Indicator: "HMAC"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found reference to "- bpo-38134: Remove obsolete copy of PBKDF2_HMAC_fast. All supported OpenSSL" (Indicator: "HMAC"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found reference to "- bpo-33604: Remove HMAC default to md5 marked for removal in 3.8 (removal" (Indicator: "HMAC"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found reference to "- bpo-33604: Update HMAC md5 default to a DeprecationWarning, bump removal" (Indicator: "HMAC"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found reference to "optimized HMAC digest." (Indicator: "HMAC"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp")28:Tde9,"WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\@pm2\agent\node_modules\eventemitter2\LICENSE.txt.WNCRYT" to "C:\tempdir\node_modules\@pm2\agent\node_modules\eventemitter2\LICENSE.txt.WNCRY" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\@pm2\io\node_modules\eventemitter2\LICENSE.txt.WNCRYT" to "C:\tempdir\node_modules\@pm2\io\node_modules\eventemitter2\LICENSE.txt.WNCRY" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\@pm2\js-api\node_modules\eventemitter2\LICENSE.txt.WNCRYT" to "C:\tempdir\node_modules\@pm2\js-api\node_modules\eventemitter2\LICENSE.txt.WNCRY" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\basic-ftp\LICENSE.txt.WNCRYT" to "C:\tempdir\node_modules\basic-ftp\LICENSE.txt.WNCRY" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\bson\vendor\base64\LICENSE-MIT.txt.WNCRYT" to "C:\tempdir\node_modules\bson\vendor\base64\LICENSE-MIT.txt.WNCRY" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\@pm2\agent\node_modules\eventemitter2\LICENSE.txt" to "%TEMP%\1.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\@pm2\io\node_modules\eventemitter2\LICENSE.txt" to "%TEMP%\2.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\@pm2\js-api\node_modules\eventemitter2\LICENSE.txt" to "%TEMP%\3.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\basic-ftp\LICENSE.txt" to "%TEMP%\4.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\bson\vendor\base64\LICENSE-MIT.txt" to "%TEMP%\5.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\emoji-regex\LICENSE-MIT.txt" to "%TEMP%\6.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\exit\test\fixtures\100-stdout-stderr.txt" to "%TEMP%\7.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\exit\test\fixtures\1000-stderr.txt" to "%TEMP%\8.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\exit\test\fixtures\1000-stdout-stderr.txt" to "%TEMP%\9.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\exit\test\fixtures\1000-stdout.txt" to "%TEMP%\10.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\fast-json-patch\LICENSE.txt" to "%TEMP%\11.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\he\LICENSE-MIT.txt" to "%TEMP%\12.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\isbinaryfile\LICENSE.txt" to "%TEMP%\13.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\needle\license.txt" to "%TEMP%\14.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\pm2\GNU-AGPL-3.0.txt" to "%TEMP%\15.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\pm2\node_modules\eventemitter2\LICENSE.txt" to "%TEMP%\16.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\pm2-sysmonit\LICENSE-APACHE.txt" to "%TEMP%\17.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\punycode\LICENSE-MIT.txt" to "%TEMP%\18.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\sift\MIT-LICENSE.txt" to "%TEMP%\19.WNCRYT" "WannaCry.exe.sample.exe" renamed original file"C:\tempdir\node_modules\tr46\node_modules\punycode\LICENSE-MIT.txt" to "%TEMP%\20.WNCRYT"29:T56a,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt data Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to decode base64 data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: YARA signature match - AES encryption Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to decrypt/decode data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2a:Ta0a,"WannaCry.exe.sample.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000b44f2600e8ec1900650907771200000000000000d06ce87602000000608f8100b44f260008ed1900650907771200000000000000d06ce876f0b9d174120000001ced1900ae2e04770200000000000000d06ce8762ced1900e16ce876020000000000000054ed1900682070750200000000000000d42282a47092d9740000000094ed1900201b7575ffffffffa4ed1900581070753c107075242282a47092d9749cb9d174f0b9d17484ed190080ed19000d0000000d0000005041f5747cc82e75000000004041f574a0ed190018ee1900608d7375c8dae7d1feffffffb0ed1900900f70755041f574c0ed19000625e8747cc82e755041f574cced1900 (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006996)2b:T751,"cscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000001800000059000477338ece72580ccf020000000064fbcf02d0bbce72871fdb44fefffffff0facf02ae42cd7212000000f0476b00f0476b00be42cd72000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007424) "cscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000f98c720000000011000000f0f18c728000000000000000000049030c000000000000000000000030ddcf02feba027700000000000000008000000080328c7250ddcf022d83bb7600004903000000008000000080328c7202000000ec138c7268ddcf028b328c7280000000b4378c7201000000a8e48c7294ddcf0241348c72 (UID: 00000000-00007424) "cscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000093c2769ccccf022df888720800000011f88872f6ed0ae7804c8872102088720200000040008972a8694903a069490368cccf02102088723ccdcf02d0f588723abe4f97feffffffa8cccf0242f8887240008972c0cccf02944c887240008972cf7bbd7601000000a4bb8a72eccccf0241f28872082088721420887200000000 (UID: 00000000-00007424) "cscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000cf63837276750a38903583722818837202000000a07f83726c6449035064490340d0cf020018857214d1cf0240648372aa5a4148feffffff80d0cf0200648372a07f837298d0cf029f358372a07f8372cf7bbd7601000000d0158572c4d0cf02a15d8372001883722c1883720000000019def4760000000001000000 (UID: 00000000-00007424) "cscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000018837202000000110000006c64490380000000000000000000490314d1cf0240648372aa5a414888d0cf02feba0277000000000000000080000000a0428672a8d0cf022d83bb76000049030000000080000000a04286720200000044188672c0d0cf02ab42867280000000d447867201000000f0158772ecd0cf0261448672 (UID: 00000000-00007424)2c:T6db,"WannaCry.exe.sample.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WannaCry.exe.sample.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "taskdl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")2d:T1120,"WannaCry.exe.sample.exe" called "CopyFileA" to copy u.wnry to new location @WanaDecryptor@.exe (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\@Please_Read_Me@.txt (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @WanaDecryptor@.exe to new location C:\@WanaDecryptor@.exe (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\@Please_Read_Me@.txt (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @WanaDecryptor@.exe to new location C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\@WanaDecryptor@.exe (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\tempdir\node_modules\.bin\@Please_Read_Me@.txt (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @WanaDecryptor@.exe to new location C:\tempdir\node_modules\.bin\@WanaDecryptor@.exe (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\tempdir\node_modules\@colors\colors\@Please_Read_Me@.txt (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location C:\tempdir\node_modules\@colors\colors\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\tempdir\node_modules\@colors\colors\examples\@Please_Read_Me@.txt (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location C:\tempdir\node_modules\@colors\colors\examples\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\tempdir\node_modules\@colors\colors\lib\@Please_Read_Me@.txt (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location C:\tempdir\node_modules\@colors\colors\lib\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\tempdir\node_modules\@colors\colors\themes\@Please_Read_Me@.txt (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location C:\tempdir\node_modules\@colors\colors\themes\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\tempdir\node_modules\@mongodb-js\saslprep\dist\@Please_Read_Me@.txt (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location C:\tempdir\node_modules\@mongodb-js\saslprep\dist\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\tempdir\node_modules\@pm2\agent\@Please_Read_Me@.txt (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location C:\tempdir\node_modules\@pm2\agent\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\tempdir\node_modules\@pm2\agent\src\@Please_Read_Me@.txt (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location C:\tempdir\node_modules\@pm2\agent\src\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\tempdir\node_modules\@pm2\io\@Please_Read_Me@.txt (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location C:\tempdir\node_modules\@pm2\io\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\tempdir\node_modules\@pm2\io\pres\@Please_Read_Me@.txt (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location C:\tempdir\node_modules\@pm2\io\pres\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)2e:T13ba,"WannaCry.exe.sample.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "LoadLibrary" with a parameter MSVCRT.dll (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "LoadLibrary" with a parameter MSVCP60.dll (UID: 00000000-00006996) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00010448) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00010448) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00010448) "taskdl.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00010448) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003516) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003516) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003516) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003516) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007424) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007424) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007424) "cscript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007424) "cscript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007424) "cscript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007424) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007424) "cscript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00007424) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007424) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006384) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006384) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006384) "taskdl.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006384) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00010388) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00010388) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00010388) "taskdl.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00010388) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008900) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008900) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008900) "taskdl.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008900) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006140) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006140) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006140) "taskdl.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006140) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006788) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006788) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006788) "taskdl.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006788)2f:Te21c,"WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CryptEncrypt (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter MoveFileW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetFileTime (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetTempFileNameW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter OpenMutexA (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetFullPathNameA (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter InterlockedExchange (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter InterlockedExchangeAdd (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryA (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter SetEntriesInAclA (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter fopen (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter fprintf (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter sprintf (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter rand (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter time (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter srand (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter wcscpy (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter wcscat (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter wcslen (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ??2@YAPAXI@Z (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter __CxxFrameHandler (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ??3@YAXPAX@Z (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter swprintf (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter _except_handler3 (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter fread (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter wcsrchr (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter wcsncpy (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter wcscmp (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter _wcsnicmp (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter wcschr (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter _wfopen (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter _ftol (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ??0exception@@QAE@ABV0@@Z (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ??1exception@@UAE@XZ (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ??0exception@@QAE@ABQBD@Z (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter _CxxThrowException (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ??1type_info@@UAE@XZ (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter _adjust_fdiv (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter fclose (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter _wcsicmp (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter _local_unwind2 (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter wcsstr (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ?_Xran@std@@YAXXZ (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006996) "taskdl.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00010448) "taskdl.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00010448) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003516) "cmd.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003516) "cscript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter LogStagedFeatureUsage (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00007424) "cscript.exe" called "GetProcAddress" with a parameter RtlUnregisterFeatureConfigurationChangeNotification (UID: 00000000-00007424) "taskdl.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006384) "taskdl.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00010388) "taskdl.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008900) "taskdl.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006140) "taskdl.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006788) "taskdl.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006788)30:T404,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "WannaCry.exe.sample") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "WannaCry.exe.sample") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp")31:Tb054,Found reference to API (Indicator: "CryptReleaseContext"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "RegQueryValueExA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CreateServiceA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "StartServiceA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "RegCreateKeyW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "OpenSCManagerA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "RegSetValueExA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "OpenServiceA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "RegCloseKey"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CloseServiceHandle"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "DeleteCriticalSection"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetStartupInfoA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetExitCodeProcess"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SetFilePointer"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "LoadLibraryA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "HeapAlloc"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetModuleHandleA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "IsBadReadPtr"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CreateProcessA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "EnterCriticalSection"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetProcessHeap"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "WriteFile"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetFileAttributesA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CreateDirectoryA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "MultiByteToWideChar"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "FreeLibrary"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetFileSizeEx"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CreateFileA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "OpenMutexA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SetFileAttributesW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetProcAddress"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "ReadFile"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "VirtualAlloc"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CopyFileA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "HeapFree"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GlobalAlloc"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetFileSize"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "LeaveCriticalSection"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "FindResourceA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "Sleep"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "InitializeCriticalSection"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GlobalFree"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SetFileTime"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "LockResource"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "LoadResource"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "VirtualFree"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetFileAttributesW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "TerminateProcess"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SetLastError"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetFullPathNameA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SizeofResource"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CreateDirectoryW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetComputerNameW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "VirtualProtect"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetTempPathW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CloseHandle"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetModuleFileNameA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "WaitForSingleObject"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "wsprintfA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "DeleteFileW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "MoveFileExW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "MoveFileW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CreateFileW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CryptGenKey"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CryptDecrypt"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CryptEncrypt"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CryptDestroyKey"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CryptImportKey"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CryptAcquireContextA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "FindFirstFileW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "FindClose"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "FindNextFileW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetDriveTypeW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetLogicalDrives"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetUserNameA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "FreeSid"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CheckTokenMembership"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetDeviceCaps"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "ExtTextOutA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetObjectA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetTextExtentPoint32A"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "BitBlt"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CreateFontIndirectA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "TextOutA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CreateSolidBrush"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CreateCompatibleDC"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CreateFontA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "DeleteObject"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CreateThread"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "WideCharToMultiByte"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "DeleteFileA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CopyFileW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GlobalLock"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetComputerNameA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetTempFileNameA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GlobalUnlock"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "FindNextFileA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetExitCodeThread"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "FindFirstFileA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetUserDefaultLangID"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "TerminateThread"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetLocaleInfoA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetTickCount"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "ExitProcess"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SetFilePointerEx"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SetEndOfFile"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetFileTime"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SHGetFolderPathW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "ShellExecuteExA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "ShellExecuteA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetSystemMetrics"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GrayStringA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SetWindowTextW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetSysColor"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SetWindowPos"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "DrawIcon"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SendMessageA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetClientRect"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "IsIconic"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SetTimer"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "FillRect"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "ShowWindow"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SystemParametersInfoW"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "InvalidateRect"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "GetParent"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CloseClipboard"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "BringWindowToTop"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SetClipboardData"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SetFocus"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "OpenClipboard"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SetCursor"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SetForegroundWindow"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SetActiveWindow"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "EmptyClipboard"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "LoadCursorA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "TabbedTextOutA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "DrawTextA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "EnableWindow"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "SystemParametersInfoA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "RedrawWindow"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "KillTimer"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "LoadIconA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "OffsetRect"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "DeleteUrlCacheEntry"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "inet_ntoa"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "__WSAFDIsSet"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "WSAStartup"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "ioctlsocket"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "htons"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "gethostbyname"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "WSAGetLastError"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "closesocket"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "inet_addr"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "URLDownloadToFileA"; File: "WannaCry.exe.sample") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "OpenMutexA"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "InterlockedExchangeAdd"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "SetEntriesInAclA"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "CryptGetKeyParam"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found reference to API (Indicator: "CryptGenKey"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found reference to API (Indicator: "CryptDestroyKey"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found reference to API (Indicator: "CryptAcquireContextA"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyW"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateServiceA"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "StartServiceA"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceA"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerA"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00006996.00000002.285629.00408000.00000002.mdmp")32:T4a7,Found string "cmd.exe /c "%s"" (Indicator: "cmd.exe /c"; File: "WannaCry.exe.sample") Found string "%WINDIR%\system32\cmd.exe /c 88831743893367.bat" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c 88831743893367.bat" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "cmd.exe /c reg add %s /v "%s" /t REG_SZ /d "\"%s\"" /f" (Indicator: "cmd.exe /c"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found string "cmd.exe /c start /b %s vs" (Indicator: "cmd.exe /c"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp")33:T432,Found reference to API "MoveFileExW" (Indicator: "MoveFile"; File: "WannaCry.exe.sample") Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "WannaCry.exe.sample") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp")34:T1291,"WannaCry.exe.sample.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76d50000 "WannaCry.exe.sample.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76d50000 "WannaCry.exe.sample.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76d50000 "WannaCry.exe.sample.exe" loaded module "KERNEL32" at base 76630000 "WannaCry.exe.sample.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72c50000 "WannaCry.exe.sample.exe" loaded module "NTDLL.DLL" at base 76fe0000 "WannaCry.exe.sample.exe" loaded module "KERNELBASE" at base 76d50000 "WannaCry.exe.sample.exe" loaded module "ADVAPI32.DLL" at base 75a70000 "WannaCry.exe.sample.exe" loaded module "KERNEL32.DLL" at base 76630000 "WannaCry.exe.sample.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72bc0000 "WannaCry.exe.sample.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75590000 "WannaCry.exe.sample.exe" loaded module "USER32.DLL" at base 768a0000 "WannaCry.exe.sample.exe" loaded module "SHELL32.DLL" at base 74cf0000 "WannaCry.exe.sample.exe" loaded module "MSVCRT.DLL" at base 76b70000 "WannaCry.exe.sample.exe" loaded module "MSVCP60.DLL" at base 72b10000 "WannaCry.exe.sample.exe" loaded module "RPCRT4.DLL" at base 76420000 "WannaCry.exe.sample.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74410000 "WannaCry.exe.sample.exe" loaded module "SSPICLI.DLL" at base 739d0000 "taskdl.exe" loaded module "KERNEL32" at base 76630000 "taskdl.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76d50000 "taskdl.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76d50000 "taskdl.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76d50000 "taskdl.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76ae0000 "taskdl.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76d50000 "taskdl.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76d50000 "taskdl.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76d50000 "taskdl.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72c50000 "cmd.exe" loaded module "KERNEL32" at base 76630000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76d50000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76d50000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76d50000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76ae0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76d50000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76d50000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76d50000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72c50000 "cmd.exe" loaded module "KERNEL32.DLL" at base 76630000 "cmd.exe" loaded module "NTDLL.DLL" at base 76fe0000 "cmd.exe" loaded module "KERNELBASE" at base 76d50000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 744c0000 "cscript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76d50000 "cscript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76d50000 "cscript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76d50000 "cscript.exe" loaded module "KERNEL32" at base 76630000 "cscript.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72c50000 "cscript.exe" loaded module "KERNEL32.DLL" at base 76630000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 744e0000 "cscript.exe" loaded module "RPCRT4.DLL" at base 76420000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\VBSCRIPT.DLL" at base 729e0000 "cscript.exe" loaded module "AMSI.DLL" at base 729c0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74cd0000 "cscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\X86\MPOAV.DLL" at base 72950000 "cscript.exe" loaded module "WLDP.DLL" at base 72900000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75a70000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72bc0000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 728e0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 76c40000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 728c0000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\SCROBJ.DLL" at base 72880000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\WSHOM.OCX" at base 72860000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 732d0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a90000 "cscript.exe" loaded module "CSCAPI.DLL" at base 72dd000035:T47e,"WannaCry.exe.sample" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "WannaCry.exe.sample" was detected as "Microsoft Visual C/C++" and name: "Compiler" "WannaCry.exe.sample" was detected as "Microsoft Linker" and name: "Linker" "WannaCry.exe.sample" was detected as "Zip" and name: "Archive" "taskse.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "taskse.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "taskse.exe" was detected as "Microsoft Linker" and name: "Linker" "taskse.exe" was detected as "Zip" and name: "Archive" "taskdl.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "taskdl.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "taskdl.exe" was detected as "Microsoft Linker" and name: "Linker" "taskdl.exe" was detected as "Zip" and name: "Archive" "u.wnry" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "u.wnry" was detected as "Microsoft Visual C/C++" and name: "Compiler" "u.wnry" was detected as "Microsoft Linker" and name: "Linker" "u.wnry" was detected as "Zip" and name: "Archive"36:T94b,"WannaCry.exe.sample" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x40d488,push 0x4076f4,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x4081c4],pop ecx,or dword ptr [0x40f94c], 0xffffffff,or dword ptr [0x40f950], 0xffffffff,call dword ptr [0x4081c0],mov ecx, dword ptr [0x40f948],mov dword ptr [eax], ecx,call dword ptr [0x4081bc],mov ecx, dword ptr [0x40f944],mov dword ptr [eax], ecx,mov eax, dword ptr [0x4081b8]," "taskse.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x402070,push 0x401540,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x402050],pop ecx,or dword ptr [0x4031b4], 0xffffffff,or dword ptr [0x4031b8], 0xffffffff,call dword ptr [0x40204c],mov ecx, dword ptr [0x4031b0],mov dword ptr [eax], ecx,call dword ptr [0x402048],mov ecx, dword ptr [0x4031ac],mov dword ptr [eax], ecx,mov eax, dword ptr [0x402044]," "taskdl.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x4020a8,push 0x401a7c,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x40208c],pop ecx,or dword ptr [0x403084], 0xffffffff,or dword ptr [0x403088], 0xffffffff,call dword ptr [0x402088],mov ecx, dword ptr [0x403080],mov dword ptr [eax], ecx,call dword ptr [0x402084],mov ecx, dword ptr [0x40307c],mov dword ptr [eax], ecx,mov eax, dword ptr [0x402080]," "u.wnry" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x41baa8,push 0x413050,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x415524],pop ecx,or dword ptr [0x422298], 0xffffffff,or dword ptr [0x42229c], 0xffffffff,call dword ptr [0x415520],mov ecx, dword ptr [0x42228c],mov dword ptr [eax], ecx,call dword ptr [0x41551c],mov ecx, dword ptr [0x422288],mov dword ptr [eax], ecx,mov eax, dword ptr [0x415518],"37:T645,Spawned process "attrib.exe" with commandline "attrib +h ." (UID: 00000000-00006392) Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (UID: 00000000-00001792) Spawned process "taskdl.exe" (UID: 00000000-00010448) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c 88831743893367.bat" (UID: 00000000-00003516) Spawned process "attrib.exe" with commandline "attrib +h +s Z:\\$RECYCLE" (UID: 00000000-00008152) Spawned process "cscript.exe" with commandline "//nologo m.vbs" (UID: 00000000-00007424) Spawned process "taskdl.exe" (UID: 00000000-00006384) Spawned process "taskdl.exe" (UID: 00000000-00010388) Spawned process "taskdl.exe" (UID: 00000000-00008900) Spawned process "taskdl.exe" (UID: 00000000-00006140) Spawned process "taskdl.exe" (UID: 00000000-00006788) Spawned process "taskdl.exe" (UID: 00000000-00004736) Spawned process "taskdl.exe" (UID: 00000000-00011212) Spawned process "taskdl.exe" (UID: 00000000-00007860) Spawned process "taskdl.exe" (UID: 00000000-00005772) Spawned process "taskdl.exe" (UID: 00000000-00009656) Spawned process "taskdl.exe" (UID: 00000000-00010244) Spawned process "taskdl.exe" (UID: 00000000-00007952) Spawned process "taskdl.exe" (UID: 00000000-00008044) Spawned process "taskdl.exe" (UID: 00000000-00005012) Spawned process "taskdl.exe" (UID: 00000000-00002220) Spawned process "taskdl.exe" (UID: 00000000-00011032) Spawned process "taskdl.exe" (UID: 00000000-00005976) Spawned process "taskdl.exe" (UID: 00000000-00010452) Spawned process "taskdl.exe" (UID: 00000000-00009608)38:T645,Spawned process "attrib.exe" with commandline "attrib +h ." (UID: 00000000-00006392) Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (UID: 00000000-00001792) Spawned process "taskdl.exe" (UID: 00000000-00010448) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c 88831743893367.bat" (UID: 00000000-00003516) Spawned process "attrib.exe" with commandline "attrib +h +s Z:\\$RECYCLE" (UID: 00000000-00008152) Spawned process "cscript.exe" with commandline "//nologo m.vbs" (UID: 00000000-00007424) Spawned process "taskdl.exe" (UID: 00000000-00006384) Spawned process "taskdl.exe" (UID: 00000000-00010388) Spawned process "taskdl.exe" (UID: 00000000-00008900) Spawned process "taskdl.exe" (UID: 00000000-00006140) Spawned process "taskdl.exe" (UID: 00000000-00006788) Spawned process "taskdl.exe" (UID: 00000000-00004736) Spawned process "taskdl.exe" (UID: 00000000-00011212) Spawned process "taskdl.exe" (UID: 00000000-00007860) Spawned process "taskdl.exe" (UID: 00000000-00005772) Spawned process "taskdl.exe" (UID: 00000000-00009656) Spawned process "taskdl.exe" (UID: 00000000-00010244) Spawned process "taskdl.exe" (UID: 00000000-00007952) Spawned process "taskdl.exe" (UID: 00000000-00008044) Spawned process "taskdl.exe" (UID: 00000000-00005012) Spawned process "taskdl.exe" (UID: 00000000-00002220) Spawned process "taskdl.exe" (UID: 00000000-00011032) Spawned process "taskdl.exe" (UID: 00000000-00005976) Spawned process "taskdl.exe" (UID: 00000000-00010452) Spawned process "taskdl.exe" (UID: 00000000-00009608)39:T19d7,"taskse.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\taskse.exe]- [targetUID: 00000000-00006996] "taskdl.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\taskdl.exe]- [targetUID: 00000000-00010448] "@WanaDecryptor@.exe.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Sat Apr 5 22:49:27 2025 mtime=Sat Apr 5 22:49:27 2025 atime=Fri May 12 09:22:56 2017 length=245760 window=hide"- Location: [C:\@WanaDecryptor@.exe.lnk]- [targetUID: 00000000-00006996] "88831743893367.bat" has type "DOS batch file ASCII text with CRLF CR line terminators"- Location: [C:\88831743893367.bat]- [targetUID: 00000000-00003516] "m.vbs" has type "ASCII text with CRLF line terminators"- Location: [C:\m.vbs]- [targetUID: 00000000-00003516] "s.wnry" has type "Zip archive data at least v1.0 to extract compression method=store"- Location: [C:\s.wnry]- [targetUID: 00000000-00006996] "u.wnry" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\u.wnry]- [targetUID: 00000000-00006996] "m_vietnamese.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_vietnamese.wnry]- [targetUID: 00000000-00006996] "m_korean.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_korean.wnry]- [targetUID: 00000000-00006996] "m_japanese.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_japanese.wnry]- [targetUID: 00000000-00006996] "m_chinese _traditional_.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- [targetUID: N/A] "m_chinese _simplified_.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- [targetUID: N/A] "m_romanian.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_romanian.wnry]- [targetUID: 00000000-00006996] "m_greek.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_greek.wnry]- [targetUID: 00000000-00006996] "m_bulgarian.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_bulgarian.wnry]- [targetUID: 00000000-00006996] "m_russian.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_russian.wnry]- [targetUID: 00000000-00006996] "m_turkish.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_turkish.wnry]- [targetUID: 00000000-00006996] "m_slovak.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_slovak.wnry]- [targetUID: 00000000-00006996] "m_latvian.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_latvian.wnry]- [targetUID: 00000000-00006996] "m_czech.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_czech.wnry]- [targetUID: 00000000-00006996] "m_polish.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_polish.wnry]- [targetUID: 00000000-00006996] "m_croatian.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_croatian.wnry]- [targetUID: 00000000-00006996] "m_swedish.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_swedish.wnry]- [targetUID: 00000000-00006996] "m_french.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_french.wnry]- [targetUID: 00000000-00006996] "m_finnish.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_finnish.wnry]- [targetUID: 00000000-00006996] "m_portuguese.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_portuguese.wnry]- [targetUID: 00000000-00006996] "m_filipino.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_filipino.wnry]- [targetUID: 00000000-00006996] "m_norwegian.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_norwegian.wnry]- [targetUID: 00000000-00006996] "m_spanish.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_spanish.wnry]- [targetUID: 00000000-00006996] "m_indonesian.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_indonesian.wnry]- [targetUID: 00000000-00006996] "m_german.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_german.wnry]- [targetUID: 00000000-00006996] "m_danish.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_danish.wnry]- [targetUID: 00000000-00006996] "m_dutch.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_dutch.wnry]- [targetUID: 00000000-00006996] "m_english.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_english.wnry]- [targetUID: 00000000-00006996] "m_italian.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [C:\msg\m_italian.wnry]- [targetUID: 00000000-00006996] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [C:\@Please_Read_Me@.txt]- [targetUID: 00000000-00006996] "r.wnry" has type "ASCII text with CRLF line terminators"- Location: [C:\r.wnry]- [targetUID: 00000000-00006996] "f.wnry" has type "ASCII text with CRLF line terminators"- Location: [C:\f.wnry]- [targetUID: 00000000-00006996]3a:T521,"WannaCry.exe.sample.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "WannaCry.exe.sample.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WannaCry.exe.sample.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WannaCry.exe.sample.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "WannaCry.exe.sample.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "WannaCry.exe.sample.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "WannaCry.exe.sample.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WannaCry.exe.sample.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WannaCry.exe.sample.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WannaCry.exe.sample.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")3b:Tb0d,"WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "WANNACRY.EXE.SAMPLE.EXE"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "")3c:T858,"WannaCry.exe.sample.exe" trying to access non-existent file "C:\attrib.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "attrib.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\icacls.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "icacls.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\crypt32.dll" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\bcrypt.dll" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\MSVCP60.dll" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\@WanaDecryptor@.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "@WanaDecryptor@.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\@WanaDecryptor@.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\WINDOWS\system\@WanaDecryptor@.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\WINDOWS\@WanaDecryptor@.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\@WanaDecryptor@.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\WINDOWS\system32\@WanaDecryptor@.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\@WanaDecryptor@.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\@WanaDecryptor@.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\WindowsApps\@WanaDecryptor@.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\Program Files\mitmproxy\bin\@WanaDecryptor@.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\nvm\@WanaDecryptor@.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\Program Files\nodejs\@WanaDecryptor@.exe" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\SspiCli.dll"3d:T7f6,"WannaCry.exe.sample.exe" trying to access non-existent file "C:\c.wnry" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\msg" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\crypt32.dll.mui" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\00000000.dky" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\00000000.pky" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\00000000.res" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\f.wnry" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\@WanaDecryptor@.exe fi" "WannaCry.exe.sample.exe" trying to access non-existent file "@WanaDecryptor@.exe fi" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\@WanaDecryptor@.exe fi" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\WINDOWS\system\@WanaDecryptor@.exe fi" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\WINDOWS\@WanaDecryptor@.exe fi" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\@WanaDecryptor@.exe fi" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\WINDOWS\system32\@WanaDecryptor@.exe fi" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\@WanaDecryptor@.exe fi" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\@WanaDecryptor@.exe fi" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\WindowsApps\@WanaDecryptor@.exe fi" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\Program Files\mitmproxy\bin\@WanaDecryptor@.exe fi" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\nvm\@WanaDecryptor@.exe fi" "WannaCry.exe.sample.exe" trying to access non-existent file "C:\Program Files\nodejs\@WanaDecryptor@.exe fi"3e:T204e,Heuristic match: "ax.id" Heuristic match: "*g.ro" Heuristic match: "}1.ng" Pattern match: "http://%d/%d/%d" Heuristic match: ".exe.sa" Heuristic match: "readme.md" Heuristic match: "security.md" Heuristic match: "c:\tempdir\node_modules\@socket.io" Heuristic match: "ce}-c\proof.fr" Pattern match: "https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip" Heuristic match: "jloup@gzip.org madler@alumni.caltech.edu" Pattern match: "http://www.openssl.org/" Pattern match: "www.freetype.org" Heuristic match: "o freetype@nongnu.org" Heuristic match: "o freetype-devel@nongnu.org" Pattern match: "http://www.freetype.org" Heuristic match: "email domain: cam.ac.uk" Heuristic match: "emain domain: freemail.hu" Pattern match: "http://www.sqlite.org/copyright.html" Heuristic match: "vhwd.gn" Heuristic match: "$y.qa" Heuristic match: "z).bz" Heuristic match: "__main__.py" Heuristic match: "segment.py" Heuristic match: "spinner.py" Heuristic match: "style.py" Heuristic match: "table.py" Heuristic match: "termin~1.py" Heuristic match: "text.py" Heuristic match: "theme.py" Heuristic match: "traceb~1.py" Heuristic match: "traceback.py" Heuristic match: "tree.py" Heuristic match: "_cell_~1.py" Heuristic match: "_cell_widths.py" Heuristic match: "_emoji~1.py" Heuristic match: "_emoji_codes.py" Heuristic match: "_emoji~2.py" Heuristic match: "_emoji_replace.py" Heuristic match: "_expor~1.py" Heuristic match: "_exten~1.py" Heuristic match: "_inspect.py" Heuristic match: "_log_r~1.py" Heuristic match: "_log_render.py" Heuristic match: "_loop.py" Heuristic match: "_palet~1.py" Heuristic match: "_palettes.py" Heuristic match: "_pick.py" Heuristic match: "_spinn~1.py" Heuristic match: "_spinners.py" Heuristic match: "_stack.py" Heuristic match: "_timer.py" Heuristic match: "more.py" Heuristic match: "recipes.py" Heuristic match: "__init__.py" Heuristic match: "markers.py" Heuristic match: "requir~1.py" Heuristic match: "requirements.py" Heuristic match: "specif~1.py" Heuristic match: "tags.py" Heuristic match: "utils.py" Heuristic match: "version.py" Heuristic match: "_manyl~1.py" Heuristic match: "_musll~1.py" Heuristic match: "_musllinux.py" Heuristic match: "_struc~1.py" Heuristic match: "_structures.py" Heuristic match: "__abou~1.py" Heuristic match: "__about__.py" Heuristic match: "extens~1.py" Heuristic match: "extension.py" Heuristic match: "glob.py" Heuristic match: "instal~1.py" Heuristic match: "installer.py" Heuristic match: "logging.py" Heuristic match: "msvc.py" Heuristic match: "namesp~1.py" Heuristic match: "namespaces.py" Heuristic match: "packag~1.py" Heuristic match: "package_index.py" Heuristic match: "py34co~1.py" Heuristic match: "sandbox.py" Heuristic match: "unicod~1.py" Heuristic match: "unicode_utils.py" Heuristic match: "cmd.py" Heuristic match: "core.py" Heuristic match: "cygwin~1.py" Heuristic match: "cygwinccompiler.py" Heuristic match: "debug.py" Heuristic match: "dep_util.py" Heuristic match: "dir_util.py" Heuristic match: "dist.py" Heuristic match: "fancy_~1.py" Heuristic match: "fancy_getopt.py" Heuristic match: "filelist.py" Heuristic match: "file_u~1.py" Heuristic match: "file_util.py" Heuristic match: "log.py" Heuristic match: "msvc9c~1.py" Heuristic match: "msvc9compiler.py" Heuristic match: "msvcco~1.py" Heuristic match: "msvccompiler.py" Heuristic match: "py38co~1.py" Heuristic match: "py39co~1.py" Heuristic match: "spawn.py" Heuristic match: "syscon~1.py" Heuristic match: "sysconfig.py" Heuristic match: "text_f~1.py" Heuristic match: "text_file.py" Heuristic match: "unixcc~1.py" Heuristic match: "unixccompiler.py" Heuristic match: "util.py" Heuristic match: "versio~1.py" Heuristic match: "versionpredicate.py" Heuristic match: "_colle~1.py" Heuristic match: "_collections.py" Heuristic match: "_funct~1.py" Heuristic match: "_functools.py" Heuristic match: "_macos~1.py" Heuristic match: "_macos_compat.py" Heuristic match: "_msvcc~1.py" Heuristic match: "_msvccompiler.py" Heuristic match: "actions.py" Heuristic match: "except~1.py" Heuristic match: "helpers.py" Heuristic match: "results.py" Heuristic match: "testing.py" Heuristic match: "unicode.py" Heuristic match: "fix_next.py" Heuristic match: "fix_no~1.py" Heuristic match: "fix_nonzero.py" Heuristic match: "fix_nu~1.py" Heuristic match: "install_data.py" Heuristic match: "instal~2.py" Heuristic match: "install_egg_info.py" Heuristic match: "instal~3.py" Heuristic match: "install_headers.py" Heuristic match: "instal~4.py" Heuristic match: "install_lib.py" Heuristic match: "in32d9~1.py" Heuristic match: "install_scripts.py" Heuristic match: "py37co~1.py" Heuristic match: "register.py" Heuristic match: "sdist.py" Heuristic match: "upload.py" Heuristic match: "_frame~1.py" Heuristic match: "_framework_compat.py" Heuristic match: "_adapt~1.py" Heuristic match: "_adapters.py" Heuristic match: "_compat.py" Heuristic match: "_itert~1.py" Heuristic match: "_meta.py" Heuristic match: "_text.py" Heuristic match: "easy_i~1.py" Heuristic match: "easy_install.py" Heuristic match: "editab~1.py" Heuristic match: "egg_info.py" Heuristic match: "install.py" Heuristic match: "py36co~1.py" Heuristic match: "saveopts.py" Heuristic match: "test.py" Heuristic match: "upload~1.py" Heuristic match: "upload_docs.py" Heuristic match: "langru~1.py" Heuristic match: "langrussianmodel.py" Heuristic match: "langth~1.py" Heuristic match: "langthaimodel.py" Heuristic match: "langtu~1.py" Heuristic match: "langturkishmodel.py" Heuristic match: "latin1~1.py" Heuristic match: "latin1prober.pyw.py" Pattern match: "https://github.com/python/cpython" Pattern match: "https://github.com/orgs/python/projects/31" Heuristic match: "- class browser now compatible with python2.3 version of pyclbr.py" Heuristic match: "- fix tk root pop-ups in configsectionnamedialog.py and configdialog.py" Heuristic match: "execbinding.py, loader.py, protocol.py, remote.py, spawn.py" Pattern match: "https://github.com/libexpat/libexpat/issues/115" Pattern match: "https://sourceforge.net/p/expat/bugs/537/" Pattern match: "https://github.com/python/typing" Heuristic match: "- bpo-27705: update message in validate_ucrtbase.py" Pattern match: "https://github.com/python/pythondotorg/issues/945" Pattern match: "sndhdr.what/whathdr" Pattern match: "http://www.python.org/" Pattern match: "http://www.example.com" Pattern match: "https://github.com/python/typing/issues/751" Heuristic match: "- bpo-40964: disable remote :mod:`imaplib` tests, host cyrus.andrew.cmu.edu" Heuristic match: "in webbrowser.py" Pattern match: "https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242274" Pattern match: "https://www.w3.org/tr/xml/#sec-prolog-dtd" Pattern match: "https://importlib-metadata.readthedocs.io/en/latest/changelog%20(links).html#v1-5-0" Heuristic match: "- bpo-39242: updated the gmane domain from news.gmane.org to news.gmane.io" Pattern match: "https://fishshell.com/docs/current/commands.html#source" Heuristic match: "- bpo-38586: now :func:`~logging.config.fileconfig` correctly sets the .name" Pattern match: "https://gitlab.com/python-devs/importlib_metadata/blob/0.21/importlib_metadata/docs/changelog.rst" Pattern match: "https://gitlab.com/python-devs/importlib_metadata/-/milestones/20" Pattern match: "https://docs.python.org/zh-cn/" Heuristic match: "- bpo-36544: fix regression introduced in bpo-36146 refactoring setup.py" Heuristic match: "- bpo-34144: fixed activate.bat to correctly update codepage when chcp.com" Pattern match: "https://github.com/python/typed_ast" Heuristic match: "- bpo-34558: correct typo in lib/ctypes/_aix.py" Heuristic match: "- bpo-33061: add missing ``noreturn`` to ``__all__`` in typing.py" Pattern match: "https://www.openssl.org/docs/man1.1.0/ssl/ssl_ctx_set_min_proto_version.html" Pattern match: "https://docs.python.org/3/" Pattern match: "https://python.visualstudio.com/cpython" Heuristic match: "- bpo-29442: replace optparse with argparse in setup.py" Pattern match: "https://github.com/pypa/setuptools/issues/100" Heuristic match: "ow.mv" Heuristic match: "8d.sa"3f:Ta5e,Found URL "https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip00000000.res00000000.pky00000000.eky" - Source: "00000000-00006996.00000000.281787.1000C000.00000004.mdmp") Found URL "http://www.openssl.org/)" - Source: "00000000-00006996.00000001.283709.031B9000.00000004.mdmp") Found URL "http://www.freetype.org" - Source: "00000000-00006996.00000001.283709.031B9000.00000004.mdmp") Found URL "http://www.sqlite.org/copyright.html," - Source: "00000000-00006996.00000001.283709.031B9000.00000004.mdmp") Found URL "https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip00000000.res00000000.pky00000000.eky" - Source: "00000000-00006996.00000001.283709.1000C000.00000004.mdmp") Found URL "https://github.com/python/cpython." - Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found URL "https://github.com/orgs/python/projects/31.the" - Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found URL "https://github.com/libexpat/libexpat/issues/115-" - Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found URL "https://sourceforge.net/p/expat/bugs/537/" - Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found URL "https://github.com/python/typing:" - Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found URL "https://github.com/python/pythondotorg/issues/945)build------" - Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found URL "https://github.com/libexpat/libexpat/issues/115what's" - Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found URL "https://github.com/python/pythondotorg/issues/945)tools/demos------------" - Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found URL "http://www.python.org/" - Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found URL "https://www.python.org:" - Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found URL "http://www.example.com" - Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found URL "https://github.com/python/typing/issues/751>" - Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found URL "https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242274-" - Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found URL "https://www.w3.org/tr/xml/" - Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found URL "https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip00000000.res00000000.pky00000000.eky" - Source: "00000000-00006996.00000002.285629.1000C000.00000004.mdmp")40:T9bd,Observed string: "- bpo-30715: Address ALPN callback changes for OpenSSL 1.1.0f. The latest" (Indicator: "OpenSSL 1.") Observed string: "version behaves like OpenSSL 1.0.2 and no longer aborts handshake." (Indicator: "OpenSSL 1.") Observed string: "- bpo-29572: Update Windows build and OS X installers to use OpenSSL 1.0.2k." (Indicator: "OpenSSL 1.") Observed string: "- bpo-28248: Update Windows build and OS X installers to use OpenSSL 1.0.2j." (Indicator: "OpenSSL 1.") Observed string: "module (requires OpenSSL 1.1.0)." (Indicator: "OpenSSL 1.") Observed string: "(Required OpenSSL 1.1.0 or LibreSSL)." (Indicator: "OpenSSL 1.") Observed string: "- bpo-26470: Port ssl and hashlib module to OpenSSL 1.1.0." (Indicator: "OpenSSL 1.") Observed string: "- bpo-26930: Update Windows builds to use OpenSSL 1.0.2h." (Indicator: "OpenSSL 1.") Observed string: "OpenSSL 1.0.2h." (Indicator: "OpenSSL 1.") Observed string: "- bpo-26465: Update Windows builds to use OpenSSL 1.0.2g." (Indicator: "OpenSSL 1.") Observed string: "OpenSSL 1.0.2g." (Indicator: "OpenSSL 1.") Observed string: "- bpo-26268: Update Windows builds to use OpenSSL 1.0.2f." (Indicator: "OpenSSL 1.") Observed string: "- bpo-23686: Update OS X 10.5 installer build to use OpenSSL 1.0.2a." (Indicator: "OpenSSL 1.") Observed string: "for ECDH key exchange on OpenSSL 1.0.2 and later, and otherwise default to" (Indicator: "OpenSSL 1.") Observed string: "- bpo-30008: Fix :mod:`ssl` code to be compatible with OpenSSL 1.1.x builds" (Indicator: "OpenSSL 1.") Observed string: "- bpo-40479: Update multissltest helper to test with latest OpenSSL 1.0.2," (Indicator: "OpenSSL 1.") Observed string: "- bpo-40162: Update Travis CI configuration to OpenSSL 1.1.1f." (Indicator: "OpenSSL 1.") Observed string: "- bpo-40164: Updates Windows to OpenSSL 1.1.1f" (Indicator: "OpenSSL 1.") Observed string: "- bpo-40164: Update macOS installer builds to use OpenSSL 1.1.1g." (Indicator: "OpenSSL 1.") Observed string: "function with OpenSSL 1.1.0+." (Indicator: "OpenSSL 1.") Observed string: "- bpo-38117: Test with OpenSSL 1.1.1d" (Indicator: "OpenSSL 1.") Observed string: "- bpo-37081: Test with OpenSSL 1.1.1c" (Indicator: "OpenSSL 1.") Observed string: "- bpo-35926: Update to OpenSSL 1.1.1b for Windows." (Indicator: "OpenSSL 1.") Observed string: "- bpo-34405: Updated to OpenSSL 1.1.0i for Windows builds." (Indicator: "OpenSSL 1.") Observed string: "support with OpenSSL 1.1.1" (Indicator: "OpenSSL 1.")41:T5e9,"WannaCry.exe.sample.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Desktop\* (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "FindNextFileW" with parameter desktop.ini (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\* (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "FindNextFileW" with parameter My Music (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "FindNextFileW" with parameter My Pictures (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "FindNextFileW" with parameter My Videos (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\My Music\* (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\My Pictures\* (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\My Videos\* (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "FindFirstFileW" with parameter C:\Users\*.* (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "FindNextFileW" with parameter All Users (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "FindNextFileW" with parameter Default (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "FindNextFileW" with parameter Default User (UID: 00000000-00006996)42:T1399,Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; File: "WannaCry.exe.sample") Found string "7naesu" (Indicator: "aes"; File: "WannaCry.exe.sample") file/memory contains long string with (Indicator: "aes"; File: "u.wnry") file/memory contains long string with (Indicator: "rsa2"; File: "u.wnry") Found string ".aes" (Indicator: "aes"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found string "t Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found string "RSA2" (Indicator: "rsa2"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp") Found string "C:\tempdir\node_modules\base64id" (Indicator: "base64"; Source: "00000000-00006996.00000000.281787.025B0000.00000004.mdmp") Found string "\??\C:\tempdir\node_modules\bson\vendor\base64\LICENSE-MIT.txt" (Indicator: "base64"; Source: "00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00006996.00000001.283709.031B9000.00000004.mdmp") file/memory contains long string with (Indicator: "3des"; Source: "00000000-00006996.00000001.283709.031B9000.00000004.mdmp") file/memory contains long string with (Indicator: "rsa2"; Source: "00000000-00006996.00000001.283709.031B9000.00000004.mdmp") Found string "-u extralargefile to run test_zipfile64." (Indicator: "zipfile"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-26293: Change resulted because of zipfile breakage. (See also:" (Indicator: "zipfile"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-28231: The zipfile module now accepts path-like objects for external" (Indicator: "zipfile"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "when executing ``__main__`` from a zipfile, directory, or other import" (Indicator: "zipfile"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-26937: The chown() method of the tarfile.TarFile class does not fail" (Indicator: "tarfile"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-28513: Documented command-line interface of zipfile." (Indicator: "zipfile"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-28449: tarfile.open() with mode "r" or "r:" now tries to open a tar" (Indicator: "tarfile"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-27199: In tarfile, expose copyfileobj bufsize to improve throughput." (Indicator: "tarfile"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-24693: Changed some RuntimeError's in the zipfile module to more" (Indicator: "zipfile"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-28047: Fixed calculation of line length used for the base64 CTE in the" (Indicator: "base64"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-27850: Remove 3DES from ssl module's default cipher list to counter" (Indicator: "3des"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-27766: Add ChaCha20 Poly1305 to ssl module's default cipher list." (Indicator: "chacha"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "ZipFile.open()." (Indicator: "zipfile"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-26039: zipfile.ZipFile.open() can now be used to write data into a ZIP" (Indicator: "zipfile"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-24838: tarfile's ustar and gnu formats now correctly calculate name" (Indicator: "tarfile"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp")43:T128e,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "WannaCry.exe.sample") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "WannaCry.exe.sample") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "WannaCry.exe.sample") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "WannaCry.exe.sample") Found reference to API "276,3118,,FindNextFileW,kernel32.dll,"01:13:22.078",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API "11828986232,9276,3118,,FindNextFileW,kernel32.dll,"01:13:22.906",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp") Found reference to API "11828831804,9276,3118,,FindNextFileW,kernel32.dll,"01:13:22.906",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp") Found reference to API "11814729952,9276,3118,,FindNextFileW,kernel32.dll,"01:13:22.906",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp") Found reference to API "11795354458,9276,3118,,FindNextFileW,kernel32.dll,"01:13:22.890",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp") Found reference to API "11813869190,9276,3118,,FindNextFileW,kernel32.dll,"01:13:22.906",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp") Found reference to API "11825321894,9276,3116,,FindFirstFileW,kernel32.dll,"01:13:22.906",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp") Found reference to API "11814316962,9276,3118,,FindNextFileW,kernel32.dll,"01:13:22.906",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp") Found reference to API "11828506710,9276,3118,,FindNextFileW,kernel32.dll,"01:13:22.906",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp") Found reference to API "11828759594,9276,3118,,FindNextFileW,kernel32.dll,"01:13:22.906",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp") Found reference to API "11828606676,9276,3118,,FindNextFileW,kernel32.dll,"01:13:22.906",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp") Found reference to API "11828902890,9276,3118,,FindNextFileW,kernel32.dll,"01:13:22.906",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp") Found reference to API "83923920614,9276,3116,,FindFirstFileW,kernel32.dll,"01:13:52.953",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006996.00000001.283709.00810000.00000004.mdmp") Found reference to API "83901889032,9276,3118,,FindNextFileW,kernel32.dll,"01:13:52.937",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000001.283709.00810000.00000004.mdmp") Found reference to API "83893672384,9276,3116,,FindFirstFileW,kernel32.dll,"01:13:52.937",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006996.00000001.283709.00810000.00000004.mdmp") Found reference to API "83908223210,9276,3116,,FindFirstFileW,kernel32.dll,"01:13:52.937",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006996.00000001.283709.00810000.00000004.mdmp") Found reference to API "83907494842,9276,3118,,FindNextFileW,kernel32.dll,"01:13:52.937",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000001.283709.00810000.00000004.mdmp") Found reference to API "83923031206,9276,3118,,FindNextFileW,kernel32.dll,"01:13:52.953",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000001.283709.00810000.00000004.mdmp") Found reference to API "83887556034,9276,3118,,FindNextFileW,kernel32.dll,"01:13:52.937",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000001.283709.00810000.00000004.mdmp")44:Tcbf,Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "WannaCry.exe.sample") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "WannaCry.exe.sample") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "WannaCry.exe.sample") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "WannaCry.exe.sample") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "WannaCry.exe.sample") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "WannaCry.exe.sample") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "WannaCry.exe.sample") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp")45:T411,Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "WannaCry.exe.sample") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp")46:T49c,Found string "expat secret using ``XML_SetHashSalt()``." (Indicator: "secret"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-29061: Fixed bug in secrets.randbelow() which would hang when given a" (Indicator: "secret"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-27928: Add scrypt (password-based key derivation function) to hashlib" (Indicator: "password"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-26996: Add secrets module as described in :pep:`506`." (Indicator: "secret"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "usernames and passwords to UTF8." (Indicator: "password"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "in the password database). This change fix the :mod:`site` module if the" (Indicator: "password"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "current user doesn't exist in the password database (if the user has no" (Indicator: "password"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp")47:T6e7,Found string "\Device\HarddiskVolume3\Windows\SysWOW64\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00006996-00000BC1-3410113738") Found string "C:\tempdir\node_modules\mongoose\lib\drivers\*" (Indicator: "\drivers\"; Source: "00000000-00006996-00000C2C-30266538766") Found string "C:\tempdir\node_modules\mongoose\lib\drivers\browser\*" (Indicator: "\drivers\"; Source: "00000000-00006996-00000C2C-30271695462") Found string "C:\tempdir\node_modules\mongoose\lib\drivers\node-mongodb-native\*" (Indicator: "\drivers\"; Source: "00000000-00006996-00000C2C-30276556068") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00003516-00000BC0-3410353701") Found string "\Device\HarddiskVolume3\Windows\SysWOW64\cscript.exe" (Indicator: "\Device\"; Source: "00000000-00003516-00000BC0-3411964192") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.025B0000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.025B0000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.025B0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.025B0000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.025B0000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.025B0000.00000004.mdmp")48:T772,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "WannaCry.exe.sample") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "WannaCry.exe.sample") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "WannaCry.exe.sample") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp") Found reference to API "SetEntriesInAclA" (Indicator: "SetEntriesInAcl"; Source: "00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp")49:T6f0,"WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\ATTRIB.EXE"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\ICACLS.EXE"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "WannaCry.exe.sample.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\TASKDL.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\CSCRIPT.EXE"; Value: "") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "")4a:T441,"WannaCry.exe.sample.exe" wrote 16384 bytes starting with PE header signature to file "C:\taskdl.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "WannaCry.exe.sample.exe" wrote 16384 bytes starting with PE header signature to file "C:\taskse.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "WannaCry.exe.sample.exe" wrote 16384 bytes starting with PE header signature to file "C:\u.wnry": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...4b:T864,"Q: What's wrong with my files?A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting!Q: What do I do?A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust?A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking on the decryptor window." (Source: @Please_Read_Me@.txt, Indicator: "decrypt your files") "Q: What's wrong with my files?A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting!Q: What do I do?A: First, you need to pay service fees for the decryption. Please send %s to this bitcoin address: %s Next, please find an application file named "%s". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust?A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking on the decryptor window." (Source: r.wnry, Indicator: "decrypt your files") "A: Ooops, your important files are encrypted. It means you will not be able to access them akw" (Source: 00000000-00006996.00000000.281787.025B0000.00000004.mdmp, 00000000-00006996.00000001.283709.025B0000.00000004.mdmp, 00000000-00006996.00000002.285629.025B0000.00000004.mdmp, Indicator: "files are encrypted")4c:T486,"WannaCry.exe.sample.exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00006996) "WannaCry.exe.sample.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00006996) "taskdl.exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00010448) "taskdl.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00010448) "taskdl.exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00006384) "taskdl.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00006384) "taskdl.exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00010388) "taskdl.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00010388) "taskdl.exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00008900) "taskdl.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00008900) "taskdl.exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00006140) "taskdl.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00006140) "taskdl.exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00006788) "taskdl.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00006788)4d:T4ed,Found string "names that happen to have a bypassed hostname as a suffix. Patch by Xiang" (Indicator: "hostname"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "gethostbyname_ex() functions of the socket module now decode the hostname" (Indicator: "hostname"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-35545: Fix asyncio discarding IPv6 scopes when ensuring hostname" (Indicator: "hostname"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-32370: Use the correct encoding for ipconfig output in the uuid" (Indicator: "ipconfig"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "and X509_VERIFY_PARAM_set1_ip() API to verify hostname and IP addresses." (Indicator: "hostname"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "- bpo-23033: Wildcard is now supported in hostname when it is one and only" (Indicator: "hostname"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp") Found string "character in the left most segment of hostname in second argument of" (Indicator: "hostname"; Source: "00000000-00006996.00000002.285629.031B9000.00000004.mdmp")4e:T9a4,"WannaCry.exe.sample.exe" opened "C:\00000000.res" with delete access "WannaCry.exe.sample.exe" opened "C:\Users\%OSUSER%\Desktop\~SD28A0.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\Users\%OSUSER%\Documents\~SD28A1.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\Users\Default\Desktop\~SD28C1.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\Users\Default User\Desktop\~SD2920.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\Users\Default\Desktop\~SD2920.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\Users\%OSUSER%\Desktop\~SD2940.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\Users\Public\Desktop\~SD2941.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\Users\Default\Documents\~SD2962.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\Users\Default User\Documents\~SD2963.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\Users\Default\Documents\~SD2963.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\Users\%OSUSER%\Documents\~SD2964.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\Users\Public\Documents\~SD2974.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\share\$RECYCLE\0.WNCRYT" with delete access "WannaCry.exe.sample.exe" opened "C:\~SD29A4.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\$Recycle.Bin\~SD29A5.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\$Recycle.Bin\S-1-5-18\~SD29A6.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\$Recycle.Bin\S-1-5-21-1271187874-1938232448-3812392235-1000\~SD29A7.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\$Recycle.Bin\S-1-5-21-1271187874-1938232448-3812392235-1001\~SD29A8.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\$Recycle.Bin\S-1-5-21-1271187874-1938232448-3812392235-1001\$RZ5Y3SM\~SD29B9.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\$Recycle.Bin\S-1-5-21-1271187874-1938232448-3812392235-1001\$RZ5Y3SM\1.0\~SD29BA.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\$Recycle.Bin\S-1-5-21-1271187874-1938232448-3812392235-1001\$RZ5Y3SM\1.0\Cache\~SD29BB.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\$WinREAgent\~SD29BC.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\$WinREAgent\Scratch\~SD29BD.tmp" with delete access "WannaCry.exe.sample.exe" opened "C:\Config.Msi\~SD29CD.tmp" with delete access4f:T717,"WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\attrib.exe" (Handle: 444) "WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\icacls.exe" (Handle: 152) "WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\taskdl.exe" (Handle: 632) "WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\attrib.exe" (Handle: 796) "WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\taskdl.exe" (Handle: 788) "WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\taskdl.exe" (Handle: 784) "WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\taskdl.exe" (Handle: 800) "WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\taskdl.exe" (Handle: 820) "WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\taskdl.exe" (Handle: 844) "WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\taskdl.exe" (Handle: 816) "WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\taskdl.exe" (Handle: 852) "WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\taskdl.exe" (Handle: 808) "WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\taskdl.exe" (Handle: 836) "WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\taskdl.exe" (Handle: 860) "WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\taskdl.exe" (Handle: 596) "WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\taskdl.exe" (Handle: 880) "WannaCry.exe.sample.exe" wrote 00000004 bytes to a remote process "C:\taskdl.exe" (Handle: 720) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\cscript.exe" (Handle: 480)50:T5ce,"WannaCry.exe.sample.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\MamLog.txt" "WannaCry.exe.sample.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.0\data.txt" "WannaCry.exe.sample.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\126.17756.17717.64\driver-signature.txt" "WannaCry.exe.sample.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\126.17756.17717.64\hub-signature.txt" "WannaCry.exe.sample.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\126.17756.17717.64\vendor.bundle.js.LICENSE.txt" "WannaCry.exe.sample.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\126.17756.17717.64\bnpl\bnpl.bundle.js.LICENSE.txt" "WannaCry.exe.sample.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\126.17756.17717.64\Notification\notification.bundle.js.LICENSE.txt" "WannaCry.exe.sample.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\126.17756.17717.64\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt" "WannaCry.exe.sample.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\126.17756.17717.64\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt"51:T7d3,Spawned process "WannaCry.exe.sample.exe" (UID: 00000000-00006996) Spawned process "attrib.exe" with commandline "attrib +h ." (UID: 00000000-00006392) Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (UID: 00000000-00001792) Spawned process "taskdl.exe" (UID: 00000000-00010448) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c 88831743893367.bat" (UID: 00000000-00003516) Spawned process "attrib.exe" with commandline "attrib +h +s Z:\\$RECYCLE" (UID: 00000000-00008152) Spawned process "cscript.exe" with commandline "//nologo m.vbs" (UID: 00000000-00007424) Spawned process "taskdl.exe" (UID: 00000000-00006384) Spawned process "taskdl.exe" (UID: 00000000-00010388) Spawned process "taskdl.exe" (UID: 00000000-00008900) Spawned process "taskdl.exe" (UID: 00000000-00006140) Spawned process "taskdl.exe" (UID: 00000000-00006788) Spawned process "taskdl.exe" (UID: 00000000-00004736) Spawned process "taskdl.exe" (UID: 00000000-00011212) Spawned process "taskdl.exe" (UID: 00000000-00007860) Spawned process "taskdl.exe" (UID: 00000000-00005772) Spawned process "taskdl.exe" (UID: 00000000-00009656) Spawned process "taskdl.exe" (UID: 00000000-00010244) Spawned process "taskdl.exe" (UID: 00000000-00007952) Spawned process "taskdl.exe" (UID: 00000000-00008044) Spawned process "taskdl.exe" (UID: 00000000-00005012) Spawned process "taskdl.exe" (UID: 00000000-00002220) Spawned process "taskdl.exe" (UID: 00000000-00011032) Spawned process "taskdl.exe" (UID: 00000000-00005976) Spawned process "taskdl.exe" (UID: 00000000-00010452) Spawned process "taskdl.exe" (UID: 00000000-00009608) Spawned process "taskdl.exe" (UID: 00000000-00002224) Spawned process "taskdl.exe" (UID: 00000000-00002564) Spawned process "taskdl.exe" (UID: 00000000-00004780) Spawned process "taskdl.exe" (UID: 00000000-00009020) Spawned process "taskdl.exe" (UID: 00000000-00010252) Spawned process "taskdl.exe" (UID: 00000000-00005096)52:T13800,iVBORw0KGgoAAAANSUhEUgAABLAAAAJYCAIAAAD9hIhNAACAAElEQVR4Xuy8f4idVfeevxARkSAiQUSCBJFgRYJYEWttmloRScUGCWLFShAJYoOIiIiI6FixQSQVa6211m+ahtSmIU3TEMT6idHP+6u+alMJIqkECRJERCQEEZF8nRxzsu5rn2edOZmcnGTmvrn+OGvv/ey99n7OmHXPvO+OmJCOqiLeyixcGJm4VonnKq4OIbZlFiyITMQbmSuuiEzESgW6R1gWmR9+EH7+WYh4MPP115H58UchYk1m0aLI7NghfPmlEPGScHMI8bVweQixL4N1L71UiNiS+fXXyDRvsNabytZM883Rt399CBcI+F7t3SvEYkWPHWlEfKvoOXMq1WLl7/wd4bTpP/0n4b/9N+E//Adh0yYBvf/yXwqvvirg2TfeELDu//gfws6dwpYtwjvvCP/xPwobNwqvvy5gCziNbduEf//vhQ0bhP/8nwVk9dZbAk4DU9VZ/df/Kvzbfysgyf/+34X/8l+Eegs4OvTi/f6bfyNg+9jv5s3Cv/pXApLEs3i///N/Cv/6Xws4Day7dWvmWdXRbdsy/ME5dfp/lmUdE382LMuaJ2rKehtCG8K+bAhPi2wIC+tlQ2hDaENoWadL/NmwLGueqCnrbQhtCPuyITwtsiEsrJcNoQ2hDaFlnS7xZ8OyrHmipqy3IbQh7MuG8LTIhrCwXjaENoQ2hJZ1usSfDcuy5omast6G0IawLxvC0yIbwsJ62RDaENoQWtbpEn82LMs6zWJ5/Vtln7j1VmE2evhh4fBhIWKj8gflMeWFzJo1kaH3uFKJ/Znt2yMT8W7mo48iQ3+ImZcrulDEnswjj0SGU8VeZW3m0UcjE3F/5g9/iMzddwuffCJEvJq56qrIROxQxDw37rHWBmUkbVYg9WnnhKC/DsA3B6/sttuEiC8VGMIflL9knnsuMs1345AAD/Dv/p2AMnc2+uf/XPiH//Dk+b//V9i9u+Jv/kb4X/9L2LNHePdd4YMPhPffFz7+WMD3u+b//B8BU332mfCnPwl//rPw178K7Vpj4p/9M+Hv/33h5puFG2+s+Af/QPh7f0/4R/9IuOkm4Z/+UwFflb/8Rfj0U+H224V77hFgF2FEX3tNwE8d/sn5F/9C+Cf/JMPidGz6G8uaN/r/RhH/tbIs6zTLhtCG0Iawhw3hCNgQ2hDOJ0N49Ld/K4/DvlHEktmyzgAd/a0SPM4pDOn5SvFfK8uyTrNsCG0IbQh72BCOgA2hDaEN4eiSMtyyzgwVpm42IT1fKf5rZVnWaZYNoQ2hDWEPG8IRsCG0IbQhHF1ShlvWmaHC1M0mpOcrxX+tLMs6zbIhtCG0IexhQzgCNoQ2hDaEo0vKcMs6M1SYutmE9Hyl+K+VZVmnXfcpnylfZ847LzK4SDPik8yKFZGJ+Er5RvlcmYXUElxwgfD550JtGJ58MjIRd2fuuisyEU8JuM9zidA47T8p6zMomLmFG4QnnhDiMgVXsC4VliovvyycKIh6xO2CTnXvvcKyZULEa5kvvojMCy8IKPNwRWVjNeV7haIXhh8XScLw46LU1auFiIcVffv8et+j6LP/+B8Lt9wioLyGM6mNCmritWsFfFempoTZ6G//VkBWAIbhf/9vAV4Lz/7xjyOAhUCdFWhPvngLsEDordfFaYx0sDg6OF78uuu994R6v7PJaqQkMRgL1VmB9vuQYHF69mvKss4q8R+RyemDDz5g0yj64Jj6n3PXQOXxWV3tljU+2RDaENoQ2hDaEJZZgfbki7dgQ1hQJ4nBWKjOCrTfhwTt1Nmv3yrs/3f0//Vx6PAMD/mPSKOeQeqL3Ul1b19dEw59vB5w0lO1g9sWyxqrbAhtCG0IbQhtCMusQHvyxVuwISyok8RgLFRnBdrvQ4J26uxXXXw7dHimhfxHpBHcUWGWiq6srgmHPl4PyL31yBg2uG2xrLHKhtCG0IbQhtCGsMwKtCdfvAUbwoI6SQzGQnVWoP0+JGinzn7VxbdDh2dayH9EGsEd9cK2MWtge27sf84hxvTV1ZKFxhy2D+aWrP4jvTE5tKyxyobQhtCG0IbQhrDMCrQnX7wFG8KCOkkMxkJ1VqD9PiRop85+1cW3Q4dnWsh/RBoNdEozbOy34PPvIzTsGtwOaIWurscHToVnexrYaFljEa4DbK73/FF5M7NrV2QeekjAhaU0KmoJ1q2LTMRHyuEMytq4Toldit5QukSM2SWXCLixM84NQT0PbkM891zhsceESy8VIg4q3yqHMnBEcZUSDyr7MrySVE0disCIu5Q3MosXR2bHDoHOU79IX34ZGdy5+t13kXnzTeHIEWHDBiFinfKIIl+kH3+MTPNtl69Z8/sOues14kjmxRcjE/GW8qKyUUDlWlsC9P5RS9vWnBRgqpr6WdTx7eOZ1hVksF+si16sC/AsruhEVrifFwvVvrTewki9yArvt84ZvZgZU9U2tX6hmKo9+Qz2WydZe0v0YmasW78yPbopy7Imqul6tFTPR/WV27s+1OHvEx3XwAH9xqI9a4aPDGwfOO3ARssai2wIbQhtCG0Ih1M/i1q8fTyD0hxgv1gXva39yOBZG8KMDaEawuJvFw4dOhx3OF2PlhrqqdoP/RAaOKyvrgFd7VnFIxAG4HNfAxstayyyIbQhtCG0IRxO/Sxq8fbxDEpzgP1iXfS29iODZ20IMzaENoQOHZ4x4XQ9WgrWqLVSA11WG/Y1tL1rnq4Ho+ka+khuHzhmYKNljUU2hDaENoQ2hMOpn0Ut3j6eQWkOsF+si97WfmTwrA1hxobQhtChwzMmnK5HS3V5rd7nwll19WJYX3lA1+feh4HKvQMfR3vbWLRY1hhlQ2hDaENoQzic+lnU4u3jGZTmAPvFuuht7UcGz9oQZmwIbQgdOjxjwul6tFTPU/XV9ubPGNNvQWP/c9ZMHkRLFkbmz+2DAwcM7LWs0yCpmPfvj8yWLcJVVwmbNwubNgl4Frd9oqy/6CIhYrOSvdNvvK+syMCnRTyvfJd55JHIHD4sROxXPhPOCwFaKFx8sRDxXmb79sjAIN13n9A4kz8pssGIW5XeZap9vsggSZwkyumDB4V33hGwI3r4iwW4qeYKVvxWYvrm1YR8N2DLcdcrvt5xoXKtAF+6datwww3C998LsVihITwkoFStK2ZUvfA8fywrdRTQGIx1MXOdJKbCYICyHklicJ0GvpQjTQXqw8FUWAiDMRWerc+5nhlT1TPXU2EwckZWcJ6Yqp65zTMD24Zn0VubWDwLPtJbVXWDU5ZlTVT90unkdOZ4J5i6k9apmseyZq7fraANoQ2hDaEN4Qkwc50kpsJgYENYnHM9M6aqZ66nwmDkjKzmgSEs/nbh0KHDcYf90ukkZONkWadEv1tBG0IbQhtCG8ITYOY6SUyFwcCGsDjnemZMVc9cT4XByBlZ2RA6dOhwnGG/dBpJ/jOaZZ1C/W4FbQhtCG0IbQhPgJnrJDEVBgMbwuKc65kxVT1zPRUGI2dkZUPo0KHDcYb90smyrEnpdytoQ2hDaENoQ3gCzFwniakwGNgQFudcz4yp6pnrqTAYOSMrG0KHDh2OM+yXTpZlTUhLFb38c+XKyFx/vXDXXcIzzwio8vfuFW66SWhcnHgeTIXLIRctikzEPcqjyiPKz4pW6vGCcGMIVwhffy3s2SM8/7xAV6MGCRe0rlolRHyZwfZ5Jan6UlykuWRJZCLuFZZFZsECATeUvvKKgGs2Fy6MTMTqzMaNkcErW7MmMjhnvO7lyyODi1IjHlY+z+D73PjSZzIvvBCZiNczb70VmcWLBX4ZULijFkddi8K97kWljt7PPhNQXo+UVT249QwZPAvv0VqIwgNgXUyFwfVU6IWdQO9ILwW92H6dxkjgnOtepIH/fuFZHCw2iN72jRdZARhCLFRPhVeGg1WmLMuaqMKyrAnLhtCG0IbQhtCGsO61IczgYLFB9LZvvMgKnEZDWPztwqFDh+MOY5h6/3fB3v9j0J8n+9mao7IhtCG0IbQhtCGse20IMzhYbBC97RsvsgI2hA4dzo8wLMuasGwIbQhtCG0IbQjrXhvCDA4WG0Rv+8aLrIANoUOH8yMMy7ImLBtCG0IbQhtCG8K614Ywg4PFBtHbvvEiK2BD6NDh/AjDsqzJCvdqXnGFELEug7q2uTvxKeV94UK50fHyywXcq4m6Djc6worAtzz9tMBrJ3np6MbMtm2RgW+JuEOR7TcL4bZP8S0RBxQstFLRZ68JIV5WPlK2Z/bti0xz9+njmd27IxOxR8HrVqd9fmRgrl57TYh4QPjNmmbUHzbO84fMoUORwe8OInZlml8lyI7wncRPyooVAi5ZxYW0t98eGaouglG81l4LU6EXM2MwZkbxXfciScwMh1Cvizq+TuPDD4XaqIx0VvW69QYbv1G9Qdy5isF1znUa8HhYt95gm3YG69bfK2yhXgg54xZZTIVnsX0sVJ7VlGVZExX/WVQdLcXRlmWdhGwIbQhtCG0Ip8HMtWFAL5LEzKjU63VtCDN1znUaNoSZ8qymyr9dOHTocNwh/1lU0QKqOHqQZjg+D+uPHNhoWXNNNoQ2hDaENoTTYObaMKAXSWJmVOr1ujaEmTrnOg0bwkx5VnWp6tChw3GH/GdRBUsGcfQg9YfV4wf2Dmy0rLkmG0IbQhtCG8JpMHNtGNCLJDEzKvV6XRvCTJ1znYYNYaY8q7pUdejQ4bhD/rOoUgNIcXQjjOmFM2nsaWCjZc012RDaENoQ2hBOg5lrw4BeJImZUanX69oQZuqc6zRsCDPlWdWlqkOHDscd8p9FVbZ/rTi6Ecb0w+JD1sBGy5pr+vlnAZeOLuedjVJev/lmZL74QsA1jLjREIX7N98IEbdl1q+PDHzLtddGJs4RcEdlxN0Z9l4pwOP98INA77FA2LBBOHBAePhhIeIvmVdfjUzEF5mDByMT8bVwc1TgOlP1LbBt9JYLcWGprqsHC5vKe2KXC59/LsAuwk2tWyfAPuC62vxvxm9qblUVW87ec5UbhaVLhWuuEfi9ulp48EGhLlVZ9dZlLkrzuujHs7V/AMgKU9U5Y4N4Foy0o9qZ1GkgZ5wGrMinnwqYGevWZ1WngcH1zMgZg7EFeC0cbH3OWBdXktanUU+FN4jDwbPw0vUXuN1UYsqyrIkqSuGfcoijG2FMPxz4IatotKy5JhtCG0IbQhvCaep6GiArTFXnjA3iWTDSjjAYU9VpIGechg1hBuvOCUNY/O3CoUOH4w6jFP4phzi6EcbkEDMMnG1go2XNNdkQ2hDaENoQTlPX0wBZYao6Z2wQz4KRdoTBmKpOAznjNGwIM1jXhtChQ4ezC6MU/imHOLoRxvTD4kPWwEbLmmuyIbQhtCG0IZymrqcBssJUdc7YIJ4FI+0IgzFVnQZyxmnYEGawrg2hQ4cOZxdGKfxTDnH0IPWH5fFt48DZBjZa1lyTDaENoQ2hDeE0dT0NkBWmqnPGBvEsGGlHGIyp6jSQM07DhjCDdW0IHTp0OLswSuGfcoijB6kdjwd74cDZBjZa1tzThszzz0cm4pUMyvo77hAw1apVkbnqKuHbb4VNm4S4RIlDyvoM/EPEE5mvvorMYl6UukPZl+EtlHpzJm433b9fQM44q/zfpt/0+uuRefZZIeLeDGqkxi1D9ys7M7t2RQZeOmKz8msGBwvDH/Fa5q67IvP11wIvdz1a8eijAi5KhYeP2KrsUT7PXHBBZC65ROCXkGcl7wg2tUnje6GuelExo7c2KnUtjnUBnkW1DTuBNGpngtPBupiqPo2msheQBp5FVvW6GAywBaxbp4GFsAUsVJ8GtlDTJpbBQnhlWLc9+WILSANfpPpw4AAxFa6cxbrISmeesixrospVi2VZE5G4OBtCG0IbQhvCafAsDIMNYQZbwLp1GlgIW8BC9WlgCzVtYhksNA8MYfG3C4cOHY47zFWLZVkTkbg4G0IbQhtCG8Jp8CwMgw1hBlvAunUaWAhbwEL1aWALNW1iGSxkQ+jQocNxhrlqsSxrIhIXZ0NoQ2hDaEM4DZ6FYbAhzGALWLdOAwthC1ioPg1soaZNLIOFbAgdOnQ4zjBXLZZlTUTi4mwIbQhtCG0Ip8GzMAw2hBlsAevWaWAhbAEL1aeBLdS0iWWwkA2hQ4cOxxnmqsWyrIlIDAMvHY1HMrjvMS5X1BDiwtIHHhDgpiJeUn5QHs0cORKZiPsU6J4CuBq4CwyGYYhFSnyiPKP8rOgFnnEks2NHZHgFK93yW5nt2yMT8U4Glv6++4S4QeC6sVERW45LOHGvJt4g6ueIbZmXX45MxBpFjZnmfPfdwuHDwnvvCfjdAY4OFhcXw+7dK5x/vtA4wAOK/hoCtTgqV9y7iIoZ4GTbARnU01gX5TWeRaWOJNFbuxqANNq0M/Xh1CandnEwKrAiWBcbrN0y1sWz9UsBmKreERbCWbUvIoPBOI2Rjh1bQFZ1bz0YC+EHGEnqVFOWZU1Uxws2y7ImpmkfaENoQ2hDaEMo2BDaEPbB4LloCIu/XTh06HDc4fGCzbKsiWnaB9oQ2hDaENoQCjaENoR9MNiG0KFDh6c0PF6wWZY1MU37QBtCG0IbQhtCwYbQhrAPBtsQOnTo8JSGxws2y7ImpmkfaENoQ2hDaEMo2BDaEPbBYBtChw4dntLweMFmWdaE9Nhjwi+/CI27kAI64rsMqqCI5zPXXx+Z5obSL5S9GZrJeDIDDwB/+NxzkYm4XXkvg8s/G1O3JbN2bWRoUy8Sli8X7rxTiLhDeVh5LgPXes01wo8/Co3xFhe3c2dk9u0TzjlHgJnE5a5cV93ywoVCxC+ZV16JTMRtgv5mgb93uDmE8xX1w/gFB4w3cl6yRIj4RtknLA4hHlN+VfTnqK6Y0QtQItdTgbbCLsDMKK9BvRA8D2ZGL/6zUm8QC8G31DPDTWGh9kAysEBYqDZmWKj0LdxvvX3sqB6MdZEVdoSpaluOwZi5Prra4mIqvFC8/fIkpyzLmqjCsqzJyobQhtCG0IZwOJgZRX/tATAVin7MjF78Z6XeIBayIbQhnLEhLP524dChw3GHMWZpaVepa2RXu2XNEdkQ2hDaENoQDgczo+ivPQCmQtGPmdGL/6zUG8RCNoQ2hDaEDh2eDWGMWX0XN9TOdY3saresOSIbQhtCG0IbwuFgZhT9tQfAVCj6MTN68Z+VeoNYyIbQhtCG0KHDsyGMcWqgtZt5Y9FuWXNHNoQ2hDaENoTDwcwo+msPgKlQ9GNm9OI/K/UGsZANoQ2hDaFDh2dDGONUl50rPsyw3bLmkl5VxJl8+WVkzj1X2LRJWLxYePtt4dprhcsvF1Cp4xpGXHf54IMCfGnE98o64dzIXHKJQLOhzmTXrsjwztV4OvPQQ5H54QcBPu2GG4T164XmctQHMrgoNS4QUCMhKxjvrVsjEwuUuDXz6KOR4TlfFUK8qKxWXsvAaTceXm4Z/eijyMB53nKLcPXVAr4q338fGXxjcadus/2PFHlHzbHrC60LaBTBdeFeVr18ti6v64XqwQBZ1bSTZzAYhgG92D7MBr46GFxPBQuEwVionqq2be1hZjC4XgjXxuJgMbg9+Qy+OfivDKaqv8DIGb14FtTP4mBL1zplWdZEFeNUl50rPsyw3bLmkmwIbQhtCG0IbQh1cD2VDWFmThjC4m8XDh06HHcY41Rh544e08CuHHa1W9Zckg2hDaENoQ2hDaEOrqeyIczYEDp06HB2YYxTXXau+DDDdsuaS7IhtCG0IbQhtCHUwfVUNoQZG0KHDh3OLowxa6C1m3lj0W5Zc0Y2hDaENoQ2hDaEOrieyoYwY0Po0KHD2YUxZh1N6rdgQP8DRtbtljVH9O23QsRfhBtC0MsSacwuFj77TIirFb2xE7VZxCZFfMtdd0Um4ilBC/cnnhDiOiV2C8tDiBcyt90WmYiPhfMigzsqL7xQOHhQYBq0uD8ohzPLlkWmuRtzdeaFFyID4/3885G5916hsUBfZt55JzKXXSZs3ChEbBcWyfWeV1whwNShJsQXCQthKvwKA14a+8VltvhuLF0q4Edjw4bIbNsm8LcDqLZR5u7ZI6C3dkQAC8G3oKxvHy+mQi2OmeEQau+BF4ysANbFVMgZg5EGemufVm8fW8BUGPzppwIGY6q/1ZszcRr1SbYvMVNbXID/XiNnTIU0kDMOtt4Rjg5fM/RiZmxBn52yLGuiCsuyJisbQhtCG0IbwmlQi7ePF1PVlTpKc4Cpav8AsC6mQs61YUAvDrbOGc9iC5gKg20IM/WOcHT4mqEXM2ML+uxU+bcLhw4djjsMy7ImKxtCG0IbQhvCaVCLt48XU9WVOkpzgKlq/wCwLqZCzrVhQC8Ots4Zz2ILmAqDbQgz9Y5wdPiaoRczYwv6bF2qOnTocNxhWJY1WdkQ2hDaENoQToNavH28mKqu1FGaA0xV+weAdTEVcq4NA3pxsHXOeBZbwFQYbEOYqXeEo8PXDL2YGVvQZ+tS1aFDh+MOw7KsycqG0IbQhtCGcBrU4u3jxVR1pY7SHGCq2j8ArIupkHNtGNCLg61zxrPYAqbCYBvCTL0jHB2+ZujFzNiCPluXqg4dOhx3GJZlTVgwSGrq4KZuvlmAbbvmmshEvJ55443IvPqqcOCA8Msvwm8ls/Ky8pAiRiXicWWzIreq4qrMffsi8+uvQsTGzM6dkYmLBPZyC3LdJXxLxBHh0sjs3y+8+KKQ78U6djXW+xlclHrffcJ33wnvvivAiOIOUlzfigs8I37K7NgRmebq17sEdY8RKzIoTZcvF2KJsGaNAD8ccX+GWelUeIMXXRQZVLkvvSTw+sfaEqDqrXvreholcj1VDXaISh1pYIMo3Os6HknWg5EGBiMNPNvuMYMd4VmAnOGmcHRYCFPV+62frV8KvoQYXFMnWYNnYSbrHcEeY2Y8C/TtT1mWNVEdq0cty5qgbAhtCG0IbQj/3PgWDK6xISxAzjaExRYmZwiLv104dOhw3OGxetSyrAnKhtCG0IbQhvDPjW/B4BobwgLkbENYbMGG0KHDeRkeq0cty5qgbAhtCG0IbQj/3PgWDK6xISxAzjaExRZsCB06nJfhsXrUsqwJyobQhtCG0Ibwz41vweAaG8IC5GxDWGzBhtChw3kZHqtHLcuanF55RYjYn9m8OTK8HVEr9VWrIhPxpnBtZL7+WuCFpUeVbFmv4+WQSBKXf9ISxErlxwwcUbPf5wS1fBGPKX/JNJd/imuFAcaNnXDa8C2oJ6+9VkBvLBMauwh7/Flm5crIwEyec44QcUtm167IXHWVgC/SBRdEBrYcdSwMIUxs3KjEncq3ihpvvTg04qvMAw9EJuI1RRdaGkL8LNTlde090Iup6hK5Ls3rdevBAAu1AzLYAnrh4upn69NAb7upDNbF1aD1Sdbbx8z1s/VU2BHMFcBUSAODkRUsLnqRFQYjSQyGx6sXqqcC5dFNWZY1UcUQoSgE49KxumiAutot6yyWDaENoQ2hDeE09czorQeDshYndZUP31I/W58GettNZbCuDWHh05DVWWIIi79dOHTocNxhDFFrAjMjq3Z0/d6uYV3thY5XWQMa667cgg+WdSplQ2hDmP67Y0NoQ9gxM3rrwaCsxUld5cO31M/Wp4HedlMZrGtDWPg0ZGVD6NChw2FhDBGKQjAudVmvrvZCx6ssaekKB35uP1jWqZQNoQ1hXzaENoSdM6O3HgzKWpzUVT58S/1sfRrobTeVwbo2hIVPQ1Y2hA4dOhwWxhChKASVYJ96YW5MJZCMyV1dAzCm3wj1u7omyRra3jXAsmYlG0Ibwr5sCG0IO2dGbz0YlLU4qat8+Jb62fo00NtuKoN1bQgLn4asbAgdOnQ4LIwhQlEIKsE+9cJ+Y+5tG4+XRgM+D2zsf4baB/E5a2h71wDLmpWa0nx75vrrIxOXC7h2sjFIUk9v2BCZ++8X6EsvVm4QvvxSuPpq4TeTm7nyysjgHtHVqyMTNws0OZcJb70lxAUCZ9ZeGAacxqFDQnOwWzK4vhXuETPfeqsAjwdbvnSpgKtB4aYefjgyuEkRXyRcs7lwoYDLbHmS8ZHytPDbtzTDo3shA+ONNDZuFGK5oqeBy10XLBAi9mW++CIyQ6reutoGdYkMQwiQRu0eMTOexWBkhZmxwdog1b31zKDeEXoxM/YLG4P9Yqo6DfQiq5p2jxl4POwI1NvHjzcWwuA2zwwG42DbXWSQJDZY/yzoF2nKsqyJKoboaMkQtVaq/ZDV1du2dw2AivF95cY05IS6JrGsUyMbQjEbNoQ2hDaEPdCL4hsz41kMRlaYGRusLV/dW88M6h2hFzNjvzaEGQxu88xgMA623UUGSc7OEBZ/u3Do0OG4wxiioyVD1FopGLAuSwbr1bb3n+3rxOjjQuPAMTFocmjoAMualWwIxWzYENoQ2hD2QC+Kb8yMZzEYWWFmbLC2fHVvPTOod4RezIz92hBmMLjNM4PBONh2FxkkaUPo0OFZG8YQHS0ZotZKDfRUbW+Xl2s/FDraiCOOqd9+0gMsa1ayIRSzYUNoQ2hD2AO9KL4xM57FYGSFmbHB2vLVvfXMoN4RejEz9mtDmMHgNs8MBuNg211kkKQNoUOHZ20YQ9Qzfl0MF5zYQHPVNuan8LltzO1ZaGwnacOBn9sPlnUqZUMoZsOG0IbQhrAHelF8Y2Y8i8HICjNjg7Xlq3vrmUG9I/RiZuzXhjCDwW2eGQzGwba7yCBJG0KHDs/aMIboaMlwFc6t1zWwt9/VNQBj+o25l00d8+uQIVn1Gy3rlAlXVn7/vbBlixDnK9cKb78tRBzMvPpqZD7/XIh4QLlbWaOIa8XdmOedF5mItZnlyyOzdasQ8Y6yM/PCC5HBZacRb2V++iky33wj7N8vRDycoYldpOi9mvDShw8LTz0l4JbRuFTAfa3btwvYIG+RXRxCbMrgTs577xUuv1zALyk2bRL4S4olSrykyG8H8LqPHBF27xbwo8H96nfjllsi8+ijQsSjivhS1rWjFLJ8ti7663q6Ls2RVW0JkDP8Uj0Y4J5cZAWwI0yFLdSHg2frXkyF3jpJvDIsVK+LqTC4/jIAJImzqn14DXJGL2bGYCSJrDAVtoDtY2b9Tk5ZljVRhWVZk5UNoQ2hDaEN4TQjOQQbwgymQm+dJF4ZFqrXxVQYXH8ZAJLEWc0DQ1j87cKhQ4fjDsOyrMnKhtCG0IbQhnCakRyCDWEGU6G3ThKvDAvV62IqDK6/DABJ4qxsCB06dDjOMCzLmqxsCG0IbQhtCKcZySHYEGYwFXrrJPHKsFC9LqbC4PrLAJAkzsqG0KFDh+MMw7KsycqG0IbQhtCGcJqRHIINYQZTobdOEq8MC9XrYioMrr8MAEnirGwIHTp0OM4wLMuasC5UtMzl3Zg3K7RPr2e2bYtMxCHlo8zrr0dm/XqBN0nGc8qtymbhItwzqRtUw9BYoMeVlzO4K3LxYmHZMiHiK+VPgt6q+uabwiWXCLhWFIL1gpAkXlnEbZlFiyITsTUD1/rQQ0LE/QoMv7wj3Nd6zjkCHG/EF4oshBtKcTFsXCmsXSusWiVE7MlccUVk8PZxfWvEZ8ozivySYkhNjKoXHgAVMwbXZT16AcrremYMbv1GkST2iyTrdeup2k0Vz+Jga8eLwXC82C96kSSmwkl++KGALcDzIOf62LEuqE8SvcgZYGZMhcHonU3OeBanoetOWZY1UaU6xbKsiciG0IbQhtCGsAWVej0zBiOrOkns14YwY0N40jnjWZyGrjtV/u3CoUOH4w5TnWJZ1kRkQ2hDaENoQ9iCSr2eGYORVZ0k9mtDmLEhPOmc8SxOQ9etS1WHDh2OO0x1imVZE5ENoQ2hDaENYQsq9XpmDEZWdZLYrw1hxobwpHPGszgNXbcuVR06dDjuMNUplmVNRDaENoQ2hDaELajU65kxGFnVSWK/NoQZG8KTzhnP4jR03bpUdejQ4bjDVKdYljURoWLWaycjHlF+UrYo92TuvDMyzZ2cTwlcV2rxWBhCrFPEtn37bWRwJyes5muvCajy4Xl++EFobijdn3n//cjgotTHHotM4/G2K3JzJmwM/NK55wpwnrfdFplYrNyoxCfKw5lm+39QPlbeV8Qf4vrWiI0Z3EEKx9v87kB+0YArKlevFmDMcK3ojh3CpZcKSLL5VcJ9Gdyqirt8Wcgi6boWR9ULh4DeeiqU1yiga2pHBJAVGCmr2j/AIGHmGkwF3zKSx8P1tfB4GIyFQHtcGRzObJ4d6TTqdesNohdTAfxotANOdvCUZVkTVdQ6WjI5HT06ePmudss6g2VDaEPY50YbQhvCmZXmwIYwg5xtCIsNohdTgVE83kiDp8q/XTh06HDcYdRqTeAohvAk7Fn9SL+3a1hXe6GjxzSwse7KLfhgWaPIhtCGsM+NNoQ2hDMrzYENYQY52xAWG0QvpgKjeLyRBtelqkOHDscdRq3WBGYmpy7r1dVeqHV9RTjwc/vBskaRDaENYZ8bbQhtCGdWmgMbwgxytiEsNoheTAVG8XgjDa5LVYcOHY47jFqtCcwME5xSz3p12af+mNySx+feflfXAIzpN0L9rq5Jsoa2dw2wrFI2hDaEfW60IbQhnFlpDmwIM8jZhrDYIHoxFRjF4400uC5VHTp0OO4wah0tGabslFrHBfuExnY8PnR9HtjY/wy1D+Jz1tD2rgGWVUu8B+57jDiowIltU25TxIo0Rb+YyZdfjswVeqNjXCJs3izs3y/EMgG+FIbh9tsjg/stcQln0ysWaN26yFxwgRDxXeayyyJzyy3Chg1C48PFxkTcqcCJ7VAOKV9mjhyJTGP55JU9+mhkIu7K0HleJezZI1x4oRDXKLEyc/31kcFCP/0k8FcJepvriy8KBw4IWAh3kG7aJDz3nPDUU0LjlhWUp6jFUUDX3gOMVNajd6Q0amOGDWIwcq6fRS/ADaWYGb2YuT4NDIbVRG9NnRWsJtJAkvV+cc54tv7dAabCFvD2MRV6MTNyxrOgPqs6K/TCh2tWU5ZlTVS/F6RdOloyTF1OqW0vPmR19bbtXQOgYnxfuTENOaGuSSxrhrIhtCG0IbQhbCzQSGnYEM6cOisbwkx9VnVW6B1mCIu/XTh06HDc4e8FaZeOlgxTl1Nq29sPvc9dlmwmE0InRh8XGgeOiUGTQ0MHWFYtG0IbQhtCG8LGAo2Uhg3hzKmzsiHM1GdVZ4VeG0KHDs/g8PeCtEtHS4apyym17e2HrLZ35hMWOtqII46p337SAyyrlg2hDaENoQ1hY4FGSsOGcObUWdkQZuqzqrNCrw2hQ4dncPh7QdqloyXD1OWUcggnNvCRtjE/hc9tY27PQmM7SRsO/Nx+sKyRZENoQ2hDaEPYWKCR0rAhnDl1VjaEmfqs6qzQa0Po0OEZHP5ekHbpaMkwdTkl2KqBLqvfNbC339U1AGP6jbmXTR3z65AhWfUbLWvmeinz0EORWbRIeOQR4fXXhY0bheaG0rczuGYTrmbx4sjgjkrYibhBiUeVTYrYVFT5cGLffCOg97vvhL17BVigWCC8/bYQ8WYGl1LidtOIpzNwcXGu8O67Aoz383qv5s6dwtKlAn47cN55kQkFZ4W7T++6S8AWmhs74Wkfz7zzTmQwGO8IhhAnuWxZZOI6Jd5RTlwiOs3NIahpX7AgMnhHrFxRuKPMhWFAb12ao56GYcBg/JghSVT5mAqDUdaP9CxAkpgZYDDAzHUa6G3Xyoz0LLLC4WAwbs5sly5AVu2BZJBz7dOQM77AGIyFkFU9GFlhIfQCzKxMWZY1UR0rRy3LmqRsCG0IbQinsSEUbAiL3natzEjPIiscDgbbEGZOqSEs/nbh0KHDcYfHylHLsiYpG0IbQhvCaWwIBRvCorddKzPSs8gKh4PBNoQZG0KHDudKeKwctSxrkrIhtCG0IZzGhlCwISx627UyIz2LrHA4GGxDmLEhdOhwroTHylHLsiYpG0IbQhvCaWwIBRvCorddKzPSs8gKh4PBNoQZG0KHDudKeKwctSxrknorc/BgZFAT43rPiJ3CNXI5JC5pjPgls2ZNZK66SsDgiK+UJ5Q7lMeULYIW7lgXjihiawZuOWJP5o03IrN2rRCxV3kvs2NHZL74Qoh4MvP995GheYY3i1eEGyNz+eUCsopYJVwZQrycgbfEdbXNl2G/cnfmmWcigx1dc42ALxJPIw5kcJtrLFHinsytt0Ymlivq4SOeVz7JwOHjFxysXFEi19U2HAKercHMKPoxGKU57mzErZsYjPob62IhDIaJhR/GaWALWAjg2fpwsMHGUQiYGaeBLdTr4ruBhdpNZTAYaQCkAZBGnSRmRhrYPl4Zjg7P1t/2Wex3yrKsiSosy5q0bAhtCG0IbQhtCMvDsSHM1EliZqRxphrC4m8XDh06HHcYlmVNWjaENoQ2hDaENoTl4dgQZuokMTPSsCF06NBhE4ZlWZOWDaENoQ2hDaENYXk4NoSZOknMjDRsCB06dNiEYVnWpGVDaENoQ2hDaENYHo4NYaZOEjMjDRtChw4dNmFYljVpfZHBzYK4KxI3hTa27X5ljSKOiHdjxkpFLh29//7IoOhfvVo4dEiIS4T33xci3sj8+mtkaOrUHkfcnkEasUyBBYK5Wipcconwyy9CxHOZAwciE7Ers2tXZDZtEpBkc/fpfcLiEOIPCmy5/rJAXyj2G9crePbSEK4VrrtO4FW3FwsPPCBccYWwb5+AS3Txu4MnnhCa7e8RejfNHmf5coGlKsprWK+6Jm4L3+4imAU0avG6NIclwOB6IewI+8UGYQgxM3oB1oUVQW89M5LE9nHOn30mYGaAZ7FQ3VtnhYXwjvAs9ltvEGDm2pbjWSRZ7wi2HL11Gtigfs2mLMuaqKLU0aMVlmWdEtkQ2hDaENoQ2hCWM9dGBedsQ3gWGsLibxcOHTocdxilWhN4hhjCo8c0sLHuyi34YFmTkg2hDaENoQ2hDWE5c21UcM42hDaEDh06HCWMUq0JPGMNYREO/Nx+sKxJyYbQhtCG0IbQhrCcuTYqOGcbQhtChw4djhJGqdYEZoaq57V65q01bG1773PbDvW72mdbDW3vGmBZp002hDaENoQ2hDaE5cy1UcE52xDaEDp06HCUMErBAYKhgq/LHmzo517Y/5yVx7eN0ND2rgGWdZrUGCSp8vfvj8zWrQJMHSpmeIBh9fQzws1yF+jhw0JTfD+lvJlprgb9WfjtBzCB2yDpLmKT8q6wKDK36IWWqGR4+aem0Rizw5lt2yIT5wk33yysWiU8/LAQ8aKwPDL4dcBLLwlPPinglUV8nVmsHh6X2Z53nnDZZcJvhinz3nuROeccIeLzzE03RWb7dqH5Xm3OwLb98IOAXwfAl+LG3a+/FvhFqstrlMi1nag9ACwQnkXFjHoag+usAAp3PIt165wxM7LCYIB1a2uNXjxbZ4XB6MWz2EJ9VjgcHB2erReCPcazdRr1Qji6eio82y6dwfbrr0r9rA6esixroopS2f61DBW8VpcHG9oOFeP7yo1pyAl1TWJZp1s2hDaENoQ2hNPYEGZsCIs06oXOTkNY/O3CoUOH4w6jVLZ/LUPVGraTbu/bvK4xUNecfQ0dYFmnSTaENoQ2hDaE09gQZmwIizTqhWwIHTp0OGIYpfrebyBD1WXeRm1HI8QRx9RvP+kBlnWaZENoQ2hDaEM4jQ1hxoawSKNeyIbQoUOHI4ZRCg4QDBW8VvZgXZ97HwaGAxtn8uzAz+0Hy5qMbAhtCG0IbQinsSHM2BAWadQL2RA6dOhwxDBK9YxfF0NVm7S+Bg5ow4EtuXHgnOjKLfhgWZPShgyuyly/XsCVlShzH31UiNitvKp8rKBX7j6N+CTzzTeRiXgvA8OwdKkQ8WgGRT9yhov78ksBV5LCt0R8m4HnefxxAcce8XwGNnXBAuGddwTeb3ljZB57TLj9duHccwX4pfPPFxo3JV+kODcyTz0lRDyoPJDZuTMyL74oXHutsGSJgJtRm8ORl4JfQ8DULVok4MuPk4y4OwMLEPFyBr9JGVK5ohdTo8qHQ8BgMNLMqLbxs4FebAFT1b0AWX36qYB1sX30wooArIvDgcmpZ8azAE6s3i+eRS/WxfYxM9aF4a+/dejF9gHWxbMjbRA7Qs71W6jRhaYsy5qowrKsScuG0IbQhtCGcNjMKL5tCIuZ8SywIZz5BrGjcRrC4m8XDh06HHcYlmVNWjaENoQ2hDaEw2ZG8W1DWMyMZ4EN4cw3iB3ZEDp0OEfDsCxr0rIhtCG0IbQhHDYzim8bwmJmPAtsCGe+QezIhtChwzkahmVZk5YNoQ2hDaEN4bCZUXzbEBYz41lgQzjzDWJHNoQOHc7RMCzLmqxuvFF45RXh/vuFK68UItZl7rgjMqyYLytRy4d7RA/qpZQwonGOslTYu1eIWJnBBteuFVDJRDyhPCZcEkJ8o4hfarI6nNm9OzK4oHXdOqHR6sy+fZGJuF/Ry06XR4Ze62qFU4GNyi2Zn3+ODC6kjetDWCzAxEa8kMH3+c47BThe3KnLnJFGbMn89FNk7rtPaL7P8juLiCMCytwPPxTagjuD7yhqcVTbcDVYCIPLAprrIisMrov+ejDSaE8gg8GYCueM3trG1IOxhbq3zhnr1u4RWWFmvG6kAa+FXjxbv+46DcyMLcDhoxfgNOqssC7evj47ZVnWRBWWZU1WNoQ2hDaENoQ2hDw6bLAejC3UvXXOWNeGMDNOQ1j87cKhQ4fjDsOyrMnKhtCG0IbQhtCGkEeHDdaDsYW6t84Z69oQZmwIHTqco2FYljVZ2RDaENoQ2hDaEPLosMF6MLZQ99Y5Y10bwowNoUOHczQMy7ImKxtCG0IbQhtCG0IeHTZYD8YW6t46Z6xrQ5ixIXTocI6GYVnWZHXFFULEeuUnZZdwcwg3KBcKcDVxkXCREvF25plnIoNrNiMOCcvF1UQ8nYHjvftu4dtvhYivhMtDiNsyePaXXwRcK4oLLSPeFfRwGvO8NoO7TyOeUn5VnizZrjyu/KyIE1u5MjK4wBOV25YtwtVXC00a4tPWrIkMbiiNuCuDm0Jxt+3LL0emWVe45JLIxAJF94tLZTdsEL76SmDVi0q9Lutr6kodJTKerc0VepEzFsLrbwv9ouhHVu34DNadjZvCs7WZrBeqk8Th1Oc80kvBQkgDrwxp1N8NzIw00IuFZvNVweA6K5wGZlamLMuaqOIs1wfHxNYR1TVDv71rQF+nJA1rnsqG0IbQhtCGcEDRj3q69h6zqfIBzBWyasdnsG7t0+rDwbM2hBnMjDTQi4Vm81XB4DornAZmVqbKv104dOhw3GEMU8/qZHGEauiAU6uRlusaPLS9a0DWTMZY1gDZENoQ2hDaEA4o+lFP195jNlU+gLlCVu34DNatfVp9OHjWhjCDmZEGerHQbL4qGFxnhdPAzEpdqjp06HDcYQzTqD5n1PGz1ClZrmuSfnvXgKyZjLGsAbIhtCG0IbQhHFD0o56uvcdsqnwAc4Ws2vEZrFv7tPpw8KwNYQYzIw30YqHZfFUwuM4Kp4GZlbpUdejQ4bjDGKYun9Nr/+C4+o1tS7+9awwa++15QBu2LWmC6fb8uT8gf86q27sG9Bv7XWixrOGyIbQhtCG0IRxQ9P9xFO8xmyofwFwhq3Z8BuvWPq0+HDxrQ5jBzEgDvVhoNl8VDK6zwmlgZqUuVR06dDjuMIapy+TAEfU/Y3w7LI+sP/db+u05bFtyOPBz/jDq54GN/c/9lhxa1swE73FUuPBC4fXXhe++E3btEpYuFbAQPB7Ka9yNCZ54QohrhFWrBLiaI0ciA7v45puR2b9f2LZNoD2GH9aThE978MHIvPCCAJ8GR3BUtXBhZC69VMDtpvC0t94qRBxQ/pCBeYZf+uijyDTucWvmggsiE/Fwht+cG4UffxQiPlNeUnZnYCZxsLih9I03hCefFBrjfZugOcOX4m5bFt8or1ET1711xfzH0jBgcF3l1+ui6K+3UIOsasOAwXjBSBJfWUwFcHQjuRrQ7jGDddGLhdCLrNCLw8H20VvvCDPjnDF4pLPCzwIG40pS5Azq7auHn7Isa6LqFaSFerYnq9+OYXV7HQ5tx4Ceup7q+tx+GLW9a8DA0LJmJhtCG0IbQhvCdjAWwuB6XXiAegs1yAr+ATNjMF4wkrQhtCFMhrD424VDhw7HHfYK0kJdJqfLC3W11+HQdgzoqeuprs/th1HbP2j0+1AdZlmjyIbQhtCG0IawHYyFMLheFx6g3kINsoJ/wMwYjBeMJG0IbQhtCB06PDPCXkFaqMvkdHmhrvY67Grvf8aAnoY+hc/th1HbMQCqey2rQzaENoQ2hDaE7WAshMH1uvAA9RZqkBX8A2bGYLxgJGlDaENoQ+jQ4ZkR9grSQl0mZ6h36grzyKGf2xDCyPpz/jDq57Yxt+OzZY0iG0IbQhtCG8J2MBbC4HpdeIB6CzXICv4BM2MwXjCStCG0IbQhdOjwzAh7BWmhngXK6rdjWP9DMazXgjFozO39XrT0lbuGfkZjVt3eNaDf2GvPoWXNVHBxcZXAq0HVTqDo3749MrhKcckSAWVPxJYMCuiIHzMbN0Ym4k7h3MigGonYmeHtpgsF+JZDh4R77hGuuUZ45BHh8suFZgubhKsjA7uIKythj2Hbzj9fiHOUuEO4IgS9sRMHG3GrcpugX6Tm2W8yjcdblcGvISJeUX4QdAv0lrrf55+PTONp12b4awi9VnTFisjw9x2xRtGrX/HDgMoV32CAqveP6ltQbY9UfNflNXJGpd6ulanLegxG70jUO8IW6reAXiSJl/LhhwLSwFT1C8WzeL94tn6hyBm92C88HnJGklgXU2FdPAtGGozTqJPEfvWnfcqyrIkqzgzVbqrobY3ZRHSGpGGdlbIhtCG0IbQhHOAfkAYWQs42hBkbwgzWxbNgpME4jTpJ7LcxhMXfLhw6dDjuMM4MFW6q6LKsuSAbQhtCG0IbwgH+AWlgIeRsQ5ixIcxgXTwLRhqM06iTxH5tCB06PJPCODM00PX5z27WvJANoQ2hDaEN4QD/gDSwEHK2IczYEGawLp4FIw3GadRJYr82hA4dnklhWJY1WdkQ2hDaENoQDvAPSAMLIWcbwowNYQbr4lkw0mAbQocO50oYlmVNWvszuGbzzjsF3BR6ww1CxOeClubLlgkR3ws3RQbucccOAZdhXn99ZGgYLo3Mzz8LuCqzuTry6wxuoUQal10WmYh9wm9mLBNfZK69NjIRLyjPKzpzrM8cOBAZXKMK1xrxmPKZ8loGvvT22wXcnPnYYwKcNmb+9tvIRBwUlocQt2e4kO5o69bIwIg+/XRkNm0SHnhAwMy43PW884QXXxQi1invCihk60odFfNserFQvS56kTNKc9TiI62LZ5EGFoKJh0ECSANToRcbxFTorWfGFrBBTFUfO3qxLmZuzzaDJOEA0Ysk4QCRxp49AnL+W7nek9Rp1FnVb6H8Xk1ZljVRhWVZk5YNoQ2hDaENYQOeRS9yrovvkdYtC3cuZEOYwczt2WaQZO3EkORcNITF3y4cOnQ47jCGqfd/5PtN/jzxz9ZclQ2hDaENoQ1hA55FL3L+Y1l8j7RuWbhzIRvCDGZuzzaDJGsnhiRtCB06dHhKw7Asa9KyIbQhtCG0IWzAs+hFznXxPdK6ZeHOhWwIM5i5PdsMkqydGJK0IXTo0OEpDcOyrEnLhtCG0IbQhrABz6IXOdfF90jrloU7F7IhzGDm9mwzSLJ2YkjShtChQ4enNAzLsiat1cqOTHMZ5qOZzz6LDC4s5a2M5wmrVgnr1gmop2++WfjiCyGOCrt3C/v2CazF4Uv1+sfVqyMTsVf4zRNm4j6BN7KKe8Slo3BER44IzTWb9wjq0q+7TsCNnRFHFNH77wuwqSiJV64UYMxwI2vE1sy2bZGJ2KiszuBXCZ9/LsDD01veLDz5pBCxQrlbeUt5PHP4cGTwu4NbbokMbs2Fe2TFjGobvShz0YuXBL+EmhigvMZCsBMYjDRq79EunalNDqgXwlTwHujFjtq1inXRi6mwLgbX+60Ptp5qpJlr8L0C2CB6kQZ6kRWODvtFVni2nhnfDc15yrKsiapfhwzW3/27FadRR4+JrWeV5sAWrDFptQ2hDWFPNoQ2hCfAQijNMRhpYDCmapfO1DYG1AthKvgW9GJH7VrFuujFVFgXg+v91gdbTzXSzDX4XgFsEL1IA73ICkeH/SIrPFvPjO+G5jxV/u3CoUOH4w77dchgtSZwREPYc0G1F5rhGDadamGJftjVfhKazbPWHNZqG0Ibwp5sCG0IT4CFUJpjMNLAYEzVLp2pbQyoF8JU8C3oxY7atYp10YupsC4G1/utD7aeaqSZa/C9AtggepEGepEVjg77RVZ4tp4Z3w3NuS5VHTp0OO6wX4cMVmsCRzeE+ADl9sITdrWfQnUt0dV+EjqFU1lzSattCG0Ie7IhtCE8ARZCaY7BSAODMVW7dKa2MaBeCFPBt6AXO2rXKtZFL6bCuhhc77c+2HqqkWauwfcKYIPoRRroRVY4OuwXWeHZemZ8NzTnulR16NDhuMN+HTJYrQkcxRCexN/WBo4ZOE92j73PuQWNuR1dRUvR3vVUf0DbnnstK2u1DaENYU82hDaEJ8BCKM0xGGlgMKZql87UNgbUC2Eq+Bb0YkftWsW66MVUWBeD6/3WB1tPNdLMNfheAWwQvUgDvcgKR4f9Iis8W8+M74bmXJeqDh06HHfYr0MGqzWBZ4YhzC05nOXn3geERfvQz72w/7kNLStWrBCefVZoCvdHlM8VMZMRb2fg4ngZ5jVKfJL58cfI4EpSlOYAd0W+9ZawYYOAnOPiEOIvigzGjaxr1ggRT2T27o3Mzp1CxAMZvCMYFVogXGeqZ4UrOvFCFyyIzNq1QmM1H87AxEb8QcFXZW1my5bIxAXCHXcIzVSq5QJ+0YAv4VdfCbxTN+7MND8LYibxO4vmNtdtyj4BZW5tn2AX0VtXzKi2sRCexWD0olLHYKxbp4GZa+qiH86kfTzTJpbBOQMshGdxOHgWBgmnAWpHhKnqDeK3A3h2pKnqrPC9+vRTARusZ64HY9366IDud8qyrIkq/Ss+SK0JHKch7BpQz9MVnmntA0PLsiG0IbQhtCG0IWxoTWDGhrDI6uw0hMXfLhw6dDjuMP0rPkitCRybISx663mONuoa1v8AYQDCU9U+MLQsG0IbQhtCG0IbwobWBGZsCIusbAgdOnQ4Ypj+FR+k1gSOxxAWXdH01mFfXcNmOf6k2weGlmVDaENoQ2hDaEPY0JrAjA1hkZUNoUOHDkcM07/ig9SawFEMYXTYpJPwSPXjA3tze9fnXogPM2/v+tz70Ibosqxp2RDaENoQ2hDaEJLWBGZsCIusbAgdOnQ4Ypj+FR+k1gSObgj7yo0DB/TU78rK7e2YgY/nxtyOrraxH9btuQuN/c8I0WVZPR1U9ivi8ZYujUzv7s0+qONxzeYFFwhN8f2KcqvA+zy/z/z6a2TgH15+WYh4I3OL3ga5f78Q8bHygyJHd8UVkXn3XeH884V33hFgrm68MTIRKzMPPxwZuCmk8d13QnOSMnPEV8rhDCpGviMczpIQ9LJTbKExk7cIelNoxKbMJ59EBl7ryisjE/Fg5vvvI/P22wJeCkwsHD6+3j/9JERsVt4U6roWRTCqbZS5tcfDK8TMs6m2YZDqwVio7q13hIXQ224qA5+GheqZ0QubiqkA0sBLqQfjrJBVPVX9jvAsBtcz11PVg+tXhsH10WEqbAFp6LNTlmVNVHGWCKZrJhp1/Lh1Eluw5olsCG0IbQhtCBvqrLAuiu96MBaqe+sdYSH0tpvK2BBm8CwG1zPXU9WD61eGwfXRYSpsAWnos1Pl3y4cOnQ47jDmruy+rLNFNoQ2hDaENoQNdVZYF8V3PRgL1b31jrAQettNZWwIM3gWg+uZ66nqwfUrw+D66DAVtoA09Nm6VHXo0OG4w5i7siG0zhbZENoQ2hDaEDbUWWFdFN/1YCxU99Y7wkLobTeVsSHM4FkMrmeup6oH168Mg+ujw1TYAtLQZ+tS1aFDh+MOw7KsScuG0IbQhtCGsKHOCuui+K4HY6G6t94RFkJvu6mMDWEGz2JwPXM9VT24fmUYXB8dpsIWkIY+W5eqDh06HHcYlmVNWgeUuzOvvx6ZWCBs2iTEIkXdBRxRxP2K1PFLlkQmrlLU1EW8r2zNNGZjZwY3Z65fLzyrd65++aWAKzq3bo0MD/baEGJd5vbbIxPxaga9vHRUrRduzjx4UIiFSuzKXHhhZJobSn/MXH11ZHAn50UXRSZivbAsBH0WF3g2U4m5wtWJu3cL/ALHaxncQNvs6HHlLkXe/qFDkUGlChMbN4RQ18QoZEeqiVFP19RmA2nUgwGSrJ0YBo90GthR3VtPhV7st76xExtsDyRTJ9mOzyArpIHeeiH04tmR1sXRYSGYZ5xVnQamArXjxcy6oynLsiaqsCxr0rIhtCG0IbQhtCEsF8J+bQiLdXF0WOhMNYTF3y4cOnQ47jAsy5q0bAhtCG0IbQhtCMuFsF8bwmJdHB0WsiF06NBhE4ZlWZOWDaENoQ2hDaENYbkQ9mtDWKyLo8NCNoQOHTpswrAsa9KyIbQhtCG0IbQhLBfCfm0Ii3VxdFjIhtChQ4dNGJZlTVYvvSS89poQcUj5U+b++yOzcKFw7bVCYxd/yeDaybvvFs49V3joIeGuuwQ8i4V27IgMiv5XXokM7HHjS+UOUpjJ224Tnn9eiPhcWBzCucK33wrffCM05kr2G/G1oIMbtyxGFNe3xoXCypUCrn6NeC/T3KqKwQ8K10Rm0SIBJvaNNyKDrwruPoXle/VVIS4WuP14OXPrrZFZu1aIeEf5RrlPqJ0Jqm30tmVxpi7cUeWjnsZCsEB18Y11AdbFQgCDMVV9dMgKU8GZ1OeMwVi3ngq0rymDwVhopKPDzO2ADGYG9RaQJN4RFsI3p94v7GL9bN1bfgmnLMuaqKIWfj0PTqOOHhNbR9fQSU7VQpY1U9kQ2hDaENoQToN6GgvZENoQdm0BSeIdYaHatmGq02gIi79dOHTocNxh1GpNYGYG6vmrwmXlAV1jYgZGboaayTwzGWNZp0w2hDaENoQ2hNOgnsZCNoQ2hF1bQJJ4R1iotm2YyobQocP5EUat1gRmZqC+uepyWV3t0AyHDdVM5pnJGMs6ZbIhtCG0IbQhnAb1NBayIbQh7NoCksQ7wkK1bcNUNoQOHc6PMGq1JjAzTHBWA43WwEaoHXPsr4nTGthYtOeugY39LrRY1rhkQ2hDaENoQzgN6mksZENoQ9i1BSSJd4SFatuGqWwIHTqcH2HUak1gZphgqwa6rOzKBg6I5sE8Mn84JZ/7LTm0rHHqHCVWZfbujQzMxjnnROaaa4SI55UnFLmyMuJRZb9yV2b58sh8/71w8cXCY48JjV/63bEc5wFF7i/dsiUyES8o1bPNOYtD+PzzyNDyaZKN492bWbAgMrjONOLpDO4g3b5duPxyYfVqgT6NvnSDIm5qub7BPXsEfjcuj8z+/QI8PH5ZgHtE4bQj/qLIG8TFoRHPKd9lXnghMrt2CREbM3yDtSUYqXCHM0FvvRB6UUCD2gNgXQzGup9+KqC3nhmH88knQj0Y+0Uv1sXBwnvURzdSGhiMo4Mtr7eAqWrXisFwYvXMmAo512mMNBV6cRqYGVvAVMqUZVkT1XQ5Wqg1gafaEGa1xqzfXoQDG7PZG6l9YGhZ4xSNig1hxobQhtCGcBAoqWsLhMFY14Ywg8E4OhvCzCk1hMXfLhw6dDjucLocLdSawHEawugYM5N5usYU7dDAYZY1ftGo2BBmbAhtCG0IB4GSurZAGIx1bQgzGIyjsyHM2BA6dDhXwulytFBrAueQIcztUN1rWadUNCo2hBkbQhtCG8JBoKSuLRAGY10bwgwG4+hsCDM2hA4dzpVwuhwt1JrAUQxhdBiw4nOXE+salj+c9OdeOPCzZY1fNCo2hBkbQhtCG8JBoKSuLRAGY10bwgwG4+hsCDM2hA4dzpVwuhwt1JrA0Q1hX7kxDRk8Bup6ZGBj0Z67Bjb22nNoWeMVL1rU6x+/+CIyuEd0yRLhjjuEiAPK7syjj0bm+uuFNWuEZ54RztWbJG+/XYjlCr3lzgzq+K++Ep58UsA1m7x09DyhMXWy/Yg9GTgx3G7644+RiXhT+O2/GIlLLxVWrBAiNgmaM153xFuZdesi01jrhzM7d0Ym4gvlvgzqOlz9euBAZOB44Vpxt+3mzQLvXNUNRqzP3HBDZCLWZO68MzKLFwsR2zONS9dfFqDMBaiYUebWRXBtkGAnMBieBws1JbWAhWCQAJ7FFnAas/FaWAg7wkJIo7ZeoE4S4JwxFZJEb/1VQS+exWnUM9evrN5vfXT1FnA49WCkgcE4SR08ZVnWRBVniVrbNiadtoUs63fZENoQ9rEhtCG0IfwdpFG7GlAnCWwIiy2cRkNY/O3CoUOH4w7DsqzJyobQhrCPDaENoQ3h7yCN2tWAOklgQ1hswYbQocP5EYZlWZOVDaENYR8bQhtCG8LfQRq1qwF1ksCGsNiCDaFDh/MjDMuyJisbQhvCPjaENoQ2hL+DNGpXA+okgQ1hsQUbQocO50cYlmVNVvA8P/0kRNyfWbs2MqzybwwhXlTeUJ7O4FbGZcuEt98W4hploQBH1Nxf+rryZOattyKDqzLheFFvbNggRDylvJLBBpt1P1ckyYiPMnBTzVQrMzDeDz8s4ILWiF3K6gyvyoyfFBm8Y0dkIrZmrr46MrFYiT8IV0am2e8tGey3efvvCjeFcLGi14riy9/84OwQNOe4TkHFDGNWOxOU5hhcF/212ajBzMgKpXm9BcyMn6u6F5agThLgnPGDhC1gZmyhTgPbr5MsfQupTwNTYaF6g+itNzibV1a/FKSBd4S3gHMG5X6nLMuaqMKyrMnKhtCG0IbQhtCGkGaj9A/cQp0Gtl8naUM4IUNY/O3CoUOH4w7DsqzJyobQhtCG0IbQhpBmo/QP3EKdBrZfJ2lDaEPo0OH8C8OyrMnKhtCG0IbQhtCGkGaj9A/cQp0Gtl8naUNoQ+jQ4fwLw7KsycqG0IbQhtCG0IaQZqP0D9xCnQa2XydpQ2hD6NDh/AvDsqwJa4lw333C118LuDsRN4VecolwVPXgg5HBnY1xQ2RwweOWLcKePULEcwKK7/ghc/BgZNavF2K50FyVuUJ5RsClo7oj3DOJwgZ2sTmrtzPNlZW7Ms8+GxlcDIv7LRu/tCXz5ZeReeklgVeS6mWnL74o3HabcOSIgDtXL7wwMs1ZiVu+6qrIbNwoYOZ3340Mvt6//io0t6r+msHdtrfeKkTckcHgiy4SWNeiREYBDfBsXSKjJkYv6ngMxrq4/hE5t5kUWaG3thOg9rTIqp65frbdRQZnVR8dFkIvnm3XymAquCnMXKcx0pehPnZMVa9b7xfv6MMPBcyMZzFzue6UZVkTVdTCf1XAaVSvoGXrLDSb2frPnvKsrHkpG0IbQhtCG8K/DvMAWNeGMIOzqo8OC6EXz7ZrZTCVDWEGM5frTpV/u3Do0OG4w6iF/6qAGSiXo+w7rhmOYdPsNJsJ87OzmceyjsmG0IbQhtCG8K/DPADWtSHM4Kzqo8NC6MWz7VoZTGVDmMHM5bp1qerQocNxh1EL/1UBM1DfL3UZJ7TPcNjsNZsJ87OzmceyjsmG0IbQhtCG8K/DPADWtSHM4Kzqo8NC6MWz7VoZTGVDmMHM5bp1qerQocNxh1EL/1UBwwSzNNA7ndyYrK6uge25petzOxjtbVcOLWtE2RDaENoQ2hD+dZgHwLo2hBmcVX10WAi9eLZdK4OpbAgzmLlcty5VHTp0OO4wauG/KmCYZmKcTm5MvwWfTwxK4cAx7Yfe566nBn7ut+TQskYTCuhrrxWWLBEiNmUuuCAyEbdmmusfpTSPuC+D0vyJJ4RYKuBuzIi/COrEVq8W6ACXKXpR6ubNAqwIrtlEzi+/LMBNXXONgEIuYrdyb4bbv0Joproz88ADkcGFpTwcfaGLF0dm924BbgpXv+JiWNwEC58GHw5D+P77QpynxBMZeFrUsc1FuK8LuAs0DiiPZF55JTIRqzKNTdWbb1HIwooA7AFVLwajCAaffipgKmSF4huVev0segGywkIA28eXA4PbLWdq+9TmmWnfSwaD61eGrHB0SBILoRcvBYOxQQyuXzdyxmBsATPjdwf1fpEzpkJWNTh29GoaU5ZlTVTT9Wih1gSeakMYxy1Wa7T6qucZ+tTAAb3GeqquGerQskaTDaENoQ2hDaENIZ9t88y07yWDwfUrQ1Y4OiSJhdCLl4LB2CAG168bOWMwtoCZzxJDWPztwqFDh+MOp+vRQq0JPNWGcPZjcnhU1Q7oKw9AY1a/HcOK0LJGkw2hDaENoQ2hDSGfbfPMtO8lg8H1K0NWODokiYXQi5eCwdggBtevGzljMLaAmW0IHTp0OCycrkcLtSbwDDaEM2zPjV2PQPWwrqcsa0ayIbQhtCG0IbQh5LNtnpn2vWQwuH5lyApHhySxEHrxUjAYG8Tg+nUjZwzGFjCzDaFDhw6HhdP1aKHWBI5iCKPDlXV9bsO+8EietmuJekz7ofcZYdveNcayTlI2hDaENoQ2hDaEfLbNM9O+lwwG168MWeHokCQWQi9eCgZjgxhcv27kjMHYAma2IXTo0OGwcLoeLdSawNENYV+5MQ0ZPAbC412P5Mbc1Q4uPreD0Z67MMyyRhZK1cOHBdyOuGiR8M03QsRdmfvvj8zatQIKd2S1fbsQ8UJm1arIwAHG+QLSuPNOIeKlDFwcdtRcOylZRTypPJXBnZy4kTXiUIYXeKpt++yzyCDJZ/WWUZjYiF8yv/wSmYiPlR+V7zPvvRcZXIX6+4s8ruXLhfPOE2KR8PrrAu4+ffzxyOANRuzNvPZaZJ58UohYrcjhrFkTBRHrM7XFfeMNgV/vunBHXVsX7uit6/h6MGpxpFEX7jWwBFgXvXgW+8Wz9Wmgtx6MNLBfAM8zkgVCL7LCBvEswFnVh1P7pXoqrAtfWu8Iz2Iw6rx6KmSFwdhCOdWUZVkTVb9aOMOVbdiZ48FgDi3rZGRDaENoQ2hDOGAw6mkbwoLWBNoQdu0Iz2Lw5Axh8bcLhw4djjvsVwtnkezBrDklG0IbQhtCG8IBg1FP2xAWtCbQhrBrR3gWg20IHTqcl2G/WjiLZENozSnZENoQ2hDaEA4YjHrahrCgNYE2hF07wrMYbEPo0OG8DPvVgmVZk5ENoQ2hDaEN4YDBqKdtCAtaE2hD2LUjPIvBNoQOHc7LsF8tWJY1KaHof1r5SflSQS2+UZGpYMw2bRLwb/fChULEJ5kFCyIDsxHxfGbbtsg0G/w10/s/5vaF6y4ffFCIeFXQizTjHCV2ZJYujQy3kK5UnUZvCuXMVylqRFFBbdkiRHymiC/FPbG4SPOuu4RzzhHiSiW+ycAR4YXiqtu4SYntmccei0zEW4qcBm8ojSPKi4L+ZgE533STsGGDQNd6ubJEQYmMmhi9tT+swY9ZbepQbWMwymtYgtYyZTAz1q0tAaizwrcfvfXhtGsVjORMsC4GY/vYIHZUbxBfFTDS+61zxgZB65Az9QaRJHrrb117Pt1MWZY1UU1Xo5ZlTVQ2hDaENoQ2hDaEmka7VgF2hF7MjHUx2IYwgyTRW3/r2vPpZqr824VDhw7HHU5Xo5ZlTVQ2hDaENoQ2hDaEmka7VgF2hF7MjHUx2IYwgyTRW3/r2vPppi5VHTp0OO5wuhq1LGuisiG0IbQhtCG0IdQ02rUKsCP0Ymasi8E2hBkkid76W9eeTzd1qerQocNxh9PVqGVZE5UNoQ2hDaENoQ2hptGuVYAdoRczY10MtiHMIEn01t+69ny6qUtVhw4djjucrkYty5qkLhZuu02IS5V4TfmTsi9zxRWROXhQ+PbbClw7+dNPwptvChEvZ2Bj7r5bgNWEA6Ql0MPBzLFQiRWZPXsiE/EX5YHMdddF5vzzBbhH3EGKmzMvvljASUbszDzySGTefluI2JNZuTIyuIEWh4NLZQ8cEFasEK6/XuD9pQuUaxU6QPklBW7N3bxZaC6V3ZZ55pnIRNyiqJeGS8cvC+IdRX9wUPXW/gGgCMazKHxRx3/4oQDDgKmQZF2p166mthN1zpi5NiroxczoRRqzcBdDnkWSAGkgyfrY6/3i2XbpDLaAYwcjpQFD2C49czAVNoiTxLdds5qyLGuiOl6SWgP0wTGxdWaa4YOzWcKaK7IhtCG0IbQhtCFEGsgZz9bUzyJJgDSQZH3s9X7xbLt0BltoTWBmpDTOVENY/O3CoUOH4w6Pl6Sd6jmWvrraP+hwNQMHdA0+CZ3CqVoVkxddPXUNaNvbFmueyYbQhtCG0IbQhhBpIGc8W1M/iyQB0kCS9bHX+8Wz7dIZbKE1gZmR0rAhdOjQYRMeL0k7BbvSD2diY2bz7Ax1CqdqNZvJu55t29sWa57JhtCG0IbQhtCGEGkgZzxbUz+LJAHSQJL1sdf7xbPt0hlsoTWBmZHSsCF06NBhEx4vSTs1G1M3cMwHSf2Wfns/7CuHvTH9ln6YW34fqmHvA0b21WuB0N4L++Nzb6+xr35j7mpH9lr67Tm05plsCG0IbQhtCG0IkQZyxrM19bNIEiANJFkfe71fPNsuncEWWhOYGSkNG0KHDh024fGStFNd1mUmHqZrTDtnbml7+x/yZ3yow/wsQnT1hUYMG/h41+deiA9ZAxuteSNcaLlc0cshn302MhGrlW8zDz0UmeefF777TmiK79uVJzK//BIZGNGIzxW5Z5I3WKrli/g+s2pVZOi11HtE3KvcWtBMdVgRs3HffZGJC5R4U3lXwP2Wek9s44heycDS8+jU4h46FBnapxsig+tbI1Yp+iy/ZnIvLvxwxH5Fkty6NTK33CLgOxmxSehdl9pHfw3x88+RiXgkc8MNkXniCYFlLgpoUNfEf9Q6HuBZVMxYCGU9wFSgHZ+B8xwpK/TiWewXC43kiOo0au+BwbWJBZgKjLQFgMOpvznYQv0G2zwzbSaZ+mDrwXWSeLbsnbIsa6KKYeoZm7662j/osDQDB2DwDEO099Q1GGFX+8Cwp3rM0Jln2N7TwEZr3siG0IbQhtCG8OPGxqCALutp0o7P2BAWYCow0hYADqf+5mAL9Rts88y0mWTqg60H10ni2bJ3qvzbhUOHDscdxjB1eZWu9kJdpmiG4cAVuwYjbNuh3NsTGrvCWbb3NLDRmjeyIbQhtCG0Ify4sTEooMt6mrTjMzaEBZgKjLQFgMOpvznYQv0G2zwzbSaZ+mDrwXWSeLbsrUtVhw4djjuMYeryKl3thbpM0QzDgSt2DUbY1V6ofmTozDNs72lgozVvZENoQ2hDaEP4cWNjUECX9TRpx2dsCAswFRhpCwCHU39zsIX6DbZ5ZtpMMvXB1oPrJPFs2VuXqg4dOhx3GMPU5VW62rNmaIqK8INjGvgZH9pw4Pi2qxf2P2cVY/LMXZ97HxCifWCLNc9kQ2hDaENoQ/hxY2NQQJf1NGnHZ2wICzAVGGkLAIdTf3OwhfoNtnlm2kwy9cHWg+sk8WzZW5eqDh06HHcYw9RlV3rmJ4sjjmngALTkrn5Lf0Duze0zaem35wH9ljxyoHIXhqErqx2QQwzLXda81VpldwaXjv7wg0D3qEU/LsPEP8cRHynPC/BpvOz0l0xzNybM5DoF3uOQsj2DezUbI3p/5uabIwPLd++9Ai4OxZ2ccI/nnRcZvLIFCyIT8QdlTWbHjshEbM0sWxaZiB8yr70WmcY+wYm9kdm+PTIRL2RuvDEyEU8q6rRvjsyuXQK+oujFHbO4NXfv3sjg7eO+VgzGnau05fy9w4nfm0yDAho/KuiFu/ij1vG1UakN0iefCPXMI9XxAM/WWbV1/8yfBR99JGAq9Jb+gVdWwlzVLxTr1km2p1eArNDbnl4Gb79+FhvE4ProMBW+ZuitDwe9dVboVaYsy5qowuoWnNtMdBLjR33EmnuyIbQhtCG0IbQhtCGc14aw+NuFQ4cOxx2GNWv1HZ3dnXVysiG0IbQhtCG0IbQhtCEcXKo6dOhw3GFYp0I9K2g3aJ2cbAhtCG0IbQhtCG0IbQgHl6oOHTocdxiWZU1aNoQ2hDaENoQ2hDaENoSDS1WHDh2OOwzLsiatd5QHMp99FpmjquZmxXsUWC9xJnFFCLw5UzzAunWRQc1w+LBAd4GZs7G8lK4GV1a+846webMQNynxembFisigAsHNmQcPRmbfPiHiT5mLLorMnj0CnFgsCYE5351pvOXHmeZ1i/Fu0ngq0+xoZQZvEF76gguE668XYoGA62rpWs8XvvlG2LJFiDiSeemlyOCy059+iszu3cKllwqwqfxyoMyFA0QvrAhqcVTbsE94ti7c0VvX8bW5qveLwUgS6+JZbBALIUkshA3Wp4F169OA18K6eBZbqNdFb71f/IhiML5m6EWS6AVYd6RzBngWYF0cHQaXRzdlWdZEFZZlTVo2hDaENoQ2hDaEjRspTgPr1qdhQzjzcwZ4FmBdHB0Gl0c3Vf7twqFDh+MOY5h+///GffCBP0/8szVXZUNoQ2hDaENoQ9i4keI0sG59GjaEMz9ngGcB1sXRYXB5dHWp6tChw3GHYVnWpGVDaENoQ2hDaEPYuJHiNLBufRo2hDM/Z4BnAdbF0WFweXR1qerQocNxh2FZ1qRlQ2hDaENoQ2hD2LiR4jSwbn0aNoQzP2eAZwHWxdFhcHl0danq0KHDcYdhWdakdTjzxBOR+fVXAVbknnuEuFpAWR83ClddJVx4oXDOOQI9wFLh5ZcFVPnLlwu4NzVipyJVPi7DjHhFeTLz44+RieuU+EJ5MXPTTZG59VYBV4Pu3ClEPC5cHplDh4T16wXcqvrII5GBaYepe+ABIWKF8rDycgbfKxwd6kncBQqH/+WXQpwr4GBxjeqddwq0fBcJzdF9lzlyJDK4+Rb7xQ9dfPqpgLoWtTgq5to/gLImJlgX5TX8AwZjqnowssIG0Ys0MBjr4ln4BzyLmTFVfc71VPW6dZLoxbpYCOYZz4LapiKN+v1iXbxu9GL7WKjeAtKov1dIsmTKsqyJ6kRNOkj9/wPbQHH0PNbRo0fZZFkzlg2hDaENoQ1hA9aFYRipFq8HI6vaLyENDMa6eBbeA89iZkxVn3M9Vb1unSR6sS4Wqt0UsCFMTJV/u3Do0OG4wxM16SDRAqo4utFAm5Qb8//2bWBjbm8HdLW3XT217W3LyelUzWPNT9kQ2hDaENoQNmBdGIaRavF6MLKq/RLSwGCsi2fhPfAsZsZU9TnXU9Xr1kmiF+tiodpNARvCRF2qOnTocNzhiZp0kGgBVRzdqPVmuaXtqtvbsOtzG3Y1ti0np1M1jzU/ZUNoQ2hDaEPYgHVhGEaqxevByKr2S0gDg7EunoX3wLOYGVPV51xPVa9bJ4lerIuFajcFbAgTdanq0KHDcYcnatJBogVUcXSjbP/ali4T1bYXjxRdrdoxuaWXW09pyIzac1dXY7+r32hZPdkQ2hDaENoQNmBdGIaRavF6MLKq/RLSwGCsi2fhPfAsZsZU9TnXU9Xr1kmiF+tiodpNARvCRF2qOnTocNzhiZp0kGgBVRzdqO+CirBV2148UnS1asfkx7s+9z4gLMYP/WxZkLiatWsjg5qYxG3KPcLNIcTnyvfKr5nnnosMzAbsYsQjGfhD9EbcmVm5MjK9H5W+Fi6MTMQG5YEMrkKNWK/8pPxJ+UV5O4OSCWYD92pGvKeI492/PzLvvy9EvKvcmsFtn9ddJ8RRZZEAX4paNOIJYVlk8MsCnOQbb0TmsccE/Boi4s1M49PEpe/dG5kDBwR8GeCWI+7L4GuGS2VZIqOuRYmMwh2g0sVXB4Oxbj0VejEzcq7BzCj6a8NQD27XymBwPRVAGvCHGIyzwtcdWdVpoBdpYOY27QyeRS/MFQYjjfrLgPdbp4GZ8SzAfvEWMDPOGb26hSnLsiaqKEULqOLoRj0L1DdCCHuf+8qN/c9oKbp6n9vZsvKAvvpdGJnDvoaOn2G7ZWXZENoQ2hDaEDY2BlOhFzMj5xrMDEswkn+ojw5gcD0VQBo2hMWXAe+3TgMz41mA/Z5SQ1j87cKhQ4fjDqMULaCKoxtlO5Q/nxiRVAyYSRc0sL1tRIZZeUzbngfkEINz+4nRlqWyIbQhtCG0IWxsDKZCL2ZGzjWYGZZgJP9QHx3A4HoqgDRsCIsvA95vnQZmxrMA+7UhdOhwroRRihZQxdGNsh3Kn0+MSCoGzKQLGtjeNhYz94T2rvFd7X11tVtW2BDaENoQ2hBOU0+FXsyMnGswMyzBSP6hPjqAwfVUAGnYEBZfBrzfOg3MjGcB9mtD6NDhXAmjFC2giqMbDXRB/Ub0Dm1vw67PbdjVmBcdOBsaB47v+twL8cGyWtkQ2hDaENoQNjYGU6EXMyPnGswMSzCSf6iPDmBwPRVAGjaExZcB77dOAzPjWYD92hA6dDhXwihFC6ji6EYDXVBuzIXfwMbc3g7oam+7emrbc0vX47kxd50Yfby3bc+N/c+WJcI/qa+8IqxYIcQ5SmzK4EbHc88VrrxSiNicwf2l8C1IklNdLCxaJOAWSripxj6JJcB1prihlJdS0k1tzeAizf+fvfeB2Ltu//8PSZKZTCaTzCTJZDIzk5nJzH5JMpNMMkmSyUwmk3vXTJIkmUzSL8kkmUkys2939b3dvz63u75Jkn6ZySRJMpmZub67drZzx/PxOs/jus5dO/ferj2fHj7O4/16vY7Xn/e5ruN5XbfX5733BNhUXP4Z8bPyVqYxdc9mli6NzIoVwn33CRH/FeimtmVuvTUysViAe/zsM+Gxx4THHxfwm4XGEH6Ruf32yEQczTTn/ILySeaLLyITsTOzfn1keMVu77ce54FN3bhRwFWo01SuqJhRE8MuoqzHWJTm2HBdmqMV86IzloHWeoO1UQFffy2M5MTQuV4GwFhsEJ2xjDoVllF/NzAvUoH6leE/svVZYSzAS8GO6i2gFeDosGbc1oux7YEkJizL6lRhWVa3wo9UG0IbQhtCG8IpUKmjtXYXWEZd9NeLbE1gxoYwg1SgfmX4j2x9VhgLrk5DWPztwqFDh+MOw7KsboUfqTaENoQ2hDaEU6BSR2vtLrCMuuivF9mawIwNYQapQP3K8B/Z+qwwFtgQOnTocMQwLMvqVviRakNoQ2hDaEM4BSp1tNbuAsuoi/56ka0JzNgQZpAK1K8M/5GtzwpjgQ2hQ4cORwzDsqxuhR+pNoQ2hDaENoRToFJHa+0usIy66K8X2ZrAjA1hBqlA/crwH9n6rDAW2BA6dOhwxDAsy+pa4gFws+L27cLDDwtNLS53gUa8n+H9pbco9DxiNSOeycBqwiHwCkdtfeCByMB5Nt7jzUxzz6S4i0OHouDVVwUYJFzBunx5ZObNEyLWZ2C9YpWwcKHQXHa6MdP4w5cUmXfRoshs3SpE/JG54YbI1K1YM6o+3CL70UdC893YJdwYwiIFvw6IE5klSyKDK3Zh+GH5du8WVq8WWObWoICG2UClW9uJ2gJhIqQCMBtYRu0P22yZ1hVkkArM5jTwtQP1Ftq3Vhws5kUr5kUqbAGtGIuJcDhoRWZ0Bu0eM/iKgvZsMzjY+qyQGa1Ys35jJyzL6lRhWVbXsiG0IbQhtCG0IdTTaM1Jpt5C+9aKg61NDuZFKmwBrRiLiXA4aEVmdAbtHjOtCcy0Z5vBwdZnhcxoxZobQ1j87cKhQ4fjDsOyrK5lQ2hDaENoQ2hDqKfRmpNMvYX2rRUHW5sczItU2AJaMRYT4XDQiszoDNo9ZloTmGnPNoODrc8KmdGKNdsQOnR4JYVhWVbXsiG0IbQhtCG0IdTTaM1Jpt5C+9aKg61NDuZFKmwBrRiLiXA4aEVmdAbtHjOtCcy0Z5vBwdZnhcxoxZptCB06vJLCsCyra9kQ2hDaENoQ2hDqabTmJFNvoX1rxcHWJgfzIhW2gFaMxUQ4HLQiMzqDdo+Z1gRm2rPN4GDrs0JmtGLNNoQOHV5JYViW1bGWC80lnK9lcIEn7ETE/ZlPPolMxEeZp56KzMqVwv79QpNKKnVYL1yGieL7r78ErIq3QapNxbWip08LEe9kHsfNmXoVKu7hi3gy8+ijkdmyRUDZE/FYBleh4nBeekmAEY01IcQrymnhrL3MxNoMro2N+DNDRxRbhTsjg1eGy2wffFB48kkBvw44dSoyEU9nDh6MDH6zsHmzEHFAwa8wtij7FD3YuhYfqRWgCMZYVMywbSjNMRZFf73IujOK/tYVZOoqv54X/3Iwtl4kwFisql4kWjEvOmNejK39Elw6aDdVgO8GFoktYFUAnfHKsEEsY6SJ6m+OZp6wLKtTRakdD/0/Bex9iTQ5OclHl1Hdzm5dk7IhtCG0IbQh/NKGsFwkwFisql4kWjEvOmNejMXRoXNrAm0Ih2SeKP924dChw3GHUao1gSMZwklVfp56UXVrT22f9snF6VLlsawZy4bQhtCG0IbwSxvCcpEAY7GqepFoxbzojHkxFkeHzq0JtCEckrkuVR06dDjuMEq1JnBUQ1iEwzSTbm2f9snF6VLlsawZy4bQhtCG0IbwSxvCcpEAY7GqepFoxbzojHkxFkeHzq0JtCEckrkuVR06dDjuMEq1JvCSGEL8tbCn/GTg86z2OTIMHD6T57lp2MN+U/+hZc1CNoQ2hDaENoRf2hCWiwQYi1XVi0Qr5kVnzIuxODp0bk2gDeGQzHWp6tChw3GHUao1gZfWEGZbNfBhfp7VPhw4fGB+hEX/aT9b1iXQ2rVC3CZ8/LEQsUk5ItwTwjxFDQPuL0VZj/L6+PHIwIrAMMDT4jLMiFMZFAkR/1a0jl8jfum334S9e4UPPhDiLgHOE/VVxF5ls7I98/33kVmwQIBLj/hSOa78ntmxIzIwSLgp9MCByDS3m74srIjMrl3CF18I+J1FswVZBr6ER44IcauAO3UjvhFWRuaPP4Q1awRcOctvbPyg6BZQ5qIIxnf088+FutrGWHSGQ6irbVgCZAao8rEjpMJEqOOxqtovgXpHNRhbn9Vs5oVNRSqcBsbW8371VQU646WgFe+3XhXeEcbWEyEVxqJzTT2RLnLCsqxOFaVaEziqIczKz/EhCw+H9WnVb0LPHPY1bf8ZPres2cqGMGNDaENoQ/g36IzyGpmBDeHM57UhzCAVxqJzTT2RLnKi/NuFQ4cOxx1GqdYEjmoI688DzdUwJ1Y/zDmh3Kd9njvkEJ3z8wu9LWv2siHM2BDaENoQ/g06o7xGZmBDOPN5bQgzSIWx6FxTT6SLrEtVhw4djjuMUq0JvGhDmMP2Q9awUfXDOmc0z4f1H/a8r2HPLesiZUOYsSG0IbQh/Bt0RnmNzMCGcObz2hBmkApj0bmmnkgXWZeqDh06HHcYpVoTeMkN4cCHvQ8Dw2EPB+bE8/xwYP9hn3shPljWpZENYcaG0IbQhvBv0BnlNTIDG8KZz2tDmEEqjEXnmnoiXWRdqjp06HDcYZRqTeBsDGH/CYzWMOs1MBz2cGDONlX/YW660Pt8a/s8P+x/tqxLop8UuXfx3Xcj8+uvQsSPwu0haGbcnAn/cNddQtykTArz5wsROxV1cWpEef2jGmA4BFzviTs577knMt9+K9xyiwC7GLFbeSLz55+RwRZwQyncFMrLWKTEh8onyrvKcxlkRqn2zjtCxHphSQg3KOridu4Umu/V85n77ovMddcJP/0k3HGHEPFgZt++yET8qrykHFT2Zz78MDLNbyU2CDhKVPkwV6iY6861YcC8qPJhgfD664kAUtWVOjpjkZi39h7IjLH1BnHOoD7J9gQySIUtIDPOClsAGIsNYiK8bmyh7owdoTNSYZHtgWQwtl4V9ouJ6rHaecKyrE7Vq0cty+pQNoQ2hDaENoQ2hDaEibozdoTOSIVFtgeSwdh6VdgvJqrHaueJ8m8XDh06HHfYq0cty+pQNoQ2hDaENoQ2hDaEibozdoTOSIVFtgeSwdh6VdgvJqrHaue6VHXo0OG4w149allWh7IhtCG0IbQhtCG0IUzUnbEjdEYqLLI9kAzG1qvCfjFRPVY716WqQ4cOxx326lHLsjqUDaENoQ2hDaENoQ1hou6MHaEzUmGR7YFkMLZeFfaLieqx2rkuVR06dDjusFePWpbVmZ59VnjmGeHUKeFsd6UySBEPKFJ8o1KPOFkBfxhblTMCL6X8OHPmTGTiemHlSuH66wVsf+nSyKBkOnRIiBuVFUr8Juj9lhHHhGUhIDOPfV2meUcwOT9kVq+ODCx93KtgkXrH7IkTAq4GxUWpS5YIMFcPPSQ0vx2Q/X70UWR+/13AVaivvCLgWtHmplC5CBc3st5/vxCxJwPXypq49h51AY2xdStSwT+gtS6+0QpqB4h/ObXzrLeAoh/z1nYCmdG5PklsoT4cdEYqjMW82C9a8QbrZSBV3RmZsQWcc33seL9IVR97vUjsCK24nlcXOWFZVqcKy7K6lQ2hDaENoQ3hFDaEmdqZoDO2UB8OOiMVxmJe7BetNoQZtE5nCIu/XTh06HDcYViW1a1sCG0IbQhtCKewIczUzgSdsYX6cNAZqTAW82K/aLUhzKDVhtChwys4DMuyupUNoQ2hDaEN4RQ2hJnamaAztlAfDjojFcZiXuwXrTaEGbTaEDp0eAWHYVlWt7IhtCG0IbQhnMKGMFM7E3TGFurDQWekwljMi/2i1YYwg1YbQocOr+AwLMvqWo8qz2V++CEyEUczN98cmYhtAjzPQiV+F84Oz9wj/PKLwCtJ4z+ZdesiE/GUskn5LvPGG5FpjOiLmbvvjkyA+F6BdmX274/Md98J8B40dauF228XYPgjDil6T2z8knnrrcjgLaxaJUR8oewTeDiw9P/KbN8eGRjgzz4Tjh8X8KuEjz+ODL9mcTozb15k4EvhLflVuVM4fVrgryHigIDKFaAIrmvi2j/UxTecCTKjM5aBeevOaIV/QGf4B0zUHlemHotl4KzQGavCSWIsaBeWQSq8hZH2W4PMWCQsH8aiMw62XnMNxuKcQf3K0FrTGELLsjpUqo4G6B+l2PtK1eTkJB91oStkGdYVKBtCG0IbQhtCG0I9K3TGqmwI55whLP524dChw3GHqToaIFpAFXsP0eR5zeR5/2FuGvgwa2CH9sNM1HZun1ycLlUea+7JhtCG0IbQhtCGUM8KnbEqG0IbQocOHV66MFVHA0QLqGLvQcouaNTP9cOsukPdCrWd2ycXp0uVx5p7siG0IbQhtCG0IdSzQmesyobQhtChQ4eXLkzV0QDRAqrYu9EwC9Q+7z9pm4Y9zBrYYWDOyaT+w6z2+UyGz+R5bhr2sN/Uf2hdC7IhtCG0IbQhtCHUs0JnrMqG0IbQoUOHly5M1dEA0QKq2LvRMGPTPu8/aZuGPcwa2KHNmb3WMN/VPhw4BJ97HxAW/af9bF1Tekx5MoNLRyP+LSyNzIEDwrFjwpEjQsTTGdzJiaIfhuG99yITi5X4OgNX8/rrQsRu5aHMq69G5pNPBBiViI2ZxrWKX8KNnahV4gahSSVHF9eFoLeMbtwYmYhXFNnvyZORoY1ZIMAfbtki8FpRntVfyuOZl1+ODG7sXLFC2LpViHhVkdPA0S1YEBlY64iDGZSmWAYES8+TxGnUJTJaUbi3RXMGFTMyo7WeCA4BLg7f4HoZsEDIXC9jJCuCidDamoRMvaqaNlsGh1O3tskz2D5S1atqsxWdMRH+A90Oz2BHAJkBUuHtY5H4qtTL0LETlmV1Kv4QVdECqti70TB70z6HKeqreJg1sEPxYWDYf9iq34SeOexr2v4zfG5dO7IhtCH8GxtCG8KhE9kQzpw2WwaHU7e2yTPYPlLVq2qzFZ0x0Vw0hMXfLhw6dDjukD9EVbSAKvZuNMzhtM9rUzTwYdbADm3OyUYXep9X+7D/hINTz4HPc4cconN+fqG3dS3JhtCG8G9sCG0Ih05kQzhz2mwZHE7d2ibPYPtIVa+qzVZ0xkQ2hA4dOrykIX+IqmgBVezdaJjDaZ/Xpmjgw6yBHdqcA7tBbZ9ph+P5sP7Dnvc17Lk152VDaEP4NzaENoRDJ7IhnDlttgwOp25tk2ewfaSqV9VmKzpjIhtChw4dXtKQP0RVtIAq9h6kbHJG/Vw/zBrYoTVgk+fUdshqH047HA8H9h/2uRfig3WtyYbQhvBvbAhtCIdOZEM4c9psGRxO3domz2D7SFWvqs1WdMZENoQOHTq8pCF/iKpoAVXsPUQ9/9O6nYHP227DHmYN7NB/mFv7kw4cEoNSzWR4fpibLvQ+39o+zw/7n61rSGvXCtdfLyxfLkS8ltm7NzKwE0ePCryTU+8RxdWgd9whHDwovPuugKsyH344Mrt3C/Sldwo//ihs2iREfJI5dSoyEScy69dHZs0aAZUMrspEa2PLxcU194j2LjU9Dy93faRku6CGH7Yc+22s5vOZhQsjE3Eqc999kcFlp7ywlDeUyi8pcOwffijESgG2HL4Ubx+/hsDXO9TD33ijEHcJX38tsAiuK2Z8OQA6o4AGmAitbWV/0cAQ/vOfwkhWs/Z4mAiZsd8vvhAwETJjXiwSE4H6HY3UGdRrxmlgzWjFWKwKnfFVQWec80gToRWp0FqfBuZtTy8xYVlWpwrLsrqVDaENoQ2hDeEUaEXxPRtQmtsQZkbqDOo14zRsCIczUf7twqFDh+MOw7KsbmVDaENoQ2hDOAVaUXzPBpTmNoSZkTqDes04DRvC4dSlqkOHDscdhmVZ3cqG0IbQhtCGcAq0ovieDSjNbQgzI3UG9ZpxGjaEw6lLVYcOHY47DMuyupUNoQ2hDaEN4RRoRfE9G1Ca2xBmRuoM6jXjNGwIh1OXqg4dOhx3GJZldasffhA+/VSIeFi4NzL79gm4WTFWKXqdKX6yx93Czz8LKD927BDObkI5nsFNoXAXe/ZEhvuNHcJ1cp9n48T2ZHhRqm7w9GkhYlMGjnfpUiHiiCIu7pFHInPbbULE24p46YiTyrZMvo3qrG69NTL1dbVwvM3lruItlyyJzBNPCPClixdHBl8VjlXbBkuP4rP5bcgbmQ0bIsOJ9JzhS3ltLCaGUYEVqatetCIzUtVj69K8tm0ART9akbluxbygdhfIDFdQt+KsMFENloH3i1aMxarQins1seb61k10rsfinPFS6sPB2Lpzu5LMbM4KaKoJy7I61VQ9allWh7IhtCG0IbQhHDAW/0SRClU+xoK6cEfmuhXzgrLoZ2aYjbq1tjE1WIYNYdG5XUlmNmcFNNVE+bcLhw4djjucqkcty+pQNoQ2hDaENoQDxuKfKFKhysdYUBfuyFy3Yl5QFv3MDLNRt9Y2pgbLsCEsOrcryczmrICmqktVhw4djjucqkcty+pQNoQ2hDaENoQDxuKfKFKhysdYUBfuyFy3Yl5QFv3MDLNRt9Y2pgbLsCEsOrcryczmrICmqktVhw4djjucqkcty+pQNoQ2hDaENoQDxuKfKFKhysdYUBfuyFy3Yl5QFv3MDLNRt9Y2pgbLsCEsOrcryczmrICmqktVhw4djjucqkcty+pQH3wg/PKLsHmzcLZ0zWzbFhl4AFw7uWJFZG6/XYAx+/hjAVV+xEblS+X7DO57PHFCgLs4fDgyuDc14kHlI0WEezVfe03A0dEhxAblqQwsUMSnmUWLIhPxnnI4c+edkYn5wjffCLFEeOklAd6y/u0Arn49c0aI2xV1YlhGxDcZ/EbjjTeEiM3KFuX5zNatkTn7b0X5S3la+SLDu22xwbpwRwENUAQDpAJtwZ3BRLVtq0vzujMmwiLredEZrchcz4tWzAswb5253j6oN4h3hM5Y5OefCyOtCq34TzCWgXnbTWXqY6+/hPXrRir8+qOcaMKyrE7Vr50GavL/q7gaNTk5yUfj1GWezroqZUNoQ2hDaEM4AEyEor+uxduVFJ0xERZZz4vOaEXmel60Yl6AeevM9fZBvUG8I3TGIm0IRzGExd8uHDp0OO6wXzsNVGsCL8IQ9v/3TWwYJHSb4aiZa2DC9mH75OJ0qfJYc1k2hDaENoQ2hAPARCj661q8XUnRGRNhkfW86IxWZK7nRSvmBZi3zlxvH9QbxDtCZyzShtCG0KHDqyTs104D1ZrAUQ1hdkQzcUcz6TMbDczfPmyfXJwuVR5rLsuG0IbQhtCGcACYCEV/XYu3Kyk6YyIssp4XndGKzPW8aMW8APPWmevtg3qDeEfojEXaENoQOnR4lYT92mmgWhM4kiFs7VD/yaSqfYj+A1v7Hdrn+WF+jj7DHmJIm2eGz3PTsIf9pv5D69qSDaENoQ2hDeEAMBGK/roWb1dSdMZEWGQ9LzqjFZnredGKeQHmrTPX2wf1BvGO0BmLtCG0IXTo8CoJ+7XTQLUm8NIawoGfex8QFv3zkJnkyc+HPRyYH597HxAW/af9bF2zejfD0hy1uNonGIbHHxfiTgFX68Udwr33CitXCrCLzz0nwCFs2iRE/JGBFXnwQQEm9qefIoMLPCNeVj4VbotMc7BnlA+F+0KI9xV5ZQ0/KQcy8MPvvy+8+aYAD4+rUCM+ydx9d2Twm4XVq4W9e4WIXzOw5fv3C7FIgOGPhUo8l7njjsg0d5+uzzz5ZGRwXe28ecLBg0LEaxmUpvhtCIvg2nugM8rc+tbNGhTf9apQi6MzrAj2j1SgXVimvrISZ4VWLGOk1nr7mBdgzRiLiTAWB4vW9vSKk8RE9RtEKzLjrGAX0bneIKgPp25FKuyoXNWEZVmdqlePDlNrAi+hIRzrc2hY//7DVv0m9MxhX9P2n+Fz69qU2InGt9gQ2hDaENoQNqtCaY7ONoQZG8Jig6A+nLoVqbCjclUT5d8uHDp0OO6wV48OU2sCryJDOKlqO/TVPsz9odynfZ475BCd8/MLva1rVWInGt9iQ2hDaENoQ9isCqU5OtsQZmwIiw2C+nDqVqTCjspV1aWqQ4cOxx326tFhak3g1WIIZ/h82MO6fzTPh/Uf9ryvYc+ta0piJxrfYkNoQ2hDaEPYrAqlOTrbEGZsCIsNgvpw6lakwo7KVdWlqkOHDscd9urRYWpN4EiGMNTw4HM2S8OM07A+M+mfHw583lf7cOBceJ4fDuw/7HMvxAfrWpbYica32BDaENoQ2hA2q0Jpjs42hBkbwmKDoD6cuhWpsKNyVXWp6tChw3GHvXp0mFoTOKohjPNeCM6n/xBNeDKwCQ/7nxHmzv3n6D/s4cA86JYf5qYLvc+3ts/zw/5n6xpVc7/lduX3DK5w/Ogj4a+/hOYu0IeUFzPNzZkvZL79NjKxQInvMocORSbivwpWtS+DSylfeUWIeCLz0EORWbtWePddAangH5qjezIDI4rq648/hMZMPpL5+uvIwNTFssjgrteYFJpUcrDwhxHHMjt3RiauFxYsELCjHTsE3ASL3yysWiW8956At3///ZGZP1/gacQDyv2Zxx6LDK5CjVgr4JcldZmL1rror8eiFanwPUPn2jCgtZ4IzCYzNggnhs643BX+AatCZiwDYGztl7AqfBmQCmuuU2HNtePF9uuJkApjawOMVPUycHQ4HHQeab/KhGVZnSo6ko2QZf0tG0IbQhtCG8IpahuDznWVj9Z6IjCbzNigDWGmNkjYfj3RXDSExd8uHDp0OO4wOpINoWX9LRtCG0IbQhvCKWobg851lY/WeiIwm8zYoA1hpjZI2H49kQ2hQ4cOL2kYHcmG0LL+lg2hDaENoQ3hFLWNQee6ykdrPRGYTWZs0IYwUxskbL+eyIbQoUOHlzQMy7K6lQ2hDaENoQ3hFLWNQee6ykdrPRGYTWZs0IYwUxskbL+eyIbQoUOHlzQMy7K6FezTjz8KcbNw/fUCSvMPPhBwleLRowIcQsTDwhK9O/RWYflyIa4Tbr5ZwNWREa8KayJz3XUCrlHFzZm//SY0pu7tDNxj3C00111+KawIIY5nHnggMrjcFbbtqaeEiJPKD8LZs00sXSpEPKq8k8FEr78u0KXPD2Glore5Yr+w1rhVtfGlaoD1txIbNkQm4vkM/2nEVgU3wcrbx/WtuGKXFTPq6ZGK/rqOR2vtl2qwZpTmmBedAQr3eiIYpJramaAz5sWO6rEAL6XtkIHnwUQAmdv3kkFnpMIG8RawKqy5fr/tHjPojFTYAlaFsXUqzFue84RlWZ0qLMvqVjaENoQ2hDaENoSc14bwGjOExd8uHDp0OO4wLMvqVjaENoQ2hDaENoSc14bQhtChQ4eXKwzLsrqVDaENoQ2hDaENIee1IbQhdOjQ4eUKw7KsbmVDaENoQ2hDaEPIeW0IbQgdOnR4ucKwLKtbwQLhZsWYJ7z1loDLMHHpaMTTyr8zTfH9q6KGQcvr5qbQ/cr2zJo1kYGnpfOMzcpjGZb18VLm1lsj8/jjwrZtQsSJzLJlkYEFitiZwU17uLHzu+8EOjFYkdiSaTztF5kzZyLz4ovCvn3Cr78KzTWbGxRx6Rs3Rmb1auHYMQE3lNKmLpALabnBe5VYl7nxxsigtbk1V76i338fGVyUit8s8O7E2k6g6q19C0B5Xdfi9TLQimWgM5aBidBa72g2Y9EK4JYxFjsCcJ5th0y9BbwjnHPt4TFR7abq1vprhrOqN4gtYCK01juCqas7//OfAragnScsy+pU5wrSoZo8cKCAveeohv2/TBz23LJGkw2hDaENoQ2hDSFNDsZiR8CGsNggtoCJ0FrvaJyGsPjbhUOHDscdnitIh6o1gaMawskkts1MGHjRefrKS+qLnZKGtQ57blmjyYbQhtCG0IbQhpAmB2OxI2BDWGwQW8BEaK13ZEPo0OEcDc8VpEPVmsCRDCEs08U5qIsbNRPNMPOwbsOeW9ZosiG0IbQhtCG0IaTJwVjsCNgQFhvEFjARWusd2RA6dDhHw3MF6VC1JnA2hjCr/6e51jTmh6nXhSdtZzzMTf3nrdrW/qjclB/i+cA+/YeWNSPZENoQ2hDaENoQ0uRgLHYEbAiLDWILmAit9Y5sCB06nKPhuYJ0qFoTeEkMYTZOxWd8aJ9P+7kX9j9DwzIjHJZ82MP+Z8uakT78UFi4UNi1S7jvPuH99wV6Lb128qefIvP778LZhQg3RQalS8Q25bsMKpmI9zILFkQGJqe5SHOPcka4W24KffllYdEi4Y8/BJwkLsPEFZ24zrS5OfPHzGOPRSbiF0Uc4HvvRQamDpesRryp7FVeENSJRXycaW7sFMeL7xV86eLFkYk4pDytYM1yQWssDCFOKT9njhyJDG5kbe62hY5k+C+lrpjrAhpFMGiHZ9AZ/8wA5oUz+fxzoa7UASr12vOAdlPFBut5sV90Rmu7kgwyw/DD1VzCt1+3YpFYVd0Za0ZngP8EYwvIjM7gq6+EepHojNZy3gnLsjoVf2aqWhM4kiGM8wYJNgmWKbup/Hzgw2Gdp33eqmiKGSRsPwwMLWsa2RDaENoQ2hBOgX9mAPPaEBbYEGawBWRGZ3AZDWHxtwuHDh2OO+TPTFVrAkc1hFnZQUHokIWHwzpP+7xV23RhQefUf4g+7QfoQm/LmlY2hDaENoQ2hFPgnxnAvDaEBTaEGWwBmdEZ2BA6dHhthPyZqWpN4KUyhNrytwY+x8NhSaZ93qruOW3C9oNlXYxsCG0IbQhtCKfAPzOAeW0IC2wIM9gCMqMzsCF06PDaCP7SXsAAAGm6SURBVPkzU9WawJEMYWGlctPA5+2H9vmwz70PA8OsomeRvJ0oP8zPLWtGsiG0IbQhtCGcAv/MAOa1ISywIcxgC8iMzsCG0KHDayPkz0xVawJHMoRx3izBMs3k+bAnA5vwsP+5DbPappyt39p/2G/qP8+f2w6WNTOpq2ku8PxJ+XcG9glXOD79tIB7F0+dEppLOL/OrFgRmea2z78yTeF+wSueBT4tYl/m9tsjg4s0I55Q/r5etUdzBevmzIMPRgbXTkacFm6LDP3DrcL69cKzzwpxowLjrbe5wh4/+aTQXBwqF8MePBiZiDcy+EUD/OHy5ZGBL926VcA1qkePCps2CfjNAlxcc4+oOEB8J5vO8luJP/+MDP3wIiXeElAEo/gGMBsokVsLUdgJgIoZxqz2S0iFedEZ+8VYtNYbrH1a3VpnxkWaGIvOdStSjWREkQogFUBnZMaaMbZ2+O1KCuqvGUDn+rcD9RcJ+0WrbnDCsqxOFZZldSwbQhtCG0Ibwv9pKnUbQhvCa8kQFn+7cOjQ4bjDsCyrY9kQ2hDaENoQ/k9TqdsQ2hDaEDp06PCyhGFZVseyIbQhtCG0IfyfplK3IbQhtCF06NDhZQnDsqyOZUNoQ2hDaEP4P02lbkNoQ2hD6NChw8sShmVZ3WrHDmHdOuGdd4QDB4Q9e4SIxzJ790Ym4kWBRuUTZa2yKYM1w5nAITz8sBDxagbXbEb8J9OMFduGQv2DD4RYLnz8sYBLR/PFUGe1Zk1k7r1XiNiqPKi8L9wRmWPHBCwj4oByWJFfB8D/w8TGpEJHdChz+HBk8MuC5ot0fwYenlewLhGWKPjGbtgQGVyj2vyiQVqbXzR8qog95hW7qFxRmqMmhrtAmYsSuTZXaMW8//yn8PXXAor+dq5MXfS3FiKDyzAxtgb7rc8Z86Jz3TqSqcMicTgYC9AZtCdf0CbPYM31FurMWORI7wjgv7nIjLeANSOVrnnCsqxOFZZldSsbQhtCG0Ibwikwrw1hpm61ISwyY5EjvSMwTkNY/O3CoUOH4w7DsqxuZUNoQ2hDaEM4Bea1IczUrTaERWYscqR3BGwIHTqco2FYltWtbAhtCG0IbQinwLw2hJm61YawyIxFjvSOgA2hQ4dzNAzLsrqVDaENoQ2hDeEUmNeGMFO32hAWmbHIkd4RsCF06HCOhmFZVre64QYh4gNFbhlt7or8LdNUzH8oG5U3hesjg/stY6kyX7lZgKeN+DMDr4WaAcUnOsN53nZbZF59VYh4PNOYDUmFRTZOTGwqDOHPP0dm2TJh82YBN7Ju3x6ZxofLrZuxOjIPPCBEHFceUUT33y/EMkXvIIWLW71aiPgyA9uCSpXfHNz2GU9leF+rWuuIp5WHlaOK/jZE76dlqQrLh1YUwWjFFxpmEscBR4RKHeV1PS9A4d52yGBV2ALAMrBm7AhgbJ0KrdgRVlXvCGAigMwYW/86AMvA2x/pNOpjRyuWMdI3BxvEWGRG53qR6Ix59TQmLMvqVFojUP9/Kfa2LOsiZEOYsSG0IbQhvJiyHtgQFmAigMwYa0OYqReJzphXT2Oi/NuFQ4cOxx1qjUDRAqrYu9Tk5CQfzUwXPdCyrg7ZEGZsCG0IbQgvpqwHNoQFmAggM8baEGbqRaIz5tXTqEtVhw4djjvUGoGiBVSxd6mL9nUXPdCyrg7ZEGZsCG0IbQgvpqwHNoQFmAggM8baEGbqRaIz5tXTqEtVhw4djjvUGoGiBVSx93DlyxqKh7kVHdBkWXNHNoQZG0IbQhvCiynrgQ1hASYCyIyxNoSZepHojHn1NOpS1aFDh+MOtUagaAFV7F1qoNkb+HnYB8uamzp0SIj4IoOfsLFCwJWVaI04oYh7xE2SjdWUWyjjlsicOCGcOSPATb32WmTidgEOMOL1TGMI/6v8O/Pcc5GBTzt4UMC9qRHvZWCBIvZnsH3cuhlnXX0m1invZ55+OjIRr2U++SQyEc8q/xJuk1tGjx8XYp6Ay13hS3Gr6jffCM19nnI4/E7GHkXOCr8NwXcS36t77hEWLBAifshgkahyt20TWPUC1PHIhaoXY1EEz6JinqYVq0KljrFwNfAtI9mY+qywwdrGoDNSzSYzqLeAzPXrhk3Ff84wEd5CDcYCLKNubZMXYAtoxURoxfcKnfG90s4TlmV1qihFC6hi71KtIRwYFh8sa27KhtCG0IbQhnBA4Y5561asyoawoN4CMtev24Ywg+8VOk9nCIu/XTh06HDcYZSiBVSxd6nWAUJoymH/s2XNQdkQ2hDaENoQDijcMW/dilXZEBbUW0Dm+nXbEGbwvUJnG0KHDq/gMErRAqrYuxR83TCb13/efrCsuSkbQhtCG0IbwgGFO+atW7EqG8KCegvIXL9uG8IMvlfobEPo0OEVHEYpWkAVezcq/tA37M+AxQfLmpuyIbQhtCG0IRxQuGPeuhWrsiEsqLeAzPXrtiHM4HuFzjaEDh1ewWGUogVUsXcjWL7WBOJhbu2H6GNZc0/iAW66KTIRJxXxLTffHJlVqwReDcprJ48KsDEc+0Kmud/yO0V2FHFQeUIRU7dzZ2R27RIinlFwON9nmktHn1eezODCUp5kfJ2BeW5cq7yjW26JTHNhqRwOKqg77hAee0zAW8CdnP3/dJ7/D+iPmeuui8wLLwhoxT2isIsR7wrz1HzqLzgOHIhM3COwVTNv3RqZt94SIh5U5Hrekycj89lnwjRmA1Uv6lq8M/gHGAb4FnTGRAAT1WAsJsIy6u3XmetForXODGOGNded0YoNorX2w+2mig1iGZh3pLH14Xz1lYDMmBeZ8SWs5623gLNCKlAfrG5wwrKsThWWZXUtsU82hDaEfWwIbQiHFdDTgLGYCMuot19nrheJ1joz7ATWXHdGKzaIVhvCYt56CzgrpAL1weoGJ8q/XTh06HDcYViW1bXEPtkQ2hD2sSG0IRxWQE8DxmIiLKPefp25XiRa68ywE1hz3Rmt2CBabQiLeest4KyQCtQHqxusS1WHDh2OOwzLsrqW2CcbQhvCPjaENoTDCuhpwFhMhGXU268z14tEa50ZdgJrrjujFRtEqw1hMW+9BZwVUoH6YHWDdanq0KHDcYdhWVbXEvtkQ2hD2MeG0IZwWAE9DRiLibCMevt15nqRaK0zw05gzXVntGKDaLUhLOatt4CzQipQH6xusC5VHTp0OO4wLMvqWHo16LJlwuHDAizB++8LS5cKMBuvvx4ZFO6NB/gsA5+GWuXJJwXcIwo3tWVLZCJOK59mMC+u91y3Toh4WjjrVTLxcQbXbP7jH8LKlULMV5bCLa9V3snMmxeZiB2Z55+PTMT2zE8/RSZin/KGcEdk4A9fekmAI1q7VojViu6osXx95z/Fu+9GJuKYIqY94q8MXnfcp+gbbC5o3ZuBxd27V8DNqHREAPV0XZqjvIarqYvvuqyHjcG8dR1fZwb45w1Q5deZ62UATIRWvBRkRiuWgaNDZ0yEznj79ViARbaHWYAt4IuEzPVEX5R3n+I7Wb/fevt15vJwJizL6lRhWVbHsiG0IbQhtCFsqV0N5i2rbbYiM8A/b1AbBqSqlwEwEVrxUpAZrViGDeHVYAiLv104dOhw3GFYltWxbAhtCG0IbQhbaleDectqm63IDPDPG9SGAanqZQBMhFa8FGRGK5ZhQ2hD6NChwzIMy7I6lg2hDaENoQ1hS+1qMG9ZbbMVmQH+eYPaMCBVvQyAidCKl4LMaMUybAhtCB06dFiGYVlWx7IhtCG0IbQhbKldDeYtq222IjPAP29QGwakqpcBMBFa8VKQGa1Yhg2hDaFDhw7LMCzL6lYffCBEHFH+m8HNiuDNN4XGP7ySwc9uXOAJXxq9q0fPs2aN0Mz7RGbDhshEfCTcHRmUPQ89JMQtSmxQTmWwyIgXM5s2RWbxYuH4ceHll4VmR0cVWdU330QGLu6HHyLz+OMCfh0Q8WoGnqe5vvVNQY8ORvS77wT8KgGX2e7ZI+DyT/g0XBz67bcCLP2vvwq4GRWGf/36yOAq1LgtBD06/LNi8Q27jFaUuWhFaf7110JdfMN7IBXGojSv63iMRWb8twBjAeatD6feQr1ItCJVnXk24CTh/9EZ28dJYpG1qRtpv/XrBrWnbZMXYF60Yvs4qzZbYsKyrE4Vpf5XKfaehc5dim5Z16RsCG0IbQhtCKewISxakarOPBtwkjaExbxoxfZxVm22xET5twuHDh2OO4xStIAq9p6FpjWE03awrKtVNoQ2hDaENoRT2BAWrUhVZ54NOEkbwmJetGL7OKs2W6IuVR06dDjuMErRAqrYexaa1u9N28GyrlbZENoQ2hDaEE5hQ1i0IlWdeTbgJG0Ii3nRiu3jrNpsibpUdejQ4bjDKEULqGLvUj1HN3lO/SdZuScetk+GPbSsq082hDaENoQ2hFPYEBatSFVnng04SRvCYl60Yvs4qzZboi5VHTp0OO4wStECqti71EA7N/Bzv08Ohz0fGFrW1aU/lZ+F806pB67ovOMOAe4C13tGbBW0Yl60SIjlippJ1tOa+cEHI4NrVL//Xjh2TMBFqc29qf/K3HVXZHbvFp54QtixQzh9WoDHg2/BpZQPPxwZvEFcs/nAA0LE8cxvv0XmnnuExhHdnzl0KDKxSvj9dyFivfKroGNxIS1uZEVmVH0oPo8cEXBWjbWWLz9uRo3YrBxSzmSeey4yEXuEs2ebQVmPihllLsCllG2HDOpgFO61u8BdkfWa4T1GWgaKfkw0SpXPVdUHi1ZMhFZMhFRYM3ZUbwGtIx1OPRFS1fPWp4F5kRnfSYzFd6POXO9opLFYpHaesCyrU/Xq0WGiBVSxd6nawg1zdMMMIVS3WtYVLhtCG0IbQhtClsgca0OYwURIhTXXrgap0DrS4dQTIVU9b30amBeZr05DWPztwqFDh+MOe/XoMNECqti7VO0Aczj158KktkP/SdvNsq5G2RDaENoQ2hCyROZYG8IMJkIqrLl2NUiF1pEOp54Iqep569PAvMhsQ+jQocMRw149Oky0gCr2LgXPNiwc9fnA0LKuLtkQ2hDaENoQskTmWBvCDCZCKqy5djVIhdaRDqeeCKnqeevTwLzIbEPo0KHDEcNePTpMtIAq9m6UfVpr4bLZG2j8hj1HmLtZ1tUoG0IbQhtCG0KWyBxrQ5jBREiFNdeuBqnQOtLh1BMhVT1vfRqYF5ltCB06dDhi2KtHh4kWUMXejWDbUsvfT7La573P7cP2SX5uWVedpMyFFXnlFQFlfVNPH1M2ZbZti0zESeWnzP79kaHVvFmJExkYs7hTuPdeIeI/mU8/jcyddwqbNwtvvy3AeXIZPJxTitgJ3A0ZcUD5LfPqq5FBuQVLj9tccZ9lxHuZp56KTNylxPuZ1asjc9ttwi23CPhVwu23CxFPKvJVwX5vvVV49llh5UoBjhfW+r77BFjrxlt+l9m5MzLNHbMvZO6+OzIsZPEKRyqva6OCsWitDQOAYQDw5XXhjnnRGa24dXOkLYzkLjAW54yJ8I7QWu8Ip1EvA1vAWBw7Dged61eG/WIsMiMV1ly3IjNaQe3xPv+8otzChGVZnWqqGrUsq1PZENoQ2hDaEE7npgCqfGBDmKl3hNOol2FDODZDWPztwqFDh+MOp6pRy7I6lQ2hDaENoQ3hdG4KoMoHNoSZekc4jXoZNoQ2hA4dzsVwqhq1LKtT2RDaENoQ2hBO56YAqnxgQ5ipd4TTqJdhQ2hD6NDhXAynqlHLsjqVDaENoQ2hDeF0bgqgygc2hJl6RziNehk2hDaEDh3OxXCqGrUsq0upjYFvwS2UEXsz8Hjz5wtwYpho61YBBQY8DxzRpk2RQR2Pyz+XLxcWLxZ436M6orguBL3d9PjxyOBaUbrlW4WDB4WIdZn7749MxEOZFSsiE/FAhi5OHWDjh8WI4jpT7OiRR4TG8X4h6NHhisqITzMnTkSGV85C+sqWLRNw5Sw8PGxbxPYMTGxzyeojihwsLx3F7yxuFN55R2At3tbBGVTqtdnAWEyEEhmFe+098C8WjgidsSpMhM71WLRig2jFIms7gVXhYAE6A8yLibBmjK03WK8ZY9GKLdRfBnzN6h2hFWPxjx87AkgF8Aaxo7ozNqhjJyzL6lT4OW9Z1mWXDaENoQ2hDWHrH+p6Gv9ibQgzmBcTYc0YW2+wXjPGohVbqL8M154hLP524dChw3GH+DlvWdZllw2hDaENoQ1h6x/qehr/Ym0IM5gXE2HNGFtvsF4zxqIVW6i/DDaEDh06vIwhfs5blnXZZUNoQ2hDaEPY+oe6nsa/WBvCDObFRFgzxtYbrNeMsWjFFuovgw2hQ4cOL2OIn/OWZV122RDaENoQ2hC2/qGup/Ev1oYwg3kxEdaMsfUG6zVjLFqxhfrLYEPo0KHDyxji57xlWZdbuM8T5mrBAiFuEdavF2AnDh+OTMQryu4M7nt88UUh4mHlKeU75YfMTz9FJuKPDGqV5lbVXzK8VjSOK2LMnnkmMjDAzS2juxRZJEwOnQlcq76jVauE668XJlUR/8488EBkfv9dwO8OuKp4S5GXgnlxB2nEG5nXX48MrVfsUX7O8AusrSggT54U4DzXrBFQEr+rV5I2TlsOFnefsiZG6pGKYLTWYCIsoyygOS9S1UYF1GaydjVY80itmAhbwAYBPE+dCvNibD0vWvEfLHSul4F5cbA4K4DOtZnEvG22InPboQAT1fNiIu08YVlWp+pVpMP0/5Zi71F0rvKxLMuG0IYwyYbQhvACqPIxFvMiFYpvpAI2hMW8aLUhzGCiel5MpJ0nyr9dOHTocNxhryIdJlpAFXuPonOVT6VpO1jWHJENoQ1hXzaENoQXQJWPsZgXqVB8IxWwISzmRasNYQYT1fNiIu1cl6oOHTocd9irSIeJFlDF3qPoXOVTadoOljVHZENoQ9iXDaEN4QVQ5WMs5kUqFN9IBWwIi3nRakOYwUT1vJhIO9elqkOHDscd9irSYaIFVLH3dEIFMvD5sCfDHlrWVS8bQhvC9J828S02hDaEF8BYzItUKL6RCtgQFvOi1YYwg4nqeTGRdq5LVYcOHY477FWkw0QLqGLvUr2qY+DnC51SOOz5wNCyrmpJ4Y4LHl97TXjrLQF+KeKE8rgC+4TO72Yw0fbtQixU1ijxpiL+AQYp4ntBL4c8ckS44QZh4UKh8QBvKyeFeyMzb54Q8WLm+ecj8913QsQm5VlF3PLSpZF59FHh7ruFWC28/LKA1ojnMqtXRyZuV+J55dPMp59GJuKjzNNPRyZihyJHh4IZ97Wiul6MG2jjT+Hsf/Yz8WgG3w1MBNPO3yxglXCAKHNR12IsvEedGRVz7TxHKa/ZGWBV9Y5AnQqt2AIWCYPUzpVBZzgieFoso36DAJmxDHTGNxiLhE/D2PqVoTOWgbFoRar6NGYzFots+2fQWc9qwrKsThWlaAFV7F1qho5umCGE6lbLurpkQ2hDaENoQ2hD2MyVQWcbwgxakao+jdmMxSLb/hl01rOaKP924dChw3GHUYoWUMXepQpD2PuDYV9th/6TtptlzQHZENoQ2hDaENoQNnNl0NmGMINWpKpPYzZjsci2fwad9azqUtWhQ4fjDqMULaCKvUvBwg0zftM+Hxha1lUtG0IbQhtCG0IbwmauDDrbEGbQilT1acxmLBbZ9s+gs55VXao6dOhw3GGUogVUsXejbNvyn/XweVif/nOEuZtlzQHZENoQ2hDaENoQNnNl0NmGMINWpKpPYzZjsci2fwad9azqUtWhQ4fjDqMULaCKvRu1pi6rfd773D5sn+TnlnWV61aFVf7PmRdeiMwPPwjwac31nlq4J991FhQ2ETuVnxRxj5s2RQZmA3dUbtggHD0q0LWerewzsU4R54kLWmOp0NzIKj48FocQ7yhTNikhLwVu+cwZYe9eYd06ASd5112RwTWbqFQjNijy2wHst7mEc18GTuz0aQGXncIP794tbNkibNwoRLyU4bfuTuGzz4SIo8Jk5Q8jPsjgcldMxDIXJTJAlY+xaEVNXI9F57oVjOQe0RmrArCpaEXmdmEZjEVrfZL4NmALeEe18cZYzAtgNevMWDPAWWHN7dQZrBmrQud6v1gGdlSvCp2RGfutW5UJy7I6VViW1bFsCG0Iz2NDaEN4gboVoPhGKzzAKJU6PQBakbldWAZj0VqfpA1hZi4awuJvFw4dOhx3GJZldSwbQhvC89gQ2hBeoG4FKL7RCg8wSqVOD4BWZG4XlsFYtNYnaUOYsSF06NDhJQ3DsqyOZUNoQ3geG0IbwgvUrQDFN1rhAUap1OkB0IrM7cIyGIvW+iRtCDM2hA4dOrykYViW1bFsCG0Iz2NDaEN4gboVoPhGKzzAKJU6PQBakbldWAZj0VqfpA1hxobQoUOHlzQMy7K6lngPlNewE3BTr74q/PmnwAs8aXK0gF4jN4W+/74QcTqDeW+6SYh5AjqjSMC8uFYUF6Xu2ROZffsEeLwdOyITsSXTmI3HlP9kjh+PDCxf3CY8/riAiVBf7dwpfPSRgKPjK4tvFNkgf7NwkxIbM/PnR+asQ8qcOhUZfCdxgWfEdkXWfP/9kVmyRMDdts32H8488khkIp7KNEZU/OE990SGBTScN4pXvEKU5vC4KK+RGanQGWCRuNAS/67qzEhVmzq0gjozwKrqNWMsJsJLqSfCsaPzSNvHMjAROmOR9SurqfcLnzbSmkcC8371lYCJAMZq5gnLsjpVWJbVtWwIbQhtCG0IG9tW19O1u6gzIxX8Q91amw2MBVhVvWaMxUS1QUIqG8JizSOBeS+pISz+duHQocNxh2FZVteyIbQhtCG0IWxsW11P1+6izoxU8A91a202MBZgVfWaMRYT1QYJqWwIizWPBOa1IXTocK6EYVlW17IhtCG0IbQhbGxbXU/X7qLOjFTwD3VrbTYwFmBV9ZoxFhPVBgmpbAiLNY8E5rUhdOhwroRhWVbXsiG0IbQhtCFsbFtdT9fuos6MVPAPdWttNjAWYFX1mjEWE9UGCalsCIs1jwTmtSF06HCuhGFZVrd64gkhbhdQ9eJCy4gDgt6duH+/8N57Ai6lbOyi3EIZ14egd0VG/Ev5SDkjaKonnxTQumKFwHlvkDtIX3xRwFWZsLhvvimcPClEvJ5ZvToy8KUwV9jCggUCj10vhsVlmDicxi0/k8H9pc8+K0QcU15QxAA318ZCb2TgluHxGhN7SBEPH/GlIt4Sl53y4lC15QsXCrt2CbxztS7c6yofFXNbyhfAPSIV5kVr3Rk2FfNiCwCdMRFaUfSPdDhohavBW4CdwAbRGZmxqvpg61SgToUd1Uc3in1iKmwQY+vt11uA5UNrPbZu1UVOWJbVqfhzXsXeKva2LOsiZENoQ2hDaENoQ0j7hLcAk2NDmMEGMbbefr2Fy2gIi79dOHTocNwhf86rJkqxt2VZFyEbQhtCG0IbQhtC2ie8BZgcG8IMNoix9fbrLdgQOnR4bYT8Oa+aKMXelmVdhGwIbQhtCG0IbQhpn/AWYHJsCDPYIMbW26+3YEPo0OG1EfLnvGqiFHuXmpyc7P3f3of+5344wz6WNddkQ2hDaENoQ2hDSPuEtwCTY0OYwQYxtt5+vQUbQocOr42QP+dVE6XYu9RA74fPbZ/c1H9uWXNK8C0oEeNeJX7NsPMqJfZnPv44MnCAr78emUWLBJT1t90WGdyNuXSpAMMQ8Z3ygbI101igXcrPGVggeACUebFEaC6l/Hfm7rsj8/33Aj1ePK7szdx8c2QijghqJnmP6MrI3HWXQB9+HS7/lNcdsUeR7xW+SP/4hxDxg7JbuV+Yp7fO6qrw5Q91+ERdegPuXH0vg2sm8RUdrXBHmYux+DeJehqVOqjnRT2NKh/LwCLx7ce8aMVYLKP2HugM2i1nMC+ozQYmgl2s19zOlcHhYBntHjPojHeE1jpznQqdsQV8J9HaLjuDsfiK4iTrLbRvPMEC07Ksy6soxd4q9i4FRzfQ4M2kj2XNNdkQ2hDaENoQTlHPi2rbhrBYpA1hBt9JtLbLzmDsOA1h8bcLhw4djjuMUhOl2LtU6+56fwDMz20IrWtRNoQ2hDaENoRT1POi2rYhLBZpQ5jBdxKt7bIzGGtD6NDhHA2j1EQp9i5VuLt+kw2hdS3KhtCG0IbQhnCKel5U2zaExSJtCDP4TqK1XXYGY20IHTqco2GUmijF3o1m+Ne/whAOa7KsuSMbQhtCG0IbwinqeVFt2xAWi7QhzOA7idZ22RmMtSF06HCOhlFqohR7Nxro+vKTbPl6T1L730/Qx7Lmmn79VYj4LfPJJ5GJ2JZZsyYyEW9nnnoqMqjyDx8WkAoeL2JLZu3ayNx7r0DLd9arJH75RXjoIeHAASHifeW/iuz35Zcjg8swIzZkGjd1OtNsX/xhrAhB3XLE08LyyBw7JkS8osi1sb//Hhm8slWrhFOnhG3bBJRqW7cK3II6z2+/FeJmAS/0lluE+fOFn38WYrWAXzTA1PGaXP1dybx5wo8/ChEfK2qPYRjqQhad67FoRR1fj8U7Qy1egzXDA2BeeB60YmxtJ7DmOhXGYs1ohcfDSSJzvQyAeQE611YTb6FeRr19dEYqdMb24eKQqn7doH5ldesoG2SBaVnW5VVYltWtbAhtCG0IbQgHjMU7a11fQW0YMG/tEDC29gBYc50KY7FmtNoQZtAZ2786DWHxtwuHDh2OOwzLsrqVDaENoQ2hDeGAsXhnresrqA0D5q0dAsbWHgBrrlNhLNaMVhvCDDpj+zaEDh06HDEMy7K6lQ2hDaENoQ3hgLF4Z63rK6gNA+atHQLG1h4Aa65TYSzWjFYbwgw6Y/s2hA4dOhwxDMuyupUNoQ2hDaEN4YCxeGet6yuoDQPmrR0CxtYeAGuuU2Es1oxWG8IMOmP7NoQOHTocMQzLsrrVAw8IEV9n7rwzMrFMePNNIeIRZX1m06bIwF1EbFZ+VI5mbrghChoX91zmnnsiE/MFXjupRjQWhhD7MrjOFF6aVgSXUuJ6TzWxOKt33xWeeUZYtkzAseN+y3feEeBLm9OQk1y4MDLYL11c7BBuCSFey2zeHBn44YMHI4N533pLiDiZOXo0MocOCREvKLsyqGNxGjh2eEvYVBhv1rWoXFGLYx2tGcugJoaNqVPV1TZWBXCtKsZiIuwXnVuTkKkz19RjsSqYnLpzvci6M14KOuOlYCxWhdeNd4TMWCTAWEwE6onqw8FYgLHYIJaBzOVZTViW1anCsqxuZUNoQ2hDaEM4IJUNYcaGMIOJQD1RfTgYCzD2khrC4m8XDh06HHcYlmV1KxtCG0IbQhvCAalsCDM2hBlMBOqJ6sPBWICxNoQOHc6VMCzL6lY2hDaENoQ2hANS2RBmbAgzmAjUE9WHg7EAY20IHTqcK2FYltWtbAhtCG0IbQgHpLIhzNgQZjARqCeqDwdjAcbaEDp0OFfCsCyrW8HUbdwooDhZt07YuVOAmcSP44gHM7zu8lYlDmZw6+Z99wmvvSZ8843QaHvmyJHINNd7yq2qf/4ZGVyG+eijQsRh5YgiBnjHjsg0fvjdDFxNxFPKGWFRCLojXFiKgirid0FTvfqqcParlGnMpLQys1rrxqaKqWustfzeAd9YZEZVj180/PBDZCZVPLrrQohTmfXrI4N/C7zat67ysSWUyHhndStK87oVqbBItGLNdSq04nRQ5WNejK2PDp0Bto9lYM2wuF99JWAZSIVVjbRmTIQ14wuNzCMd++efCyMtEq0AX+C6FavCMtAK6sx4g/o1m7Asq1OdK8+Ga7LEOq9ztcoADXtuWRdkQ2hDaENoQzigFamwSLRizXUqtOJ0bAgzNoQZtII683SGsPjbhUOHDscdnivPhquwM0XTeTU/za8aYeU9sVPSsNZhzy3rgmwIbQhtCG0IB7QiFRaJVqy5ToVWnI4NYcaGMINWUGe2IXTo8AoOz5Vnw9WzM5MN/aZSsENXozua4ZqHdRv23LIuyIbQhtCG0IZwQCtSYZFoxZrrVGjF6dgQZmwIM2gFdWYbQocOr+DwXHk2XH3vB/pNpWCHcqg/5S+ofpift33yh9y5HZsf4jnUtg4cmB/i+cA+/YeWZUNoQ2hD+Dc2hAJSYZFoxZrrVGjF6dgQZmwIM2gFdWYbQocOr+DwXHk2XD3nMtnQbyoF59MPz/9wH/C59yF/nknnHOY+CAf2QX8ITcPCYQmHPex/tqyA9Yr4RHlHeVZ5XHkvA8OAuzFhReJmYds2AXdjonCPWJfBz31cwhnxlnI6s29fZCL2KPdnVq+OTMSjwr2R+f13Ad7yxAkBhnD+/Mi8+KLw3nsCrhXlPbFLlXhRuCMyOHZsEL6U19Xeo8DwLxfwjtasEVasEPbuFSL+UNYqRxX5it58c2Tw24GffhJwbyquM921S4j4WPkzs3t3ZFhe/+//LdQ1cV30w1yhMyrmkfwhloGxKM3RGZnRGaBzvX2cFcbWrTU4K1C/o5HmxY7QinNG5/b0MhiLLdQHC9C5nghbwFiAs8Ii69OoN4gtaKoJy7I61VQ1WqhnWyYb+k2les6nr/w89RLXlJ8PfDis87TPi4cD+/RUNMUMJm0/DAyta1w2hDaENoQ2hDaEJTgrUL+jkebFjtCKc0bn9vQyGIst1AcL0LmeCFvAWICzwiLr06g3iC1oqonybxcOHTocdzhVjRbq2ZbJhn5TqWx78Blqm/KT/uccjvocDyH2OK+2aeBAdGufY1T/uWWFDaENoQ2hDeEUdR2PsVgGxsIhoDMyt9Ylg8719mvrVbfW4KxA/Y5Gmhc7QivOGZ3b08tgLLZQHyxA53oibAFjAc4Ki6xPo94gtqCp6lLVoUOH4w6nqtFCPdsy2dBvKgXb0w9nYoeGdb7o59M+HKg627STth8sq5UNoQ2hDaENoQ1hCc4K1O9opHmxI7TinNG5Pb0MxmIL9cECdK4nwhYwFuCssMj6NOoNYguaqi5VHTp0OO5wqhotVLiYoum8CpuUmwa6poGd8bn3oXg+rCk/zM9btdny54EJ8bl9mJ9bVtgQ2hDaENoQTlHX8RiLZWAsHAI6I3NrXTLoXG+/tl51aw3OCtTvaKR5sSO04pzRuT29DMZiC/XBAnSuJ8IWMBbgrLDI+jTqDWILmqouVR06dDjucKoaLTRZMp1a2wODBJuUnw98OOx573P/Ye7Te1KMxXOobc2j+q39h/2m/vP8ue1gWXH8uBDxfOb22yNztnuGt4yq2cDNmTfdJOCHNTI3d3K+nHn++cg8/rgQ8XYG15k++aQQ8Uvm4MHIRGxQditvZs6ciUzjTOQyzIgvM81bkFXlf73n/gHvEZaFoJdhwh/Omyc0d5CK4434dwYOMOIV5eEM/FLEpszbb0cm4jVhYQh6Mez+/ZFBmUeXvlLA9vn1vlH47TcBbxDLgKXnrz/0dcddIaAIBqi269IcFTMMIVrxj7AtqTMYC/BrmLbQz6AzNojtt8MzWAZS4RJO7Aip6v0iMw4WY+tjB/D/eL/14dSd0YrXjWXgNOrM7bc0U38Z0BlnhXnrs0JrvV8s45//zExYltWpwrKsbtVYERtCG0IbQhvCBowFtQcANoQZG8IM5q3PCq31frGMxhAWf7tw6NDhuMOwLKtbNVbEhtCG0IbQhrABY0HtAYANYcaGMIN567NCa71fLMOG0KHDKykMy7K6VWNFbAhtCG0IbQgbMBbUHgDYEGZsCDOYtz4rtNb7xTJsCB06vJLCsCyrWzVWxIbQhtCG0IawAWNB7QGADWHGhjCDeeuzQmu9XyzDhtChwyspDMuyOtYaZZWwZYvw5psCnUm8K9BswFztFFbIpaNPPCHAAeK+x4inFDGEuGbzgw+EiB8yuLETZR7uTb3hBiGWCK+8IjS3UD6Uue22yGBVEU8rYjW/+SYyEccy8C24SPPnn4XmYOUCz+bS0eeULzJ//BGZiG8zd98dmYhXM1gVv1fxr8zhw5H59FMhrlNisyJfwgULIoPbXDdsEDiReviHHooM3sKpUwKr7bomRivqaVS9dU2M0hwToTMWiaIf4F9OvQy0YoM1WDPAmtGKVOiMLdTeEmPRGa31wSJz7S3xBkeaqJ63TlW/hZEyoxWWD/Niv1hGPREy68FOWJbVqcKyrI61xobQhtCG0IbQhlA7YwvweGjFWHRGa32wyGxDmBmnISz+duHQocNxh2FZVsdaY0NoQ2hDaENoQ6idsQV4PLRiLDqjtT5YZLYhzNgQOnQ4R8OwLKtjrbEhtCG0IbQhtCHUztgCPB5aMRad0VofLDLbEGZsCB06nKNhWJbVsdbYENoQ2hDaENoQamdsAR4PrRiLzmitDxaZbQgzNoQOHc7RMCzL6lZwNb/8Ivz5p4C6NuJP5ZEM7re8/nphGjN51l9lYkdm1arIrF0r8MrKeE95IYMSYvFiAXbi1lsF3DKK+0vfeEPARLC4ET8ph5XvlY0ZzPvRR0LEY8pnmbvuigxaH3wwMhFPKuLxIv6jXDClZ1m0KDLPPivETUo8o7yhfJTZujUy8GnPPCM0l9nKlwEvFKYOl+hu3ixE7FIwkXj4bdsiQ0dU+5bZWAKMrattfGUBOiMzloHOI43FIutloBVHV59Gu8cMHC8yj2Rj0FqvCvPW1hpHV78FjMV+67eARQIcTp0KrVgGOiMz5q0XicyaasKyrE51riAdqsmYLGBvy7IuQjaEmcU2hDaENoQ98JUF6IzMWAY6jzQWi6yXgVYcXX0a7R4zNoTFIgEOp06FViwDnZEZ89aLRGZNNVH+7cKhQ4fjDs8VpENVuL6iqa9z//+6Locu20SWdellQ5hZbENoQ2hD2ANfWYDOyIxloPNIY7HIehloxdHVp9HuMWNDWCwS4HDqVGjFMtAZmTFvvUhk1lR1qerQocNxh+cK0qHqub6Bfxu0IbSsSyMbwsxiG0IbQhvCHvjKAnRGZiwDnUcai0XWy0Arjq4+jXaPGRvCYpEAh1OnQiuWgc7IjHnrRSKzpqpLVYcOHY47PFeQDtWlMoSTSTnMPbP6z9GUH6Kpp3ZU/4llXaGyIcwstiG0IbQh7IGvLEBnZMYy0HmksVhkvQy04ujq02j3mLEhLBYJcDh1KrRiGeiMzJi3XiQya6q6VHXo0OG4w3MF6VBdQkPYPsyfs3kb9XMv7H9GiCbLugKFyvV5RZwYLh1tvIfUxE8/HZmII5nmts9PlC2ZL/TSvltuEXAlacQ64bbInDghnD4txC1K/FcRZ4JbN3HdZcTXyjsZ1HW43zJAfKk8oeiVpAtD0O1HnMns3BkZXP6Ji1Lxy4KIlxV5Zc2FpY8q+FXCvzPLlkXmsceEO+4QMO9nn0UGhhCvu/klBSQ3waIWffttAeb5wAEB75dWE6nr0hytqPKRqi3WC+riG62YF4usqedFZnRGa1nlk/pGViyybsWq6rNCZ/zj//xzAamwQWSubSomqlvrYwdYVduh6IyJsKN6kXgL9ZehfmXaOmFZVqfij1/V5TSE/YezeT4wtKwrXDaENoQ2hDaEjTFDKrRiXiyypp4XmdEZrTgNrBnYEBat9bEDrKrtUHTGRNhRvUi8hfrLUL8ybZ0o/3bh0KHDcYf88au6Sg1h70lPeG5ZV6BsCG0IbQhtCBtjhlRoxbxYZE09LzKjM1pxGlgzsCEsWutjB1hV26HojImwo3qReAv1l6F+Zdpal6oOHTocd8gfv6qr1xD2VTRZ1hUiG0IbQhtCG8LGmCEVWjEvFllTz4vM6IxWnAbWDGwIi9b62AFW1XYoOmMi7KheJN5C/WWoX5m21qWqQ4cOxx3yx6+qcH1FU18D/dvAz5PnNNLn3odpQzRZ1hUoG0IbQhtCG8LGmCEVWjEvFllTz4vM6IxWnAbWDGwIi9b62AFW1XYoOmMi7KheJN5C/WWoX5m21qWqQ4cOxx3yx6+q/dsg/k5Ya6B/G/i5Z/b66ndAU36YulzoUzyxrCtUzc2Z4j3+8Y/IzJ8vPPywEPGjcGdkXntNOHNGwGWnqKebazafVXZm4B5Rix88KGBHEXuVk8LKEOK0cNacJF58UYglAowKbs6M+Cbz1FORifsUNe2NA+x77B6vKWImYXFhnhcuFHbsEI4cESIOZD75JDIR24R7IrN+vRDxnLI9s2JFZK67Toj5wrFjAizf7t2Rwf2l/L2DvlB+GZaFoG8Bv9FgTVxX6ujc1t8ZlNdlTcx50YpqG/dqIjMWic6YCIvEvMhcnwZa61XBH9ZnhVY4MRxODTaIVaG1PhxkRqo6MzaIl4KxI51kPS/WXGfGC60nqt8g5tVUE5ZldaqpevQKkJ2bde3KhtCG0IbQhnAKzFvX8TaENoR9ap9Wr7nOjBdaT1S/QcyrqSbKv104dOhw3OFUPXoFyIbQunZlQ2hDaENoQzgF5q3reBtCG8I+tU+r11xnxgutJ6rfIObVVHWp6tChw3GHU/XoFSAbQuvalQ2hDaENoQ3hFJi3ruNtCG0I+9Q+rV5znRkvtJ6ofoOYV1PVpapDhw7HHU7Vo5ZldSgbQhtCG0Ibwikwb13H2xDaEPapfVq95jozXmg9Uf0GMa+mqktVhw4djjucqkcty+pQq1cLES9lcFPoffcJuFkRrREPZNC5uaH0GeVrYXLqkqk+ixcLu3YJ2AJsTGMmMe8LyuEMNnjnnULEocw990QGF2nyLlC9vzTOOvME5m2uM71fWB4C7/N8JfPhh5G5Xm/dbFzrWxlcs4nbPiM+yDz+eGSQCoUcvipHjwqwmhGbld8U+QXH3r2R6V//1ROuM434LoNfYSDV/v0Cfndw6JAQsUFAxYzjQBGMuhZjQV0xo3Ndqddj0VovEm4K4Dc6dVmPznCetbvAqkBtRbDfujO2ANqpMzgczNtmmzlIhaOrvwwA20dmpEIr3lF95yrmxZpHmldbJyzL6lRhWVa3siG0IbQhtCGcAplRfNdj0VovsjWBNoTDsCHMYF6seaR5tXWi/NuFQ4cOxx2GZVndyobQhtCG0IZwCmRG8V2PRWu9yNYE2hAOw4Ywg3mx5pHm1da6VHXo0OG4w7Asq1vZENoQ2hDaEE6BzCi+67ForRfZmkAbwmHYEGYwL9Y80rzaWpeqDh06HHcYlmV1KxtCG0IbQhvCKZAZxXc9Fq31IlsTaEM4DBvCDObFmkeaV1vrUtWhQ4fjDsOyrG71669CxJvCLSHE7sxbb0Vmzx4B1z82/mF9Zs2ayGzZIjzyiMALPGkJvlDE8q1cGZnPPhNQ5fPSUb0MM+JfmeXLI4NrJ1Gc3HSTgB3hes+dO4Xmle3K4OgiTihHMuvWRQbXbDY30G4U1oQQ72U+/jgysUi5Xom/hLsj8/LLAqwm31E8kYEtx9cs7lX4fpF5nXJK2SfoP5x58wTeuYqaGN+VGhTQ9QWecBfwHhiLzqjF0YotIDMKd/gl2AlsEBOhMyaqbVtpCTgRdoRWjMXRoRVHh8xYVd1ad67nxVh4aZwkqLeAViwDLwVjR5oImTEWrfUideyEZVmdKkpl69jC3pZlXYQad2FDaENoQ2hDaEOoO0IrxtoQZrCMq8QQ5vrSoUOHlzmMUkWHoqmn3v8CqA3zw/zcsq5RNe7ChtCG0IbQhtCGUHeEVoy1IcxgGTaEDh06nC6MUr0OuX9/1LRjQ71f/7MNoWWJGndhQ2hDaENoQ2hDqDtCK8baEGawDBtChw4dThdGqV6H3L8/atqxPbV/FRz42Z7QunbVuAsbQhtCG0IbQhtC3RFaMdaGMINl2BA6dOhwujBK9Trk/v1R047tyYbQsqYRrAjKHl4duSwyH3wgRPwk3BeZbduETZsEWL6Ix5RHhfkhxMHMzz9HhrpDuU64+24B1042zuRHRRzCqlWR+esv4a67hH37BPiWJUuE++8X4MQefTQyEd9kUBPi0tGHHooM7PFvvwkwwGvXCvzNgl4rinPm1yxeVHCtqH431MUdPCjgvlbcyIpjp09bovS8a5/lwlNPCfPnCzj2kycFVq74R4jCvS6+USIjVV0iIxWsZllPsxUTYf8Yi86grvIBjBlWVbfCtWKRMKL1jjAROiNVnRmpMFF9OEiF/SJVPRad68z19rHmr74SkAqrwjJq6h2pTZ2wLKtTpSptgGZvCKMxezaEliWyIbQhtCG0IRyQyoYwU9s2dK4dUWsCi8xIhYnqw0Eq7Bep6rHoXGeut481XzGGMFeZDh06vMxhqtIGqNch9++PmnZsT8VfCAujaFnXkGwIbQhtCG0IB6SyIczUtg2da0fUmsAiM1JhovpwkAr7Rap6LDrXmevtY802hA4dOpzO1PU65P79UdOO7ak2hFC/j2VdQ7IhtCG0IbQhHJDKhjBT2zZ0rh1RawKLzEiFierDQSrsF6nqsehcZ663jzXbEDp06HA6U1d0KJr6yh6v/7n9MDC0rGtFNoQ2hDaENoQDUtkQZmrbhs61I2pNYJEZqTBRfThIhf0iVT0WnevM9faxZhtChw4dTmfqcs8W9la1Bq/3JP9faOBDy5rjWrZMiPg6s3RpZCL+yKBShRVBTXzkiPDttwLu5Iz4T2bBgsg8/7zQXDv5rbIz0zjehzLNvZritT79NDK4DBNmAzdYNuZZLW78nnnnncjAtMPk/PKLAOO9f79wxx0C7PHx40LEs8pJZUdm0aLI4OpXbJ9Xzqq5itifQV0X8ZlwewjxWgbWGjfQbt8eGZxkxNHMH39EBg4w4tPM0aORiTimfCRobUqHgPK6dghwNSiC0RnFd01bcGfqoh+p8EYBxiJznapeBs4ZW0ArJkJmvCN0xryYCE4bqdqzzbTHlUFnLAMT/Z//IyAVdgRwVvWxt8MLRloGOtdGFGiqCcuyOlVYltWtbAhtCG0IbQinB2MBJqotAd4owNiyjufYehk4Z2wBrZgImfGO0BnzYiIbwoKRloHOszOE+Q8ODh06vMxhWJbVrWwIbQhtCG0IpwdjASaqLQHeKMDYso7n2HoZOGdsAa2YCJnxjtAZ82IiG8KCkZaBzjaEDh1etWFYltWtbAhtCG0IbQinB2MBJqotAd4owNiyjufYehk4Z2wBrZgImfGO0BnzYiIbwoKRloHONoQOHV61YViW1a1sCG0IbQhtCKcHYwEmqi0B3ijA2LKO59h6GThnbAGtmAiZ8Y7QGfNiIhvCgpGWgc42hA4dXrVhWJbVtcQBRjyvfCPAQiwQcEclrCYuluSNjrE+8+CDkUGBEfG6sjFz4EBkGqupO1ocArd/RnlfuDkytG166WjEM8KKENROPPlkZCKeE84688TXXwsffijEaiXeUMTxYr8rV0YmYnsGhh9v8JtvIhPxvaKOSN8gLv9E1ffmm8L11wtwrWiFW4bzPHYsMnGXEn9lDh+ODL78EW8r2O8hAWXuSGaj9oc4O2RGKzKjFWCistqW3xu1YCwW2XrgDCaqzwrU9gm2DYvE2HbqAkyEg0Xn9uQz9bHPZl50xn5n80XC7+TqF1ovsp4XvxwpU01YltWpwrKsrmVDaENoQ2hD2NTTaAWYqHYmrQm0IeyDg0Xn9uQz9bHPZl50xn5n80W6Ug1h8bcLhw4djjsMy7K6lg2hDaENoQ1hU0+jFWCi2pm0JtCGsA8OFp3bk8/Uxz6bedEZ+53NF8mG0KFDh00YlmV1LRtCG0IbQhvCpp5GK8BEtTNpTaANYR8cLDq3J5+pj30286Iz9jubL5INoUOHDpswLMvqWjaENoQ2hDaETT2NVoCJamfSmkAbwj44WHRuTz5TH/ts5kVn7Hc2XyQbQocOHTZhWJbVrVDWr1gh4LrLuFN45BEhblK0ykfmiB+VdzK7d0fm9Glh+XJh1y6h8R7iEDAR7opcvVqg81wVgpq6JUuEG24QIo4rL2Vg6nDZ6WefCbFMePhh4c8/BUwUcSJz5kxkIv6lvJnZuDEyWMbLLwsRb2VQBJ48KWALjW17WvlN2Ze57rrIROzN8CT10tE33ohM0/mwsk15WHlEkdPgLylQ1qOQRS1eewC0ogiux6KerjtjVZgIhqGmXiQmwjLqq0GRGeCcMS8WicPBF7qeF60AmeuJsF+0wsRig7Be2C/ARO3pZbDmdo/FftGKZaAVXwbc+4zMeINIpVuYsCyrU/Uq0mH6X8f+VwF7W5Z1EbIhtCG0IbQhnAL1dN0Zq8JEresrqBeJibAMG8KMDWEGbxCpdAsT5d8uHDp0OO6wV5EOU+H6iqa+JlUDH/ak4/7uxkfnH3LwkMwY2D4f1qd9iCc5tKzZyobQhtCG0IZwCtTTdWesChO1rq+gXiQmwjJsCDM2hBm8QaTSLdSlqkOHDscd9irSYeq5voF/G5yhIZx5CA1s7T0c2BTN8344k+fF52HDLevSyIbQhtCG0IZwCtTTdWesChO1rq+gXiQmwjJsCDM2hBm8QaTSLdSlqkOHDscd9irSYerQEEbTYaCRy7ro/m0HNOUObWfLmpVsCG0IbQhtCKdAPV13xqowUev6CupFYiIsw4YwY0OYwRtEKt1CXao6dOhw3GGvIh0mG0IbQmvs2rpViHhRuCcEOCJ1gJs3C3G7Ev/ONBdpbsrAqNx8sxDxqvKT8mjmjz8ic9ddQsSRDIzKb78JcZ9w5IgAAwx3sWGDgPstI7Yof2RggHH5J489HswcOhSZiO+Ul5WdwvUhLFLiAUEPB156UoU7SG+8UeAvGuIXBffiPqG8oaxTPs7gOlNkfvTRyETcn1m1KjIw3nv2RCbiB+HWEFBeo+qtQRGMehqZ6+IbqTAROqPans28aMW8SIVFwvPUa64nwo5q64XOuDcV1gtrxo6wjHqR9QWtmAipZtOKiQB2hJcCcJIjnUa9KozFO2qHJyYsy+pUUWr2hjCrbcUTCB36IdIOe35hpDblh/jQV9vUfrCsSyMbQhtCG0IbwimQChOhM6rt2cyLVsyLVFgkzEa95noi7MiGMIOJAHbUmsDMlWoIi79dOHTocNxhlJq9IRz4ediTVv0+daqeZtInBuVsOw9s6n1uO1vWrGRDaENoQ2hDOAVSYSJ0RrU9m3nRinmRCouE2ajXXE+EHdkQZjARwI5aE5ixIXTo0GETRqlLaAinDQeq3yd3HjZwhvnbnG3PgU29z21ny5qVbAhtCG0IbQinQCpMhM6otmczL1oxL1JhkTAb9ZrribAjG8IMJgLYUWsCMzaEDh06bMIoVbi+oqkveKc6HKZe9YInOexrWLeZPJ/J5144bHbLukjZENoQ2hDaEE6BVJgInVFtz2ZetGJepMIiYTbqNdcTYUc2hBlMBLCj1gRmbAgdOnTYhFGq/dsg/k5Yq/VO+UnbOlC96qV9ktV/nrvlJ23n3NoP0aH3ECGeWNasdZfw0ktC3CDgnsm1awWYOhgzVuq3hKBm44UXBF52ihs74VoXKrEng8s///EPYccO4bvvhIhDiti2iIOZp5+OzIMPChEvKJ8qX2Zefz0yEc8Jd0Rm8WKBZ8U7V3FV5rHMu+9GZssW4YcfBFzCiYtScQcpylpcZ0oXtzwEvXQUv9HYtEmI+ERYJb/RuOceobndVKw1doT7Wk+ciAy+SH/9JcQSBbU4Clm4i6aWrcDYOlVdXgPU8RiLiWCusEGkArg5s/YtaEUqtGLNaMUiMRF2hP0iFcYCTIRzRub/294ZgFpdbWl8IRIiEREiIhERIhIRIRER8ggRkYgQkRARcUJEnAgRiZCIvM5DQkKkcRonoiciEiISIRHRiE8e70UzOSKPCImIkEeIRESESDTejp3W+u1zvut5dvrn7fv4MbjO/u+1197/k67v3sce/RaAfhhFaserTwMLAW3aNe1xZfQbxCgy19OYsCyrU022o5ZldSkbQhtCG0Ibwr817XXbnQ/vpzkXC9kQCrAQzhmZ9VsA+mEU+bs3hOJ3Fw4dOhx3ONmOWpbVpWwIbQhtCG0I/9a01213Pryf5lwsZEMowEI4Z2TWbwHoh1GkDeHwVtWhQ4fjDifb0d+A+v9zzb74hGVNW9kQ2hDaENoQ/q1pr9vufHg/zblYyIZQgIVwzsis3wLQD6NIG8LhrapDhw7HHU62o5ZldSkbQhtCG0Ibwr817XXbnQ/vpzkXC9kQCrAQzhmZ9VsA+mEUaUM4vFV16NDhuMPJdtSyrC41o1KvjkTHvHlz4d57C7GwUvvpl1+ODC7h3LGj0FzgeT6DqiLWZWCfVq0qzJhRwNWgc+dG5umnC7iwFPbp1KnIrF9fmD278OmnBQhGtDEqn2ROnowM3mDzP34o+92/PzIRazILF0YmHirMn1/AaNxZmVWAX6I/7Dn5n8BJ4j7PiBWVYxncyAr/H3+oxObK6xn44eba2HOZf/wjMrg1N+KLAjpXNO6wBLoXx6iei3PHungYo6gZqVAVysBc9PG6ZmSG2UBm2BgspDNjv5iLzHCtKAMLYYPwlnhY7wjHjlF9ONgv5mL7qFl/GfQWsC5GcRp6IWwQW8Ark0xYltWpfm6ALMvqRjaENoQ2hDaEp20Ia2bsF3OR2YZQ7Fevi9HuDKH43YVDhw7HHf7cAFmW1Y1sCG0IbQhtCE/bENbM2C/mIrMNodivXhejNoQOHf4uw58bIMuyupENoQ2hDaEN4WkbwpoZ+8VcZLYhFPvV62LUhtChw99l+HMDZFlWN7IhtCG0IbQhPG1DWDNjv5iLzDaEYr96XYzaEDp0+LsMf26ALMvqSJ8Vbqk3i1ZTF7E0c/hwZOLewpw5BdxCCf9w112FpowidNsR2zO4oTTicKap6nhm1qzI4EJLWK8jRwoRZzK4/TJuLdCn3VOvnazGDDejXrlS+O67QjxaQM3vvVeA0167NjIR+zKwQLj69fz5Agx/s265kRVdH+zTbbcVzp4twGk/+2wB37rmZtQTlb2VA5VLGVQVsTWzZk1kYBdjSRSw/48+KqC9xsNAP4w+GKPaielOHV0+5qKPRxmYO1LNGMW6cAgoA+uOZMxQBq7ohE/DXJ0ZoEigDwfb12eFuRhtl85g7kipUFV7AhmduV06I1NNWJbVqULqT6f/JODTlmX9U7IhtCG0IbQhtCG0IUxgtF06g7kjpUJV7QlkdOZ26YxMNSF/d+HQocNxhyElXJ8Y6osd16APe6rzrmng5/iwnT7wk/YPWQM/7H+OofaTvvrPW9ZIsiG0IbQhtCG0IbQhTGC0XTqDuSOlQlXtCWR05nbpjEylW1WHDh2OOwypnuvr/0qwT39ICx5Jh62u9Wm/xCfD/pA18MNoPtehZf0T+skK2hDaENoQ2hDaENoQftB8kdqlM5g7UipU1Z5ARmdul87IVLpVdejQ4bjDkPqNG8L+n9sP208G/iFr4Icx/POe9KhlXY9+9IE2hDaENoQ2hDaENoQ9MNouncHckVKhqvYEMjpzu3RGptKtqkOHDscdhlTnhrD/f9uwHcp/bj8Z+IesgR/G8M970qOWdT16oXIs0zTQVyqnC3PL5ZBPPFFYtKiwbl3h3XcLEX+prMw0107+I3PuXGQah7A7wwtLqzG79dbC1q0FOLHlywtP1UspkeqNNwoRmzLbt0cm7qjExsyKFZHBBiOOFh6OzNtvF778shCzK9XwR7xZOVUpV7DC/7/2WgGXf+IK1sZ4f1B5J3PpUmTgaffsiUxzmW35IuGVbdlSgMXdtKnw1luFiLUF+H/0tQCNrDY5ur1Gi4zWHI4Io0g1Ui+uH263nNFl4DSQWV+zqU8Sc5EZDhBF6i3oUSyEURSJh2HpscH2bDPIjHWB3gLKwFlhLkb1BvXoSFXVVBOWZXWqXj86TDduCLPaUXwC9R7oP4awHRr24cA/ZA38sP85hvof9ofwiWWNKhtCG0IbQhtCG8I6akMo0Fu4OQ2h+N2FQ4cOxx32+tFhunFDOPDPwz6B+g9kJ9b+QXze+3M7NHDpgR+2GrauZf3TsiG0IbQhtCG0IayjNoQCvQUbQocOHY4Y9vrRYfoFDeGUYavs31ov1/swCw/0/9wO5Wf6GvhhKzx2nbMsS8iG0IbQhtCG0IawjtoQCvQWbAgdOnQ4YtjrR4dJuD4x1Jf2TlNaqYEPDDN14vN2SGeG2oQitKx/QjaENoQ2hDaENoR11IZQoLdgQ+jQocMRw14/Okzt7wbxe0Kt1izlT9pRaOADvQ+vf2jSDjY+cNh0aOBQmnFtCJ9Y1oiaV8A/ms8/X2juTtyVQceM+y0jzhbmRAYe4Nixwo4dhYjvK8UuHsbdp3Eys21bZPbvL2C/t9xSwF2RTdO/pvBIFGAJcKHlgijUmiMey8ycGZnG1XyYwRbgWyJeLyyMzCuvFOLRSqzK4CRXrSrgrteI5Rm0efPmFXBlY8RfM7hldPfuAl738eMFuEf8kCLiYGbfvsjA/+O+1rj6N3OCP3eoo1M0snoUaBuDg4Z7xEIY1W09Hsa6KHIko3LmTAFz9ULYLx5GKszVO8JcXSTQVeGv4PZAMkilt48dIRWK1NvXIFX7QAZF6g0CfCfxFnAaONjKhGVZnSosy+pYNoQ2hDaENoStQ8CoDaGYq4sEuir8FdweSAap9PaxI6RCkXr7GqRqH8igSL1B8IsaQvG7C4cOHY47DMuyOpYNoQ2hDaENYesQMGpDKObqIoGuCn8FtweSQSq9fewIqVCk3r4GqdoHMihSbxDYEDp0OF3C+G0o/28ye+ITljVtZUNoQ2hDaEPYOgSM2hCKubpIoKvCX8HtgWSQSm8fO0IqFKm3r0Gq9oEMitQbBDaEDh1OlzAsy+pYNoQ2hDaENoStQ8CoDaGYq4sEuir8FdweSAap9PaxI6RCkXr7GqRqH8igSL1BYEPo0OF0CcOyrG7VeLxtldL0oxeP+VGIryurK99lcN8jLjtdsiQyuEly7drIwBF98UUh4rXM4sWRifhj5UwGN4UeOlTYvLlw8GAB/gGOd+HCQsSlDC7/jHivUlwcTE7MLNC1PlpYsKDw9dcF+CU47b17CwcOFCJ2ZHD1a8TjGbzBjRsLze2m9ScL8UoGbhle+quvIsOFYnsGP5XA0X3/fSFiXQZn9eabBTptdK66J/7znwu6cUfmkRZC04wuH724vqEUC400inVRFQxw6xkyyAz/gC3gYJFK7xc1g9YUiVeGw0FV+ujwjvRcoA8WNY+0QYB1cbDtS7x+sF+sW89qwrKsThWWZXUrG0IbQhtCG8IBC9kQZpBK7xc1g9YUiVeGw0FV+uhsCDNYt57VhPzdhUOHDscdhmVZ3cqG0IbQhtCGcMBCNoQZpNL7Rc2gNUXileFwUJU+OhvCDNatZ6VbVYcOHY47DMuyupUNoQ2hDaEN4YCFbAgzSKX3i5pBa4rEK8PhoCp9dDaEGaxbz0q3qg4dOhx3GJZldSsbQhtCG0IbwgEL2RBmkErvFzWD1hSJV4bDQVX66GwIM1i3npVuVR06dDjuMCzL6laPPlqA50E/HfF05avK6cKCenPmnMIDDxRw2SmcJ67KbLzHxcqKDLqCuK9S7WLcExncyfniiwXcqopRbHDp0gKaE3QyR44U3n238OSThW++KXz8cSHi2QycNpzYlSsFOM+IpZlFiyKDLWC/EVsr5X7amBuZ1asLEc8VcEVnHK2sLyyKDM1zvTYWX8L58wsRLxVqzadOFSKuZO6+OzKffVbg2aEXB2igW7+RgUOAm8J/G/AP2hCiDNlt82GMAqRCkTozThJzAR7Wc3E4umZdJEZxsHjdOhVAKtSsN6i3oEeBPmfUjMx4GKOYi4f1QvJgJyzL6lS9jnSY8M8+uwDLsm5cNoQ2hDaENoST2BCKuTaEYhToc0bNyIyHMYq5eFgvJA92Qv7uwqFDh+MOex3pMAnXJ4b64v+z+an+381P+YDQSAvFdaw15QOW9cvIhtCG0IbQhnASG0Ix14ZQjAJ9zqgZmfEwRjEXD+uF5MHqVtWhQ4fjDnsd6TD1LBH+8e9/OKVG9VSjPp+FuTeSqqcbz2BZ1yUbQhtCG0IbwklsCMVcG0IxCvQ5o2ZkxsMYxVw8rBeSB6tbVYcOHY477HWkw9T3fvz3/6f/qzXMU/U+x2/z+mH+pH0sD4lPctjPgA/zH/BAP+x/Ylnjkg2hDaENoQ3hJDaEYq4NoRgF+pxRMzLjYYxiLh7WC8mD1a2qQ4cOxx32OtJh6pkh/OPf/3BKDXNTMFrZhvU/7IViKIftJ3nisD+3H+Lz/oeWNVbVBrq2yLfdFpne97WviEOZ++8PQcSeDG4KXbasEHEqA2OG9nr27ML69YXbby9EHMhcuBCZZ54pRKzMwD7FzEJzOOXO1cuXIzOTl2EerLyQgeWL2JzZuTMyu3YVsIWYEYU4WSkP4x2tW1eI2Fj5NPPGG5FZubKA71XEhxlcwrlqVSHieAbfHPTA+OkAju7ixcjgzlV8vSP+t3BnFOJE4eoXPhNfVlYX0MiinwbwaQANNOaiRdbgKDGqF4JDaJt1AS7/bAvLYC6qArjBUu9I01aS0a8MhwOjAlMHkFlbPix0+nRB7wgLgfZAMngY28dCKFKP6prbSkRVde6EZVmdKqR6luiHhv6QFtqzHzu0a5/jMf05Qnze/zArf56eGpBkygcsa9yyIbQh7GNDaEP4EzaEgraSjH5lOBwbwowe1TW3lYiq6twJ+bsLhw4djjsMqZ4l+qGhP6T1Y0s2QPi8Hw77HOHAtAM/jObzNsmUD1jWuGVDaEPYx4bQhvAnbAgFbSUZ/cpwODaEGT2qa24rEVXVubpVdejQ4bjDkOpZoh8a+kNaP7ZkA4TP++Gwz/FJ+/mwD6P5vF1rygcsa9yyIbQh7GNDaEP4EzaEgraSjH5lOBwbwowe1TW3lYiq6lzdqjp06HDcYUgJSySG+vqxJRsgfN4Ph32eP2k/7El8nvO3aw1bdFhCy/rFZUNoQ9jHhtCG8CdsCAVtJRn9ynA4NoQZPaprbisRVdW5ulV16NDhuMOQ+kEypdCe/dihXfscj/X/IB4TH8bwz6OWkT/EH9rPMcWyxqP8X9Xk921XpXSu+/ZFhpclxhMVmJxvKsUfRpwp1CscFy4swGouXlyI+Kzy98yzz0am/1/aT/+9bag8nnn55cicOFF47bXCyZMFHB0tQTxZwUluK1y1tYk9ewobNxYijmXmzInM+fMF3FCKLURczqxYEZnlyxXff1+IeC+DC0vxUwncbnrwYGTQA7/4YmHr1kLcUpg3rxDxj0pxnvCW+/dHpnl4U6VcZvvSS5FhXwvadjyj++m2LRZo74FRvRBMDlJhrrYx8Dy6DAAHiIXwsN6CflhbPg0OB0VivzB1qAoPo0gNqtJl6JqRSheJVDh2ZMYLxVwshJeCdWuqCcuyOlXcbLJDs6adbAhtCG0IbQg/sCGUW9AP2xBmkEoXiVTdGULxuwuHDh2OO4ybSnaD1nSUDaENoQ2hDeEHNoRyC/phG8IMUukikcqG0KHD32UYN4l+6hUta/rJhjDJhtCG0IZwcKeOUb2QDeH1g8NBkdivDaENoUOH0zEMy7I6lg2hDaENoQ3hBzaEcgv6YRvCDFLpIpHKhtChw99lGJZldaslSwoRX1V+tGc/cz6DuyK//rrw3XeFiLcyzdWRZRRXVkZ8XDmdwbWi8+cXcDnktm2ReeqpwurVhYjXM7gpFN4y4tsKrPU7GdR85Ehhw4ZC3FV4880Cb7C8uuXE7t2Fv/+9gJtCH3ggMl98UYjYknn++cjgCtbXXy8cP16IuJJZujQyR48WIr6vPFV5OfPgg5F56KECfjqwZk1k3nmnELMqiwt33FGIeLryYWVz5t57IzNFX6sbd4BUei7aa4xiLlpzgIcBTB1G0aljFAvhcID2SzAbWFeP4nD0qHY1OhXm4jSwI8zFKBwRRvUb1MeOUXyRkArfSWxQv7IbAdtHGfXoJizL6lST/ahlWR3KhtCG0IbQhtCGcIpRHI4eRSpsQafCXJwGdoS5GLUhHMUQit9dOHTocNzhZD9qWVaHsiG0IbQhtCG0IZxiFIejR5EKW9CpMBengR1hLkZtCG0IHTq8ScLJftSyrA5lQ2hDaENoQ2hDOMUoDkePIhW2oFNhLk4DO8JcjNoQ2hA6dHiThJP9qGVZHcqG0IbQhtCG0IZwilEcjh5FKmxBp8JcnAZ2hLkYtSG0IXTo8CYJJ/tRy7I61Iv1VkZYoIijmcaKPJM5diwy8B5nzxZefbUQMwsrVxYijhSuGtdM7Mi89VZkYlFhy5YCLEFjCPdUyu2XmzZFBrdfYhR3VJ47Fxnc9YoeKWJ7Zu7cyODSUZj2iFWZXbsiE3EhA0uPY4ddjNiXwYWluBr0woXINPbpVAYuDu3l228XTp0qNN+Nwxkc3YwZhYi1lZ9/6HAVXkh79fkMvqL1OlMcDn8aAoeADaPpx8OgbYszyKzX1e01Rm+krccGUQb6eMzV20cq2Bisi1Fk1hYIReJhDYrEOWvTrk9Db0Efjh796KMCioTl0+eMLQD99gFqRlUYrYczYVlWpwrLsrqVDaENoQ2hDeGAdTHXhjADs2FDmLk5DaH43YVDhw7HHYZlWd3KhtCG0IbQhnDAuphrQ5iB2bAhzNgQOnTocMQwLMvqVjaENoQ2hDaEA9bFXBvCDMyGDWHGhtChQ4cjhmFZVreyIbQhtCG0IRywLubaEGZgNmwIMzaEDh06HDEMy7K6lmpk4fGaaydLH//cc5GBu3j88cLJkwVaIJqcv2YOHYrMV18V9u4toHH/+ONCxKZK8ZYRhyq7Ki9knn46MhHrKlsz+/ZFJu4oNKkOVlBG8TyNl75UWFyuymwcfvGHuOv1jTcigwtpX3ghMnfeWcD36uLFQtxfeO+9wrvvFiJOVo5lnnkmMrzPsy60dm0h7i08/HAh4tlKudx12bLIRByorCksiELb2oo2F6PaiugWWXfbsBNIBc6cKegtwPNo36JTYS4ehjPRl51qcHRYSJeBVBhFZqSCm9ILYYP6/bZ7zOiFgF5IHx02qL8bukiUgbeP71WdO2FZVqe61pBaltWdbAhtCG0IbQibPl734sCGUJSBVBhFZqSCX9IL2RBmRjSE4ncXDh06HHd4rSG1LKs72RDaENoQ2hA2fbzuxYENoSgDqTCKzEgFv6QXsiHM2BA6dHjzhNcaUsuyupMNoQ2hDaENYdPH614c2BCKMpAKo8iMVPBLeiEbwowNoUOHN094rSG1LKs72RDaENoQ2hA2fbzuxYENoSgDqTCKzEgFv6QXsiHM2BA6dHjzhNcaUsuyuhLt06wCL7SsV2U++2xk1q0rROys1J64erw5cyJz662FmTMLEW9VijOJWFbBhZZvZrZti8zmzQW9QTheWFxcZ4orK++4IzK4r/W22yLz2WeFmFv45psC/GF+1z+q2Bi08YcPF7BBfDfgtXD554oVBfxk4fjxAspoLkr9LjNrVmRo6uLxzKJFkWnuIC2OF1t4//0Cuk3a8up4m/tLy9unp0Wbi45ZGySgW2QshF4cIDPm6i4fZaDLR1WYizKQCqeBph8Po2aUoWtGGbpmjKJIpNKeByAVLB8e1mWgZhwOUqFIvG5trfHfM1LhYYCaATaIuVhIf5Hq3AnLsjpV6VMsy/r1ZUNoQ2hDaEM4AGTGXBvCDEZRJFKhDKwLkMqGMIO5WEh/kercCfm7C4cOHY47LH2KZVm/vmwIbQhtCG0IB4DMmGtDmMEoikQqlIF1AVLZEGYwFwvpL1Kdq1tVhw4djjssfYplWb++bAhtCG0IbQgHgMyYa0OYwSiKRCqUgXUBUtkQZjAXC+kvUp2rW1WHDh2OOyx9imVZv75sCG0IbQhtCAeAzJhrQ5jBKIpEKpSBdQFS2RBmMBcL6S9SnatbVYcOHY47LH2KZVld6NtKuZTylVciE3Eis3NnZL79toB+OuYX4D3insLrrxd4z2R9OOJopdjFP/4xMhEXM7hm85ZbClf9cuby5cjAmcAvXbhQ2LSpcPRoAXMjPqv8MYNUER9mWNX9lXon5/nzkcHln7ixE+fcON7y3bj99shgg/PmFXir6sOFBQsKuHMVt6p+912BN4XWe0QjdhdujQJ/0FBeytKlkYn4PHP2bGQ2bChE7Cvonhh9LdBzASyBdgjtWhlkxlwN2nqUgcYdC6EMvQWMIpVeCHPbE8jAL+lUI/kWbYFwOzMWwsOoSo8ilR7F9pEZW9BvfyRQFX46gIXkFiYsy+pUYVlW17IhtCG0IbQhbPxDu1YGmTFXoy2B9mkoQ28Bo0ilF8Lc9gQyNoQ3vyEUv7tw6NDhuMOwLKtr2RDaENoQ2hA2/qFdK4PMmKvRlkD7NJSht4BRpNILYW57AhkbQhtChw4d3kAYlmV1LRtCG0IbQhvCxj+0a2WQGXM12hJon4Yy9BYwilR6IcxtTyBjQ2hD6NChwxsIw7KsrmVDaENoQ2hD2PiHdq0MMmOuRlsC7dNQht4CRpFKL4S57QlkbAhtCB06dHgDYViW1a3wr2Q8UqkeAA7w1VcLaPrhW+65p4DrLp98MjKNMSu3QS5cGBlsAR4v4pvCvMjA8+A6U9z2+fjjBRgGpDpxohDxfmVpgbdfFgeo7z5ttDMDf/jYY4U77yxEPJlpLv8so3hlKBKcOlXg/aWxsXI2A4+HG2i3by/EXZXYUHg0CvWqW3rp+yqxKoMyIjZXjmTgDyOeKKCB1pYAX3c9Fy0yvIdur/EwFsKozoyqkEo7BNgnpNJbgFHBwygD5gpzsUE8jFQoEhsEuLETW8D28bB2YvpwMKrPCnNxGiNlHunLgMz6rJCq/VoOf4MTlmV1qrAsq1vhn1QbQhtCG0Ibwknw8EjdNjKP5AEw14bQhrCPPiukar+Ww9/ghPzdhUOHDscdhmVZ3Qr/pNoQ2hDaENoQToKHR+q2kXkkD4C5NoQ2hH30WSFV+7Uc/gZ1q+rQocNxh2FZVrfCP6k2hDaENoQ2hJPg4ZG6bWQeyQNgrg2hDWEffVZI1X4th79B3ao6dOhw3GFYltWt8E+qDaENoQ2hDeEkeHikbhuZR/IAmGtDaEPYR58VUrVfy+FvULeqDh06HHcYlmV1rNsr1QHy4diawa2buDtx0aLIRPy9sj7zzjshWLOmEPFBZsaMyEScqpSFeGHpogIa93PnChHLM2hOIv6SmT8/MhHfZdDJRGwp3I+rQXdnZs+OTMSOzPHjkUHjCnt88GBkIo5n5s6NTMQLlecyx45FBne9YvsR2zI0V3cXcOVsxK5KsV4rVkSm8eHvVMp+jxyJDN4gfDjc45UrhbVrC3PmFCLeKODbgH4aoJ/GXIAmGN02UmlQBjKj6YeNwcN6v9oBoukHmNs+kGnPVpSBUWxBHyzWxVyMYl2N3hEWwl9Yei7AjlAGfu6Ah3E4mIuH9eHoUXzNsAX5jiYsy+pUYVlWx7IhtCG0IbQhnBKUgcw2hOJgsS7mYhTravSOsJAN4fB3NCF/d+HQocNxh2FZVseyIbQhtCG0IZwSlIHMNoTiYLEu5mIU62r0jrCQDeHwd6RbVYcOHY47DMuyOpYNoQ2hDaEN4ZSgDGS2IRQHi3UxF6NYV6N3hIVsCIe/I92qOnTocNxhWJbVsWwIbQhtCG0IpwRlILMNoThYrIu5GMW6Gr0jLGRDOPwd6VbVoUOH4w7DsqyutbJwtR3PPFxYubKwYUOh8QBFX35ZeOKJQsTrlXIJJ64VhbdsUp2vFIvbmNhnM7jQEndy4p7JiE8y2nqhGcM1quiRIk5kXnwxMn/4QyFiXWVv5VDl5Uoxosh88WIBfum11wrLlxdo2x6t13s+WMAGt20rRHxRuZi5dCkyuMwWTWDEpcqmwj2R4SW68UzlcAZ3ru7fX4j4PHP33ZFhm4v2Gn0tHtajaJGRGaeD9lqP6qZfP4yvO+biYWwBc7EQwFz8R4hRgKowqrevRwGqwhvUrxtgXZyGTqVrhuFHZqTSb0HPxboY1c5TryuLnLAsq1OFZVldy4bQhtCG0IawcXF6VPsH/bANYcaGMIN1MTpOQyh+d+HQocNxh2FZVteyIbQhtCG0IWxcnB7V/kE/bEOYsSHMYF2M2hA6dDhNw7Asq2vZENoQ2hDaEDYuTo9q/6AftiHM2BBmsC5GbQgdOpymYViW1bVsCG0IbQhtCBsXp0e1f9AP2xBmbAgzWBejNoQOHU7TMCzL6lY7dhQiXq2UKxzpiOZH4ZHCt98W7ruvAPu0enWhudASlqCMNh7vyczOnZE5dKiAPv6ZZwq4SRLm6v33I4NbKBcsKMAfwkzOnBmZiD2ZO+6IDNoemPaYU1lcqXax8ZYrCrdEBsb7zjsLb79d4G2u8V4GfgmXuzZXkm7IwBHwWtGFlXgt8/DDkcF3Mn4oLF1aiLhQKV9C3IuLw+E7iucLaFXR5qKPR8eMbwNG8Z8ZHtYOAaOYq7ttoB0gMo/U5eNh0FaSwcOoCsAR6cPRD2MLevsa/RZQhn4LKPLMmQJG9UnqV4ZUAN9YLITM2FGbLSOPbsKyrE4VlmV1KxtCG0IbQhvCSVAGRjEXXT7mAm1FkHkkd4GHQVtJBg+jKqA9HorUD2MLevsa/RZsCDPy6Cbk7y4cOnQ47jAsy+pWNoQ2hDaENoSToAyMYi66fMwF2oog80juAg+DtpIMHkZVQHs8FKkfxhb09jX6LdgQZuTR6VbVoUOH4w7DsqxuZUNoQ2hDaEM4CcrAKOaiy8dcoK0IMo/kLvAwaCvJ4GFUBbTHQ5H6YWxBb1+j34INYUYenW5VHTp0OO4wLMvqVjaENoQ2hDaEk6AMjGIuunzMBdqKIPNI7gIPg7aSDB5GVUB7PBSpH8YW9PY1+i3YEGbk0elW1aFDh+MOw7KsrrW5cj6DyzAjdmc2bowMOuY1ayITcTAD/xCLCjBXuKQRti1ideWvmbfeikzEXyrPZe66KzIRyzJwRBEvZfbsiQysyBdfRIbbj1cq6zO4hjCWVGJ/BaexNvPAA5GJ+Cpz7lxkjh8vRHyb+frryGAUG8TlnzGvEl9XdhSuvogEvpOoufmJRr0aFG653hS6aVNk8FJ2744MPC1OcvHiyMDS8+cs6FzRQKNxR4s8UreNuUB7AHTqWFePIhXaelwdqe8CxWnILp8bRBmwE9rV6FFkRpFY6KOPCigSmZEKo9ryoSpsQY/q/QI8jLeAF6r3i4eRGaeh3y8exlnVzBOWZXWqsCyra9kQ2hDaENoQ2hDWVNrzYBSZUaQNYUbvFw8jM05Dv188PJUhFL+7cOjQ4bjDsCyra9kQ2hDaENoQ2hDWVNrzYBSZUaQNYUbvFw8jM05Dv188bEPo0OFvOAzLsrqWDaENoQ2hDaENYU2lPQ9GkRlF2hBm9H7xMDLjNPT7xcM2hA4d/obDsCyra9kQ2hDaENoQ2hDWVNrzYBSZUaQNYUbvFw8jM05Dv188bEPo0OFvOAzLsrpVY4G+qTxVKcYM1z9GPFaYFYVbK+iJ55cLS1etKsSDlWqBcFXmD1XoVHHL6JEjBZxG43ivVIo9/uabyER8n+FlmPU+z717I4My6B7rSW7bVsCNrAcORAYG+JFHIrNlSwEm57bbIvPSS4WYUXj88cKcOQX4//XrC59+WsDb37ev8MILhcZqvlt5IoN1I85kcLCff144erSAbzu85ZIlhXioAkeEJhhtLppg/bD2WpiL1lxXpVOhDGTGqC5jJEOoU2m/BPAwjl1bERwOHkZmFKkza7B9pNJVtdky+mG8FD1Xg7+vsSP9UrBBXVX9ek9YltWpwrKsbmVDaENoQ2hDOAmcia5Kp0IZyIxRXYYN4fWD7SOVrqrNltEPa+uFuZruDKH43YVDhw7HHYZlWd3KhtCG0IbQhnASOBNdlU6FMpAZo7oMG8LrB9tHKl1Vmy2jH9bWC3M1NoQOHf4uw7Asq1vZENoQ2hDaEE4CZ6Kr0qlQBjJjVJdhQ3j9YPtIpatqs2X0w9p6Ya7GhtChw99lGJZldSsbQhtCG0IbwkngTHRVOhXKQGaM6jJsCK8fbB+pdFVttox+WFsvzNXYEDp0+LsMw7KsbjVjRqExhCcK90WGPfGCAq73nDWrsGtXAW39PbiUMi5XtmVWr44Mmn4YJFSFnoFzq7vA/ZZwrS++WIj4JAM3BYO0YUNh9uxC3FuJjZlLlyIzc2Yh4nSGxmxhAc4TbjliaYEu/UDl+QwusMQXCVvAfnfuLGAunCd/hHFHFGJ7Bl/ge+8twMM3t+aey+zYEZljxwrN7aYvFNCqognW7bV2F/h+w1xpvzRSp65rxijKwEKoCql0Zj2q0dvHKLwHUsFLnzpVwAaxkH5leBijKAMP43BQBt4vMqOqP/+5gHWxEObqDWqwI71fzMV+69wJy7I61WQ/allWh7IhzHCuDaENoQ1hDxvCjA3htDOE4ncXDh06HHc42Y9altWhbAgznGtDaENoQ9jDhjBjQ2hD6NChw18unOxHLcvqUDaEGc61IbQhtCHsYUOYsSG0IXTo0OEvF072o5ZldSgbwgzn2hDaENoQ9rAhzNgQ2hA6dOjwlwsn+1HLsjpU46bKxZJwNbyS9NbCokUFeDyaHPTEsTzz3nuRiXipcNXnZOJY5ZXM2bORaVrz85XDma++iswnnxQinsysXRsZGNHHHovM0qWFuKdw4UIhFlfi/Qxuv8S9mni/eEfvvFPAS9m6NTJxZ6Waybi/wnMu9gnGbOXKyKBze+ihwsKFBRws1n3wwULMLTz9dAE/s0CHHEsq8WGluGUYQnyfaYBhNtAx61E0wbAiGMXJYhToXhxNvwb2CaM6sy4Do0DbNpwk1oXnwVvQZWAhvBSMokiAb6F++//zPwV9zvgy6NMAKBJzkRlz9RZwODh2bHCkVP/3f4Va5IRlWZ2q15FaltWZbAhtCG0IbQgHAJOD0dYkCOAfMKoz6zIwCrAuHAJOEuvaEApQJOYiM+bqLeBwcOzjNITidxcOHTocd9jrSC3L6kw2hDaENoQ2hAOAycFoaxIE8A8Y1Zl1GRgFWBcOASeJdW0IBSgSc5EZc/UWcDg4dhtChw6nadjrSC3L6kw2hDaENoQ2hAOAycFoaxIE8A8Y1Zl1GRgFWBcOASeJdW0IBSgSc5EZc/UWcDg4dhtChw6nadjrSC3L6kw2hDaENoQ2hAOAycFoaxIE8A8Y1Zl1GRgFWBcOASeJdW0IBSgSc5EZc/UWcDg4dhtChw6nadjrSC3L6lB/rZS+NuJQZs+eyKBXWbascNVsZvAve8TFyveZGTMig04dNzriIk34B/iWQ4cKjW85WTmeWbIkMhEfVOBLt2VgjyP2Fq6668SCBQW4dNiJ558vQDhJuNb33y98/HEBl3AiVcTRymOV4rRh+WJ24fz5QjxQqT93iDiSWb48Mvv3Fw4fLmzZUojYlDl+PDIRbxXuK7eb4jsZsaJSfpJy8mRkTpwosGNGI4uuF94Dzbd2JuiY8TCAjUGRWFeXgVFUpQ2DXldvUKPnYhR/f6Eqnao920xbmCgD28dZ6aNDZqRCVVi3TS7AXGTGurpIZL6Rn3fIDU5YltWpSuNiWVYXsiG0IbQhtCFssCHM2BBeP5iLzFhXF4nM4zSE4ncXDh06HHdYGhfLsrqQDaENoQ2hDWGDDWHGhvD6wVxkxrq6SGS2IXTocJqGpXGxLKsL2RDaENoQ2hA22BBmbAivH8xFZqyri0RmG0KHDqdpWBoXy7K6kA2hDaENoQ1hgw1hxobw+sFcZMa6ukhktiF06HCahqVxsSzr19f69QW4i3nzChGXMw8/HJlXXy3gZsUfqiJWVj7PfPllZLZvL+D2y/vuK+zdW4hbKtUfHjxYiFhW2VdZn7lyJTIReyqfZXDtJO/kjAOZy5cjc+ZMYd26Am7dhLWOWJXBrZsPPFCYSusqZypV3CAefrnyZaU4/Hg0ChidBpKtKnti3eaivdbN90iXUurMKFK35tggwFx9sSRGsRBSAV0z9ouHsZA+ST2Kn6v9138V/vM/C/iBx3/8R+HAgQL+RsbfjP/6r4V/+ZfCv/974d/+rYDMN78mLOumEr/BlmVZNygbQhtCG8KOZUNoQ2hD2Kkm5O8uHDocU/jfn/93nzb80+k/9UHIb7BlWdYNyobQhtCGsGPZENoQ2hB2qrZTd+jwVwhtCC3L+q3IhtCG0IawY9kQ2hDaEHaqtlN36PBXCG0ILcv6rciG0IbQhrBj2RDaENoQdqq2U3fo8FcIbQgty/qN6P8Bw4jRCoW4zCkAAAAASUVORK5CYII=53:T4dec,IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLlJpY2hhLnRleHRgLnJkYXRhQC5kYXRhLnJzcmNoWDRBX15bZGh4NEE9MFZBPTBWQVQkSFNVVj08VUFMJFhQUS00VUFRUmhUTCRYUF9eXVtkSHRySFdqI2hEJCBoU2pAUFNqMGggU2pAaF9eW2R0NVZqRCR0VlZWUFZEJGQ7RCRoO1BTU1NTU1NoIEwkMGpTVVZXX15dM2gxNUFoUDBBdGspRV9eXVtfXl0zaG41QUQkVFJoVCRUUVJEJCxRUFQkLFFSRCQgUDVsVUE9WFVBVCRkaEQkXFBUJFxRUkwkXFFMJDhQUkQkOFBUJDRRUkwkXFFMJEhQUkQkSFBUJDhRUlQkIFJEJCg7PXBVQUQkZGhMJFxRVCRkaEQkXFBMJDRQUUQkIHQmVCQ0U1JMJFhQUTl0JCB1VCQoUl9eQFtTVVZXMF5dW3RqU1YzUVNVVnQkIFdfXl1bX15dW2RfXltkRmBQaEggajBRUWowUlFqMFBXajBRX15dW19eXVtoIDZBRCQgK0wkJF9oXDZBVCQkU1JMJCRRTCQoUV9eXVtkPTBWQWh7NkE9MFZBakBoLFQkKFdSPSxRQUQkKFJTVmhsLXhVQUwkXGhMJFw7VCQgaHBEJCBQakQkIVxSUEQkKFxEJCBQaj0wVkFoOTdBUVNVVkZIMFpBPUhWQV9eXVtkaHY3QUAgV1JoTCRcX15kUmo8UHRoV1ZEJCRQTCQgXmQ7QVR9aDheQWhQMEFoSF5BaFAwQVJWU1doOEFGZERaQUZwMFpBaE44QUggajBRUWowUldqMFBXajBQaHA4QUQkICtMJCRfX15dW19eXVtGIGghOFZLdSZEJCBQVCQkUVJUJCBRTCQoX15dW2RoQzlBTiBQUUQkQD9MJEBqUVVSUEQkKFBEJDhRM0QkNFBUJHRSUEQkPFBRXCRoU1wkaFNQVCQsUlVQfiU5RCRMJDBAO0QkOF9EJCRQNWBQQVQkMFJeXVtkeXBfXnlwX15oUFpAaHY6QWhlPEFTVVZXX15dW2RGYFBoU1VWVzUwVkFDIFJqNSxWQVBqJ1FoMD5BRCQgK0wkJF91Kl9eXTN1X15dM19eXVtoYT5BPTxVQTUwVkFoeD5BPTBWQUQkNGpMJCRfXmQtMFZBUlZoS0wkIGpEJCBqaHViRjtEJChUVCQgUl9eXVtTVVZXPXRQQS14UEE9MFZBSCBqMFFRajBSUWowUEggajBRUWowUlVqMFBIIGowUVFqMFJRajBQU2owUUQkOFBMJChQVCQ8UVJUJCAlTCQmUlQkJiVMJEhRVCQ4UFFSVCQgJUwkJlJUJCYlX15dZFNVVjN0JCAzRCQyJVJQV1FEJEhoIEwkOFE1MFZBX15dW2R3YnRTPXc4dCl3N3QoPXV3aDhfXV5baHc/QTVIVUFEJEhoUVJoVEwkYFBEJEBSaEQtOFVBdFRWal9eXVtTVVZXNUhVQVJQaFRUJDhRdC9TakBoU2owaGBfXl1bZFNQU2heXVtkaFVAQUQkTDNWIFNTaEwkYFBRRCQgXGdBRCQwUFQkMCtMJDhQK0QkKFFMJExQUVJMJExQUUwkTFJMJGA7O0QkZEwkUCtEJEwrbCRkK0QkdHQgflRdO0QkRFJEJGh1TCRoUVBEJGhQRCRIUVBMJDBoIFQkTCtUJEwrTCQwaCBUJEwrVCRMK0QkKDtfXltkaHtAQVJXVVBRUldQX15dZEQkNFNVVkQkJDtUJCA7VCQ4fUwkMFBRRCQoUFFfXl1bRCR8U1QkLCtUJCArLVRQQUQkMHUzRCQ0RFpBTCQkJVQkPFJEJFBTUFQkQFJEJGRTUEwkRDtKTCRsX15dW2RoTUFBTCQoK08gVVVqMVFEJFR8Z0FEJGh4Z0F0JHxqRCR8cGdBRCQodDJRajxSZ2ZmZkQkKDNEJCwzTCQwUFNRRCQsdVQkNCtMJDBQRCQ8K0QkSFJEJEhQTCRIUUwkMFBEJDRRUFNMJDhRU0QkIFFQRCR4cGdBRCRkeGdBRCRQfGdBTCRUUF9eXVtkaGhBQWggQkFEJChWdCQsK2g4QkFoWEJBVCQgUlQkIFJUJCBSRCQgUFQkIFJUJCBSVCQgUlQkIFJUJCBSVCQgUlQkIFJQTCQsfGwkJDNUJCRASlQkJHVEJCQ7VCQoK3wkMDtEJCR8TCQmM0wkKDNMJCh0JkwkJzNMJCw7RCQkfEwkLDtEJDB+akwkJzNEJDB8RCQsM3QkODNUJCxdMkQkIGhEJDAzTCQgQEQkJDNEJDwzRCQ8M0QkPDNEJCQzRCRAMkwkMF4yRCQ0aFQkRFFSX15dW0wkICtUJCwlRCQgK0QkRDJfXl1bRCQ0aFQkRFFSX15dW0wkICtUJCwlRCQgK0QkRDJfXl1bdCQoM1QkIDNEJCBVUHQkLDtfXl1bdCQsRnQkLDtfXl1bVCQsMzlEJCxyX15dW3RbV2pfXl0yX15dMl9eXVt8JF1oTCRoaFQkXFJoSCFCdV9eRCRcalBRUlJoVCQwZlQkZFJMJChqU1VWV0QkJFBUJCRRUkQkJFFQTCRAUUwkPFFfXl1bZEQkIHQnRCQ4alQkPFFSOXQkIHVqY1BoamNRaEghQlQkJGpjUmhTVldoU2ggTj0wVkFTaCJOX15bZFNVVldoVWggTlVoIk5fXl1bZFNVVlcwXl1bdGlTVjNoMUNBX15dW19eXVtkX15dW19eXVtfXl1bUVZXan45U1VHUDJdW19eX15dM19eXVtSKD0zJ0wkIDtfXl1bdV5dM1IoPTMnX15dW1loSENBaGhDQUQkOmZcJCxmXCQqZj18VkFQaH5mTCQsalQkRFFMJDxRVlBofmZEJCRgX15dM3wkIGZTVVZXRCQkJF9eXVtNPFNWUXUwX15dW1l0JCRXV1ZRUjNEJDBzTCQockQkKCNEJCwzTCQockQkKCNEJCwzTCQockQkKCNMJChyRCQoI1QkMFJXVkQkIHNEJCA7QUg7TixUJDBSV1ZEJCBzRCQgO19eXVtUJDBSV1ZfXl1bX15dW0wkMFFXVl9eXVtUJDBSV1ZfXl1bX15dW19eXVtHKFJQRzBfXlcoVlJHKFNqVyhRUkcoVlBcJDxVVkQkKFZMJDBQVCQ4UUQkQFJQRCREVlFMJFBSUFFMJCRzVCQgdSxUJCQ7TCQgK0QkSHJOKFBRRCRIckQkSHJEJEhyVCQkc1QkOHM7RCRIckwkICNUJCBKVCQgdUwkSFJRTCQwUkQkREwkJFZSVCQoUFFSTihQUUQkUCtfXl1bX15dW19eXVtUJFBSVlNfXl1bX15dW19eXVtWKFFSX15dW19eXVtEJFBQVl9eXVtWKFFSX15dW1YoUVJfXl1bX15dW0s0UFZTX15dW19eXVtfXl1bTihQUUYoUlBOKFdROXQkVHU6X15dMzk4dUFUJCx2VCszeCVBdCREeXQkREJMJCw7VCQsK0wkSDtEJDErVCQwKztEJDxzITtEJDxyfCQ4TSNMJCxCO3QkRDN8JCBqTCQgUlVQalcoU1JeXV9bWVcoU1JeXV9bWVwkLFVWQyhXakwkNFJUJCxQUWhMJDhSVCQoUEQkMFFoQyhXUF9eXVtZSyhXUV9eXVtZSyhXUV9eXVtZSyhXUV9eXVtZUyhXUl9eXVtZUyhXUl9eXVtZTCQoU1V0JDAjdCQ0I0wkLCtsJCgrbCQoK0dGTXVHRkl1R0ZJdUdGSXVcJDgrezRfXl0zXCQ4K3s0X15dXCQ4K3s0X15dTihQUX4oOX4kdV9eXVtfXl1bX15dW19eXVtEJCBfXl10JCAzX15dM19eXVtEJCBqTCQgUWo8MFB1W19eXUQkIFBWRCQgO0QkPFBWTCRAUVZUJCRSVkwkQFV8JDxodCQgK3wkZDNEJCBQUVQkSFJQTCQsUVJEJChQUVQkLFJQTCQwUVJEJDRQUVQkOFJQTCQ8UVJEJEBQUVQkRFJQRCQwVVQkfDtMJGxqRCQ8K0QkbGpWKFFSVkYoUlBWRCQgUFFMJCBRUkwkIDtEJCBQUVQkIFJQVCQgUlBUJCBSUDtHSHQ5X3x0V3hWNHR3fF9eW1NVVlczTCQkO19eXTNGcFJQRlBXUlBfXl1bX15dM19eXVtfXl1bdV9edV9eRCQgZj9QUWZQV1FWX15dWUQkTFJQUUQkQFJMJFhQUVJEJCBqTCQwUFFXdDQrU1VWV19eXTNfXl0zX15dW19eXVtMJDBRVnVnX15dTCQsUWotTFFBUFZRV19eXVtRU1doRHQkLDslfFRBJXhUQSV0VEElcFRBJWxUQSVoVEElZFRBJWBUQSVcVEElWFRBJVRUQSVQVEElTFRBJUhUQSVEVEElQFRBJTxUQSU4VEElNFRBJTBUQSUsVEElKFRBJSRUQSUgVEElfFNBJXhTQSV0U0ElcFNBJWxTQSVoU0ElZFNBJWBTQSVcU0ElWFNBJVRTQSVMU0ElSFNBJURTQSVAU0ElPFNBJThTQSU0U0ElMFNBJSxTQSUoU0ElJFNBJSBTQSUkUkEldFFBJXhRQSV8UUElIFJBJShSQSUsUkElMFJBJTRSQSU4UkElPFJBJUBSQSVEUkElSFJBJUxSQSVQUkElVFJBJVhSQSVcUkElYFJBJWRSQSVoUkElbFJBJXBSQSV0UkEleFJBJXxSQSUsVUElMFVBJThVQSU8VUElQFVBJURVQSVIVUElTFVBJVxVQSVgVUElZFVBaFAwQWhTVlc+InU6RlhQVlNTJXxVQVdWUzMlKFVBJVBTQWN8d3s5SkxYfj1kXWxwSFBQMDBgfSsrVj1qJiZMWjY2bEE/P35cNDRoUzExYj9lIyNGXmknJ050LCxYLk07O3ZhfXspKVI+cS8vXmAgIEBnSzk5clUzM2ZEPDx4IUg4OHBjISFCMEc9PXpmIiJEfioqVFYyMmROOjp0bCQkSFk3N25vJSVKci4uXCRCPj58XzU1angoKFB6KXctLVpUMDBgUCsrVn0mJkxqNjZsWj8/fkFPNDRoXHMxMWJTUiMjRmUmJydOaSwsWHQ2LW5uOzt2TSkpUns+Ly9ecSwgIEBgOTlyS0pKMzNmVTw8eEQ4OHBIdSEhQmM9PXpHZGQyK3NzIiJEZioqVH47MjJkVjo6dE4kJEhsXFxDNzduWW1tJSVKby4uXHI+IUtLPj58QjU1al9XVyIzaWkoKFB4LS1adzBgUDBnK1Z9KyZMaiY2bFo2P35BPzRoXDQxYlMxI0ZlIydOaScsWHQsUjt2TTspUnspL15xLyBAYCA5cks5Sk0zZlUzUDx4RDw4cEg4IUJjIX49ekc9ZCJEZiIqVH4qMmRWMjp0TjokSGwkXDduWTdteCVKbyUuXHIucD58Qj5hNWpfNVdVKFB4KC1ady1gUDAwZ2dWfSsrTGomJmxaNjZ+QT8/aFw0NFFiUzExKj9GZSMjTmknJ1h0LCw0LlJSdk07O1J7KSlecS8vQGAgIHJLOTlNTWZVMzNQUHhEPDwlcEg4OEJjISEgMERELjl+fnpHPT1dXTIrRGYiIlR+Kio7ZFYyMnROOjpIbCQkblk3N3h4Sm8lJVxyLi44JHR0PiFwcHxCPj5xYWFqXzU1VVVQeCgoWnctLVFTZUF+IXRYKWlYaEhwTnJabD0nOS02ZDouNiRhaUt3WjtmRDR+W3YpQ2NCQCJfamJGflQxMSM/KjAsNCQ4X0BJPChBdFxsSEJXUVBlQX5TMCBVbXYtIXRYU2JFd2RoSHBYVWYqKCsySHByWmxOOS02J1xoIVRbLjYkOmdLd1ppWzQpQ0Z+VGIjPyoxX1tvPT40JDgsQHBcbEh0V0F+U2VgM1NiRStIcFhoRXBabE5yLTYnOVQ2JDouIHdaaUsqIjxDWzR+Q35UYkZ4WW4/KjEjZk50NyQ4LDRsSHRcQldRUH5TZUEhdEkpaWs+WCdgM1FiRXBYaEhDQGd3bE5yWjYnOS1UWyQ6LjZaaUt3O2ZbNH5fVGJGfngmbioxIz9oOCw0JDJIdFxsLDQkOCc5LTY6LjYkMSM/KlhoSHBTZUF+TnJabEVTYnRcbEhRZUZiRn5UaUt3Wix9Vno0JDgsOS02Jy42JDojPyoxaEhwWGVBflNyWmxOU2JFXGxIdFFlRkZ+VGJLd1ppJDgsNC02Jzk2JDouPyoxI0hwWGhBflNlWmxOclNiRWxIdFxlRlF+VGJGd1ppSypHejw4LDQkNic5LSQ6LjYqMSM/cFhoSH5TZUFsTnJaYkVTSHRcbEZRZVRiRn5aaUt3LH03eiBpbmZsYXRlIDEuMS4zIENvcHlyaWdodCAxOTk1LTE5OTggTWFyayBBZGxlciAgbjteUWtrYmFsaV1XYjlhJmdNR2lJd24+SmojLnpmK28qNy0gdW56aXAgMC4xNSBDb3B5cmlnaHQgMTk5OCBHaWxsZXMgVm9sbGFudCBNRkM0Mi5ETExfX0N4eEZyYW1lSGFuZGxlcmZjbG9zZWZyZWFkZm9wZW5zcHJpbnRmcmFuZGZ3cml0ZXRpbWVzcmFuZHdjc2NweXdjc2NhdHdjc2xlbl9mdG9sX2V4Y2VwdF9oYW5kbGVyM19sb2NhbF91bndpbmQyd2NzcmNocndjc2NtcHN3cHJpbnRmd2Nzc3RyZmdldHNzc2NhbmZzdHJuY21wX21ic2NtcF9fcF9fX2FyZ3ZfX3BfX19hcmdjc3RycmNocj8/MGV4Y2VwdGlvbkBAUUFFQEFCVjBAQFo/PzFleGNlcHRpb25AQFVBRUBYWj8/MGV4Y2VwdGlvbkBAUUFFQEFCUUJEQFpfQ3h4VGhyb3dFeGNlcHRpb25zdHJ0b2tzdHJuY3B5bWVtbW92ZV9wdXJlY2FsbGZyZWVjYWxsb2NtYWxsb2NfbWJzc3RycmVhbGxvY01TVkNSVC5kbGxfX2RsbG9uZXhpdF9vbmV4aXQ/PzF0eXBlX2luZm9AQFVBRUBYWl9leGl0X1hjcHRGaWx0ZXJleGl0X2FjbWRsbl9fZ2V0bWFpbmFyZ3NfaW5pdHRlcm1fX3NldHVzZXJtYXRoZXJyX2FkanVzdF9mZGl2X19wX19jb21tb2RlX19wX19mbW9kZV9fc2V0X2FwcF90eXBlX2NvbnRyb2xmcENyZWF0ZVRocmVhZERlbGV0ZUZpbGVBR2V0RmlsZUF0dHJpYnV0ZXNBQ2xvc2VIYW5kbGVUZXJtaW5hdGVUaHJlYWRXYWl0Rm9yU2luZ2xlT2JqZWN0R2V0RXhpdENvZGVQcm9jZXNzVGVybWluYXRlUHJvY2Vzc0NyZWF0ZVByb2Nlc3NBR2V0VGlja0NvdW50R2xvYmFsRnJlZUdldFByb2NBZGRyZXNzTG9hZExpYnJhcnlBR2xvYmFsQWxsb2NTZXRDdXJyZW50RGlyZWN0b3J5QUdldEN1cnJlbnREaXJlY3RvcnlBU2V0RmlsZVRpbWVTZXRGaWxlUG9pbnRlckV4U2V0RW5kT2ZGaWxlU2V0RmlsZVBvaW50ZXJHZXRGaWxlVGltZU11bHRpQnl0ZVRvV2lkZUNoYXJGaW5kQ2xvc2VGaW5kTmV4dEZpbGVXR2V0RmlsZUF0dHJpYnV0ZXNXRmluZEZpcnN0RmlsZVdDcmVhdGVGaWxlQUdldEV4aXRDb2RlVGhyZWFkR2xvYmFsVW5sb2NrR2xvYmFsTG9ja1dpZGVDaGFyVG9NdWx0aUJ5dGVHZXREaXNrRnJlZVNwYWNlRXhXR2V0RHJpdmVUeXBlV0dldExvZ2ljYWxEcml2ZXNGaW5kTmV4dEZpbGVBRmluZEZpcnN0RmlsZUFJbml0aWFsaXplQ3JpdGljYWxTZWN0aW9uRGVsZXRlQ3JpdGljYWxTZWN0aW9uUmVhZEZpbGVHZXRGaWxlU2l6ZVdyaXRlRmlsZUxlYXZlQ3JpdGljYWxTZWN0aW9uRW50ZXJDcml0aWNhbFNlY3Rpb25TbGVlcEV4aXRQcm9jZXNzR2V0TW9kdWxlRmlsZU5hbWVBR2V0TG9jYWxlSW5mb0FHZXRVc2VyRGVmYXVsdExhbmdJRFN5c3RlbVRpbWVUb1R6U3BlY2lmaWNMb2NhbFRpbWVHZXRUaW1lWm9uZUluZm9ybWF0aW9uQ29weUZpbGVXQ3JlYXRlRGlyZWN0b3J5QUdldFRlbXBGaWxlTmFtZUFDb3B5RmlsZUFHZXRDb21wdXRlck5hbWVBU3lzdGVtVGltZVRvRmlsZVRpbWVMb2NhbEZpbGVUaW1lVG9GaWxlVGltZUdldE1vZHVsZUhhbmRsZUFHZXRTdGFydHVwSW5mb0FLRVJORUwzMi5kbGxTZXRUaW1lclNlbmRNZXNzYWdlQUtpbGxUaW1lckVuYWJsZVdpbmRvd0dldENsaWVudFJlY3RDbG9zZUNsaXBib2FyZFNldENsaXBib2FyZERhdGFFbXB0eUNsaXBib2FyZE9wZW5DbGlwYm9hcmRMb2FkQ3Vyc29yQUdldFBhcmVudFNldEN1cnNvckludmFsaWRhdGVSZWN0UmVkcmF3V2luZG93RmlsbFJlY3RMb2FkSWNvbkFTZXRXaW5kb3dUZXh0V0RyYXdJY29uR2V0U3lzdGVtTWV0cmljc0lzSWNvbmljU3lzdGVtUGFyYW1ldGVyc0luZm9XU3lzdGVtUGFyYW1ldGVyc0luZm9BR2V0U3lzQ29sb3JPZmZzZXRSZWN0VGFiYmVkVGV4dE91dEFEcmF3VGV4dEFHcmF5U3RyaW5nQUJyaW5nV2luZG93VG9Ub3BTZXRBY3RpdmVXaW5kb3dTZXRGb2N1c1NldEZvcmVncm91bmRXaW5kb3dTZXRXaW5kb3dQb3NTaG93V2luZG93RmluZFdpbmRvd1d3c3ByaW50ZkFVU0VSMzIuZGxsQ3JlYXRlRm9udEFDcmVhdGVTb2xpZEJydXNoUGF0Qmx0Q3JlYXRlRm9udEluZGlyZWN0QUdldE9iamVjdEFHZXRUZXh0RXh0ZW50UG9pbnQzMkFEZWxldGVPYmplY3RCaXRCbHRDcmVhdGVDb21wYXRpYmxlRENHZXREZXZpY2VDYXBzR2V0Vmlld3BvcnRPcmdFeEdldFdpbmRvd09yZ0V4Q3JlYXRlUmVjdFJnbkNyZWF0ZUNvbXBhdGlibGVCaXRtYXBQdFZpc2libGVSZWN0VmlzaWJsZVRleHRPdXRBRXh0VGV4dE91dEFFc2NhcGVHREkzMi5kbGxGcmVlU2lkQ2hlY2tUb2tlbk1lbWJlcnNoaXBBbGxvY2F0ZUFuZEluaXRpYWxpemVTaWRSZWdDbG9zZUtleVJlZ1F1ZXJ5VmFsdWVFeEFSZWdDcmVhdGVLZXlXUmVnU2V0VmFsdWVFeEFDcnlwdFJlbGVhc2VDb250ZXh0R2V0VXNlck5hbWVBQURWQVBJMzIuZGxsU2hlbGxFeGVjdXRlRXhBU2hlbGxFeGVjdXRlQVNIR2V0Rm9sZGVyUGF0aFdTSEVMTDMyLmRsbF9UcmFja01vdXNlRXZlbnRDT01DVEwzMi5kbGxPTEVBVVQzMi5kbGxVUkxEb3dubG9hZFRvRmlsZUF1cmxtb24uZGxsPz8xPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQFFBRUBYWj9fQ0A/MT8/X051bGxzdHJAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQENBUEJHWFpANEdCP2Fzc2lnbkA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAUUFFQUFWMTJAUEJHSUBaP19UaWR5QD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEBBQUVYX05AWj9fRW9zQD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEBBQUVYSUBaP19Hcm93QD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEBBQUVfTklfTkBaP19TcGxpdEA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAQUFFWFhaP19YcmFuQHN0ZEBAWUFYWFo/bnBvc0A/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAMklCP19YbGVuQHN0ZEBAWUFYWFpNU1ZDUDYwLmRsbFdTMl8zMi5kbGxEZWxldGVVcmxDYWNoZUVudHJ5V0lOSU5FVC5kbGxfd2NzaWNtcF93Y3NuaWNtcF9zdHJuaWNtcF9zZXRtYmNwQ29ubmVjdGluZyB0byBzZXJ2ZXIuLi5zLnducnklMDhYLmVreSUwOFgucmVzMDAwMDAwMDAucmVzJTA4WC5ka3klMDhYLnBreUNvbm5lY3RlZFNlbnQgcmVxdWVzdFN1Y2NlZWRSZWNlaXZlZCByZXNwb25zZUNvbmdyYXR1bGF0aW9ucyEgWW91ciBwYXltZW50IGhhcyBiZWVuIGNoZWNrZWQhU3RhcnQgZGVjcnlwdGluZyBub3chRmFpbGVkIHRvIGNoZWNrIHlvdXIgcGF5bWVudCFQbGVhc2UgbWFrZSBzdXJlIHRoYXQgeW91ciBjb21wdXRlciBpcyBjb25uZWN0ZWQgdG8gdGhlIEludGVybmV0IGFuZCB5b3VyIEludGVybmV0IFNlcnZpY2UgUHJvdmlkZXIgKElTUCkgZG9lcyBub3QgYmxvY2sgY29ubmVjdGlvbnMgdG8gdGhlIFRPUiBOZXR3b3JrIVlvdSBkaWQgbm90IHBheSBvciB3ZSBkaWQgbm90IGNvbmZpcm1lZCB5b3VyIHBheW1lbnQhUGF5IG5vdyBpZiB5b3UgZGlkbid0IGFuZCBjaGVjayBhZ2FpbiBhZnRlciAyIGhvdXJzLkJlc3QgdGltZSB0byBjaGVjazogOTowMGFtIC0gMTE6MDBhbSBHTVQgZnJvbSBNb25kYXkgdG8gRnJpZGF5LllvdSBoYXZlIGEgbmV3IG1lc3NhZ2U6Yy53bnJ5cnVuYXNhZHZhcGkzMi5kbGwlMDRkLSUwMmQtJTAyZCAlMDJkOiUwMmQ6JTAyZFdBTkFDUlkhQ2xvc2VIYW5kbGVEZWxldGVGaWxlV01vdmVGaWxlRXhXTW92ZUZpbGVXUmVhZEZpbGVXcml0ZUZpbGVDcmVhdGVGaWxlV2tlcm5lbDMyLmRsbFBhdGhBcmlhbFBsZWFzZSBzZWxlY3QgYSBob3N0IHRvIGRlY3J5cHQuQWxsIHlvdXIgZmlsZXMgaGF2ZSBiZWVuIGRlY3J5cHRlZCFQYXkgbm93LCBpZiB5b3Ugd2FudCB0byBkZWNyeXB0IEFMTCB5b3VyIGZpbGVzIWYud25yeU15IENvbXB1dGVyKi5yZXNvcGVubWFpbHRvOlJTQTJDK00rbkNxJW08YTpsNkt5TW9dM3YgcUsiT3x4OCteX1ptI29tcDgsNSlhOTV5ZUZ6Mi9PLV8uWDh3Lit8fn0lLjE1cllbbmI1M100bExzMHw4TWljcm9zb2Z0IEVuaGFuY2VkIFJTQSBhbmQgQUVTIENyeXB0b2dyYXBoaWMgUHJvdmlkZXJURVNUREFUQUNyeXB0R2VuS2V5Q3J5cHREZWNyeXB0Q3J5cHRFbmNyeXB0Q3J5cHREZXN0cm95S2V5Q3J5cHRJbXBvcnRLZXlDcnlwdEFjcXVpcmVDb250ZXh0QSVzICVzY21kLmV4ZS9jIHZzc2FkbWluIGRlbGV0ZSBzaGFkb3dzIC9hbGwgL3F1aWV0ICYgd21pYyBzaGFkb3djb3B5IGRlbGV0ZSAmIGJjZGVkaXQgL3NldCB7ZGVmYXVsdH0gYm9vdHN0YXR1c3BvbGljeSBpZ25vcmVhbGxmYWlsdXJlcyAmIGJjZGVkaXQgL3NldCB7ZGVmYXVsdH0gcmVjb3ZlcnllbmFibGVkIG5vICYgd2JhZG1pbiBkZWxldGUgY2F0YWxvZyAtcXVpZXQxM0FNNFZXMmRoeFlnWGVRZXBvSGtIU1F1eTZOZ2FFYjk0RW5nbGlzaG1fJXMud25yeW1zZ1w8aHR0cHM6Ly88aHR0cDovLyVkLyVkLyVkICUwMmQ6JTAyZDolMDJkMDA7MDA7MDA7MDBodHRwOi8vd3d3LmJ0Y2Zyb2cuY29tL3FyL2JpdGNvaW5QTkcucGhwP2FkZHJlc3M9JXNtYWlsdG86JXNodHRwczovL3d3dy5nb29nbGUuY29tL3NlYXJjaD9xPWhvdyt0bytidXkrYml0Y29pbmh0dHBzOi8vZW4ud2lraXBlZGlhLm9yZy93aWtpL0JpdGNvaW5TZW5kICUuMWYgQlRDIHRvIHRoaXMgYWRkcmVzczolLjFmIEJUQ1NlbmQgJCVkIHdvcnRoIG9mIGJpdGNvaW4gdG8gdGhpcyBhZGRyZXNzOiUwMmQ7JTAyZDslMDJkOyUwMmRiLnducnktLS0lcyVzJWQlSTY0ZCVkRmFpbGVkIHRvIHNlbmQgeW91ciBtZXNzYWdlIVBsZWFzZSBtYWtlIHN1cmUgdGhhdCB5b3VyIGNvbXB1dGVyIGlzIGNvbm5lY3RlZCB0byB0aGUgSW50ZXJuZXQgYW5kIHlvdXIgSW50ZXJuZXQgU2VydmljZSBQcm92aWRlciAoSVNQKSBkb2VzIG5vdCBibG9jayBjb25uZWN0aW9ucyB0byB0aGUgVE9SIE5ldHdvcmshWW91ciBtZXNzYWdlIGhhcyBiZWVuIHNlbnQgc3VjY2Vzc2Z1bGx5IVlvdSBhcmUgc2VuZGluZyB0b28gbWFueSBtYWlscyEgUGxlYXNlIHRyeSBhZ2FpbiAlZCBtaW51dGVzIGxhdGVyLlRvbyBzaG9ydCBtZXNzYWdlISVkJSUuP0FWZXhjZXB0aW9uQEBOVklESUFBbWF6b25JbnRlbFNreXBlMzYwU2FmZVJpc2luZ1RlbmNlbnRNb3ppbGxhQWRvYmVZYWhvb0dvb2dsZWluY29tcGF0aWJsZSB2ZXJzaW9uYnVmZmVyIGVycm9yaW5zdWZmaWNpZW50IG1lbW9yeWRhdGEgZXJyb3JzdHJlYW0gZXJyb3JmaWxlIGVycm9yc3RyZWFtIGVuZG5lZWQgZGljdGlvbmFyeSVzXCVzdG9yLmV4ZSVzXCVzXCVzVGFza0RhdGF0YXNraHN2Yy5leGUxMjcuMC4wLjFtZW1vcnlpbnZhbGlkIGRpc3RhbmNlIGNvZGVpbnZhbGlkIGxpdGVyYWwvbGVuZ3RoIGNvZGVpbnZhbGlkIGJpdCBsZW5ndGggcmVwZWF0dG9vIG1hbnkgbGVuZ3RoIG9yIGRpc3RhbmNlIHN5bWJvbHNpbnZhbGlkIHN0b3JlZCBibG9jayBsZW5ndGhzaW52YWxpZCBibG9jayB0eXBlaW5jb21wbGV0ZSBkeW5hbWljIGJpdCBsZW5ndGhzIHRyZWVvdmVyc3Vic2NyaWJlZCBkeW5hbWljIGJpdCBsZW5ndGhzIHRyZWVpbmNvbXBsZXRlIGxpdGVyYWwvbGVuZ3RoIHRyZWVvdmVyc3Vic2NyaWJlZCBsaXRlcmFsL2xlbmd0aCB0cmVlZW1wdHkgZGlzdGFuY2UgdHJlZSB3aXRoIGxlbmd0aHNpbmNvbXBsZXRlIGRpc3RhbmNlIHRyZWVvdmVyc3Vic2NyaWJlZCBkaXN0YW5jZSB0cmVlMS4xLjNpbmNvcnJlY3QgZGF0YSBjaGVja2luY29ycmVjdCBoZWFkZXIgY2hlY2tpbnZhbGlkIHdpbmRvdyBzaXpldW5rbm93biBjb21wcmVzc2lvbiBtZXRob2QvLi5cLy4uL1wuLi9cLi5cJXMlcyVzJXMlcy4/QVZ0eXBlX2luZm9AQCIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiI=54:T13fc,IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLlJpY2hnLnYudGV4dGAucmRhdGFALmRhdGEucnNyY2hgIEBTVlczaFAxQGhQMUBoPDFAaCQxQGhsMEBoVDBAaEQwQGhEMEBoMDBAUWggMEBTU1NTU1VWVzNocDFAaGAxQF9eXVslNCBAaHAgQGhTVlc+InU6RlhQVlNTJSwgQCU8IEAlVCBAV2FpdEZvclNpbmdsZU9iamVjdEdldFByb2NBZGRyZXNzTG9hZExpYnJhcnlBR2V0TW9kdWxlSGFuZGxlQVNsZWVwS0VSTkVMMzIuZGxsX2V4Y2VwdF9oYW5kbGVyM19sb2NhbF91bndpbmQyX19wX19fYXJndl9fcF9fX2FyZ2NNU1ZDUlQuZGxsX2V4aXRfWGNwdEZpbHRlcmV4aXRfYWNtZGxuX19nZXRtYWluYXJnc19pbml0dGVybV9fc2V0dXNlcm1hdGhlcnJfYWRqdXN0X2ZkaXZfX3BfX2NvbW1vZGVfX3BfX2Ztb2RlX19zZXRfYXBwX3R5cGVfY29udHJvbGZwR2V0U3RhcnR1cEluZm9Bd2luc3RhMFxkZWZhdWx0U2VUY2JQcml2aWxlZ2VXVFNRdWVyeVVzZXJUb2tlbnd0c2FwaTMyLmRsbERlc3Ryb3lFbnZpcm9ubWVudEJsb2NrQ3JlYXRlRW52aXJvbm1lbnRCbG9ja3VzZXJlbnYuZGxsQ2xvc2VIYW5kbGVHZXRDdXJyZW50UHJvY2Vzc1dUU0dldEFjdGl2ZUNvbnNvbGVTZXNzaW9uSWRrZXJuZWwzMi5kbGxDcmVhdGVQcm9jZXNzQXNVc2VyQUR1cGxpY2F0ZVRva2VuRXhBZGp1c3RUb2tlblByaXZpbGVnZXNMb29rdXBQcml2aWxlZ2VWYWx1ZUFPcGVuUHJvY2Vzc1Rva2VuYWR2YXBpMzIuZGxsV1RTRnJlZU1lbW9yeVdUU0VudW1lcmF0ZVNlc3Npb25zQVd0c2FwaTMyLmRsbFBBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQUQ=55:T167c,IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLlJpY2h5LnRleHRgLnJkYXRhQC5kYXRhLnJzcmN1PFZoXHUnVmggMEA9bCBATCQ4aFAwQFBoQDBARCQ4UlBEJEBoNDBAXCQoakwkOFFMJChqVCQ4VlJQTCQoVkwkKFFqX15dW2RTVVZXX15dM1NVVldfXl1bfCQkK0wkKFFWRCQkdUQkIFZQTCQgdUQkJFVQTCQkdUQkIF9eRCQgdF9eXVtRU1VWdCQgV19eXVtfXl1bZCVYIEAlXCBAaFNWVzV0MEA+InU6RlhQVlNTJWAgQCVoIEAleCBAJUwgQEdldFRlbXBQYXRoV0dldFdpbmRvd3NEaXJlY3RvcnlXRGVsZXRlRmlsZVdGaW5kQ2xvc2VGaW5kTmV4dEZpbGVXRmluZEZpcnN0RmlsZVdTbGVlcEdldERyaXZlVHlwZVdHZXRMb2dpY2FsRHJpdmVzS0VSTkVMMzIuZGxsPz8xPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQFFBRUBYWj9fQ0A/MT8/X051bGxzdHJAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQENBUEJHWFpANEdCP19Fb3NAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQEFBRVhJQFo/X0dyb3dAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQEFBRV9OSV9OQFo/X1RpZHlAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQEFBRVhfTkBaP2Fzc2lnbkA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAUUFFQUFWMTJAQUJWMTJASUlAWj9ucG9zQD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEAySUI/X1NwbGl0QD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEBBQUVYWFo/X1hyYW5Ac3RkQEBZQVhYWk1TVkNQNjAuZGxsc3dwcmludGZ3Y3NsZW5fX0N4eEZyYW1lSGFuZGxlcj8/MkBZQVBBWElAWmZyZWVNU1ZDUlQuZGxsX2V4aXRfWGNwdEZpbHRlcmV4aXRfYWNtZGxuX19nZXRtYWluYXJnc19pbml0dGVybV9fc2V0dXNlcm1hdGhlcnJfYWRqdXN0X2ZkaXZfX3BfX2NvbW1vZGVfX3BfX2Ztb2RlX19zZXRfYXBwX3R5cGVfZXhjZXB0X2hhbmRsZXIzX2NvbnRyb2xmcEdldE1vZHVsZUhhbmRsZUFHZXRTdGFydHVwSW5mb0FQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElORw==56:T4a4,UTogIFdoYXQncyB3cm9uZyB3aXRoIG15IGZpbGVzP0E6ICBPb29wcywgeW91ciBpbXBvcnRhbnQgZmlsZXMgYXJlIGVuY3J5cHRlZC4gSXQgbWVhbnMgeW91IHdpbGwgbm90IGJlIGFibGUgdG8gYWNjZXNzIHRoZW0gYW55bW9yZSB1bnRpbCB0aGV5IGFyZSBkZWNyeXB0ZWQuICAgIElmIHlvdSBmb2xsb3cgb3VyIGluc3RydWN0aW9ucywgd2UgZ3VhcmFudGVlIHRoYXQgeW91IGNhbiBkZWNyeXB0IGFsbCB5b3VyIGZpbGVzIHF1aWNrbHkgYW5kIHNhZmVseSEgICAgTGV0J3Mgc3RhcnQgZGVjcnlwdGluZyFROiAgV2hhdCBkbyBJIGRvP0E6ICBGaXJzdCwgeW91IG5lZWQgdG8gcGF5IHNlcnZpY2UgZmVlcyBmb3IgdGhlIGRlY3J5cHRpb24uICAgIFBsZWFzZSBzZW5kICQzMDAgd29ydGggb2YgYml0Y29pbiB0byB0aGlzIGJpdGNvaW4gYWRkcmVzczogMTE1cDdVTU1uZ29qMXBNdmtwSGlqY1JkZkpOWGo2THJMbiAgICBOZXh0LCBwbGVhc2UgZmluZCBhbiBhcHBsaWNhdGlvbiBmaWxlIG5hbWVkICJAV2FuYURlY3J5cHRvckAuZXhlIi4gSXQgaXMgdGhlIGRlY3J5cHQgc29mdHdhcmUuICAgIFJ1biBhbmQgZm9sbG93IHRoZSBpbnN0cnVjdGlvbnMhIChZb3UgbWF5IG5lZWQgdG8gZGlzYWJsZSB5b3VyIGFudGl2aXJ1cyBmb3IgYSB3aGlsZS4pICAgIFE6ICBIb3cgY2FuIEkgdHJ1c3Q/QTogIERvbid0IHdvcnJ5IGFib3V0IGRlY3J5cHRpb24uICAgIFdlIHdpbGwgZGVjcnlwdCB5b3VyIGZpbGVzIHN1cmVseSBiZWNhdXNlIG5vYm9keSB3aWxsIHRydXN0IHVzIGlmIHdlIGNoZWF0IHVzZXJzLiAgICAqICAgSWYgeW91IG5lZWQgb3VyIGFzc2lzdGFuY2UsIHNlbmQgYSBtZXNzYWdlIGJ5IGNsaWNraW5nIDxDb250YWN0IFVzPiBvbiB0aGUgZGVjcnlwdG9yIHdpbmRvdy4=57:T448,UTogIFdoYXQncyB3cm9uZyB3aXRoIG15IGZpbGVzP0E6ICBPb29wcywgeW91ciBpbXBvcnRhbnQgZmlsZXMgYXJlIGVuY3J5cHRlZC4gSXQgbWVhbnMgeW91IHdpbGwgbm90IGJlIGFibGUgdG8gYWNjZXNzIHRoZW0gYW55bW9yZSB1bnRpbCB0aGV5IGFyZSBkZWNyeXB0ZWQuICAgIElmIHlvdSBmb2xsb3cgb3VyIGluc3RydWN0aW9ucywgd2UgZ3VhcmFudGVlIHRoYXQgeW91IGNhbiBkZWNyeXB0IGFsbCB5b3VyIGZpbGVzIHF1aWNrbHkgYW5kIHNhZmVseSEgICAgTGV0J3Mgc3RhcnQgZGVjcnlwdGluZyFROiAgV2hhdCBkbyBJIGRvP0E6ICBGaXJzdCwgeW91IG5lZWQgdG8gcGF5IHNlcnZpY2UgZmVlcyBmb3IgdGhlIGRlY3J5cHRpb24uICAgIFBsZWFzZSBzZW5kICVzIHRvIHRoaXMgYml0Y29pbiBhZGRyZXNzOiAlcyAgICBOZXh0LCBwbGVhc2UgZmluZCBhbiBhcHBsaWNhdGlvbiBmaWxlIG5hbWVkICIlcyIuIEl0IGlzIHRoZSBkZWNyeXB0IHNvZnR3YXJlLiAgICBSdW4gYW5kIGZvbGxvdyB0aGUgaW5zdHJ1Y3Rpb25zISAoWW91IG1heSBuZWVkIHRvIGRpc2FibGUgeW91ciBhbnRpdmlydXMgZm9yIGEgd2hpbGUuKSAgICBROiAgSG93IGNhbiBJIHRydXN0P0E6ICBEb24ndCB3b3JyeSBhYm91dCBkZWNyeXB0aW9uLiAgICBXZSB3aWxsIGRlY3J5cHQgeW91ciBmaWxlcyBzdXJlbHkgYmVjYXVzZSBub2JvZHkgd2lsbCB0cnVzdCB1cyBpZiB3ZSBjaGVhdCB1c2Vycy4gICAgKiAgIElmIHlvdSBuZWVkIG91ciBhc3Npc3RhbmNlLCBzZW5kIGEgbWVzc2FnZSBieSBjbGlja2luZyA8Q29udGFjdCBVcz4gb24gdGhlIGRlY3J5cHRvciB3aW5kb3cu58:T4dec,IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLlJpY2hhLnRleHRgLnJkYXRhQC5kYXRhLnJzcmNoWDRBX15bZGh4NEE9MFZBPTBWQVQkSFNVVj08VUFMJFhQUS00VUFRUmhUTCRYUF9eXVtkSHRySFdqI2hEJCBoU2pAUFNqMGggU2pAaF9eW2R0NVZqRCR0VlZWUFZEJGQ7RCRoO1BTU1NTU1NoIEwkMGpTVVZXX15dM2gxNUFoUDBBdGspRV9eXVtfXl0zaG41QUQkVFJoVCRUUVJEJCxRUFQkLFFSRCQgUDVsVUE9WFVBVCRkaEQkXFBUJFxRUkwkXFFMJDhQUkQkOFBUJDRRUkwkXFFMJEhQUkQkSFBUJDhRUlQkIFJEJCg7PXBVQUQkZGhMJFxRVCRkaEQkXFBMJDRQUUQkIHQmVCQ0U1JMJFhQUTl0JCB1VCQoUl9eQFtTVVZXMF5dW3RqU1YzUVNVVnQkIFdfXl1bX15dW2RfXltkRmBQaEggajBRUWowUlFqMFBXajBRX15dW19eXVtoIDZBRCQgK0wkJF9oXDZBVCQkU1JMJCRRTCQoUV9eXVtkPTBWQWh7NkE9MFZBakBoLFQkKFdSPSxRQUQkKFJTVmhsLXhVQUwkXGhMJFw7VCQgaHBEJCBQakQkIVxSUEQkKFxEJCBQaj0wVkFoOTdBUVNVVkZIMFpBPUhWQV9eXVtkaHY3QUAgV1JoTCRcX15kUmo8UHRoV1ZEJCRQTCQgXmQ7QVR9aDheQWhQMEFoSF5BaFAwQVJWU1doOEFGZERaQUZwMFpBaE44QUggajBRUWowUldqMFBXajBQaHA4QUQkICtMJCRfX15dW19eXVtGIGghOFZLdSZEJCBQVCQkUVJUJCBRTCQoX15dW2RoQzlBTiBQUUQkQD9MJEBqUVVSUEQkKFBEJDhRM0QkNFBUJHRSUEQkPFBRXCRoU1wkaFNQVCQsUlVQfiU5RCRMJDBAO0QkOF9EJCRQNWBQQVQkMFJeXVtkeXBfXnlwX15oUFpAaHY6QWhlPEFTVVZXX15dW2RGYFBoU1VWVzUwVkFDIFJqNSxWQVBqJ1FoMD5BRCQgK0wkJF91Kl9eXTN1X15dM19eXVtoYT5BPTxVQTUwVkFoeD5BPTBWQUQkNGpMJCRfXmQtMFZBUlZoS0wkIGpEJCBqaHViRjtEJChUVCQgUl9eXVtTVVZXPXRQQS14UEE9MFZBSCBqMFFRajBSUWowUEggajBRUWowUlVqMFBIIGowUVFqMFJRajBQU2owUUQkOFBMJChQVCQ8UVJUJCAlTCQmUlQkJiVMJEhRVCQ4UFFSVCQgJUwkJlJUJCYlX15dZFNVVjN0JCAzRCQyJVJQV1FEJEhoIEwkOFE1MFZBX15dW2R3YnRTPXc4dCl3N3QoPXV3aDhfXV5baHc/QTVIVUFEJEhoUVJoVEwkYFBEJEBSaEQtOFVBdFRWal9eXVtTVVZXNUhVQVJQaFRUJDhRdC9TakBoU2owaGBfXl1bZFNQU2heXVtkaFVAQUQkTDNWIFNTaEwkYFBRRCQgXGdBRCQwUFQkMCtMJDhQK0QkKFFMJExQUVJMJExQUUwkTFJMJGA7O0QkZEwkUCtEJEwrbCRkK0QkdHQgflRdO0QkRFJEJGh1TCRoUVBEJGhQRCRIUVBMJDBoIFQkTCtUJEwrTCQwaCBUJEwrVCRMK0QkKDtfXltkaHtAQVJXVVBRUldQX15dZEQkNFNVVkQkJDtUJCA7VCQ4fUwkMFBRRCQoUFFfXl1bRCR8U1QkLCtUJCArLVRQQUQkMHUzRCQ0RFpBTCQkJVQkPFJEJFBTUFQkQFJEJGRTUEwkRDtKTCRsX15dW2RoTUFBTCQoK08gVVVqMVFEJFR8Z0FEJGh4Z0F0JHxqRCR8cGdBRCQodDJRajxSZ2ZmZkQkKDNEJCwzTCQwUFNRRCQsdVQkNCtMJDBQRCQ8K0QkSFJEJEhQTCRIUUwkMFBEJDRRUFNMJDhRU0QkIFFQRCR4cGdBRCRkeGdBRCRQfGdBTCRUUF9eXVtkaGhBQWggQkFEJChWdCQsK2g4QkFoWEJBVCQgUlQkIFJUJCBSRCQgUFQkIFJUJCBSVCQgUlQkIFJUJCBSVCQgUlQkIFJQTCQsfGwkJDNUJCRASlQkJHVEJCQ7VCQoK3wkMDtEJCR8TCQmM0wkKDNMJCh0JkwkJzNMJCw7RCQkfEwkLDtEJDB+akwkJzNEJDB8RCQsM3QkODNUJCxdMkQkIGhEJDAzTCQgQEQkJDNEJDwzRCQ8M0QkPDNEJCQzRCRAMkwkMF4yRCQ0aFQkRFFSX15dW0wkICtUJCwlRCQgK0QkRDJfXl1bRCQ0aFQkRFFSX15dW0wkICtUJCwlRCQgK0QkRDJfXl1bdCQoM1QkIDNEJCBVUHQkLDtfXl1bdCQsRnQkLDtfXl1bVCQsMzlEJCxyX15dW3RbV2pfXl0yX15dMl9eXVt8JF1oTCRoaFQkXFJoSCFCdV9eRCRcalBRUlJoVCQwZlQkZFJMJChqU1VWV0QkJFBUJCRRUkQkJFFQTCRAUUwkPFFfXl1bZEQkIHQnRCQ4alQkPFFSOXQkIHVqY1BoamNRaEghQlQkJGpjUmhTVldoU2ggTj0wVkFTaCJOX15bZFNVVldoVWggTlVoIk5fXl1bZFNVVlcwXl1bdGlTVjNoMUNBX15dW19eXVtkX15dW19eXVtfXl1bUVZXan45U1VHUDJdW19eX15dM19eXVtSKD0zJ0wkIDtfXl1bdV5dM1IoPTMnX15dW1loSENBaGhDQUQkOmZcJCxmXCQqZj18VkFQaH5mTCQsalQkRFFMJDxRVlBofmZEJCRgX15dM3wkIGZTVVZXRCQkJF9eXVtNPFNWUXUwX15dW1l0JCRXV1ZRUjNEJDBzTCQockQkKCNEJCwzTCQockQkKCNEJCwzTCQockQkKCNMJChyRCQoI1QkMFJXVkQkIHNEJCA7QUg7TixUJDBSV1ZEJCBzRCQgO19eXVtUJDBSV1ZfXl1bX15dW0wkMFFXVl9eXVtUJDBSV1ZfXl1bX15dW19eXVtHKFJQRzBfXlcoVlJHKFNqVyhRUkcoVlBcJDxVVkQkKFZMJDBQVCQ4UUQkQFJQRCREVlFMJFBSUFFMJCRzVCQgdSxUJCQ7TCQgK0QkSHJOKFBRRCRIckQkSHJEJEhyVCQkc1QkOHM7RCRIckwkICNUJCBKVCQgdUwkSFJRTCQwUkQkREwkJFZSVCQoUFFSTihQUUQkUCtfXl1bX15dW19eXVtUJFBSVlNfXl1bX15dW19eXVtWKFFSX15dW19eXVtEJFBQVl9eXVtWKFFSX15dW1YoUVJfXl1bX15dW0s0UFZTX15dW19eXVtfXl1bTihQUUYoUlBOKFdROXQkVHU6X15dMzk4dUFUJCx2VCszeCVBdCREeXQkREJMJCw7VCQsK0wkSDtEJDErVCQwKztEJDxzITtEJDxyfCQ4TSNMJCxCO3QkRDN8JCBqTCQgUlVQalcoU1JeXV9bWVcoU1JeXV9bWVwkLFVWQyhXakwkNFJUJCxQUWhMJDhSVCQoUEQkMFFoQyhXUF9eXVtZSyhXUV9eXVtZSyhXUV9eXVtZSyhXUV9eXVtZUyhXUl9eXVtZUyhXUl9eXVtZTCQoU1V0JDAjdCQ0I0wkLCtsJCgrbCQoK0dGTXVHRkl1R0ZJdUdGSXVcJDgrezRfXl0zXCQ4K3s0X15dXCQ4K3s0X15dTihQUX4oOX4kdV9eXVtfXl1bX15dW19eXVtEJCBfXl10JCAzX15dM19eXVtEJCBqTCQgUWo8MFB1W19eXUQkIFBWRCQgO0QkPFBWTCRAUVZUJCRSVkwkQFV8JDxodCQgK3wkZDNEJCBQUVQkSFJQTCQsUVJEJChQUVQkLFJQTCQwUVJEJDRQUVQkOFJQTCQ8UVJEJEBQUVQkRFJQRCQwVVQkfDtMJGxqRCQ8K0QkbGpWKFFSVkYoUlBWRCQgUFFMJCBRUkwkIDtEJCBQUVQkIFJQVCQgUlBUJCBSUDtHSHQ5X3x0V3hWNHR3fF9eW1NVVlczTCQkO19eXTNGcFJQRlBXUlBfXl1bX15dM19eXVtfXl1bdV9edV9eRCQgZj9QUWZQV1FWX15dWUQkTFJQUUQkQFJMJFhQUVJEJCBqTCQwUFFXdDQrU1VWV19eXTNfXl0zX15dW19eXVtMJDBRVnVnX15dTCQsUWotTFFBUFZRV19eXVtRU1doRHQkLDslfFRBJXhUQSV0VEElcFRBJWxUQSVoVEElZFRBJWBUQSVcVEElWFRBJVRUQSVQVEElTFRBJUhUQSVEVEElQFRBJTxUQSU4VEElNFRBJTBUQSUsVEElKFRBJSRUQSUgVEElfFNBJXhTQSV0U0ElcFNBJWxTQSVoU0ElZFNBJWBTQSVcU0ElWFNBJVRTQSVMU0ElSFNBJURTQSVAU0ElPFNBJThTQSU0U0ElMFNBJSxTQSUoU0ElJFNBJSBTQSUkUkEldFFBJXhRQSV8UUElIFJBJShSQSUsUkElMFJBJTRSQSU4UkElPFJBJUBSQSVEUkElSFJBJUxSQSVQUkElVFJBJVhSQSVcUkElYFJBJWRSQSVoUkElbFJBJXBSQSV0UkEleFJBJXxSQSUsVUElMFVBJThVQSU8VUElQFVBJURVQSVIVUElTFVBJVxVQSVgVUElZFVBaFAwQWhTVlc+InU6RlhQVlNTJXxVQVdWUzMlKFVBJVBTQWN8d3s5SkxYfj1kXWxwSFBQMDBgfSsrVj1qJiZMWjY2bEE/P35cNDRoUzExYj9lIyNGXmknJ050LCxYLk07O3ZhfXspKVI+cS8vXmAgIEBnSzk5clUzM2ZEPDx4IUg4OHBjISFCMEc9PXpmIiJEfioqVFYyMmROOjp0bCQkSFk3N25vJSVKci4uXCRCPj58XzU1angoKFB6KXctLVpUMDBgUCsrVn0mJkxqNjZsWj8/fkFPNDRoXHMxMWJTUiMjRmUmJydOaSwsWHQ2LW5uOzt2TSkpUns+Ly9ecSwgIEBgOTlyS0pKMzNmVTw8eEQ4OHBIdSEhQmM9PXpHZGQyK3NzIiJEZioqVH47MjJkVjo6dE4kJEhsXFxDNzduWW1tJSVKby4uXHI+IUtLPj58QjU1al9XVyIzaWkoKFB4LS1adzBgUDBnK1Z9KyZMaiY2bFo2P35BPzRoXDQxYlMxI0ZlIydOaScsWHQsUjt2TTspUnspL15xLyBAYCA5cks5Sk0zZlUzUDx4RDw4cEg4IUJjIX49ekc9ZCJEZiIqVH4qMmRWMjp0TjokSGwkXDduWTdteCVKbyUuXHIucD58Qj5hNWpfNVdVKFB4KC1ady1gUDAwZ2dWfSsrTGomJmxaNjZ+QT8/aFw0NFFiUzExKj9GZSMjTmknJ1h0LCw0LlJSdk07O1J7KSlecS8vQGAgIHJLOTlNTWZVMzNQUHhEPDwlcEg4OEJjISEgMERELjl+fnpHPT1dXTIrRGYiIlR+Kio7ZFYyMnROOjpIbCQkblk3N3h4Sm8lJVxyLi44JHR0PiFwcHxCPj5xYWFqXzU1VVVQeCgoWnctLVFTZUF+IXRYKWlYaEhwTnJabD0nOS02ZDouNiRhaUt3WjtmRDR+W3YpQ2NCQCJfamJGflQxMSM/KjAsNCQ4X0BJPChBdFxsSEJXUVBlQX5TMCBVbXYtIXRYU2JFd2RoSHBYVWYqKCsySHByWmxOOS02J1xoIVRbLjYkOmdLd1ppWzQpQ0Z+VGIjPyoxX1tvPT40JDgsQHBcbEh0V0F+U2VgM1NiRStIcFhoRXBabE5yLTYnOVQ2JDouIHdaaUsqIjxDWzR+Q35UYkZ4WW4/KjEjZk50NyQ4LDRsSHRcQldRUH5TZUEhdEkpaWs+WCdgM1FiRXBYaEhDQGd3bE5yWjYnOS1UWyQ6LjZaaUt3O2ZbNH5fVGJGfngmbioxIz9oOCw0JDJIdFxsLDQkOCc5LTY6LjYkMSM/KlhoSHBTZUF+TnJabEVTYnRcbEhRZUZiRn5UaUt3Wix9Vno0JDgsOS02Jy42JDojPyoxaEhwWGVBflNyWmxOU2JFXGxIdFFlRkZ+VGJLd1ppJDgsNC02Jzk2JDouPyoxI0hwWGhBflNlWmxOclNiRWxIdFxlRlF+VGJGd1ppSypHejw4LDQkNic5LSQ6LjYqMSM/cFhoSH5TZUFsTnJaYkVTSHRcbEZRZVRiRn5aaUt3LH03eiBpbmZsYXRlIDEuMS4zIENvcHlyaWdodCAxOTk1LTE5OTggTWFyayBBZGxlciAgbjteUWtrYmFsaV1XYjlhJmdNR2lJd24+SmojLnpmK28qNy0gdW56aXAgMC4xNSBDb3B5cmlnaHQgMTk5OCBHaWxsZXMgVm9sbGFudCBNRkM0Mi5ETExfX0N4eEZyYW1lSGFuZGxlcmZjbG9zZWZyZWFkZm9wZW5zcHJpbnRmcmFuZGZ3cml0ZXRpbWVzcmFuZHdjc2NweXdjc2NhdHdjc2xlbl9mdG9sX2V4Y2VwdF9oYW5kbGVyM19sb2NhbF91bndpbmQyd2NzcmNocndjc2NtcHN3cHJpbnRmd2Nzc3RyZmdldHNzc2NhbmZzdHJuY21wX21ic2NtcF9fcF9fX2FyZ3ZfX3BfX19hcmdjc3RycmNocj8/MGV4Y2VwdGlvbkBAUUFFQEFCVjBAQFo/PzFleGNlcHRpb25AQFVBRUBYWj8/MGV4Y2VwdGlvbkBAUUFFQEFCUUJEQFpfQ3h4VGhyb3dFeGNlcHRpb25zdHJ0b2tzdHJuY3B5bWVtbW92ZV9wdXJlY2FsbGZyZWVjYWxsb2NtYWxsb2NfbWJzc3RycmVhbGxvY01TVkNSVC5kbGxfX2RsbG9uZXhpdF9vbmV4aXQ/PzF0eXBlX2luZm9AQFVBRUBYWl9leGl0X1hjcHRGaWx0ZXJleGl0X2FjbWRsbl9fZ2V0bWFpbmFyZ3NfaW5pdHRlcm1fX3NldHVzZXJtYXRoZXJyX2FkanVzdF9mZGl2X19wX19jb21tb2RlX19wX19mbW9kZV9fc2V0X2FwcF90eXBlX2NvbnRyb2xmcENyZWF0ZVRocmVhZERlbGV0ZUZpbGVBR2V0RmlsZUF0dHJpYnV0ZXNBQ2xvc2VIYW5kbGVUZXJtaW5hdGVUaHJlYWRXYWl0Rm9yU2luZ2xlT2JqZWN0R2V0RXhpdENvZGVQcm9jZXNzVGVybWluYXRlUHJvY2Vzc0NyZWF0ZVByb2Nlc3NBR2V0VGlja0NvdW50R2xvYmFsRnJlZUdldFByb2NBZGRyZXNzTG9hZExpYnJhcnlBR2xvYmFsQWxsb2NTZXRDdXJyZW50RGlyZWN0b3J5QUdldEN1cnJlbnREaXJlY3RvcnlBU2V0RmlsZVRpbWVTZXRGaWxlUG9pbnRlckV4U2V0RW5kT2ZGaWxlU2V0RmlsZVBvaW50ZXJHZXRGaWxlVGltZU11bHRpQnl0ZVRvV2lkZUNoYXJGaW5kQ2xvc2VGaW5kTmV4dEZpbGVXR2V0RmlsZUF0dHJpYnV0ZXNXRmluZEZpcnN0RmlsZVdDcmVhdGVGaWxlQUdldEV4aXRDb2RlVGhyZWFkR2xvYmFsVW5sb2NrR2xvYmFsTG9ja1dpZGVDaGFyVG9NdWx0aUJ5dGVHZXREaXNrRnJlZVNwYWNlRXhXR2V0RHJpdmVUeXBlV0dldExvZ2ljYWxEcml2ZXNGaW5kTmV4dEZpbGVBRmluZEZpcnN0RmlsZUFJbml0aWFsaXplQ3JpdGljYWxTZWN0aW9uRGVsZXRlQ3JpdGljYWxTZWN0aW9uUmVhZEZpbGVHZXRGaWxlU2l6ZVdyaXRlRmlsZUxlYXZlQ3JpdGljYWxTZWN0aW9uRW50ZXJDcml0aWNhbFNlY3Rpb25TbGVlcEV4aXRQcm9jZXNzR2V0TW9kdWxlRmlsZU5hbWVBR2V0TG9jYWxlSW5mb0FHZXRVc2VyRGVmYXVsdExhbmdJRFN5c3RlbVRpbWVUb1R6U3BlY2lmaWNMb2NhbFRpbWVHZXRUaW1lWm9uZUluZm9ybWF0aW9uQ29weUZpbGVXQ3JlYXRlRGlyZWN0b3J5QUdldFRlbXBGaWxlTmFtZUFDb3B5RmlsZUFHZXRDb21wdXRlck5hbWVBU3lzdGVtVGltZVRvRmlsZVRpbWVMb2NhbEZpbGVUaW1lVG9GaWxlVGltZUdldE1vZHVsZUhhbmRsZUFHZXRTdGFydHVwSW5mb0FLRVJORUwzMi5kbGxTZXRUaW1lclNlbmRNZXNzYWdlQUtpbGxUaW1lckVuYWJsZVdpbmRvd0dldENsaWVudFJlY3RDbG9zZUNsaXBib2FyZFNldENsaXBib2FyZERhdGFFbXB0eUNsaXBib2FyZE9wZW5DbGlwYm9hcmRMb2FkQ3Vyc29yQUdldFBhcmVudFNldEN1cnNvckludmFsaWRhdGVSZWN0UmVkcmF3V2luZG93RmlsbFJlY3RMb2FkSWNvbkFTZXRXaW5kb3dUZXh0V0RyYXdJY29uR2V0U3lzdGVtTWV0cmljc0lzSWNvbmljU3lzdGVtUGFyYW1ldGVyc0luZm9XU3lzdGVtUGFyYW1ldGVyc0luZm9BR2V0U3lzQ29sb3JPZmZzZXRSZWN0VGFiYmVkVGV4dE91dEFEcmF3VGV4dEFHcmF5U3RyaW5nQUJyaW5nV2luZG93VG9Ub3BTZXRBY3RpdmVXaW5kb3dTZXRGb2N1c1NldEZvcmVncm91bmRXaW5kb3dTZXRXaW5kb3dQb3NTaG93V2luZG93RmluZFdpbmRvd1d3c3ByaW50ZkFVU0VSMzIuZGxsQ3JlYXRlRm9udEFDcmVhdGVTb2xpZEJydXNoUGF0Qmx0Q3JlYXRlRm9udEluZGlyZWN0QUdldE9iamVjdEFHZXRUZXh0RXh0ZW50UG9pbnQzMkFEZWxldGVPYmplY3RCaXRCbHRDcmVhdGVDb21wYXRpYmxlRENHZXREZXZpY2VDYXBzR2V0Vmlld3BvcnRPcmdFeEdldFdpbmRvd09yZ0V4Q3JlYXRlUmVjdFJnbkNyZWF0ZUNvbXBhdGlibGVCaXRtYXBQdFZpc2libGVSZWN0VmlzaWJsZVRleHRPdXRBRXh0VGV4dE91dEFFc2NhcGVHREkzMi5kbGxGcmVlU2lkQ2hlY2tUb2tlbk1lbWJlcnNoaXBBbGxvY2F0ZUFuZEluaXRpYWxpemVTaWRSZWdDbG9zZUtleVJlZ1F1ZXJ5VmFsdWVFeEFSZWdDcmVhdGVLZXlXUmVnU2V0VmFsdWVFeEFDcnlwdFJlbGVhc2VDb250ZXh0R2V0VXNlck5hbWVBQURWQVBJMzIuZGxsU2hlbGxFeGVjdXRlRXhBU2hlbGxFeGVjdXRlQVNIR2V0Rm9sZGVyUGF0aFdTSEVMTDMyLmRsbF9UcmFja01vdXNlRXZlbnRDT01DVEwzMi5kbGxPTEVBVVQzMi5kbGxVUkxEb3dubG9hZFRvRmlsZUF1cmxtb24uZGxsPz8xPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQFFBRUBYWj9fQ0A/MT8/X051bGxzdHJAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQENBUEJHWFpANEdCP2Fzc2lnbkA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAUUFFQUFWMTJAUEJHSUBaP19UaWR5QD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEBBQUVYX05AWj9fRW9zQD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEBBQUVYSUBaP19Hcm93QD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEBBQUVfTklfTkBaP19TcGxpdEA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAQUFFWFhaP19YcmFuQHN0ZEBAWUFYWFo/bnBvc0A/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAMklCP19YbGVuQHN0ZEBAWUFYWFpNU1ZDUDYwLmRsbFdTMl8zMi5kbGxEZWxldGVVcmxDYWNoZUVudHJ5V0lOSU5FVC5kbGxfd2NzaWNtcF93Y3NuaWNtcF9zdHJuaWNtcF9zZXRtYmNwQ29ubmVjdGluZyB0byBzZXJ2ZXIuLi5zLnducnklMDhYLmVreSUwOFgucmVzMDAwMDAwMDAucmVzJTA4WC5ka3klMDhYLnBreUNvbm5lY3RlZFNlbnQgcmVxdWVzdFN1Y2NlZWRSZWNlaXZlZCByZXNwb25zZUNvbmdyYXR1bGF0aW9ucyEgWW91ciBwYXltZW50IGhhcyBiZWVuIGNoZWNrZWQhU3RhcnQgZGVjcnlwdGluZyBub3chRmFpbGVkIHRvIGNoZWNrIHlvdXIgcGF5bWVudCFQbGVhc2UgbWFrZSBzdXJlIHRoYXQgeW91ciBjb21wdXRlciBpcyBjb25uZWN0ZWQgdG8gdGhlIEludGVybmV0IGFuZCB5b3VyIEludGVybmV0IFNlcnZpY2UgUHJvdmlkZXIgKElTUCkgZG9lcyBub3QgYmxvY2sgY29ubmVjdGlvbnMgdG8gdGhlIFRPUiBOZXR3b3JrIVlvdSBkaWQgbm90IHBheSBvciB3ZSBkaWQgbm90IGNvbmZpcm1lZCB5b3VyIHBheW1lbnQhUGF5IG5vdyBpZiB5b3UgZGlkbid0IGFuZCBjaGVjayBhZ2FpbiBhZnRlciAyIGhvdXJzLkJlc3QgdGltZSB0byBjaGVjazogOTowMGFtIC0gMTE6MDBhbSBHTVQgZnJvbSBNb25kYXkgdG8gRnJpZGF5LllvdSBoYXZlIGEgbmV3IG1lc3NhZ2U6Yy53bnJ5cnVuYXNhZHZhcGkzMi5kbGwlMDRkLSUwMmQtJTAyZCAlMDJkOiUwMmQ6JTAyZFdBTkFDUlkhQ2xvc2VIYW5kbGVEZWxldGVGaWxlV01vdmVGaWxlRXhXTW92ZUZpbGVXUmVhZEZpbGVXcml0ZUZpbGVDcmVhdGVGaWxlV2tlcm5lbDMyLmRsbFBhdGhBcmlhbFBsZWFzZSBzZWxlY3QgYSBob3N0IHRvIGRlY3J5cHQuQWxsIHlvdXIgZmlsZXMgaGF2ZSBiZWVuIGRlY3J5cHRlZCFQYXkgbm93LCBpZiB5b3Ugd2FudCB0byBkZWNyeXB0IEFMTCB5b3VyIGZpbGVzIWYud25yeU15IENvbXB1dGVyKi5yZXNvcGVubWFpbHRvOlJTQTJDK00rbkNxJW08YTpsNkt5TW9dM3YgcUsiT3x4OCteX1ptI29tcDgsNSlhOTV5ZUZ6Mi9PLV8uWDh3Lit8fn0lLjE1cllbbmI1M100bExzMHw4TWljcm9zb2Z0IEVuaGFuY2VkIFJTQSBhbmQgQUVTIENyeXB0b2dyYXBoaWMgUHJvdmlkZXJURVNUREFUQUNyeXB0R2VuS2V5Q3J5cHREZWNyeXB0Q3J5cHRFbmNyeXB0Q3J5cHREZXN0cm95S2V5Q3J5cHRJbXBvcnRLZXlDcnlwdEFjcXVpcmVDb250ZXh0QSVzICVzY21kLmV4ZS9jIHZzc2FkbWluIGRlbGV0ZSBzaGFkb3dzIC9hbGwgL3F1aWV0ICYgd21pYyBzaGFkb3djb3B5IGRlbGV0ZSAmIGJjZGVkaXQgL3NldCB7ZGVmYXVsdH0gYm9vdHN0YXR1c3BvbGljeSBpZ25vcmVhbGxmYWlsdXJlcyAmIGJjZGVkaXQgL3NldCB7ZGVmYXVsdH0gcmVjb3ZlcnllbmFibGVkIG5vICYgd2JhZG1pbiBkZWxldGUgY2F0YWxvZyAtcXVpZXQxM0FNNFZXMmRoeFlnWGVRZXBvSGtIU1F1eTZOZ2FFYjk0RW5nbGlzaG1fJXMud25yeW1zZ1w8aHR0cHM6Ly88aHR0cDovLyVkLyVkLyVkICUwMmQ6JTAyZDolMDJkMDA7MDA7MDA7MDBodHRwOi8vd3d3LmJ0Y2Zyb2cuY29tL3FyL2JpdGNvaW5QTkcucGhwP2FkZHJlc3M9JXNtYWlsdG86JXNodHRwczovL3d3dy5nb29nbGUuY29tL3NlYXJjaD9xPWhvdyt0bytidXkrYml0Y29pbmh0dHBzOi8vZW4ud2lraXBlZGlhLm9yZy93aWtpL0JpdGNvaW5TZW5kICUuMWYgQlRDIHRvIHRoaXMgYWRkcmVzczolLjFmIEJUQ1NlbmQgJCVkIHdvcnRoIG9mIGJpdGNvaW4gdG8gdGhpcyBhZGRyZXNzOiUwMmQ7JTAyZDslMDJkOyUwMmRiLnducnktLS0lcyVzJWQlSTY0ZCVkRmFpbGVkIHRvIHNlbmQgeW91ciBtZXNzYWdlIVBsZWFzZSBtYWtlIHN1cmUgdGhhdCB5b3VyIGNvbXB1dGVyIGlzIGNvbm5lY3RlZCB0byB0aGUgSW50ZXJuZXQgYW5kIHlvdXIgSW50ZXJuZXQgU2VydmljZSBQcm92aWRlciAoSVNQKSBkb2VzIG5vdCBibG9jayBjb25uZWN0aW9ucyB0byB0aGUgVE9SIE5ldHdvcmshWW91ciBtZXNzYWdlIGhhcyBiZWVuIHNlbnQgc3VjY2Vzc2Z1bGx5IVlvdSBhcmUgc2VuZGluZyB0b28gbWFueSBtYWlscyEgUGxlYXNlIHRyeSBhZ2FpbiAlZCBtaW51dGVzIGxhdGVyLlRvbyBzaG9ydCBtZXNzYWdlISVkJSUuP0FWZXhjZXB0aW9uQEBOVklESUFBbWF6b25JbnRlbFNreXBlMzYwU2FmZVJpc2luZ1RlbmNlbnRNb3ppbGxhQWRvYmVZYWhvb0dvb2dsZWluY29tcGF0aWJsZSB2ZXJzaW9uYnVmZmVyIGVycm9yaW5zdWZmaWNpZW50IG1lbW9yeWRhdGEgZXJyb3JzdHJlYW0gZXJyb3JmaWxlIGVycm9yc3RyZWFtIGVuZG5lZWQgZGljdGlvbmFyeSVzXCVzdG9yLmV4ZSVzXCVzXCVzVGFza0RhdGF0YXNraHN2Yy5leGUxMjcuMC4wLjFtZW1vcnlpbnZhbGlkIGRpc3RhbmNlIGNvZGVpbnZhbGlkIGxpdGVyYWwvbGVuZ3RoIGNvZGVpbnZhbGlkIGJpdCBsZW5ndGggcmVwZWF0dG9vIG1hbnkgbGVuZ3RoIG9yIGRpc3RhbmNlIHN5bWJvbHNpbnZhbGlkIHN0b3JlZCBibG9jayBsZW5ndGhzaW52YWxpZCBibG9jayB0eXBlaW5jb21wbGV0ZSBkeW5hbWljIGJpdCBsZW5ndGhzIHRyZWVvdmVyc3Vic2NyaWJlZCBkeW5hbWljIGJpdCBsZW5ndGhzIHRyZWVpbmNvbXBsZXRlIGxpdGVyYWwvbGVuZ3RoIHRyZWVvdmVyc3Vic2NyaWJlZCBsaXRlcmFsL2xlbmd0aCB0cmVlZW1wdHkgZGlzdGFuY2UgdHJlZSB3aXRoIGxlbmd0aHNpbmNvbXBsZXRlIGRpc3RhbmNlIHRyZWVvdmVyc3Vic2NyaWJlZCBkaXN0YW5jZSB0cmVlMS4xLjNpbmNvcnJlY3QgZGF0YSBjaGVja2luY29ycmVjdCBoZWFkZXIgY2hlY2tpbnZhbGlkIHdpbmRvdyBzaXpldW5rbm93biBjb21wcmVzc2lvbiBtZXRob2QvLi5cLy4uL1wuLi9cLi5cJXMlcyVzJXMlcy4/QVZ0eXBlX2luZm9AQCIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiI=59:T13fc,IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLlJpY2hnLnYudGV4dGAucmRhdGFALmRhdGEucnNyY2hgIEBTVlczaFAxQGhQMUBoPDFAaCQxQGhsMEBoVDBAaEQwQGhEMEBoMDBAUWggMEBTU1NTU1VWVzNocDFAaGAxQF9eXVslNCBAaHAgQGhTVlc+InU6RlhQVlNTJSwgQCU8IEAlVCBAV2FpdEZvclNpbmdsZU9iamVjdEdldFByb2NBZGRyZXNzTG9hZExpYnJhcnlBR2V0TW9kdWxlSGFuZGxlQVNsZWVwS0VSTkVMMzIuZGxsX2V4Y2VwdF9oYW5kbGVyM19sb2NhbF91bndpbmQyX19wX19fYXJndl9fcF9fX2FyZ2NNU1ZDUlQuZGxsX2V4aXRfWGNwdEZpbHRlcmV4aXRfYWNtZGxuX19nZXRtYWluYXJnc19pbml0dGVybV9fc2V0dXNlcm1hdGhlcnJfYWRqdXN0X2ZkaXZfX3BfX2NvbW1vZGVfX3BfX2Ztb2RlX19zZXRfYXBwX3R5cGVfY29udHJvbGZwR2V0U3RhcnR1cEluZm9Bd2luc3RhMFxkZWZhdWx0U2VUY2JQcml2aWxlZ2VXVFNRdWVyeVVzZXJUb2tlbnd0c2FwaTMyLmRsbERlc3Ryb3lFbnZpcm9ubWVudEJsb2NrQ3JlYXRlRW52aXJvbm1lbnRCbG9ja3VzZXJlbnYuZGxsQ2xvc2VIYW5kbGVHZXRDdXJyZW50UHJvY2Vzc1dUU0dldEFjdGl2ZUNvbnNvbGVTZXNzaW9uSWRrZXJuZWwzMi5kbGxDcmVhdGVQcm9jZXNzQXNVc2VyQUR1cGxpY2F0ZVRva2VuRXhBZGp1c3RUb2tlblByaXZpbGVnZXNMb29rdXBQcml2aWxlZ2VWYWx1ZUFPcGVuUHJvY2Vzc1Rva2VuYWR2YXBpMzIuZGxsV1RTRnJlZU1lbW9yeVdUU0VudW1lcmF0ZVNlc3Npb25zQVd0c2FwaTMyLmRsbFBBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQUQ=5a:T167c,IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLlJpY2h5LnRleHRgLnJkYXRhQC5kYXRhLnJzcmN1PFZoXHUnVmggMEA9bCBATCQ4aFAwQFBoQDBARCQ4UlBEJEBoNDBAXCQoakwkOFFMJChqVCQ4VlJQTCQoVkwkKFFqX15dW2RTVVZXX15dM1NVVldfXl1bfCQkK0wkKFFWRCQkdUQkIFZQTCQgdUQkJFVQTCQkdUQkIF9eRCQgdF9eXVtRU1VWdCQgV19eXVtfXl1bZCVYIEAlXCBAaFNWVzV0MEA+InU6RlhQVlNTJWAgQCVoIEAleCBAJUwgQEdldFRlbXBQYXRoV0dldFdpbmRvd3NEaXJlY3RvcnlXRGVsZXRlRmlsZVdGaW5kQ2xvc2VGaW5kTmV4dEZpbGVXRmluZEZpcnN0RmlsZVdTbGVlcEdldERyaXZlVHlwZVdHZXRMb2dpY2FsRHJpdmVzS0VSTkVMMzIuZGxsPz8xPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQFFBRUBYWj9fQ0A/MT8/X051bGxzdHJAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQENBUEJHWFpANEdCP19Fb3NAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQEFBRVhJQFo/X0dyb3dAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQEFBRV9OSV9OQFo/X1RpZHlAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQEFBRVhfTkBaP2Fzc2lnbkA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAUUFFQUFWMTJAQUJWMTJASUlAWj9ucG9zQD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEAySUI/X1NwbGl0QD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEBBQUVYWFo/X1hyYW5Ac3RkQEBZQVhYWk1TVkNQNjAuZGxsc3dwcmludGZ3Y3NsZW5fX0N4eEZyYW1lSGFuZGxlcj8/MkBZQVBBWElAWmZyZWVNU1ZDUlQuZGxsX2V4aXRfWGNwdEZpbHRlcmV4aXRfYWNtZGxuX19nZXRtYWluYXJnc19pbml0dGVybV9fc2V0dXNlcm1hdGhlcnJfYWRqdXN0X2ZkaXZfX3BfX2NvbW1vZGVfX3BfX2Ztb2RlX19zZXRfYXBwX3R5cGVfZXhjZXB0X2hhbmRsZXIzX2NvbnRyb2xmcEdldE1vZHVsZUhhbmRsZUFHZXRTdGFydHVwSW5mb0FQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElORw==5b:T4a4,UTogIFdoYXQncyB3cm9uZyB3aXRoIG15IGZpbGVzP0E6ICBPb29wcywgeW91ciBpbXBvcnRhbnQgZmlsZXMgYXJlIGVuY3J5cHRlZC4gSXQgbWVhbnMgeW91IHdpbGwgbm90IGJlIGFibGUgdG8gYWNjZXNzIHRoZW0gYW55bW9yZSB1bnRpbCB0aGV5IGFyZSBkZWNyeXB0ZWQuICAgIElmIHlvdSBmb2xsb3cgb3VyIGluc3RydWN0aW9ucywgd2UgZ3VhcmFudGVlIHRoYXQgeW91IGNhbiBkZWNyeXB0IGFsbCB5b3VyIGZpbGVzIHF1aWNrbHkgYW5kIHNhZmVseSEgICAgTGV0J3Mgc3RhcnQgZGVjcnlwdGluZyFROiAgV2hhdCBkbyBJIGRvP0E6ICBGaXJzdCwgeW91IG5lZWQgdG8gcGF5IHNlcnZpY2UgZmVlcyBmb3IgdGhlIGRlY3J5cHRpb24uICAgIFBsZWFzZSBzZW5kICQzMDAgd29ydGggb2YgYml0Y29pbiB0byB0aGlzIGJpdGNvaW4gYWRkcmVzczogMTE1cDdVTU1uZ29qMXBNdmtwSGlqY1JkZkpOWGo2THJMbiAgICBOZXh0LCBwbGVhc2UgZmluZCBhbiBhcHBsaWNhdGlvbiBmaWxlIG5hbWVkICJAV2FuYURlY3J5cHRvckAuZXhlIi4gSXQgaXMgdGhlIGRlY3J5cHQgc29mdHdhcmUuICAgIFJ1biBhbmQgZm9sbG93IHRoZSBpbnN0cnVjdGlvbnMhIChZb3UgbWF5IG5lZWQgdG8gZGlzYWJsZSB5b3VyIGFudGl2aXJ1cyBmb3IgYSB3aGlsZS4pICAgIFE6ICBIb3cgY2FuIEkgdHJ1c3Q/QTogIERvbid0IHdvcnJ5IGFib3V0IGRlY3J5cHRpb24uICAgIFdlIHdpbGwgZGVjcnlwdCB5b3VyIGZpbGVzIHN1cmVseSBiZWNhdXNlIG5vYm9keSB3aWxsIHRydXN0IHVzIGlmIHdlIGNoZWF0IHVzZXJzLiAgICAqICAgSWYgeW91IG5lZWQgb3VyIGFzc2lzdGFuY2UsIHNlbmQgYSBtZXNzYWdlIGJ5IGNsaWNraW5nIDxDb250YWN0IFVzPiBvbiB0aGUgZGVjcnlwdG9yIHdpbmRvdy4=5c:T448,UTogIFdoYXQncyB3cm9uZyB3aXRoIG15IGZpbGVzP0E6ICBPb29wcywgeW91ciBpbXBvcnRhbnQgZmlsZXMgYXJlIGVuY3J5cHRlZC4gSXQgbWVhbnMgeW91IHdpbGwgbm90IGJlIGFibGUgdG8gYWNjZXNzIHRoZW0gYW55bW9yZSB1bnRpbCB0aGV5IGFyZSBkZWNyeXB0ZWQuICAgIElmIHlvdSBmb2xsb3cgb3VyIGluc3RydWN0aW9ucywgd2UgZ3VhcmFudGVlIHRoYXQgeW91IGNhbiBkZWNyeXB0IGFsbCB5b3VyIGZpbGVzIHF1aWNrbHkgYW5kIHNhZmVseSEgICAgTGV0J3Mgc3RhcnQgZGVjcnlwdGluZyFROiAgV2hhdCBkbyBJIGRvP0E6ICBGaXJzdCwgeW91IG5lZWQgdG8gcGF5IHNlcnZpY2UgZmVlcyBmb3IgdGhlIGRlY3J5cHRpb24uICAgIFBsZWFzZSBzZW5kICVzIHRvIHRoaXMgYml0Y29pbiBhZGRyZXNzOiAlcyAgICBOZXh0LCBwbGVhc2UgZmluZCBhbiBhcHBsaWNhdGlvbiBmaWxlIG5hbWVkICIlcyIuIEl0IGlzIHRoZSBkZWNyeXB0IHNvZnR3YXJlLiAgICBSdW4gYW5kIGZvbGxvdyB0aGUgaW5zdHJ1Y3Rpb25zISAoWW91IG1heSBuZWVkIHRvIGRpc2FibGUgeW91ciBhbnRpdmlydXMgZm9yIGEgd2hpbGUuKSAgICBROiAgSG93IGNhbiBJIHRydXN0P0E6ICBEb24ndCB3b3JyeSBhYm91dCBkZWNyeXB0aW9uLiAgICBXZSB3aWxsIGRlY3J5cHQgeW91ciBmaWxlcyBzdXJlbHkgYmVjYXVzZSBub2JvZHkgd2lsbCB0cnVzdCB1cyBpZiB3ZSBjaGVhdCB1c2Vycy4gICAgKiAgIElmIHlvdSBuZWVkIG91ciBhc3Npc3RhbmNlLCBzZW5kIGEgbWVzc2FnZSBieSBjbGlja2luZyA8Q29udGFjdCBVcz4gb24gdGhlIGRlY3J5cHRvciB3aW5kb3cu5d:T4dec,IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLlJpY2hhLnRleHRgLnJkYXRhQC5kYXRhLnJzcmNoWDRBX15bZGh4NEE9MFZBPTBWQVQkSFNVVj08VUFMJFhQUS00VUFRUmhUTCRYUF9eXVtkSHRySFdqI2hEJCBoU2pAUFNqMGggU2pAaF9eW2R0NVZqRCR0VlZWUFZEJGQ7RCRoO1BTU1NTU1NoIEwkMGpTVVZXX15dM2gxNUFoUDBBdGspRV9eXVtfXl0zaG41QUQkVFJoVCRUUVJEJCxRUFQkLFFSRCQgUDVsVUE9WFVBVCRkaEQkXFBUJFxRUkwkXFFMJDhQUkQkOFBUJDRRUkwkXFFMJEhQUkQkSFBUJDhRUlQkIFJEJCg7PXBVQUQkZGhMJFxRVCRkaEQkXFBMJDRQUUQkIHQmVCQ0U1JMJFhQUTl0JCB1VCQoUl9eQFtTVVZXMF5dW3RqU1YzUVNVVnQkIFdfXl1bX15dW2RfXltkRmBQaEggajBRUWowUlFqMFBXajBRX15dW19eXVtoIDZBRCQgK0wkJF9oXDZBVCQkU1JMJCRRTCQoUV9eXVtkPTBWQWh7NkE9MFZBakBoLFQkKFdSPSxRQUQkKFJTVmhsLXhVQUwkXGhMJFw7VCQgaHBEJCBQakQkIVxSUEQkKFxEJCBQaj0wVkFoOTdBUVNVVkZIMFpBPUhWQV9eXVtkaHY3QUAgV1JoTCRcX15kUmo8UHRoV1ZEJCRQTCQgXmQ7QVR9aDheQWhQMEFoSF5BaFAwQVJWU1doOEFGZERaQUZwMFpBaE44QUggajBRUWowUldqMFBXajBQaHA4QUQkICtMJCRfX15dW19eXVtGIGghOFZLdSZEJCBQVCQkUVJUJCBRTCQoX15dW2RoQzlBTiBQUUQkQD9MJEBqUVVSUEQkKFBEJDhRM0QkNFBUJHRSUEQkPFBRXCRoU1wkaFNQVCQsUlVQfiU5RCRMJDBAO0QkOF9EJCRQNWBQQVQkMFJeXVtkeXBfXnlwX15oUFpAaHY6QWhlPEFTVVZXX15dW2RGYFBoU1VWVzUwVkFDIFJqNSxWQVBqJ1FoMD5BRCQgK0wkJF91Kl9eXTN1X15dM19eXVtoYT5BPTxVQTUwVkFoeD5BPTBWQUQkNGpMJCRfXmQtMFZBUlZoS0wkIGpEJCBqaHViRjtEJChUVCQgUl9eXVtTVVZXPXRQQS14UEE9MFZBSCBqMFFRajBSUWowUEggajBRUWowUlVqMFBIIGowUVFqMFJRajBQU2owUUQkOFBMJChQVCQ8UVJUJCAlTCQmUlQkJiVMJEhRVCQ4UFFSVCQgJUwkJlJUJCYlX15dZFNVVjN0JCAzRCQyJVJQV1FEJEhoIEwkOFE1MFZBX15dW2R3YnRTPXc4dCl3N3QoPXV3aDhfXV5baHc/QTVIVUFEJEhoUVJoVEwkYFBEJEBSaEQtOFVBdFRWal9eXVtTVVZXNUhVQVJQaFRUJDhRdC9TakBoU2owaGBfXl1bZFNQU2heXVtkaFVAQUQkTDNWIFNTaEwkYFBRRCQgXGdBRCQwUFQkMCtMJDhQK0QkKFFMJExQUVJMJExQUUwkTFJMJGA7O0QkZEwkUCtEJEwrbCRkK0QkdHQgflRdO0QkRFJEJGh1TCRoUVBEJGhQRCRIUVBMJDBoIFQkTCtUJEwrTCQwaCBUJEwrVCRMK0QkKDtfXltkaHtAQVJXVVBRUldQX15dZEQkNFNVVkQkJDtUJCA7VCQ4fUwkMFBRRCQoUFFfXl1bRCR8U1QkLCtUJCArLVRQQUQkMHUzRCQ0RFpBTCQkJVQkPFJEJFBTUFQkQFJEJGRTUEwkRDtKTCRsX15dW2RoTUFBTCQoK08gVVVqMVFEJFR8Z0FEJGh4Z0F0JHxqRCR8cGdBRCQodDJRajxSZ2ZmZkQkKDNEJCwzTCQwUFNRRCQsdVQkNCtMJDBQRCQ8K0QkSFJEJEhQTCRIUUwkMFBEJDRRUFNMJDhRU0QkIFFQRCR4cGdBRCRkeGdBRCRQfGdBTCRUUF9eXVtkaGhBQWggQkFEJChWdCQsK2g4QkFoWEJBVCQgUlQkIFJUJCBSRCQgUFQkIFJUJCBSVCQgUlQkIFJUJCBSVCQgUlQkIFJQTCQsfGwkJDNUJCRASlQkJHVEJCQ7VCQoK3wkMDtEJCR8TCQmM0wkKDNMJCh0JkwkJzNMJCw7RCQkfEwkLDtEJDB+akwkJzNEJDB8RCQsM3QkODNUJCxdMkQkIGhEJDAzTCQgQEQkJDNEJDwzRCQ8M0QkPDNEJCQzRCRAMkwkMF4yRCQ0aFQkRFFSX15dW0wkICtUJCwlRCQgK0QkRDJfXl1bRCQ0aFQkRFFSX15dW0wkICtUJCwlRCQgK0QkRDJfXl1bdCQoM1QkIDNEJCBVUHQkLDtfXl1bdCQsRnQkLDtfXl1bVCQsMzlEJCxyX15dW3RbV2pfXl0yX15dMl9eXVt8JF1oTCRoaFQkXFJoSCFCdV9eRCRcalBRUlJoVCQwZlQkZFJMJChqU1VWV0QkJFBUJCRRUkQkJFFQTCRAUUwkPFFfXl1bZEQkIHQnRCQ4alQkPFFSOXQkIHVqY1BoamNRaEghQlQkJGpjUmhTVldoU2ggTj0wVkFTaCJOX15bZFNVVldoVWggTlVoIk5fXl1bZFNVVlcwXl1bdGlTVjNoMUNBX15dW19eXVtkX15dW19eXVtfXl1bUVZXan45U1VHUDJdW19eX15dM19eXVtSKD0zJ0wkIDtfXl1bdV5dM1IoPTMnX15dW1loSENBaGhDQUQkOmZcJCxmXCQqZj18VkFQaH5mTCQsalQkRFFMJDxRVlBofmZEJCRgX15dM3wkIGZTVVZXRCQkJF9eXVtNPFNWUXUwX15dW1l0JCRXV1ZRUjNEJDBzTCQockQkKCNEJCwzTCQockQkKCNEJCwzTCQockQkKCNMJChyRCQoI1QkMFJXVkQkIHNEJCA7QUg7TixUJDBSV1ZEJCBzRCQgO19eXVtUJDBSV1ZfXl1bX15dW0wkMFFXVl9eXVtUJDBSV1ZfXl1bX15dW19eXVtHKFJQRzBfXlcoVlJHKFNqVyhRUkcoVlBcJDxVVkQkKFZMJDBQVCQ4UUQkQFJQRCREVlFMJFBSUFFMJCRzVCQgdSxUJCQ7TCQgK0QkSHJOKFBRRCRIckQkSHJEJEhyVCQkc1QkOHM7RCRIckwkICNUJCBKVCQgdUwkSFJRTCQwUkQkREwkJFZSVCQoUFFSTihQUUQkUCtfXl1bX15dW19eXVtUJFBSVlNfXl1bX15dW19eXVtWKFFSX15dW19eXVtEJFBQVl9eXVtWKFFSX15dW1YoUVJfXl1bX15dW0s0UFZTX15dW19eXVtfXl1bTihQUUYoUlBOKFdROXQkVHU6X15dMzk4dUFUJCx2VCszeCVBdCREeXQkREJMJCw7VCQsK0wkSDtEJDErVCQwKztEJDxzITtEJDxyfCQ4TSNMJCxCO3QkRDN8JCBqTCQgUlVQalcoU1JeXV9bWVcoU1JeXV9bWVwkLFVWQyhXakwkNFJUJCxQUWhMJDhSVCQoUEQkMFFoQyhXUF9eXVtZSyhXUV9eXVtZSyhXUV9eXVtZSyhXUV9eXVtZUyhXUl9eXVtZUyhXUl9eXVtZTCQoU1V0JDAjdCQ0I0wkLCtsJCgrbCQoK0dGTXVHRkl1R0ZJdUdGSXVcJDgrezRfXl0zXCQ4K3s0X15dXCQ4K3s0X15dTihQUX4oOX4kdV9eXVtfXl1bX15dW19eXVtEJCBfXl10JCAzX15dM19eXVtEJCBqTCQgUWo8MFB1W19eXUQkIFBWRCQgO0QkPFBWTCRAUVZUJCRSVkwkQFV8JDxodCQgK3wkZDNEJCBQUVQkSFJQTCQsUVJEJChQUVQkLFJQTCQwUVJEJDRQUVQkOFJQTCQ8UVJEJEBQUVQkRFJQRCQwVVQkfDtMJGxqRCQ8K0QkbGpWKFFSVkYoUlBWRCQgUFFMJCBRUkwkIDtEJCBQUVQkIFJQVCQgUlBUJCBSUDtHSHQ5X3x0V3hWNHR3fF9eW1NVVlczTCQkO19eXTNGcFJQRlBXUlBfXl1bX15dM19eXVtfXl1bdV9edV9eRCQgZj9QUWZQV1FWX15dWUQkTFJQUUQkQFJMJFhQUVJEJCBqTCQwUFFXdDQrU1VWV19eXTNfXl0zX15dW19eXVtMJDBRVnVnX15dTCQsUWotTFFBUFZRV19eXVtRU1doRHQkLDslfFRBJXhUQSV0VEElcFRBJWxUQSVoVEElZFRBJWBUQSVcVEElWFRBJVRUQSVQVEElTFRBJUhUQSVEVEElQFRBJTxUQSU4VEElNFRBJTBUQSUsVEElKFRBJSRUQSUgVEElfFNBJXhTQSV0U0ElcFNBJWxTQSVoU0ElZFNBJWBTQSVcU0ElWFNBJVRTQSVMU0ElSFNBJURTQSVAU0ElPFNBJThTQSU0U0ElMFNBJSxTQSUoU0ElJFNBJSBTQSUkUkEldFFBJXhRQSV8UUElIFJBJShSQSUsUkElMFJBJTRSQSU4UkElPFJBJUBSQSVEUkElSFJBJUxSQSVQUkElVFJBJVhSQSVcUkElYFJBJWRSQSVoUkElbFJBJXBSQSV0UkEleFJBJXxSQSUsVUElMFVBJThVQSU8VUElQFVBJURVQSVIVUElTFVBJVxVQSVgVUElZFVBaFAwQWhTVlc+InU6RlhQVlNTJXxVQVdWUzMlKFVBJVBTQWN8d3s5SkxYfj1kXWxwSFBQMDBgfSsrVj1qJiZMWjY2bEE/P35cNDRoUzExYj9lIyNGXmknJ050LCxYLk07O3ZhfXspKVI+cS8vXmAgIEBnSzk5clUzM2ZEPDx4IUg4OHBjISFCMEc9PXpmIiJEfioqVFYyMmROOjp0bCQkSFk3N25vJSVKci4uXCRCPj58XzU1angoKFB6KXctLVpUMDBgUCsrVn0mJkxqNjZsWj8/fkFPNDRoXHMxMWJTUiMjRmUmJydOaSwsWHQ2LW5uOzt2TSkpUns+Ly9ecSwgIEBgOTlyS0pKMzNmVTw8eEQ4OHBIdSEhQmM9PXpHZGQyK3NzIiJEZioqVH47MjJkVjo6dE4kJEhsXFxDNzduWW1tJSVKby4uXHI+IUtLPj58QjU1al9XVyIzaWkoKFB4LS1adzBgUDBnK1Z9KyZMaiY2bFo2P35BPzRoXDQxYlMxI0ZlIydOaScsWHQsUjt2TTspUnspL15xLyBAYCA5cks5Sk0zZlUzUDx4RDw4cEg4IUJjIX49ekc9ZCJEZiIqVH4qMmRWMjp0TjokSGwkXDduWTdteCVKbyUuXHIucD58Qj5hNWpfNVdVKFB4KC1ady1gUDAwZ2dWfSsrTGomJmxaNjZ+QT8/aFw0NFFiUzExKj9GZSMjTmknJ1h0LCw0LlJSdk07O1J7KSlecS8vQGAgIHJLOTlNTWZVMzNQUHhEPDwlcEg4OEJjISEgMERELjl+fnpHPT1dXTIrRGYiIlR+Kio7ZFYyMnROOjpIbCQkblk3N3h4Sm8lJVxyLi44JHR0PiFwcHxCPj5xYWFqXzU1VVVQeCgoWnctLVFTZUF+IXRYKWlYaEhwTnJabD0nOS02ZDouNiRhaUt3WjtmRDR+W3YpQ2NCQCJfamJGflQxMSM/KjAsNCQ4X0BJPChBdFxsSEJXUVBlQX5TMCBVbXYtIXRYU2JFd2RoSHBYVWYqKCsySHByWmxOOS02J1xoIVRbLjYkOmdLd1ppWzQpQ0Z+VGIjPyoxX1tvPT40JDgsQHBcbEh0V0F+U2VgM1NiRStIcFhoRXBabE5yLTYnOVQ2JDouIHdaaUsqIjxDWzR+Q35UYkZ4WW4/KjEjZk50NyQ4LDRsSHRcQldRUH5TZUEhdEkpaWs+WCdgM1FiRXBYaEhDQGd3bE5yWjYnOS1UWyQ6LjZaaUt3O2ZbNH5fVGJGfngmbioxIz9oOCw0JDJIdFxsLDQkOCc5LTY6LjYkMSM/KlhoSHBTZUF+TnJabEVTYnRcbEhRZUZiRn5UaUt3Wix9Vno0JDgsOS02Jy42JDojPyoxaEhwWGVBflNyWmxOU2JFXGxIdFFlRkZ+VGJLd1ppJDgsNC02Jzk2JDouPyoxI0hwWGhBflNlWmxOclNiRWxIdFxlRlF+VGJGd1ppSypHejw4LDQkNic5LSQ6LjYqMSM/cFhoSH5TZUFsTnJaYkVTSHRcbEZRZVRiRn5aaUt3LH03eiBpbmZsYXRlIDEuMS4zIENvcHlyaWdodCAxOTk1LTE5OTggTWFyayBBZGxlciAgbjteUWtrYmFsaV1XYjlhJmdNR2lJd24+SmojLnpmK28qNy0gdW56aXAgMC4xNSBDb3B5cmlnaHQgMTk5OCBHaWxsZXMgVm9sbGFudCBNRkM0Mi5ETExfX0N4eEZyYW1lSGFuZGxlcmZjbG9zZWZyZWFkZm9wZW5zcHJpbnRmcmFuZGZ3cml0ZXRpbWVzcmFuZHdjc2NweXdjc2NhdHdjc2xlbl9mdG9sX2V4Y2VwdF9oYW5kbGVyM19sb2NhbF91bndpbmQyd2NzcmNocndjc2NtcHN3cHJpbnRmd2Nzc3RyZmdldHNzc2NhbmZzdHJuY21wX21ic2NtcF9fcF9fX2FyZ3ZfX3BfX19hcmdjc3RycmNocj8/MGV4Y2VwdGlvbkBAUUFFQEFCVjBAQFo/PzFleGNlcHRpb25AQFVBRUBYWj8/MGV4Y2VwdGlvbkBAUUFFQEFCUUJEQFpfQ3h4VGhyb3dFeGNlcHRpb25zdHJ0b2tzdHJuY3B5bWVtbW92ZV9wdXJlY2FsbGZyZWVjYWxsb2NtYWxsb2NfbWJzc3RycmVhbGxvY01TVkNSVC5kbGxfX2RsbG9uZXhpdF9vbmV4aXQ/PzF0eXBlX2luZm9AQFVBRUBYWl9leGl0X1hjcHRGaWx0ZXJleGl0X2FjbWRsbl9fZ2V0bWFpbmFyZ3NfaW5pdHRlcm1fX3NldHVzZXJtYXRoZXJyX2FkanVzdF9mZGl2X19wX19jb21tb2RlX19wX19mbW9kZV9fc2V0X2FwcF90eXBlX2NvbnRyb2xmcENyZWF0ZVRocmVhZERlbGV0ZUZpbGVBR2V0RmlsZUF0dHJpYnV0ZXNBQ2xvc2VIYW5kbGVUZXJtaW5hdGVUaHJlYWRXYWl0Rm9yU2luZ2xlT2JqZWN0R2V0RXhpdENvZGVQcm9jZXNzVGVybWluYXRlUHJvY2Vzc0NyZWF0ZVByb2Nlc3NBR2V0VGlja0NvdW50R2xvYmFsRnJlZUdldFByb2NBZGRyZXNzTG9hZExpYnJhcnlBR2xvYmFsQWxsb2NTZXRDdXJyZW50RGlyZWN0b3J5QUdldEN1cnJlbnREaXJlY3RvcnlBU2V0RmlsZVRpbWVTZXRGaWxlUG9pbnRlckV4U2V0RW5kT2ZGaWxlU2V0RmlsZVBvaW50ZXJHZXRGaWxlVGltZU11bHRpQnl0ZVRvV2lkZUNoYXJGaW5kQ2xvc2VGaW5kTmV4dEZpbGVXR2V0RmlsZUF0dHJpYnV0ZXNXRmluZEZpcnN0RmlsZVdDcmVhdGVGaWxlQUdldEV4aXRDb2RlVGhyZWFkR2xvYmFsVW5sb2NrR2xvYmFsTG9ja1dpZGVDaGFyVG9NdWx0aUJ5dGVHZXREaXNrRnJlZVNwYWNlRXhXR2V0RHJpdmVUeXBlV0dldExvZ2ljYWxEcml2ZXNGaW5kTmV4dEZpbGVBRmluZEZpcnN0RmlsZUFJbml0aWFsaXplQ3JpdGljYWxTZWN0aW9uRGVsZXRlQ3JpdGljYWxTZWN0aW9uUmVhZEZpbGVHZXRGaWxlU2l6ZVdyaXRlRmlsZUxlYXZlQ3JpdGljYWxTZWN0aW9uRW50ZXJDcml0aWNhbFNlY3Rpb25TbGVlcEV4aXRQcm9jZXNzR2V0TW9kdWxlRmlsZU5hbWVBR2V0TG9jYWxlSW5mb0FHZXRVc2VyRGVmYXVsdExhbmdJRFN5c3RlbVRpbWVUb1R6U3BlY2lmaWNMb2NhbFRpbWVHZXRUaW1lWm9uZUluZm9ybWF0aW9uQ29weUZpbGVXQ3JlYXRlRGlyZWN0b3J5QUdldFRlbXBGaWxlTmFtZUFDb3B5RmlsZUFHZXRDb21wdXRlck5hbWVBU3lzdGVtVGltZVRvRmlsZVRpbWVMb2NhbEZpbGVUaW1lVG9GaWxlVGltZUdldE1vZHVsZUhhbmRsZUFHZXRTdGFydHVwSW5mb0FLRVJORUwzMi5kbGxTZXRUaW1lclNlbmRNZXNzYWdlQUtpbGxUaW1lckVuYWJsZVdpbmRvd0dldENsaWVudFJlY3RDbG9zZUNsaXBib2FyZFNldENsaXBib2FyZERhdGFFbXB0eUNsaXBib2FyZE9wZW5DbGlwYm9hcmRMb2FkQ3Vyc29yQUdldFBhcmVudFNldEN1cnNvckludmFsaWRhdGVSZWN0UmVkcmF3V2luZG93RmlsbFJlY3RMb2FkSWNvbkFTZXRXaW5kb3dUZXh0V0RyYXdJY29uR2V0U3lzdGVtTWV0cmljc0lzSWNvbmljU3lzdGVtUGFyYW1ldGVyc0luZm9XU3lzdGVtUGFyYW1ldGVyc0luZm9BR2V0U3lzQ29sb3JPZmZzZXRSZWN0VGFiYmVkVGV4dE91dEFEcmF3VGV4dEFHcmF5U3RyaW5nQUJyaW5nV2luZG93VG9Ub3BTZXRBY3RpdmVXaW5kb3dTZXRGb2N1c1NldEZvcmVncm91bmRXaW5kb3dTZXRXaW5kb3dQb3NTaG93V2luZG93RmluZFdpbmRvd1d3c3ByaW50ZkFVU0VSMzIuZGxsQ3JlYXRlRm9udEFDcmVhdGVTb2xpZEJydXNoUGF0Qmx0Q3JlYXRlRm9udEluZGlyZWN0QUdldE9iamVjdEFHZXRUZXh0RXh0ZW50UG9pbnQzMkFEZWxldGVPYmplY3RCaXRCbHRDcmVhdGVDb21wYXRpYmxlRENHZXREZXZpY2VDYXBzR2V0Vmlld3BvcnRPcmdFeEdldFdpbmRvd09yZ0V4Q3JlYXRlUmVjdFJnbkNyZWF0ZUNvbXBhdGlibGVCaXRtYXBQdFZpc2libGVSZWN0VmlzaWJsZVRleHRPdXRBRXh0VGV4dE91dEFFc2NhcGVHREkzMi5kbGxGcmVlU2lkQ2hlY2tUb2tlbk1lbWJlcnNoaXBBbGxvY2F0ZUFuZEluaXRpYWxpemVTaWRSZWdDbG9zZUtleVJlZ1F1ZXJ5VmFsdWVFeEFSZWdDcmVhdGVLZXlXUmVnU2V0VmFsdWVFeEFDcnlwdFJlbGVhc2VDb250ZXh0R2V0VXNlck5hbWVBQURWQVBJMzIuZGxsU2hlbGxFeGVjdXRlRXhBU2hlbGxFeGVjdXRlQVNIR2V0Rm9sZGVyUGF0aFdTSEVMTDMyLmRsbF9UcmFja01vdXNlRXZlbnRDT01DVEwzMi5kbGxPTEVBVVQzMi5kbGxVUkxEb3dubG9hZFRvRmlsZUF1cmxtb24uZGxsPz8xPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQFFBRUBYWj9fQ0A/MT8/X051bGxzdHJAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQENBUEJHWFpANEdCP2Fzc2lnbkA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAUUFFQUFWMTJAUEJHSUBaP19UaWR5QD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEBBQUVYX05AWj9fRW9zQD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEBBQUVYSUBaP19Hcm93QD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEBBQUVfTklfTkBaP19TcGxpdEA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAQUFFWFhaP19YcmFuQHN0ZEBAWUFYWFo/bnBvc0A/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAMklCP19YbGVuQHN0ZEBAWUFYWFpNU1ZDUDYwLmRsbFdTMl8zMi5kbGxEZWxldGVVcmxDYWNoZUVudHJ5V0lOSU5FVC5kbGxfd2NzaWNtcF93Y3NuaWNtcF9zdHJuaWNtcF9zZXRtYmNwQ29ubmVjdGluZyB0byBzZXJ2ZXIuLi5zLnducnklMDhYLmVreSUwOFgucmVzMDAwMDAwMDAucmVzJTA4WC5ka3klMDhYLnBreUNvbm5lY3RlZFNlbnQgcmVxdWVzdFN1Y2NlZWRSZWNlaXZlZCByZXNwb25zZUNvbmdyYXR1bGF0aW9ucyEgWW91ciBwYXltZW50IGhhcyBiZWVuIGNoZWNrZWQhU3RhcnQgZGVjcnlwdGluZyBub3chRmFpbGVkIHRvIGNoZWNrIHlvdXIgcGF5bWVudCFQbGVhc2UgbWFrZSBzdXJlIHRoYXQgeW91ciBjb21wdXRlciBpcyBjb25uZWN0ZWQgdG8gdGhlIEludGVybmV0IGFuZCB5b3VyIEludGVybmV0IFNlcnZpY2UgUHJvdmlkZXIgKElTUCkgZG9lcyBub3QgYmxvY2sgY29ubmVjdGlvbnMgdG8gdGhlIFRPUiBOZXR3b3JrIVlvdSBkaWQgbm90IHBheSBvciB3ZSBkaWQgbm90IGNvbmZpcm1lZCB5b3VyIHBheW1lbnQhUGF5IG5vdyBpZiB5b3UgZGlkbid0IGFuZCBjaGVjayBhZ2FpbiBhZnRlciAyIGhvdXJzLkJlc3QgdGltZSB0byBjaGVjazogOTowMGFtIC0gMTE6MDBhbSBHTVQgZnJvbSBNb25kYXkgdG8gRnJpZGF5LllvdSBoYXZlIGEgbmV3IG1lc3NhZ2U6Yy53bnJ5cnVuYXNhZHZhcGkzMi5kbGwlMDRkLSUwMmQtJTAyZCAlMDJkOiUwMmQ6JTAyZFdBTkFDUlkhQ2xvc2VIYW5kbGVEZWxldGVGaWxlV01vdmVGaWxlRXhXTW92ZUZpbGVXUmVhZEZpbGVXcml0ZUZpbGVDcmVhdGVGaWxlV2tlcm5lbDMyLmRsbFBhdGhBcmlhbFBsZWFzZSBzZWxlY3QgYSBob3N0IHRvIGRlY3J5cHQuQWxsIHlvdXIgZmlsZXMgaGF2ZSBiZWVuIGRlY3J5cHRlZCFQYXkgbm93LCBpZiB5b3Ugd2FudCB0byBkZWNyeXB0IEFMTCB5b3VyIGZpbGVzIWYud25yeU15IENvbXB1dGVyKi5yZXNvcGVubWFpbHRvOlJTQTJDK00rbkNxJW08YTpsNkt5TW9dM3YgcUsiT3x4OCteX1ptI29tcDgsNSlhOTV5ZUZ6Mi9PLV8uWDh3Lit8fn0lLjE1cllbbmI1M100bExzMHw4TWljcm9zb2Z0IEVuaGFuY2VkIFJTQSBhbmQgQUVTIENyeXB0b2dyYXBoaWMgUHJvdmlkZXJURVNUREFUQUNyeXB0R2VuS2V5Q3J5cHREZWNyeXB0Q3J5cHRFbmNyeXB0Q3J5cHREZXN0cm95S2V5Q3J5cHRJbXBvcnRLZXlDcnlwdEFjcXVpcmVDb250ZXh0QSVzICVzY21kLmV4ZS9jIHZzc2FkbWluIGRlbGV0ZSBzaGFkb3dzIC9hbGwgL3F1aWV0ICYgd21pYyBzaGFkb3djb3B5IGRlbGV0ZSAmIGJjZGVkaXQgL3NldCB7ZGVmYXVsdH0gYm9vdHN0YXR1c3BvbGljeSBpZ25vcmVhbGxmYWlsdXJlcyAmIGJjZGVkaXQgL3NldCB7ZGVmYXVsdH0gcmVjb3ZlcnllbmFibGVkIG5vICYgd2JhZG1pbiBkZWxldGUgY2F0YWxvZyAtcXVpZXQxM0FNNFZXMmRoeFlnWGVRZXBvSGtIU1F1eTZOZ2FFYjk0RW5nbGlzaG1fJXMud25yeW1zZ1w8aHR0cHM6Ly88aHR0cDovLyVkLyVkLyVkICUwMmQ6JTAyZDolMDJkMDA7MDA7MDA7MDBodHRwOi8vd3d3LmJ0Y2Zyb2cuY29tL3FyL2JpdGNvaW5QTkcucGhwP2FkZHJlc3M9JXNtYWlsdG86JXNodHRwczovL3d3dy5nb29nbGUuY29tL3NlYXJjaD9xPWhvdyt0bytidXkrYml0Y29pbmh0dHBzOi8vZW4ud2lraXBlZGlhLm9yZy93aWtpL0JpdGNvaW5TZW5kICUuMWYgQlRDIHRvIHRoaXMgYWRkcmVzczolLjFmIEJUQ1NlbmQgJCVkIHdvcnRoIG9mIGJpdGNvaW4gdG8gdGhpcyBhZGRyZXNzOiUwMmQ7JTAyZDslMDJkOyUwMmRiLnducnktLS0lcyVzJWQlSTY0ZCVkRmFpbGVkIHRvIHNlbmQgeW91ciBtZXNzYWdlIVBsZWFzZSBtYWtlIHN1cmUgdGhhdCB5b3VyIGNvbXB1dGVyIGlzIGNvbm5lY3RlZCB0byB0aGUgSW50ZXJuZXQgYW5kIHlvdXIgSW50ZXJuZXQgU2VydmljZSBQcm92aWRlciAoSVNQKSBkb2VzIG5vdCBibG9jayBjb25uZWN0aW9ucyB0byB0aGUgVE9SIE5ldHdvcmshWW91ciBtZXNzYWdlIGhhcyBiZWVuIHNlbnQgc3VjY2Vzc2Z1bGx5IVlvdSBhcmUgc2VuZGluZyB0b28gbWFueSBtYWlscyEgUGxlYXNlIHRyeSBhZ2FpbiAlZCBtaW51dGVzIGxhdGVyLlRvbyBzaG9ydCBtZXNzYWdlISVkJSUuP0FWZXhjZXB0aW9uQEBOVklESUFBbWF6b25JbnRlbFNreXBlMzYwU2FmZVJpc2luZ1RlbmNlbnRNb3ppbGxhQWRvYmVZYWhvb0dvb2dsZWluY29tcGF0aWJsZSB2ZXJzaW9uYnVmZmVyIGVycm9yaW5zdWZmaWNpZW50IG1lbW9yeWRhdGEgZXJyb3JzdHJlYW0gZXJyb3JmaWxlIGVycm9yc3RyZWFtIGVuZG5lZWQgZGljdGlvbmFyeSVzXCVzdG9yLmV4ZSVzXCVzXCVzVGFza0RhdGF0YXNraHN2Yy5leGUxMjcuMC4wLjFtZW1vcnlpbnZhbGlkIGRpc3RhbmNlIGNvZGVpbnZhbGlkIGxpdGVyYWwvbGVuZ3RoIGNvZGVpbnZhbGlkIGJpdCBsZW5ndGggcmVwZWF0dG9vIG1hbnkgbGVuZ3RoIG9yIGRpc3RhbmNlIHN5bWJvbHNpbnZhbGlkIHN0b3JlZCBibG9jayBsZW5ndGhzaW52YWxpZCBibG9jayB0eXBlaW5jb21wbGV0ZSBkeW5hbWljIGJpdCBsZW5ndGhzIHRyZWVvdmVyc3Vic2NyaWJlZCBkeW5hbWljIGJpdCBsZW5ndGhzIHRyZWVpbmNvbXBsZXRlIGxpdGVyYWwvbGVuZ3RoIHRyZWVvdmVyc3Vic2NyaWJlZCBsaXRlcmFsL2xlbmd0aCB0cmVlZW1wdHkgZGlzdGFuY2UgdHJlZSB3aXRoIGxlbmd0aHNpbmNvbXBsZXRlIGRpc3RhbmNlIHRyZWVvdmVyc3Vic2NyaWJlZCBkaXN0YW5jZSB0cmVlMS4xLjNpbmNvcnJlY3QgZGF0YSBjaGVja2luY29ycmVjdCBoZWFkZXIgY2hlY2tpbnZhbGlkIHdpbmRvdyBzaXpldW5rbm93biBjb21wcmVzc2lvbiBtZXRob2QvLi5cLy4uL1wuLi9cLi5cJXMlcyVzJXMlcy4/QVZ0eXBlX2luZm9AQCIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiI=5e:T13fc,IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLlJpY2hnLnYudGV4dGAucmRhdGFALmRhdGEucnNyY2hgIEBTVlczaFAxQGhQMUBoPDFAaCQxQGhsMEBoVDBAaEQwQGhEMEBoMDBAUWggMEBTU1NTU1VWVzNocDFAaGAxQF9eXVslNCBAaHAgQGhTVlc+InU6RlhQVlNTJSwgQCU8IEAlVCBAV2FpdEZvclNpbmdsZU9iamVjdEdldFByb2NBZGRyZXNzTG9hZExpYnJhcnlBR2V0TW9kdWxlSGFuZGxlQVNsZWVwS0VSTkVMMzIuZGxsX2V4Y2VwdF9oYW5kbGVyM19sb2NhbF91bndpbmQyX19wX19fYXJndl9fcF9fX2FyZ2NNU1ZDUlQuZGxsX2V4aXRfWGNwdEZpbHRlcmV4aXRfYWNtZGxuX19nZXRtYWluYXJnc19pbml0dGVybV9fc2V0dXNlcm1hdGhlcnJfYWRqdXN0X2ZkaXZfX3BfX2NvbW1vZGVfX3BfX2Ztb2RlX19zZXRfYXBwX3R5cGVfY29udHJvbGZwR2V0U3RhcnR1cEluZm9Bd2luc3RhMFxkZWZhdWx0U2VUY2JQcml2aWxlZ2VXVFNRdWVyeVVzZXJUb2tlbnd0c2FwaTMyLmRsbERlc3Ryb3lFbnZpcm9ubWVudEJsb2NrQ3JlYXRlRW52aXJvbm1lbnRCbG9ja3VzZXJlbnYuZGxsQ2xvc2VIYW5kbGVHZXRDdXJyZW50UHJvY2Vzc1dUU0dldEFjdGl2ZUNvbnNvbGVTZXNzaW9uSWRrZXJuZWwzMi5kbGxDcmVhdGVQcm9jZXNzQXNVc2VyQUR1cGxpY2F0ZVRva2VuRXhBZGp1c3RUb2tlblByaXZpbGVnZXNMb29rdXBQcml2aWxlZ2VWYWx1ZUFPcGVuUHJvY2Vzc1Rva2VuYWR2YXBpMzIuZGxsV1RTRnJlZU1lbW9yeVdUU0VudW1lcmF0ZVNlc3Npb25zQVd0c2FwaTMyLmRsbFBBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQUQ=5f:T167c,IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLlJpY2h5LnRleHRgLnJkYXRhQC5kYXRhLnJzcmN1PFZoXHUnVmggMEA9bCBATCQ4aFAwQFBoQDBARCQ4UlBEJEBoNDBAXCQoakwkOFFMJChqVCQ4VlJQTCQoVkwkKFFqX15dW2RTVVZXX15dM1NVVldfXl1bfCQkK0wkKFFWRCQkdUQkIFZQTCQgdUQkJFVQTCQkdUQkIF9eRCQgdF9eXVtRU1VWdCQgV19eXVtfXl1bZCVYIEAlXCBAaFNWVzV0MEA+InU6RlhQVlNTJWAgQCVoIEAleCBAJUwgQEdldFRlbXBQYXRoV0dldFdpbmRvd3NEaXJlY3RvcnlXRGVsZXRlRmlsZVdGaW5kQ2xvc2VGaW5kTmV4dEZpbGVXRmluZEZpcnN0RmlsZVdTbGVlcEdldERyaXZlVHlwZVdHZXRMb2dpY2FsRHJpdmVzS0VSTkVMMzIuZGxsPz8xPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQFFBRUBYWj9fQ0A/MT8/X051bGxzdHJAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQENBUEJHWFpANEdCP19Fb3NAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQEFBRVhJQFo/X0dyb3dAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQEFBRV9OSV9OQFo/X1RpZHlAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQEFBRVhfTkBaP2Fzc2lnbkA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAUUFFQUFWMTJAQUJWMTJASUlAWj9ucG9zQD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEAySUI/X1NwbGl0QD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEBBQUVYWFo/X1hyYW5Ac3RkQEBZQVhYWk1TVkNQNjAuZGxsc3dwcmludGZ3Y3NsZW5fX0N4eEZyYW1lSGFuZGxlcj8/MkBZQVBBWElAWmZyZWVNU1ZDUlQuZGxsX2V4aXRfWGNwdEZpbHRlcmV4aXRfYWNtZGxuX19nZXRtYWluYXJnc19pbml0dGVybV9fc2V0dXNlcm1hdGhlcnJfYWRqdXN0X2ZkaXZfX3BfX2NvbW1vZGVfX3BfX2Ztb2RlX19zZXRfYXBwX3R5cGVfZXhjZXB0X2hhbmRsZXIzX2NvbnRyb2xmcEdldE1vZHVsZUhhbmRsZUFHZXRTdGFydHVwSW5mb0FQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElORw==60:T4a4,UTogIFdoYXQncyB3cm9uZyB3aXRoIG15IGZpbGVzP0E6ICBPb29wcywgeW91ciBpbXBvcnRhbnQgZmlsZXMgYXJlIGVuY3J5cHRlZC4gSXQgbWVhbnMgeW91IHdpbGwgbm90IGJlIGFibGUgdG8gYWNjZXNzIHRoZW0gYW55bW9yZSB1bnRpbCB0aGV5IGFyZSBkZWNyeXB0ZWQuICAgIElmIHlvdSBmb2xsb3cgb3VyIGluc3RydWN0aW9ucywgd2UgZ3VhcmFudGVlIHRoYXQgeW91IGNhbiBkZWNyeXB0IGFsbCB5b3VyIGZpbGVzIHF1aWNrbHkgYW5kIHNhZmVseSEgICAgTGV0J3Mgc3RhcnQgZGVjcnlwdGluZyFROiAgV2hhdCBkbyBJIGRvP0E6ICBGaXJzdCwgeW91IG5lZWQgdG8gcGF5IHNlcnZpY2UgZmVlcyBmb3IgdGhlIGRlY3J5cHRpb24uICAgIFBsZWFzZSBzZW5kICQzMDAgd29ydGggb2YgYml0Y29pbiB0byB0aGlzIGJpdGNvaW4gYWRkcmVzczogMTE1cDdVTU1uZ29qMXBNdmtwSGlqY1JkZkpOWGo2THJMbiAgICBOZXh0LCBwbGVhc2UgZmluZCBhbiBhcHBsaWNhdGlvbiBmaWxlIG5hbWVkICJAV2FuYURlY3J5cHRvckAuZXhlIi4gSXQgaXMgdGhlIGRlY3J5cHQgc29mdHdhcmUuICAgIFJ1biBhbmQgZm9sbG93IHRoZSBpbnN0cnVjdGlvbnMhIChZb3UgbWF5IG5lZWQgdG8gZGlzYWJsZSB5b3VyIGFudGl2aXJ1cyBmb3IgYSB3aGlsZS4pICAgIFE6ICBIb3cgY2FuIEkgdHJ1c3Q/QTogIERvbid0IHdvcnJ5IGFib3V0IGRlY3J5cHRpb24uICAgIFdlIHdpbGwgZGVjcnlwdCB5b3VyIGZpbGVzIHN1cmVseSBiZWNhdXNlIG5vYm9keSB3aWxsIHRydXN0IHVzIGlmIHdlIGNoZWF0IHVzZXJzLiAgICAqICAgSWYgeW91IG5lZWQgb3VyIGFzc2lzdGFuY2UsIHNlbmQgYSBtZXNzYWdlIGJ5IGNsaWNraW5nIDxDb250YWN0IFVzPiBvbiB0aGUgZGVjcnlwdG9yIHdpbmRvdy4=61:T448,UTogIFdoYXQncyB3cm9uZyB3aXRoIG15IGZpbGVzP0E6ICBPb29wcywgeW91ciBpbXBvcnRhbnQgZmlsZXMgYXJlIGVuY3J5cHRlZC4gSXQgbWVhbnMgeW91IHdpbGwgbm90IGJlIGFibGUgdG8gYWNjZXNzIHRoZW0gYW55bW9yZSB1bnRpbCB0aGV5IGFyZSBkZWNyeXB0ZWQuICAgIElmIHlvdSBmb2xsb3cgb3VyIGluc3RydWN0aW9ucywgd2UgZ3VhcmFudGVlIHRoYXQgeW91IGNhbiBkZWNyeXB0IGFsbCB5b3VyIGZpbGVzIHF1aWNrbHkgYW5kIHNhZmVseSEgICAgTGV0J3Mgc3RhcnQgZGVjcnlwdGluZyFROiAgV2hhdCBkbyBJIGRvP0E6ICBGaXJzdCwgeW91IG5lZWQgdG8gcGF5IHNlcnZpY2UgZmVlcyBmb3IgdGhlIGRlY3J5cHRpb24uICAgIFBsZWFzZSBzZW5kICVzIHRvIHRoaXMgYml0Y29pbiBhZGRyZXNzOiAlcyAgICBOZXh0LCBwbGVhc2UgZmluZCBhbiBhcHBsaWNhdGlvbiBmaWxlIG5hbWVkICIlcyIuIEl0IGlzIHRoZSBkZWNyeXB0IHNvZnR3YXJlLiAgICBSdW4gYW5kIGZvbGxvdyB0aGUgaW5zdHJ1Y3Rpb25zISAoWW91IG1heSBuZWVkIHRvIGRpc2FibGUgeW91ciBhbnRpdmlydXMgZm9yIGEgd2hpbGUuKSAgICBROiAgSG93IGNhbiBJIHRydXN0P0E6ICBEb24ndCB3b3JyeSBhYm91dCBkZWNyeXB0aW9uLiAgICBXZSB3aWxsIGRlY3J5cHQgeW91ciBmaWxlcyBzdXJlbHkgYmVjYXVzZSBub2JvZHkgd2lsbCB0cnVzdCB1cyBpZiB3ZSBjaGVhdCB1c2Vycy4gICAgKiAgIElmIHlvdSBuZWVkIG91ciBhc3Npc3RhbmNlLCBzZW5kIGEgbWVzc2FnZSBieSBjbGlja2luZyA8Q29udGFjdCBVcz4gb24gdGhlIGRlY3J5cHRvciB3aW5kb3cu1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"job_id":"67f14d588cdd2a74670f9f6b","environment_id":140,"environment_description":"Windows 11 64 bit","size":3514368,"type":"PE32 executable (GUI) Intel 80386, for MS Windows","type_short":["peexe","executable"],"type_short_id":"exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"WannaCry.exe.sample","md5":"84c82835a5d21bbcf75a61706d8ab549","sha1":"5ff465afaabcbf0150d1a3ab2c2e74f3a4426467","sha256":"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa","sha512":"90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244","ssdeep":"98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB","imphash":"68f013d7437aa653a8a98a05807afeb1","entrypoint":"0x4077ba","entrypoint_section":".text","image_base":"0x400000","subsystem":"Windows Gui","image_file_characteristics":["RELOCS_STRIPPED","EXECUTABLE_IMAGE","LINE_NUMS_STRIPPED","LOCAL_SYMS_STRIPPED","32BIT_MACHINE"],"dll_characteristics":[],"major_os_version":"4","minor_os_version":"0","av_detect":87,"vx_family":null,"url_analysis":false,"analysis_start_time":"2025-04-05T15:33:46+00:00","threat_score":100,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[],"is_certificates_valid":false,"certificates_validation_message":"No signature was present in the subject. (0x800b0100)","domains":[],"compromised_hosts":[],"hosts":[],"total_network_connections":0,"total_processes":32,"total_signatures":230,"extracted_files":[{"name":"88831743893367.bat","file_path":"C:\\88831743893367.bat","file_size":278,"md5":"fefe6b30d0819f1a1775e14730a10e0e","sha1":"6d461ff1eddb21957383f8840e55c9674b81efc2","sha256":"f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077","sha512":"00130e489d0d8c1be39afc6eea9847d26747045c5fdfbc2ae3103fc73dc0cff17ad448ccf7a1033fdf6cd77cc67be017dd477a83e2c85e7569c858b0102fecb1","type_tags":["text"],"description":"DOS batch file, ASCII text, with CRLF, CR line terminators","runtime_process":"cmd.exe (PID: 3516)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=3a59ac2f4d1384b9b051f7ee38efe70a6ac466da08a9bafc1a2118304b164294285e1ea1eec8fb666d6eb46f73e7a5eaded82b17f92785cdfd8a0aa8fb6f9d6d97b9b7f71f8795dcf21ec7a9e2","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=3a59ac2f4d1384b9b051f7ee38efe70a6ac466da08a9bafc1a2118304b164294285e1ea1eec8fb666d6eb46f73e7a5eaded82b17f92785cdfd8a0aa8fb6f9d6d97b9b7f71f8795dcf21ec7a9e2","has_overview":true,"extended_details":null},{"name":"m.vbs","file_path":"C:\\m.vbs","file_size":157,"md5":"800446ec5d8b6041f6b08693d8aa1d53","sha1":"39b9e242af021ee4daa31956f5e786f5d8f9d62c","sha256":"51432d3196d9b78bdc9867a77d601caffd4adaa66dcac944a5ba0b3112bbea3b","sha512":"48fe611107dc9e62982f0812db89d8f91a795dab738ba3a9b21be1fe1b50d32b7375d2930cd9b1a1eb2164e386973b5b06c208aee20660f50249f6f1ece081d2","type_tags":["text"],"description":"ASCII text, with CRLF line terminators","runtime_process":"cmd.exe (PID: 3516)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=0b1b9edf763f16c5bb04a78305e54ea553b249cde9719b919ce9101c64f712da0b058f13d7a3654203f3f8d5b682e200645a3f4b16938509fe2c774f8c77dd55","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=0b1b9edf763f16c5bb04a78305e54ea553b249cde9719b919ce9101c64f712da0b058f13d7a3654203f3f8d5b682e200645a3f4b16938509fe2c774f8c77dd55","has_overview":true,"extended_details":null},{"name":"@Please_Read_Me@.txt","file_path":"C:\\@Please_Read_Me@.txt","file_size":933,"md5":"f97d2e6f8d820dbd3b66f21137de4f09","sha1":"596799b75b5d60aa9cd45646f68e9c0bd06df252","sha256":"0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a","sha512":"efda21d83464a6a32fdeef93152ffd32a648130754fdd3635f7ff61cc1664f7fc050900f0f871b0ddd3a3846222bf62ab5df8eed42610a76be66fff5f7b4c4c0","type_tags":["text"],"description":"ASCII text, with CRLF line terminators","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=d91446106f5c66f80cb082a5bfd2b6aa0ab30e74fba55aa5192b960c7c44c03ac3767a745c86bbf0649cfceb58cfe5e1056a1f8f760cb1bcbd841b02dbaadda55afcb799dc7b9952911d9e3712","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=d91446106f5c66f80cb082a5bfd2b6aa0ab30e74fba55aa5192b960c7c44c03ac3767a745c86bbf0649cfceb58cfe5e1056a1f8f760cb1bcbd841b02dbaadda55afcb799dc7b9952911d9e3712","has_overview":true,"extended_details":null},{"name":"@WanaDecryptor@.exe.lnk","file_path":"C:\\@WanaDecryptor@.exe.lnk","file_size":523,"md5":"ef4fdc8edb170d419e2a4a8a9efd4bf4","sha1":"9531fd066099612e1ab4cb7c60bb7b8db4e1beb7","sha256":"1e9c01bcd9bed619087d5500839a25e5c78127792c7b3479458fc40499fa2cfd","sha512":"0cdda09addde91ef7d10718c400d755ec10f93be7ad231118d6e25d4a7b5b3e2db3fbc5561951beb5356c0f1563978d1d4c921cdf0aca7fbdaa3df9c3bdf92bd","type_tags":["lnk"],"description":"MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Apr 5 22:49:27 2025, mtime=Sat Apr 5 22:49:27 2025, atime=Fri May 12 09:22:56 2017, length=245760, window=hide","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=7a0ee55a38718cdaa42b93d4101b2adfd945cefe1817c16cf38c32ca49aed40c03c545ae2ed69fea65a7262ed5d11b5b4760fd820597883dc0d2833db32040aeb01b38f81aa06ac4f8ccc2ad998019214e70","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=7a0ee55a38718cdaa42b93d4101b2adfd945cefe1817c16cf38c32ca49aed40c03c545ae2ed69fea65a7262ed5d11b5b4760fd820597883dc0d2833db32040aeb01b38f81aa06ac4f8ccc2ad998019214e70","has_overview":true,"extended_details":null},{"name":"f.wnry","file_path":"C:\\f.wnry","file_size":429,"md5":"0216a901e03e48c98dac95b25c7f489c","sha1":"7bcfb28bc264d844ca3368c06f59fbfc49374680","sha256":"6609284ec15271b31ff44c5e8e961db8bd8251f73b3fc16c29767f6712312cfa","sha512":"4bfb6a2b56a3aabdf62c9986a5d64d16ac3b57e8c1054651fefd3bf689706679bea0e705d2f2896080b70e9e852828a0a9c5f473e0462e71670eafdf0e50a54a","type_tags":["text"],"description":"ASCII text, with CRLF line terminators","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=ca9f5c912e03e7aa2e6bdf6421993769d54e94ef6e28a118dffe50cf3a48479ab9eec992b37091c449b04f2fea13a89097d0f4b38a5a37b5c1e46ba886b1c8c98d","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=ca9f5c912e03e7aa2e6bdf6421993769d54e94ef6e28a118dffe50cf3a48479ab9eec992b37091c449b04f2fea13a89097d0f4b38a5a37b5c1e46ba886b1c8c98d","has_overview":false,"extended_details":null},{"name":"m_bulgarian.wnry","file_path":"C:\\msg\\m_bulgarian.wnry","file_size":47879,"md5":"95673b0f968c0f55b32204361940d184","sha1":"81e427d15a1a826b93e91c3d2fa65221c8ca9cff","sha256":"40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd","sha512":"7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92","type_tags":["rtf"],"description":"Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=4d207a4c9cbe835d560b8d0ac3785bb9002a19d7bf97a322fd491c57e5b779bd61fda2e1a4838b63acf80501070e330f448d6d741c370763b87023960d139f518b7f7d3fb69c177a0b4767","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=4d207a4c9cbe835d560b8d0ac3785bb9002a19d7bf97a322fd491c57e5b779bd61fda2e1a4838b63acf80501070e330f448d6d741c370763b87023960d139f518b7f7d3fb69c177a0b4767","has_overview":true,"extended_details":null},{"name":"m_croatian.wnry","file_path":"C:\\msg\\m_croatian.wnry","file_size":39070,"md5":"17194003fa70ce477326ce2f6deeb270","sha1":"e325988f68d327743926ea317abb9882f347fa73","sha256":"3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171","sha512":"dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c","type_tags":["rtf"],"description":"Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=2e095eb6dcbcfc6f27833268ed055585324aea72e19436b21fb9d210756bf23a19caa6734371c937bc14703daf0c1d1d9bb33e42fe9bed974648e19c7b525d4f62837ff32d32ec1493","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=2e095eb6dcbcfc6f27833268ed055585324aea72e19436b21fb9d210756bf23a19caa6734371c937bc14703daf0c1d1d9bb33e42fe9bed974648e19c7b525d4f62837ff32d32ec1493","has_overview":true,"extended_details":null},{"name":"m_czech.wnry","file_path":"C:\\msg\\m_czech.wnry","file_size":40512,"md5":"537efeecdfa94cc421e58fd82a58ba9e","sha1":"3609456e16bc16ba447979f3aa69221290ec17d0","sha256":"5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150","sha512":"e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b","type_tags":["rtf"],"description":"Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=b936f4e06dbf2f4eca2282b3202d6029b7e5ef3a3a7062c6a5b792c1840626e168953b4074278f67888a3e83576e8bcbb9ba0ba0f7cd41245f4caf626016d157253799a324240c","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=b936f4e06dbf2f4eca2282b3202d6029b7e5ef3a3a7062c6a5b792c1840626e168953b4074278f67888a3e83576e8bcbb9ba0ba0f7cd41245f4caf626016d157253799a324240c","has_overview":true,"extended_details":null},{"name":"m_danish.wnry","file_path":"C:\\msg\\m_danish.wnry","file_size":37045,"md5":"2c5a3b81d5c4715b7bea01033367fcb5","sha1":"b548b45da8463e17199daafd34c23591f94e82cd","sha256":"a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6","sha512":"490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3","type_tags":["rtf"],"description":"Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=21118aac36aebb069eb9ed4e4c33c177c7cf35240e073e5f3e67ad7ca37d5c8ff03f367e93c54319d7fabe3b81a92aaf6768162cb39192b095f3e8e738b81389ba613c77e783959b","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=21118aac36aebb069eb9ed4e4c33c177c7cf35240e073e5f3e67ad7ca37d5c8ff03f367e93c54319d7fabe3b81a92aaf6768162cb39192b095f3e8e738b81389ba613c77e783959b","has_overview":true,"extended_details":null},{"name":"m_dutch.wnry","file_path":"C:\\msg\\m_dutch.wnry","file_size":36987,"md5":"7a8d499407c6a647c03c4471a67eaad7","sha1":"d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b","sha256":"2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c","sha512":"608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12","type_tags":["rtf"],"description":"Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=87f3cc0b85662e5530f797059b6fdad0d25137599045e6b91b87fda5aacc796db1d6a6b145eba776b0b0f50c5bd8ebcec1f1fcaa80cf446ef5544b2edb848e909246a03125aeed","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=87f3cc0b85662e5530f797059b6fdad0d25137599045e6b91b87fda5aacc796db1d6a6b145eba776b0b0f50c5bd8ebcec1f1fcaa80cf446ef5544b2edb848e909246a03125aeed","has_overview":true,"extended_details":null},{"name":"m_english.wnry","file_path":"C:\\msg\\m_english.wnry","file_size":36973,"md5":"fe68c2dc0d2419b38f44d83f2fcf232e","sha1":"6c6e49949957215aa2f3dfb72207d249adf36283","sha256":"26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5","sha512":"941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810","type_tags":["rtf"],"description":"Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=ce52509658afea2008e27734dacb920ea7e4c62e4dfabb6c9e9cd963920a4588d4b272c33d5324239da292472771b106fb7109a479bb7cfbdc1642428df07dbf814c2d5d56fb8a84c3","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=ce52509658afea2008e27734dacb920ea7e4c62e4dfabb6c9e9cd963920a4588d4b272c33d5324239da292472771b106fb7109a479bb7cfbdc1642428df07dbf814c2d5d56fb8a84c3","has_overview":true,"extended_details":null},{"name":"m_filipino.wnry","file_path":"C:\\msg\\m_filipino.wnry","file_size":37580,"md5":"08b9e69b57e4c9b966664f8e1c27ab09","sha1":"2da1025bbbfb3cd308070765fc0893a48e5a85fa","sha256":"d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324","sha512":"966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4","type_tags":["rtf"],"description":"Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=e8943ffdb1126d50d5dddbfe570dd228a132e2aaedd2f3585a4e2ff306ca9c805d6cd69ec9e8a42d2a1e1e74c60f02abcdd4b8ef5e28b28ad1254a4112ba522a4406e17531ee21ddcfcc","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=e8943ffdb1126d50d5dddbfe570dd228a132e2aaedd2f3585a4e2ff306ca9c805d6cd69ec9e8a42d2a1e1e74c60f02abcdd4b8ef5e28b28ad1254a4112ba522a4406e17531ee21ddcfcc","has_overview":true,"extended_details":null},{"name":"m_finnish.wnry","file_path":"C:\\msg\\m_finnish.wnry","file_size":38377,"md5":"35c2f97eea8819b1caebd23fee732d8f","sha1":"e354d1cc43d6a39d9732adea5d3b0f57284255d2","sha256":"1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e","sha512":"908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf","type_tags":["rtf"],"description":"Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=b21ef5a97105e8cc6136bee612ebb3ce7aaf24b0b5052e27111e5ee97d18cf4410a0f8ac952dbc690efde2a400fec814c545e4d335257315f18b7716c192fa4901dd6977c81d51c43e","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=b21ef5a97105e8cc6136bee612ebb3ce7aaf24b0b5052e27111e5ee97d18cf4410a0f8ac952dbc690efde2a400fec814c545e4d335257315f18b7716c192fa4901dd6977c81d51c43e","has_overview":true,"extended_details":null},{"name":"m_french.wnry","file_path":"C:\\msg\\m_french.wnry","file_size":38437,"md5":"4e57113a6bf6b88fdd32782a4a381274","sha1":"0fccbc91f0f94453d91670c6794f71348711061d","sha256":"9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc","sha512":"4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9","type_tags":["rtf"],"description":"Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=2f006c74822ac07a972dce71dd6bc765e37316090105ba52bac9a3f3ef23f40f2b36744646dd0cce63861b2445d027ce4e59ee96638eab90191b9edb0e749c8355baf184f3b84f","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=2f006c74822ac07a972dce71dd6bc765e37316090105ba52bac9a3f3ef23f40f2b36744646dd0cce63861b2445d027ce4e59ee96638eab90191b9edb0e749c8355baf184f3b84f","has_overview":true,"extended_details":null},{"name":"m_german.wnry","file_path":"C:\\msg\\m_german.wnry","file_size":37181,"md5":"3d59bbb5553fe03a89f817819540f469","sha1":"26781d4b06ff704800b463d0f1fca3afd923a9fe","sha256":"2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61","sha512":"95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac","type_tags":["rtf"],"description":"Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=55435b45b2d908fcf2246488c4823b858b78049fc582c53584ff42c487221d5803c722878c0fb8bdfe3a5fe5603fbe15af58483277b1330c1d25742777216749f74cb2d4e1745317","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=55435b45b2d908fcf2246488c4823b858b78049fc582c53584ff42c487221d5803c722878c0fb8bdfe3a5fe5603fbe15af58483277b1330c1d25742777216749f74cb2d4e1745317","has_overview":true,"extended_details":null},{"name":"m_greek.wnry","file_path":"C:\\msg\\m_greek.wnry","file_size":49044,"md5":"fb4e8718fea95bb7479727fde80cb424","sha1":"1088c7653cba385fe994e9ae34a6595898f20aeb","sha256":"e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9","sha512":"24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb","type_tags":["rtf"],"description":"Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=6d69ed4021033d3cca0489766b0be60011da3a68699ccda3dee743e7e42382385a0349d15af9eb3102722cf068c6fae0166770b612d46c94b0d127f330327ad3164af6f5c28f47","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=6d69ed4021033d3cca0489766b0be60011da3a68699ccda3dee743e7e42382385a0349d15af9eb3102722cf068c6fae0166770b612d46c94b0d127f330327ad3164af6f5c28f47","has_overview":true,"extended_details":null},{"name":"m_indonesian.wnry","file_path":"C:\\msg\\m_indonesian.wnry","file_size":37196,"md5":"3788f91c694dfc48e12417ce93356b0f","sha1":"eb3b87f7f654b604daf3484da9e02ca6c4ea98b7","sha256":"23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4","sha512":"b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd","type_tags":["rtf"],"description":"Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=49c1389b05cd4521d628721bb2ba0f8c9751d81affb6baf8d2810fd63abc9e99a8b6ea5a3609a257857cb2e9c8eae6e400f487cd2de6925579e122ce2d370b36fedb42f982b50e4dfa051495","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=49c1389b05cd4521d628721bb2ba0f8c9751d81affb6baf8d2810fd63abc9e99a8b6ea5a3609a257857cb2e9c8eae6e400f487cd2de6925579e122ce2d370b36fedb42f982b50e4dfa051495","has_overview":true,"extended_details":null},{"name":"m_italian.wnry","file_path":"C:\\msg\\m_italian.wnry","file_size":36883,"md5":"30a200f78498990095b36f574b6e8690","sha1":"c4b1b3c087bd12b063e98bca464cd05f3f7b7882","sha256":"49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07","sha512":"c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511","type_tags":["rtf"],"description":"Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=df45f643201a57c221643588ae288fe3b563e01cf9aa8dd8a99125cc605c8e41ee9389148bcbbe13f2b5174b15b2a5cc59827a7e6cd7d1fa6e963c052c393ebd1bf4baf47feea8b73e","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=df45f643201a57c221643588ae288fe3b563e01cf9aa8dd8a99125cc605c8e41ee9389148bcbbe13f2b5174b15b2a5cc59827a7e6cd7d1fa6e963c052c393ebd1bf4baf47feea8b73e","has_overview":true,"extended_details":null},{"name":"m_japanese.wnry","file_path":"C:\\msg\\m_japanese.wnry","file_size":81844,"md5":"b77e1221f7ecd0b5d696cb66cda1609e","sha1":"51eb7a254a33d05edf188ded653005dc82de8a46","sha256":"7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e","sha512":"f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc","type_tags":["rtf"],"description":"Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=16a4722b884ea7b6505b61fa7db82f3828bc26b9db6c196d41e36cb54ca7b05f2cf894b723c52a7a121c4c136c4e323521268d7dca95c9460b58b69258c0a8d9a8b14218ee679cb0ad","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=16a4722b884ea7b6505b61fa7db82f3828bc26b9db6c196d41e36cb54ca7b05f2cf894b723c52a7a121c4c136c4e323521268d7dca95c9460b58b69258c0a8d9a8b14218ee679cb0ad","has_overview":true,"extended_details":null},{"name":"m_korean.wnry","file_path":"C:\\msg\\m_korean.wnry","file_size":91501,"md5":"6735cb43fe44832b061eeb3f5956b099","sha1":"d636daf64d524f81367ea92fdafa3726c909bee1","sha256":"552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0","sha512":"60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e","type_tags":["rtf"],"description":"Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=117d2ad1fe2b6eeb96e7b2034b3115d29f666f459e730a84b1099d112db87a833e338ad617ab6afb6010a6f14694492ee23245b0dfb0b2d3d0343419960eb68f5d4973cc7cc081ac","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=117d2ad1fe2b6eeb96e7b2034b3115d29f666f459e730a84b1099d112db87a833e338ad617ab6afb6010a6f14694492ee23245b0dfb0b2d3d0343419960eb68f5d4973cc7cc081ac","has_overview":true,"extended_details":null},{"name":"taskdl.exe","file_path":"C:\\taskdl.exe","file_size":20480,"md5":"4fef5e34143e646dbf9907c4374276f5","sha1":"47a9ad4125b6bd7c55e4e7da251e23f089407b8f","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","sha512":"4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5","type_tags":["peexe","executable"],"description":"PE32 executable (GUI) Intel 80386, for MS Windows","runtime_process":"taskdl.exe (PID: 10448)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=f3a5a3dd57f43ad60ce7aea997e44c42442626aba1979a7cb50b5525a365a33395ee5d7ea0b12f6cbf28bc55441b259a66780acc132c84d0a115e593d326bbfb5d58a8af13","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=f3a5a3dd57f43ad60ce7aea997e44c42442626aba1979a7cb50b5525a365a33395ee5d7ea0b12f6cbf28bc55441b259a66780acc132c84d0a115e593d326bbfb5d58a8af13","has_overview":true,"extended_details":{"filename":"taskdl.exe","size":20480,"description":null,"architecture":"32 Bit","ssdeep":"96:Udocv5e0e1wWtaLYjJN0yDGgI2u9+w5eOIMviS0jPtboyn15EWBwwWwT:6oL0edtJN7qvAZM6S0jP1oynkWBwwWg","imphash":"818097acf11d6a2ac55031896b50d98c","authentihash":"42f9adff5abdf7f5c0706dfe6d12c0716168755e178873eeccf74cda6b72d4f3","entrypoint_bytes":null,"packer":"Microsoft visual C++ 5.0","version_info":[{"id":"CompanyName","value":"Microsoft Corporation"},{"id":"FileDescription","value":"SQL Client Configuration Utility EXE"},{"id":"FileVersion","value":"6.1.7600.16385 (win7_rtm.090713-1255)"},{"id":"InternalName","value":"cliconfg.exe"},{"id":"LegalCopyright","value":"Microsoft Corporation. All rights reserved."},{"id":"OriginalFilename","value":"cliconfg.exe"},{"id":"ProductName","value":"Microsoft Windows Operating System"},{"id":"ProductVersion","value":"6.1.7600.16385"},{"id":"Translation","value":"0x0409 0x04b0"}],"file_sections":[{"name":".text","entropy":4.922827488152073,"virtual_address":"0x1000","virtual_size":"0xadb","raw_size":"0x1000","md5":"c9aa64fe8d9efc3e7be627442c0172f0"},{"name":".rdata","entropy":2.6644116640352418,"virtual_address":"0x2000","virtual_size":"0x67a","raw_size":"0x1000","md5":"e98eaa78f8b3d90a99454c5d64db86ba"},{"name":".data","entropy":0.10561247448894767,"virtual_address":"0x3000","virtual_size":"0x90","raw_size":"0x1000","md5":"d71c25cb529fed9abe0ee5d3d6264cd5"},{"name":".rsrc","entropy":3.716111370187453,"virtual_address":"0x4000","virtual_size":"0x410","raw_size":"0x1000","md5":"a5fbafb18686e9366dc75c2e1920c441"}],"file_imports":[{"module":"KERNEL32.dll","functions":["DeleteFileW","FindClose","FindFirstFileW","FindNextFileW","GetDriveTypeW","GetLogicalDrives","GetModuleHandleA","GetStartupInfoA","GetTempPathW","GetWindowsDirectoryW","Sleep"]},{"module":"MSVCP60.dll","functions":["??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ","?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB","?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z","?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z","?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ","?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z","?_Xran@std@@YAXXZ","?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z","?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB"]},{"module":"MSVCRT.dll","functions":["??2@YAPAXI@Z","__CxxFrameHandler","__getmainargs","__p__commode","__p__fmode","__set_app_type","__setusermatherr","_acmdln","_adjust_fdiv","_controlfp","_except_handler3","_exit","_initterm","_XcptFilter","exit","free","swprintf","wcslen"]}],"file_exports":[]}},{"name":"taskse.exe","file_path":"C:\\taskse.exe","file_size":20480,"md5":"8495400f199ac77853c53b5a3f278f3e","sha1":"be5d6279874da315e3080b06083757aad9b32c23","sha256":"2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d","sha512":"0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4","type_tags":["peexe","executable"],"description":"PE32 executable (GUI) Intel 80386, for MS Windows","runtime_process":"WannaCry.exe.sample.exe (PID: 6996)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/67f14d588cdd2a74670f9f6b/download/dropped-file?key=794a169f5098be323d49a819081f164d8a076c72d25c7215a5d951374d496116aa57680e400fc53cd88daeb472898f261f76804c0585756aa09134f14bad973c6d05f547","submit_link":"/bff/report/67f14d588cdd2a74670f9f6b/submit/dropped-file?key=794a169f5098be323d49a819081f164d8a076c72d25c7215a5d951374d496116aa57680e400fc53cd88daeb472898f261f76804c0585756aa09134f14bad973c6d05f547","has_overview":true,"extended_details":{"filename":"taskse.exe","size":20480,"description":null,"architecture":"32 Bit","ssdeep":"96:UjpvOHheaCDCNIOgTegoddPtboyX7cvp0EWy1HlWwr:UjVWEam7ofP1oyX7olWUHlW0","imphash":"a89f8e8fe712c2f1d82dff25307d18c6","authentihash":"60feb964a615fceef2aa4a4067a39eb7d6c5f725d370734e81118ebc7a6e1a3c","entrypoint_bytes":null,"packer":"Microsoft visual C++ 5.0","version_info":[{"id":"CompanyName","value":"Microsoft Corporation"},{"id":"FileDescription","value":"waitfor - wait/send a signal over a network"},{"id":"FileVersion","value":"6.1.7600.16385 (win7_rtm.090713-1255)"},{"id":"InternalName","value":"waitfor.exe"},{"id":"LegalCopyright","value":"Microsoft Corporation. All rights reserved."},{"id":"OriginalFilename","value":"waitfor.exe"},{"id":"ProductName","value":"Microsoft Windows Operating System"},{"id":"ProductVersion","value":"6.1.7600.16385"},{"id":"Translation","value":"0x0409 0x04b0"}],"file_sections":[{"name":".text","entropy":3.2997690833455167,"virtual_address":"0x1000","virtual_size":"0x6d2","raw_size":"0x1000","md5":"27ba7eebe222f1f600c05d356fdd3f20"},{"name":".rdata","entropy":1.0510535982242626,"virtual_address":"0x2000","virtual_size":"0x280","raw_size":"0x1000","md5":"95ab42776493299c34c1e0c609c3d165"},{"name":".data","entropy":0.7997585034099354,"virtual_address":"0x3000","virtual_size":"0x1c0","raw_size":"0x1000","md5":"5a849268f8bc1bf35214e328323b8793"},{"name":".rsrc","entropy":3.7217147003722455,"virtual_address":"0x4000","virtual_size":"0x414","raw_size":"0x1000","md5":"f7bd6aed27ba347f17f0fa5893d895d6"}],"file_imports":[{"module":"KERNEL32.dll","functions":["GetModuleHandleA","GetProcAddress","GetStartupInfoA","LoadLibraryA","Sleep","WaitForSingleObject"]},{"module":"MSVCRT.dll","functions":["__getmainargs","__p___argc","__p___argv","__p__commode","__p__fmode","__set_app_type","__setusermatherr","_acmdln","_adjust_fdiv","_controlfp","_except_handler3","_exit","_initterm","_local_unwind2","_XcptFilter","exit"]}],"file_exports":[]}}],"file_metadata":{"file_compositions":["1 .RES Files linked with CVTRES.EXE 5.00 (Visual Studio 5) (build: 1735)","7 .CPP Files compiled with CL.EXE 12.00 (Visual Studio 6) (build: 9782)"],"imported_objects":["13 .LIB Files generated with LIB.EXE 7.10 (Visual Studio .NET 2003) (build: 4035)","4 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 8047)","11 .C Files compiled with CL.EXE 12.00 (Visual Studio 6) (build: 8047)","4 .ASM Files assembled with MASM 6.13 (Visual Studio 6 SP1) (build: 7299)","1 .CPP Files compiled with CL.EXE 12.00 (Visual Studio 6) (build: 8047)","2 .OBJ Files linked with ALIASOBJ.EXE 6.00 (Internal OLDNAMES.LIB Tool) (build: 7291)"],"file_analysis":["File contains C++ code","File is the product of a small codebase (7 files)"],"total_file_compositions_imports":163},"processes":[{"uid":"00000000-00006996","parentuid":null,"name":"WannaCry.exe.sample.exe","normalized_path":"C:\\WannaCry.exe.sample.exe","command_line":null,"sha256":"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa","av_label":"Trojan.Ransom.WannaCryptor","av_matched":21,"av_total":24,"pid":"6996","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC","process_flags":[{"name":"Extracted Streams","data":null},{"name":"Multiscan Match","data":"21/24"}]},{"uid":"00000000-00006392","parentuid":"00000000-00006996","name":"attrib.exe","normalized_path":"%WINDIR%\\SysWOW64\\attrib.exe","command_line":"attrib +h .","sha256":"c4bf774cce635357b356e2d8d9adb6018ed59f39f9cc8ae7c68079dd780f9a5b","av_label":null,"av_matched":null,"av_total":null,"pid":"6392","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00001792","parentuid":"00000000-00006996","name":"icacls.exe","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","command_line":"icacls . /grant Everyone:F /T /C /Q","sha256":"d95f7071dd1190d66844a778a2434b8f0bb453b975cc6a8620b448b66eb73261","av_label":null,"av_matched":null,"av_total":null,"pid":"1792","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00010448","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"10448","icon":null,"process_flags":[]},{"uid":"00000000-00003516","parentuid":"00000000-00006996","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c 88831743893367.bat","sha256":"678652bb50abb92de91a69c05ea018c160fb4be0902ace14b15749246788cb40","av_label":null,"av_matched":null,"av_total":null,"pid":"3516","icon":null,"process_flags":[]},{"uid":"00000000-00007424","parentuid":"00000000-00003516","name":"cscript.exe","normalized_path":"%WINDIR%\\SysWOW64\\cscript.exe","command_line":"//nologo m.vbs","sha256":"c876969e99ab93b30f1c96dc0caaa7b2636bb43844117a25f69ba4b2205b04b2","av_label":null,"av_matched":null,"av_total":null,"pid":"7424","icon":null,"process_flags":[{"name":"Logged Script Calls","data":null}]},{"uid":"00000000-00008152","parentuid":"00000000-00006996","name":"attrib.exe","normalized_path":"%WINDIR%\\SysWOW64\\attrib.exe","command_line":"attrib +h +s Z:\\$RECYCLE","sha256":"c4bf774cce635357b356e2d8d9adb6018ed59f39f9cc8ae7c68079dd780f9a5b","av_label":null,"av_matched":null,"av_total":null,"pid":"8152","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00006384","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"6384","icon":null,"process_flags":[]},{"uid":"00000000-00010388","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"10388","icon":null,"process_flags":[]},{"uid":"00000000-00008900","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"8900","icon":null,"process_flags":[]},{"uid":"00000000-00006140","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"6140","icon":null,"process_flags":[]},{"uid":"00000000-00006788","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"6788","icon":null,"process_flags":[]},{"uid":"00000000-00004736","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"4736","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00011212","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"11212","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00007860","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"7860","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00005772","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"5772","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00009656","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"9656","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00010244","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"10244","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00007952","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"7952","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00008044","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"8044","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00005012","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"5012","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00002220","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"2220","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00011032","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"11032","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00005976","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"5976","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00010452","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"10452","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00009608","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"9608","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00002224","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"2224","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00002564","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"2564","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00004780","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"4780","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00009020","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"9020","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00010252","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"10252","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00005096","parentuid":"00000000-00006996","name":"taskdl.exe","normalized_path":"C:\\taskdl.exe","command_line":null,"sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","av_label":null,"av_matched":null,"av_total":null,"pid":"5096","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]}],"mitre_attcks":[{"tactic":"Execution","technique":"Native API","attck_id":"T1106","attck_id_wiki":"https://attack.mitre.org/techniques/T1106","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":3,"suspicious_identifiers":["Imports suspicious APIs"],"informative_identifiers_count":14,"informative_identifiers":["Contains ability to create a new process (API string)","Contains ability to create/open files (API string)","Contains ability to execute an application (API string)","Contains ability to load modules (API string)","Contains ability to find and load resources of specific modules (API string)","Contains ability to set/get the last-error code for a calling thread (API string)","Contains ability to execute Windows APIs","Calls an API typically used to load a resource in memory","Contains ability to retrieve address of exported function from a DLL (API string)","Contains ability to retrieve the fully qualified path of module (API string)","Contains ability to retrieve/modify process thread (API string)","Calls an API typically used to find a resource in a module","Calls an API typically used to create a process","Calls an API typically used to retrieve function addresses"],"parent":null},{"tactic":"Execution","technique":"Windows Command Shell","attck_id":"T1059.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to executes commands or batch file"],"parent":{"technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059"}},{"tactic":"Execution","technique":"Service Execution","attck_id":"T1569.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1569/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to open a service (API string)"],"parent":{"technique":"System Services","attck_id":"T1569","attck_id_wiki":"https://attack.mitre.org/techniques/T1569"}},{"tactic":"Execution","technique":"Inter-Process Communication","attck_id":"T1559","attck_id_wiki":"https://attack.mitre.org/techniques/T1559","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create/connect to a named pipe (API string)"],"parent":null},{"tactic":"Execution","technique":"Visual Basic","attck_id":"T1059.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1059/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Launches a VBS file"],"parent":{"technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059"}},{"tactic":"Execution","technique":"Shared Modules","attck_id":"T1129","attck_id_wiki":"https://attack.mitre.org/techniques/T1129","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Loads modules at runtime","Calls an API typically used to load libraries","Loads the RPC (Remote Procedure Call) module DLL"],"parent":null},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Logged script engine calls","Executes batch file"],"parent":null},{"tactic":"Persistence","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to create a service (API string)","Contains ability to access device drivers","Creates or modifies windows services","Contains ability to start a service (API string)"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Persistence","technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify the user configuration/privilege (API string)"],"parent":null},{"tactic":"Persistence","technique":"Transport Agent","attck_id":"T1505.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1505/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"],"parent":{"technique":"Server Software Component","attck_id":"T1505","attck_id_wiki":"https://attack.mitre.org/techniques/T1505"}},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Persistence","technique":"Shortcut Modification","attck_id":"T1547.009","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/009","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Persistence","technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"],"parent":null},{"tactic":"Persistence","technique":"Web Shell","attck_id":"T1505.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1505/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["YARA signature match - Web shell"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Server Software Component","attck_id":"T1505","attck_id_wiki":"https://attack.mitre.org/techniques/T1505"}},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attck_id":"T1134.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to obtains specified information about the security of a file or directory (API string)","Contains ability to impersonate access tokens (API string)","Imports system security related APIs"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Privilege Escalation","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to create a service (API string)","Contains ability to access device drivers","Creates or modifies windows services","Contains ability to start a service (API string)"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify the user configuration/privilege (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":1,"malicious_identifiers":["Writes data to a remote process"],"suspicious_identifiers_count":1,"suspicious_identifiers":["Spawned processes likely due to injection"],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to inject code into another process (API string)","Found PE header in memory"],"parent":null},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Shortcut Modification","attck_id":"T1547.009","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/009","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Privilege Escalation","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve token privileges information (API string)","Contains ability to modify access token privileges (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":5,"suspicious_identifiers":["YARA signature match - RSA algorithm (keys)"],"informative_identifiers_count":8,"informative_identifiers":["Contains ability to perform AES/RC4 encryption (API string)","Contains CRYPTO related strings","Contains ability to use Cryptographic classes","Loads the Bcrypt module DLL","Matched Compiler/Packer signature (DIE)","YARA signature match - AES encryption","Sample file has high entropy (likely encrypted/compressed content)","Shows ability to obfuscate file or information"],"parent":null},{"tactic":"Defense Evasion","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to disable/close registry key (API string)","Contains ability to create/load registry keys (API string)","Contains ability to modify registry key/value (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attck_id":"T1222","attck_id_wiki":"https://attack.mitre.org/techniques/T1222","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify file attributes (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Timestomp","attck_id":"T1070.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve file time (API string)","Contains ability to set file time (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attck_id":"T1134.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to obtains specified information about the security of a file or directory (API string)","Contains ability to impersonate access tokens (API string)","Imports system security related APIs"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to check debugger is running (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attck_id":"T1620","attck_id_wiki":"https://attack.mitre.org/techniques/T1620","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to perform reflective code loading"],"parent":null},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Possibly tries to evade analysis by sleeping many times"],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Hidden Window","attck_id":"T1564.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to show a graphical window (API string)"],"parent":{"technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564"}},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":1,"malicious_identifiers":["Writes data to a remote process"],"suspicious_identifiers_count":1,"suspicious_identifiers":["Spawned processes likely due to injection"],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to inject code into another process (API string)","Found PE header in memory"],"parent":null},{"tactic":"Defense Evasion","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Masquerading","attck_id":"T1036","attck_id_wiki":"https://attack.mitre.org/techniques/T1036","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Renames files"],"parent":null},{"tactic":"Defense Evasion","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attck_id":"T1480","attck_id_wiki":"https://attack.mitre.org/techniques/T1480","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Creates mutants","Shows ability to use execution guardrails"],"parent":null},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attck_id":"T1140","attck_id_wiki":"https://attack.mitre.org/techniques/T1140","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to decode base64 data","Contains ability to perform decryption (API string)","Shows ability to deobfuscate/decode files or information"],"parent":null},{"tactic":"Defense Evasion","technique":"Windows File and Directory Permissions Modification","attck_id":"T1222.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1222/001","malicious_identifiers_count":1,"malicious_identifiers":["Modifies the access control lists of files"],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"File and Directory Permissions Modification","attck_id":"T1222","attck_id_wiki":"https://attack.mitre.org/techniques/T1222"}},{"tactic":"Defense Evasion","technique":"Software Packing","attck_id":"T1027.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Matched Compiler/Packer signature"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attck_id":"T1027.009","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/009","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Section contains high entropy"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"File Deletion","attck_id":"T1070.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Opens file with deletion access rights"],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to delete files/directories (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Double File Extension","attck_id":"T1036.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1036/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Masquerading","attck_id":"T1036","attck_id_wiki":"https://attack.mitre.org/techniques/T1036"}},{"tactic":"Defense Evasion","technique":"Hidden Files and Directories","attck_id":"T1564.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1564/001","malicious_identifiers_count":1,"malicious_identifiers":["Attempts to change the attributes of the files"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564"}},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attck_id":"T1027.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to dynamically determine API calls"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve token privileges information (API string)","Contains ability to modify access token privileges (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attck_id":"T1562.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Loads the AMSI (Antimalware Scan Interface) DLL"],"parent":{"technique":"Impair Defenses","attck_id":"T1562","attck_id_wiki":"https://attack.mitre.org/techniques/T1562"}},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attck_id":"T1036.008","attck_id_wiki":"https://attack.mitre.org/techniques/T1036/008","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Masquerading","attck_id":"T1036","attck_id_wiki":"https://attack.mitre.org/techniques/T1036"}},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["The input sample possibly contains the RDTSCP instruction"],"parent":null},{"tactic":"Credential Access","technique":"Keylogging","attck_id":"T1056.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found strings related to keylogger"],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attck_id":"T1555","attck_id_wiki":"https://attack.mitre.org/techniques/T1555","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains string like password/secret"],"parent":null},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/techniques/T1083","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Reads configuration files (.ini files)"],"informative_identifiers_count":14,"informative_identifiers":["Contains ability to retrieve file and directory information (API string)","Contains ability to retrieve path in which Windows is installed (API string)","Contains ability to read files (API string)","Reads files","Tries to access non-existent files (executable)","References Windows filepaths for DLLs (possible dropped files)","Contains ability to retrieve files based on search patterns","Calls an API typically used for searching a directory for files","Contains ability to retrieve list of files and subdirectories","Touches files in the Windows directory","Contains ability to enumerate files on disk (API string)","Touches files","Tries to access non-existent files (non-executable)","Tries to access LNK files (Windows shortcut)"],"parent":null},{"tactic":"Discovery","technique":"System Information Discovery","attck_id":"T1082","attck_id_wiki":"https://attack.mitre.org/techniques/T1082","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Found system commands related strings","Calls an API typically used to find and list the Windows drive types"],"informative_identifiers_count":24,"informative_identifiers":["Contains reference to mutex-related activity (API string)","Contains ability to find logical drives of the machine (API string)","Contains ability to retrieve a module handle (API string)","Contains ability to retrieve operating system version","Contains ability to retrieve the OS information (API string)","Calls an API typically used to retrieve computer name","Calls an API typically used to retrieve information about the current system","Contains ability to query volume/memory size (API string)","Contains ability to retrieve data about the local computer (API string)","Calls an API typically used to open an existing named mutex object","Contains ability to read software policies","Calls an API typically used to retrieve OS information","Queries volume information of an entire harddrive","Calls an API typically used to get product type","Reads information about supported languages","Reads the cryptographic machine GUID","Contains ability to retrieve the NetBIOS name of the local computer (API string)","Contains ability to retrieve information about the current system (API string)","Contains ability to retrieve environment variable settings","Contains ability to determine disk drive type (API string)","Contains ability to retrieve the specified system metric or system configuration setting (API string)","Calls an API typically used to get system version information","Reads the active computer name","Queries volume information"],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/techniques/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Contains registry location strings","Contains ability to query registry keys (API string)","Opens registry keys","Queries registry keys","Reads Windows Trust Settings"],"parent":null},{"tactic":"Discovery","technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to query system locale (API string)","Calls an API typically used to retrieve local language"],"parent":null},{"tactic":"Discovery","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to check debugger is running (API string)"],"parent":null},{"tactic":"Discovery","technique":"Application Window Discovery","attck_id":"T1010","attck_id_wiki":"https://attack.mitre.org/techniques/T1010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve open application windows (API string)","Contains ability to find open windows (API string)"],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/techniques/T1057","malicious_identifiers_count":1,"malicious_identifiers":["Spawns a lot of processes"],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":7,"informative_identifiers":["Contains ability to enumerate process and/or its information (API string)","Calls an API typically used for taking snapshot of the specified processes","Queries basic information of the specified process","Process launched with changed environment","Spawns new processes that are not known child processes","Spawns new processes","Contains ability to retrieve/open a process (API string)"],"parent":null},{"tactic":"Discovery","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Possibly tries to evade analysis by sleeping many times"],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"System Owner/User Discovery","attck_id":"T1033","attck_id_wiki":"https://attack.mitre.org/techniques/T1033","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve usernames and/or user information (API string)","Calls an API typically used to retrieve user name"],"parent":null},{"tactic":"Discovery","technique":"Software Discovery","attck_id":"T1518","attck_id_wiki":"https://attack.mitre.org/techniques/T1518","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Reads the registry for installed applications"],"parent":null},{"tactic":"Discovery","technique":"System Service Discovery","attck_id":"T1007","attck_id_wiki":"https://attack.mitre.org/techniques/T1007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to enumerate service (API string)","Queries services related registry keys"],"parent":null},{"tactic":"Discovery","technique":"System Language Discovery","attck_id":"T1614.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve system language (API string)","Reads the windows installation language"],"parent":{"technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614"}},{"tactic":"Discovery","technique":"System Time Discovery","attck_id":"T1124","attck_id_wiki":"https://attack.mitre.org/techniques/T1124","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve machine timezone (API string)"],"parent":null},{"tactic":"Discovery","technique":"Security Software Discovery","attck_id":"T1518.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1518/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Possibly tries to implement anti-virtualization techniques using MAC address detection"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Software Discovery","attck_id":"T1518","attck_id_wiki":"https://attack.mitre.org/techniques/T1518"}},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attck_id":"T1016","attck_id_wiki":"https://attack.mitre.org/techniques/T1016","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the local name for a socket (API string)"],"parent":null},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["The input sample possibly contains the RDTSCP instruction"],"parent":null},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attck_id":"T1570","attck_id_wiki":"https://attack.mitre.org/techniques/T1570","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to move file or directory (API string)"],"parent":null},{"tactic":"Collection","technique":"Local Data Staging","attck_id":"T1074.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to create directories (API string)","Calls an API typically used to create a directory"],"parent":{"technique":"Data Staged","attck_id":"T1074","attck_id_wiki":"https://attack.mitre.org/techniques/T1074"}},{"tactic":"Collection","technique":"Email Collection","attck_id":"T1114","attck_id_wiki":"https://attack.mitre.org/techniques/T1114","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Collection","technique":"Screen Capture","attck_id":"T1113","attck_id_wiki":"https://attack.mitre.org/techniques/T1113","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to capture screen (API string)"],"parent":null},{"tactic":"Collection","technique":"Data from Local System","attck_id":"T1005","attck_id_wiki":"https://attack.mitre.org/techniques/T1005","malicious_identifiers_count":1,"malicious_identifiers":["Tries to steal browser sensitive information (file access)"],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Calls an API typically used to copy file from one location to another"],"parent":null},{"tactic":"Collection","technique":"Keylogging","attck_id":"T1056.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found strings related to keylogger"],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Collection","technique":"Clipboard Data","attck_id":"T1115","attck_id_wiki":"https://attack.mitre.org/techniques/T1115","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to access clipboard data (API string)"],"parent":null},{"tactic":"Collection","technique":"Local Email Collection","attck_id":"T1114.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1114/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found string that contains outlook file extensions .ost/.pst"],"parent":{"technique":"Email Collection","attck_id":"T1114","attck_id_wiki":"https://attack.mitre.org/techniques/T1114"}},{"tactic":"Collection","technique":"Automated Collection","attck_id":"T1119","attck_id_wiki":"https://attack.mitre.org/techniques/T1119","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to send encrypted data to the internet"],"parent":null},{"tactic":"Command and Control","technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Found potential URL in binary/memory","Contains ability to communicate with network (API string)","Found potential URLs in memory dumps","Found potential IP address in binary/memory"],"parent":null},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attck_id":"T1095","attck_id_wiki":"https://attack.mitre.org/techniques/T1095","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to communicate with C2 using Sockets (API string)"],"parent":null},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attck_id":"T1105","attck_id_wiki":"https://attack.mitre.org/techniques/T1105","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":4,"suspicious_identifiers":["Writes a PE file header to disc","Drops executable files"],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to write files (API string)","Contains ability to download a file from a URL (API string)","Dropped files"],"parent":null},{"tactic":"Command and Control","technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Making HTTPS connections using secure TLS/SSL version"],"parent":null},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attck_id":"T1573.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains reference to OpenSSL library string","References OpenSSL library string"],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Command and Control","technique":"Mail Protocols","attck_id":"T1071.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found mail related domain names"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Non-Standard Port","attck_id":"T1571","attck_id_wiki":"https://attack.mitre.org/techniques/T1571","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to open a port and listen for incoming connection (API string)"],"parent":null},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attck_id":"T1090.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1090/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains Tor Onion URL"],"parent":{"technique":"Proxy","attck_id":"T1090","attck_id_wiki":"https://attack.mitre.org/techniques/T1090"}},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attck_id":"T1573.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to use encryption for command and control traffic"],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Impact","technique":"Data Encrypted for Impact","attck_id":"T1486","attck_id_wiki":"https://attack.mitre.org/techniques/T1486","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":3,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to cryptographic keys"],"parent":null},{"tactic":"Impact","technique":"Service Stop","attck_id":"T1489","attck_id_wiki":"https://attack.mitre.org/techniques/T1489","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Able to retrieve/open a process (API string)","Contains ability to terminate a process (API string)","Contains ability to close a handle to a service (API string)"],"parent":null},{"tactic":"Impact","technique":"Internal Defacement","attck_id":"T1491.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1491/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Detected indicator that file is ransomware"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Defacement","attck_id":"T1491","attck_id_wiki":"https://attack.mitre.org/techniques/T1491"}},{"tactic":"Impact","technique":"System Shutdown/Reboot","attck_id":"T1529","attck_id_wiki":"https://attack.mitre.org/techniques/T1529","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to shutdown system"],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-678","type":2,"relevance":3,"name":"Able to perform reflective code loading","description":"Found string \"- bpo-26836: Add :func:`os.memfd_create`.\" (Indicator: \"memfd_create\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")\n Found string \"- bpo-37098: Fix test_memfd_create on older Linux Kernels.\" (Indicator: \"memfd_create\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","description_v2":["Found string \"- bpo-26836: Add :func:`os.memfd_create`.\" (Indicator: \"memfd_create\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-37098: Fix test_memfd_create on older Linux Kernels.\" (Indicator: \"memfd_create\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"- bpo-26836: Add :func:`os.memfd_create`.\" (Indicator: \"memfd_create\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-37098: Fix test_memfd_create on older Linux Kernels.\" (Indicator: \"memfd_create\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1620","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1620","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"api-140","type":6,"relevance":3,"name":"Calls an API typically used to find a resource in a module","description":"\"WannaCry.exe.sample.exe\" called \"FindResourceA\" with parameter \"2058\" - (UID: 00000000-00006996)","description_v2":["\"WannaCry.exe.sample.exe\" called \"FindResourceA\" with parameter \"2058\" - (UID: 00000000-00006996)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"FindResourceA\" with parameter \"2058\" - (UID: 00000000-00006996)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"api-139","type":6,"relevance":3,"name":"Calls an API typically used to load a resource in memory","description":"\"WannaCry.exe.sample.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4260024'}\" (UID: 00000000-00006996)","description_v2":["\"WannaCry.exe.sample.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4260024'}\" (UID: 00000000-00006996)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4260024'}\" (UID: 00000000-00006996)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-226","type":2,"relevance":1,"name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")\n Found reference to API \"around a WaitForMultipleObjects limitation.\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","description_v2":["Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"WannaCry.exe.sample\")","Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"WannaCry.exe.sample\")","Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"around a WaitForMultipleObjects limitation.\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"around a WaitForMultipleObjects limitation.\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-306","type":2,"relevance":1,"name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1134.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-92","type":2,"relevance":1,"name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"WannaCry.exe.sample\")","Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-318","type":2,"relevance":1,"name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"WannaCry.exe.sample\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"WannaCry.exe.sample\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-304","type":2,"relevance":1,"name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"WannaCry.exe.sample\")","Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-544","type":2,"relevance":1,"name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"WannaCry.exe.sample\")","Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1569.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1569/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-409","type":2,"relevance":1,"name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"WannaCry.exe.sample\")","Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-138","type":2,"relevance":2,"name":"Contains ability to use Cryptographic classes","description":"$27","description_v2":["Found reference to \"- bpo-40645: The :class:`hmac.HMAC` exposes internal implementation details.\" (Indicator: \"HMAC\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found reference to \"HMAC API. The new code will be used in Python 3.10 after the internal\" (Indicator: \"HMAC\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found reference to \"implementation details of the pure Python HMAC module are no longer part\" (Indicator: \"HMAC\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found reference to \"- bpo-33604: Fixed `hmac.new` and `hmac.HMAC` to raise TypeError instead of\" (Indicator: \"HMAC\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found reference to \"- bpo-38134: Remove obsolete copy of PBKDF2_HMAC_fast. All supported OpenSSL\" (Indicator: \"HMAC\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found reference to \"- bpo-33604: Remove HMAC default to md5 marked for removal in 3.8 (removal\" (Indicator: \"HMAC\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found reference to \"- bpo-33604: Update HMAC md5 default to a DeprecationWarning, bump removal\" (Indicator: \"HMAC\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found reference to \"optimized HMAC digest.\" (Indicator: \"HMAC\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to \"- bpo-40645: The :class:`hmac.HMAC` exposes internal implementation details.\" (Indicator: \"HMAC\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"HMAC API. The new code will be used in Python 3.10 after the internal\" (Indicator: \"HMAC\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"implementation details of the pure Python HMAC module are no longer part\" (Indicator: \"HMAC\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"- bpo-33604: Fixed `hmac.new` and `hmac.HMAC` to raise TypeError instead of\" (Indicator: \"HMAC\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"- bpo-38134: Remove obsolete copy of PBKDF2_HMAC_fast. All supported OpenSSL\" (Indicator: \"HMAC\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"- bpo-33604: Remove HMAC default to md5 marked for removal in 3.8 (removal\" (Indicator: \"HMAC\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"- bpo-33604: Update HMAC md5 default to a DeprecationWarning, bump removal\" (Indicator: \"HMAC\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"optimized HMAC digest.\" (Indicator: \"HMAC\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"memorydump-8","type":20,"relevance":1,"name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found PE header \"MZ\" - Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")","Found PE header \"MZ\" - Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")","Found PE header \"MZ\" - Source: \"00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found PE header \"MZ\" - Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found PE header \"MZ\" - Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found PE header \"MZ\" - Source: \"00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"Memory Dumps","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"api-162","type":6,"relevance":1,"name":"Renames files","description":"$28","description_v2":["\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\@pm2\\agent\\node_modules\\eventemitter2\\LICENSE.txt.WNCRYT\" to \"C:\\tempdir\\node_modules\\@pm2\\agent\\node_modules\\eventemitter2\\LICENSE.txt.WNCRY\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\@pm2\\io\\node_modules\\eventemitter2\\LICENSE.txt.WNCRYT\" to \"C:\\tempdir\\node_modules\\@pm2\\io\\node_modules\\eventemitter2\\LICENSE.txt.WNCRY\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\@pm2\\js-api\\node_modules\\eventemitter2\\LICENSE.txt.WNCRYT\" to \"C:\\tempdir\\node_modules\\@pm2\\js-api\\node_modules\\eventemitter2\\LICENSE.txt.WNCRY\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\basic-ftp\\LICENSE.txt.WNCRYT\" to \"C:\\tempdir\\node_modules\\basic-ftp\\LICENSE.txt.WNCRY\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\bson\\vendor\\base64\\LICENSE-MIT.txt.WNCRYT\" to \"C:\\tempdir\\node_modules\\bson\\vendor\\base64\\LICENSE-MIT.txt.WNCRY\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\@pm2\\agent\\node_modules\\eventemitter2\\LICENSE.txt\" to \"%TEMP%\\1.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\@pm2\\io\\node_modules\\eventemitter2\\LICENSE.txt\" to \"%TEMP%\\2.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\@pm2\\js-api\\node_modules\\eventemitter2\\LICENSE.txt\" to \"%TEMP%\\3.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\basic-ftp\\LICENSE.txt\" to \"%TEMP%\\4.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\bson\\vendor\\base64\\LICENSE-MIT.txt\" to \"%TEMP%\\5.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\emoji-regex\\LICENSE-MIT.txt\" to \"%TEMP%\\6.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\exit\\test\\fixtures\\100-stdout-stderr.txt\" to \"%TEMP%\\7.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\exit\\test\\fixtures\\1000-stderr.txt\" to \"%TEMP%\\8.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\exit\\test\\fixtures\\1000-stdout-stderr.txt\" to \"%TEMP%\\9.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\exit\\test\\fixtures\\1000-stdout.txt\" to \"%TEMP%\\10.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\fast-json-patch\\LICENSE.txt\" to \"%TEMP%\\11.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\he\\LICENSE-MIT.txt\" to \"%TEMP%\\12.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\isbinaryfile\\LICENSE.txt\" to \"%TEMP%\\13.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\needle\\license.txt\" to \"%TEMP%\\14.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\pm2\\GNU-AGPL-3.0.txt\" to \"%TEMP%\\15.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\pm2\\node_modules\\eventemitter2\\LICENSE.txt\" to \"%TEMP%\\16.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\pm2-sysmonit\\LICENSE-APACHE.txt\" to \"%TEMP%\\17.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\punycode\\LICENSE-MIT.txt\" to \"%TEMP%\\18.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\sift\\MIT-LICENSE.txt\" to \"%TEMP%\\19.WNCRYT\"","\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\tr46\\node_modules\\punycode\\LICENSE-MIT.txt\" to \"%TEMP%\\20.WNCRYT\""],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\@pm2\\agent\\node_modules\\eventemitter2\\LICENSE.txt.WNCRYT\" to \"C:\\tempdir\\node_modules\\@pm2\\agent\\node_modules\\eventemitter2\\LICENSE.txt.WNCRY\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\@pm2\\io\\node_modules\\eventemitter2\\LICENSE.txt.WNCRYT\" to \"C:\\tempdir\\node_modules\\@pm2\\io\\node_modules\\eventemitter2\\LICENSE.txt.WNCRY\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\@pm2\\js-api\\node_modules\\eventemitter2\\LICENSE.txt.WNCRYT\" to \"C:\\tempdir\\node_modules\\@pm2\\js-api\\node_modules\\eventemitter2\\LICENSE.txt.WNCRY\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\basic-ftp\\LICENSE.txt.WNCRYT\" to \"C:\\tempdir\\node_modules\\basic-ftp\\LICENSE.txt.WNCRY\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\bson\\vendor\\base64\\LICENSE-MIT.txt.WNCRYT\" to \"C:\\tempdir\\node_modules\\bson\\vendor\\base64\\LICENSE-MIT.txt.WNCRY\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\@pm2\\agent\\node_modules\\eventemitter2\\LICENSE.txt\" to \"%TEMP%\\1.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\@pm2\\io\\node_modules\\eventemitter2\\LICENSE.txt\" to \"%TEMP%\\2.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\@pm2\\js-api\\node_modules\\eventemitter2\\LICENSE.txt\" to \"%TEMP%\\3.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\basic-ftp\\LICENSE.txt\" to \"%TEMP%\\4.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\bson\\vendor\\base64\\LICENSE-MIT.txt\" to \"%TEMP%\\5.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\emoji-regex\\LICENSE-MIT.txt\" to \"%TEMP%\\6.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\exit\\test\\fixtures\\100-stdout-stderr.txt\" to \"%TEMP%\\7.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\exit\\test\\fixtures\\1000-stderr.txt\" to \"%TEMP%\\8.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\exit\\test\\fixtures\\1000-stdout-stderr.txt\" to \"%TEMP%\\9.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\exit\\test\\fixtures\\1000-stdout.txt\" to \"%TEMP%\\10.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\fast-json-patch\\LICENSE.txt\" to \"%TEMP%\\11.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\he\\LICENSE-MIT.txt\" to \"%TEMP%\\12.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\isbinaryfile\\LICENSE.txt\" to \"%TEMP%\\13.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\needle\\license.txt\" to \"%TEMP%\\14.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\pm2\\GNU-AGPL-3.0.txt\" to \"%TEMP%\\15.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\pm2\\node_modules\\eventemitter2\\LICENSE.txt\" to \"%TEMP%\\16.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\pm2-sysmonit\\LICENSE-APACHE.txt\" to \"%TEMP%\\17.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\punycode\\LICENSE-MIT.txt\" to \"%TEMP%\\18.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\sift\\MIT-LICENSE.txt\" to \"%TEMP%\\19.WNCRYT\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" renamed original file\"C:\\tempdir\\node_modules\\tr46\\node_modules\\punycode\\LICENSE-MIT.txt\" to \"%TEMP%\\20.WNCRYT\""}],"origin":"API Call","attck_id":"T1036","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1036","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-183","type":2,"relevance":1,"name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"WannaCry.exe.sample\")","description_v2":["Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"WannaCry.exe.sample\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"WannaCry.exe.sample\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-106","type":2,"relevance":1,"name":"Contains ability to decode base64 data","description":"Found reference to API \"- bpo-39055: :func:`base64.b64decode` with ``validate=True`` raises now a\" (Indicator: \"b64decode\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")\n Found reference to API \"- bpo-39055: :func:`base64.b64decode` with ``validate=True`` raises now a\" (Indicator: \"base64.b64decode\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","description_v2":["Found reference to API \"- bpo-39055: :func:`base64.b64decode` with ``validate=True`` raises now a\" (Indicator: \"b64decode\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found reference to API \"- bpo-39055: :func:`base64.b64decode` with ``validate=True`` raises now a\" (Indicator: \"base64.b64decode\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"- bpo-39055: :func:`base64.b64decode` with ``validate=True`` raises now a\" (Indicator: \"b64decode\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"- bpo-39055: :func:`base64.b64decode` with ``validate=True`` raises now a\" (Indicator: \"base64.b64decode\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-438","type":2,"relevance":3,"name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CryptGenKey\" (Indicator: \"CryptGenKey\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CryptDestroyKey\" (Indicator: \"CryptDestroyKey\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContext\"; File: \"WannaCry.exe.sample\")","description_v2":["Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CryptGenKey\" (Indicator: \"CryptGenKey\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CryptDestroyKey\" (Indicator: \"CryptDestroyKey\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContext\"; File: \"WannaCry.exe.sample\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptGenKey\" (Indicator: \"CryptGenKey\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptDestroyKey\" (Indicator: \"CryptDestroyKey\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContext\"; File: \"WannaCry.exe.sample\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-212","type":2,"relevance":1,"name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","description_v2":["Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-280","type":2,"relevance":1,"name":"Contains reference to cryptographic keys","description":"Found string \"CryptoAPI Private Key\" (Indicator: \"private key\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")\n Found string \"- bpo-38271: The private keys for test_ssl were encrypted with 3DES in\" (Indicator: \"private key\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","description_v2":["Found string \"CryptoAPI Private Key\" (Indicator: \"private key\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found string \"- bpo-38271: The private keys for test_ssl were encrypted with 3DES in\" (Indicator: \"private key\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"CryptoAPI Private Key\" (Indicator: \"private key\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-38271: The private keys for test_ssl were encrypted with 3DES in\" (Indicator: \"private key\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"binary-71","type":8,"relevance":1,"name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.995470941164686","description_v2":["Sample file \"sample.bin\" has high entropy 7.995470941164686"],"description_v3":[{"type":"text","value":"Sample file \"sample.bin\" has high entropy 7.995470941164686"}],"origin":"Binary File","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-32","type":15,"relevance":1,"name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match - AES encryption","description_v2":["The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data","Matched sigs: YARA signature match - AES encryption"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - AES encryption"}],"origin":"Indicator Combinations","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-28","type":15,"relevance":1,"name":"Shows ability to obfuscate file or information","description":"$29","description_v2":["The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)","Matched sigs: Contains key cryptographic functions (API string)","Matched sigs: Contains CRYPTO related strings","Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)","Matched sigs: Contains ability to use Cryptographic classes","Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider","Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP","Matched sigs: Calls an API typically used to encrypt data","Matched sigs: Contains reference to cryptographic keys","Matched sigs: Contains ability to decode base64 data","Matched sigs: Calls an API typically used to decrypt data","Matched sigs: Reads the cryptographic machine GUID","Matched sigs: YARA signature match - AES encryption","Matched sigs: Contains ability to perform decryption (API string)","Matched sigs: Contains ability to decrypt/decode data","Matched sigs: Calls an API typically used to import cryptographic keys into a CSP","Matched sigs: Calls an API typically used to encrypt a block of data","Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","Matched sigs: Sample file has high entropy (likely encrypted/compressed content)"],"description_v3":[{"type":"text","value":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains key cryptographic functions (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains CRYPTO related strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use Cryptographic classes"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to encrypt data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains reference to cryptographic keys"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to decode base64 data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to decrypt data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Reads the cryptographic machine GUID"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - AES encryption"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform decryption (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to decrypt/decode data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to import cryptographic keys into a CSP"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to encrypt a block of data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Sample file has high entropy (likely encrypted/compressed content)"}],"origin":"Indicator Combinations","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-31","type":15,"relevance":1,"name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Found potential IP address in binary/memory","description_v2":["The analysis shows use of encryption","use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","Matched sigs: Found potential URL in binary/memory","Matched sigs: Contains ability to communicate with network (API string)","Matched sigs: Found potential URLs in memory dumps","Matched sigs: Found potential IP address in binary/memory"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption"},{"type":"linebreak"},{"type":"text","value":"use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Found potential URL in binary/memory"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to communicate with network (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Found potential URLs in memory dumps"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Found potential IP address in binary/memory"}],"origin":"Indicator Combinations","attck_id":"T1573.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-721","type":2,"relevance":1,"name":"Able to visualize and control listed components (API string)","description":"file/memory contains long string with (Indicator: \"sendmessage\"; File: \"u.wnry\")\n Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; File: \"WannaCry.exe.sample\")","description_v2":["file/memory contains long string with (Indicator: \"sendmessage\"; File: \"u.wnry\")","Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; File: \"WannaCry.exe.sample\")","Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; File: \"WannaCry.exe.sample\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"sendmessage\"; File: \"u.wnry\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; File: \"WannaCry.exe.sample\")"}],"origin":"File/Memory","attck_id":"T1055.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-124","type":6,"relevance":3,"name":"Calls an API typically used to get product type","description":"\"WannaCry.exe.sample.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006996)\n \"cscript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007424)","description_v2":["\"WannaCry.exe.sample.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006996)","\"cscript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007424)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007424)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-125","type":6,"relevance":3,"name":"Calls an API typically used to get system version information","description":"$2a","description_v2":["\"WannaCry.exe.sample.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"RtlGetVersion\" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d5800000200000000000000b44f2600e8ec1900650907771200000000000000d06ce87602000000608f8100b44f260008ed1900650907771200000000000000d06ce876f0b9d174120000001ced1900ae2e04770200000000000000d06ce8762ced1900e16ce876020000000000000054ed1900682070750200000000000000d42282a47092d9740000000094ed1900201b7575ffffffffa4ed1900581070753c107075242282a47092d9749cb9d174f0b9d17484ed190080ed19000d0000000d0000005041f5747cc82e75000000004041f574a0ed190018ee1900608d7375c8dae7d1feffffffb0ed1900900f70755041f574c0ed19000625e8747cc82e755041f574cced1900 (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006996)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"RtlGetVersion\" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d5800000200000000000000b44f2600e8ec1900650907771200000000000000d06ce87602000000608f8100b44f260008ed1900650907771200000000000000d06ce876f0b9d174120000001ced1900ae2e04770200000000000000d06ce8762ced1900e16ce876020000000000000054ed1900682070750200000000000000d42282a47092d9740000000094ed1900201b7575ffffffffa4ed1900581070753c107075242282a47092d9749cb9d174f0b9d17484ed190080ed19000d0000000d0000005041f5747cc82e75000000004041f574a0ed190018ee1900608d7375c8dae7d1feffffffb0ed1900900f70755041f574c0ed19000625e8747cc82e755041f574cced1900 (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006996)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-144","type":6,"relevance":3,"name":"Calls an API typically used to open an existing named mutex object","description":"\"WannaCry.exe.sample.exe\" called \"OpenMutexA\" with parameter \"Global\\MsWinZonesCacheCounterMutexW\" - (UID: 00000000-00006996)","description_v2":["\"WannaCry.exe.sample.exe\" called \"OpenMutexA\" with parameter \"Global\\MsWinZonesCacheCounterMutexW\" - (UID: 00000000-00006996)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"OpenMutexA\" with parameter \"Global\\MsWinZonesCacheCounterMutexW\" - (UID: 00000000-00006996)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-222","type":6,"relevance":2,"name":"Calls an API typically used to retrieve OS information","description":"$2b","description_v2":["\"cscript.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000001800000059000477338ece72580ccf020000000064fbcf02d0bbce72871fdb44fefffffff0facf02ae42cd7212000000f0476b00f0476b00be42cd72000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007424)","\"cscript.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d5800000200000000f98c720000000011000000f0f18c728000000000000000000049030c000000000000000000000030ddcf02feba027700000000000000008000000080328c7250ddcf022d83bb7600004903000000008000000080328c7202000000ec138c7268ddcf028b328c7280000000b4378c7201000000a8e48c7294ddcf0241348c72 (UID: 00000000-00007424)","\"cscript.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d580000020000000093c2769ccccf022df888720800000011f88872f6ed0ae7804c8872102088720200000040008972a8694903a069490368cccf02102088723ccdcf02d0f588723abe4f97feffffffa8cccf0242f8887240008972c0cccf02944c887240008972cf7bbd7601000000a4bb8a72eccccf0241f28872082088721420887200000000 (UID: 00000000-00007424)","\"cscript.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d5800000200000000000000cf63837276750a38903583722818837202000000a07f83726c6449035064490340d0cf020018857214d1cf0240648372aa5a4148feffffff80d0cf0200648372a07f837298d0cf029f358372a07f8372cf7bbd7601000000d0158572c4d0cf02a15d8372001883722c1883720000000019def4760000000001000000 (UID: 00000000-00007424)","\"cscript.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d580000020000000018837202000000110000006c64490380000000000000000000490314d1cf0240648372aa5a414888d0cf02feba0277000000000000000080000000a0428672a8d0cf022d83bb76000049030000000080000000a04286720200000044188672c0d0cf02ab42867280000000d447867201000000f0158772ecd0cf0261448672 (UID: 00000000-00007424)"],"description_v3":[{"type":"text","value":"\"cscript.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000001800000059000477338ece72580ccf020000000064fbcf02d0bbce72871fdb44fefffffff0facf02ae42cd7212000000f0476b00f0476b00be42cd72000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d5800000200000000f98c720000000011000000f0f18c728000000000000000000049030c000000000000000000000030ddcf02feba027700000000000000008000000080328c7250ddcf022d83bb7600004903000000008000000080328c7202000000ec138c7268ddcf028b328c7280000000b4378c7201000000a8e48c7294ddcf0241348c72 (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d580000020000000093c2769ccccf022df888720800000011f88872f6ed0ae7804c8872102088720200000040008972a8694903a069490368cccf02102088723ccdcf02d0f588723abe4f97feffffffa8cccf0242f8887240008972c0cccf02944c887240008972cf7bbd7601000000a4bb8a72eccccf0241f28872082088721420887200000000 (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d5800000200000000000000cf63837276750a38903583722818837202000000a07f83726c6449035064490340d0cf020018857214d1cf0240648372aa5a4148feffffff80d0cf0200648372a07f837298d0cf029f358372a07f8372cf7bbd7601000000d0158572c4d0cf02a15d8372001883722c1883720000000019def4760000000001000000 (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d580000020000000018837202000000110000006c64490380000000000000000000490314d1cf0240648372aa5a414888d0cf02feba0277000000000000000080000000a0428672a8d0cf022d83bb76000049030000000080000000a04286720200000044188672c0d0cf02ab42867280000000d447867201000000f0158772ecd0cf0261448672 (UID: 00000000-00007424)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-147","type":6,"relevance":3,"name":"Calls an API typically used to retrieve local language","description":"\"cscript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007424)\n \"cscript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00007424)","description_v2":["\"cscript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007424)","\"cscript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00007424)"],"description_v3":[{"type":"text","value":"\"cscript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00007424)"}],"origin":"API Call","attck_id":"T1614","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-413","type":2,"relevance":1,"name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"WannaCry.exe.sample\")","description_v2":["Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"WannaCry.exe.sample\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"WannaCry.exe.sample\")"}],"origin":"File/Memory","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-201","type":2,"relevance":1,"name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"WannaCry.exe.sample\")","description_v2":["Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"WannaCry.exe.sample\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"WannaCry.exe.sample\")"}],"origin":"File/Memory","attck_id":"T1614","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-193","type":2,"relevance":1,"name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-78","type":3,"relevance":1,"name":"Contains ability to read software policies","description":"$2c","description_v2":["\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","\"taskdl.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")","\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")","\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")","\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")","\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")","\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")","\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")","\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")","\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-326","type":2,"relevance":1,"name":"Contains ability to retrieve environment variable settings","description":"Found string \"SET ow = WScript.CreateObject(\"WScript.Shell\")SET om = ow.CreateShortcut(\"C:\\@WanaDecryptor@.exe.lnk\")om.TargetPath = \"C:\\@WanaDecryptor@.exe\"om.Save\" (Indicator: \"set \"; File: \"m.vbs\")","description_v2":["Found string \"SET ow = WScript.CreateObject(\"WScript.Shell\")SET om = ow.CreateShortcut(\"C:\\@WanaDecryptor@.exe.lnk\")om.TargetPath = \"C:\\@WanaDecryptor@.exe\"om.Save\" (Indicator: \"set \"; File: \"m.vbs\")"],"description_v3":[{"type":"text","value":"Found string \"SET ow = WScript.CreateObject(\"WScript.Shell\")SET om = ow.CreateShortcut(\"C:\\@WanaDecryptor@.exe.lnk\")om.TargetPath = \"C:\\@WanaDecryptor@.exe\"om.Save\" (Indicator: \"set \"; File: \"m.vbs\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-249","type":2,"relevance":1,"name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-89","type":2,"relevance":1,"name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"WannaCry.exe.sample\")","description_v2":["Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"WannaCry.exe.sample\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"WannaCry.exe.sample\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-248","type":2,"relevance":1,"name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"WannaCry.exe.sample\")","description_v2":["Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"WannaCry.exe.sample\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"WannaCry.exe.sample\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-141","type":2,"relevance":1,"name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"WannaCry.exe.sample\")","description_v2":["Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"WannaCry.exe.sample\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"WannaCry.exe.sample\")"}],"origin":"File/Memory","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-327","type":2,"relevance":1,"name":"Contains ability to retrieve operating system version","description":"Observed string: \":data:`os.devnull` when running external programs like ``cmd /c ver``.\" (Indicator: \"cmd /c ver\") in Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp\n Observed string: \":data:`os.devnull` when running external programs like ``cmd /c ver``.\" (Indicator: \"/c ver\") in Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp","description_v2":["Observed string: \":data:`os.devnull` when running external programs like ``cmd /c ver``.\" (Indicator: \"cmd /c ver\") in Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp","Observed string: \":data:`os.devnull` when running external programs like ``cmd /c ver``.\" (Indicator: \"/c ver\") in Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp"],"description_v3":[{"type":"text","value":"Observed string: \":data:`os.devnull` when running external programs like ``cmd /c ver``.\" (Indicator: \"cmd /c ver\") in Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"Observed string: \":data:`os.devnull` when running external programs like ``cmd /c ver``.\" (Indicator: \"/c ver\") in Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-312","type":2,"relevance":1,"name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-143","type":2,"relevance":1,"name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"WannaCry.exe.sample\")","description_v2":["Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"WannaCry.exe.sample\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"WannaCry.exe.sample\")"}],"origin":"File/Memory","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-171","type":2,"relevance":1,"name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"- bpo-35890: Fix API calling consistency of GetVersionEx and wcstok.\" (Indicator: \"GetVersion\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","description_v2":["Found reference to API \"- bpo-35890: Fix API calling consistency of GetVersionEx and wcstok.\" (Indicator: \"GetVersion\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"- bpo-35890: Fix API calling consistency of GetVersionEx and wcstok.\" (Indicator: \"GetVersion\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-167","type":2,"relevance":1,"name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"WannaCry.exe.sample\")","description_v2":["Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"WannaCry.exe.sample\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"WannaCry.exe.sample\")"}],"origin":"File/Memory","attck_id":"T1543","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-11","type":6,"relevance":2,"name":"Queries volume information","description":"\"cscript.exe\" queries volume information of \"C:\\\" at 00000000-00007424-00000C16-3415243802","description_v2":["\"cscript.exe\" queries volume information of \"C:\\\" at 00000000-00007424-00000C16-3415243802"],"description_v3":[{"type":"text","value":"\"cscript.exe\" queries volume information of \"C:\\\" at 00000000-00007424-00000C16-3415243802"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-39","type":6,"relevance":8,"name":"Queries volume information of an entire harddrive","description":"\"cscript.exe\" queries volume information of \"C:\\\" at 00000000-00007424-00000C16-3415243802","description_v2":["\"cscript.exe\" queries volume information of \"C:\\\" at 00000000-00007424-00000C16-3415243802"],"description_v3":[{"type":"text","value":"\"cscript.exe\" queries volume information of \"C:\\\" at 00000000-00007424-00000C16-3415243802"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-1","type":3,"relevance":5,"name":"Reads the cryptographic machine GUID","description":"\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","description_v2":["\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-55","type":3,"relevance":10,"name":"Reads the registry for installed applications","description":"\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CSCRIPT.EXE\")","description_v2":["\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CSCRIPT.EXE\")"],"description_v3":[{"type":"text","value":"\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CSCRIPT.EXE\")"}],"origin":"Registry Access","attck_id":"T1518","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1518","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-191","type":2,"relevance":1,"name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; File: \"WannaCry.exe.sample\")","Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-123","type":6,"relevance":3,"name":"Calls an API typically used to copy file from one location to another","description":"$2d","description_v2":["\"WannaCry.exe.sample.exe\" called \"CopyFileA\" to copy u.wnry to new location @WanaDecryptor@.exe (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\@Please_Read_Me@.txt (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe to new location C:\\@WanaDecryptor@.exe (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\@Please_Read_Me@.txt (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe to new location C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\@WanaDecryptor@.exe (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\.bin\\@Please_Read_Me@.txt (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe to new location C:\\tempdir\\node_modules\\.bin\\@WanaDecryptor@.exe (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@colors\\colors\\@Please_Read_Me@.txt (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@colors\\colors\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@colors\\colors\\examples\\@Please_Read_Me@.txt (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@colors\\colors\\examples\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@colors\\colors\\lib\\@Please_Read_Me@.txt (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@colors\\colors\\lib\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@colors\\colors\\themes\\@Please_Read_Me@.txt (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@colors\\colors\\themes\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@mongodb-js\\saslprep\\dist\\@Please_Read_Me@.txt (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@mongodb-js\\saslprep\\dist\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@pm2\\agent\\@Please_Read_Me@.txt (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@pm2\\agent\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@pm2\\agent\\src\\@Please_Read_Me@.txt (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@pm2\\agent\\src\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@pm2\\io\\@Please_Read_Me@.txt (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@pm2\\io\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@pm2\\io\\pres\\@Please_Read_Me@.txt (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@pm2\\io\\pres\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileA\" to copy u.wnry to new location @WanaDecryptor@.exe (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\@Please_Read_Me@.txt (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe to new location C:\\@WanaDecryptor@.exe (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\@Please_Read_Me@.txt (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe to new location C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\@WanaDecryptor@.exe (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\.bin\\@Please_Read_Me@.txt (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe to new location C:\\tempdir\\node_modules\\.bin\\@WanaDecryptor@.exe (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@colors\\colors\\@Please_Read_Me@.txt (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@colors\\colors\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@colors\\colors\\examples\\@Please_Read_Me@.txt (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@colors\\colors\\examples\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@colors\\colors\\lib\\@Please_Read_Me@.txt (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@colors\\colors\\lib\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@colors\\colors\\themes\\@Please_Read_Me@.txt (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@colors\\colors\\themes\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@mongodb-js\\saslprep\\dist\\@Please_Read_Me@.txt (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@mongodb-js\\saslprep\\dist\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@pm2\\agent\\@Please_Read_Me@.txt (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@pm2\\agent\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@pm2\\agent\\src\\@Please_Read_Me@.txt (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@pm2\\agent\\src\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@pm2\\io\\@Please_Read_Me@.txt (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@pm2\\io\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @Please_Read_Me@.txt to new location C:\\tempdir\\node_modules\\@pm2\\io\\pres\\@Please_Read_Me@.txt (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CopyFileW\" to copy @WanaDecryptor@.exe.lnk to new location C:\\tempdir\\node_modules\\@pm2\\io\\pres\\@WanaDecryptor@.exe.lnk (UID: 00000000-00006996)"}],"origin":"API Call","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-122","type":6,"relevance":3,"name":"Calls an API typically used to create a directory","description":"\"WannaCry.exe.sample.exe\" called \"CreateDirectoryA\" with parameter C:\\msg (UID: 00000000-00006996)\n \"WannaCry.exe.sample.exe\" called \"CreateDirectoryW\" with parameter Z:\\$RECYCLE (UID: 00000000-00006996)","description_v2":["\"WannaCry.exe.sample.exe\" called \"CreateDirectoryA\" with parameter C:\\msg (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CreateDirectoryW\" with parameter Z:\\$RECYCLE (UID: 00000000-00006996)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CreateDirectoryA\" with parameter C:\\msg (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CreateDirectoryW\" with parameter %SAMPLEDIR%\\$RECYCLE (UID: 00000000-00006996)"}],"origin":"API Call","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-128","type":6,"relevance":5,"name":"Calls an API typically used to create a process","description":"\"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"attrib +h .\" - (UID: 00000000-00006996)\n \"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"icacls . /grant Everyone:F /T /C /Q\" - (UID: 00000000-00006996)\n \"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"taskdl.exe\" - (UID: 00000000-00006996)\n \"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"@WanaDecryptor@.exe fi\" - (UID: 00000000-00006996)\n \"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"88831743893367.bat\" - (UID: 00000000-00006996)\n \"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"attrib +h +s Z:\\$RECYCLE\" - (UID: 00000000-00006996)","description_v2":["\"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"attrib +h .\" - (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"icacls . /grant Everyone:F /T /C /Q\" - (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"taskdl.exe\" - (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"@WanaDecryptor@.exe fi\" - (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"88831743893367.bat\" - (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"attrib +h +s Z:\\$RECYCLE\" - (UID: 00000000-00006996)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"attrib +h .\" - (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"icacls . /grant Everyone:F /T /C /Q\" - (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"taskdl.exe\" - (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"@WanaDecryptor@.exe fi\" - (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"88831743893367.bat\" - (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CreateProcessA\" with parameter \"attrib +h +s %SAMPLEDIR%\\$RECYCLE\" - (UID: 00000000-00006996)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-175","type":6,"relevance":1,"name":"Calls an API typically used to load libraries","description":"$2e","description_v2":["\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter KERNEL32.dll (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter SHELL32.dll (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter MSVCRT.dll (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter MSVCP60.dll (UID: 00000000-00006996)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00010448)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00010448)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00010448)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00010448)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003516)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003516)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003516)","\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00003516)","\"cscript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007424)","\"cscript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007424)","\"cscript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007424)","\"cscript.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007424)","\"cscript.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00007424)","\"cscript.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00007424)","\"cscript.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00007424)","\"cscript.exe\" called \"LoadLibrary\" with a parameter WLDP.DLL (UID: 00000000-00007424)","\"cscript.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00007424)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006384)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006384)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006384)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006384)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00010388)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00010388)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00010388)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00010388)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008900)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008900)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008900)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00008900)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006140)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006140)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006140)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006140)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006788)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006788)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006788)","\"taskdl.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006788)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter KERNEL32.dll (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter SHELL32.dll (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter MSVCRT.dll (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"LoadLibrary\" with a parameter MSVCP60.dll (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"LoadLibrary\" with a parameter WLDP.DLL (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006788)"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-176","type":6,"relevance":1,"name":"Calls an API typically used to retrieve function addresses","description":"$2f","description_v2":["\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptAcquireContextA (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptImportKey (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptDestroyKey (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptEncrypt (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptDecrypt (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptGenKey (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateFileW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter WriteFile (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ReadFile (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter MoveFileW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter MoveFileExW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter DeleteFileW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CloseHandle (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetNativeSystemInfo (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSection (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetFileAttributesW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetFileTime (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetFilePointer (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetFileTime (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetFileSizeEx (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter MultiByteToWideChar (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FindClose (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FindNextFileW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FindFirstFileW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ExitThread (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter LeaveCriticalSection (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter EnterCriticalSection (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter Sleep (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetTempFileNameW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FlushFileBuffers (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CopyFileW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateFileA (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateThread (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesA (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateMutexA (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter OpenMutexA (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetFullPathNameA (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CopyFileA (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateDirectoryW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetTempPathW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetWindowsDirectoryW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetDriveTypeW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter WideCharToMultiByte (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter InterlockedExchange (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter InterlockedExchangeAdd (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetLogicalDrives (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter DeleteFileA (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetCurrentDirectoryW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter DeleteCriticalSection (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetComputerNameW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetCurrentDirectoryA (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter LocalFree (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcess (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetLastError (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GlobalAlloc (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter LoadLibraryA (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetProcAddress (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GlobalFree (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetTickCount (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateProcessA (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter WaitForSingleObject (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter TerminateProcess (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetExitCodeProcess (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetFileSize (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SystemParametersInfoW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter AllocateAndInitializeSid (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptExportKey (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptReleaseContext (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetSecurityInfo (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetEntriesInAclA (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetSecurityInfo (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CheckTokenMembership (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FreeSid (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetUserNameW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter OpenProcessToken (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetTokenInformation (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptGenRandom (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptGetKeyParam (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SHGetFolderPathW (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter fopen (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter fprintf (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter sprintf (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter rand (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter time (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter srand (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter wcscpy (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter wcscat (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter wcslen (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ??2@YAPAXI@Z (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter __CxxFrameHandler (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ??3@YAXPAX@Z (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter swprintf (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _except_handler3 (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter fread (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter wcsrchr (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter wcsncpy (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter wcscmp (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _wcsnicmp (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter strncmp (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter wcschr (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _wfopen (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _ftol (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ??0exception@@QAE@ABV0@@Z (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ??1exception@@UAE@XZ (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ??0exception@@QAE@ABQBD@Z (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _CxxThrowException (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ??1type_info@@UAE@XZ (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter free (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _initterm (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter malloc (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _adjust_fdiv (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter fwrite (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter fclose (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _wcsicmp (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _local_unwind2 (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter wcsstr (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ?_Xran@std@@YAXXZ (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ConvertSidToStringSidW (UID: 00000000-00006996)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00010448)","\"cmd.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00003516)","\"cmd.exe\" called \"GetProcAddress\" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003516)","\"cscript.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter SetThreadUILanguage (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter HeapSetInformation (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter RtlDllShutdownInProgress (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter LogStagedFeatureUsage (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter QueryProtectedPolicy (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter AmsiInitialize (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter AmsiScanString (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoExW (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter VerQueryValueW (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter WldpIsClassInApprovedList (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter SaferIdentifyLevel (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter SaferCloseLevel (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter AmsiUninitialize (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter NtQueryWnfStateData (UID: 00000000-00007424)","\"cscript.exe\" called \"GetProcAddress\" with a parameter RtlUnregisterFeatureConfigurationChangeNotification (UID: 00000000-00007424)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00006788)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptAcquireContextA (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptImportKey (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptDestroyKey (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptEncrypt (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptDecrypt (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptGenKey (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateFileW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter WriteFile (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ReadFile (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter MoveFileW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter MoveFileExW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter DeleteFileW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CloseHandle (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetNativeSystemInfo (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSection (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetFileAttributesW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetFileTime (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetFilePointer (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetFileTime (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetFileSizeEx (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter MultiByteToWideChar (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FindClose (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FindNextFileW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FindFirstFileW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ExitThread (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter LeaveCriticalSection (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter EnterCriticalSection (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter Sleep (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetTempFileNameW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FlushFileBuffers (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CopyFileW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateFileA (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateThread (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesA (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateMutexA (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter OpenMutexA (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetFullPathNameA (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CopyFileA (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateDirectoryW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetTempPathW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetWindowsDirectoryW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetDriveTypeW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter WideCharToMultiByte (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter InterlockedExchange (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter InterlockedExchangeAdd (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetLogicalDrives (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter DeleteFileA (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetCurrentDirectoryW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter DeleteCriticalSection (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetComputerNameW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetCurrentDirectoryA (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter LocalFree (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcess (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetLastError (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GlobalAlloc (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter LoadLibraryA (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetProcAddress (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GlobalFree (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetTickCount (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CreateProcessA (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter WaitForSingleObject (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter TerminateProcess (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetExitCodeProcess (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetFileSize (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SystemParametersInfoW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter AllocateAndInitializeSid (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptExportKey (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptReleaseContext (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetSecurityInfo (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetEntriesInAclA (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SetSecurityInfo (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CheckTokenMembership (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter FreeSid (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetUserNameW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter OpenProcessToken (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter GetTokenInformation (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptGenRandom (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter CryptGetKeyParam (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter SHGetFolderPathW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter fopen (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter fprintf (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter sprintf (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter rand (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter time (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter srand (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter wcscpy (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter wcscat (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter wcslen (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ??2@YAPAXI@Z (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter __CxxFrameHandler (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ??3@YAXPAX@Z (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter swprintf (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _except_handler3 (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter fread (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter wcsrchr (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter wcsncpy (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter wcscmp (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _wcsnicmp (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter strncmp (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter wcschr (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _wfopen (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _ftol (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ??0exception@@QAE@ABV0@@Z (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ??1exception@@UAE@XZ (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ??0exception@@QAE@ABQBD@Z (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _CxxThrowException (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ??1type_info@@UAE@XZ (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter free (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _initterm (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter malloc (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _adjust_fdiv (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter fwrite (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter fclose (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _wcsicmp (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter _local_unwind2 (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter wcsstr (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ?_Xran@std@@YAXXZ (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetProcAddress\" with a parameter ConvertSidToStringSidW (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"GetProcAddress\" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003516)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter SetThreadUILanguage (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter HeapSetInformation (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter RtlDllShutdownInProgress (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter LogStagedFeatureUsage (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter QueryProtectedPolicy (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter AmsiInitialize (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter AmsiScanString (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoExW (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter VerQueryValueW (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter WldpIsClassInApprovedList (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter SaferIdentifyLevel (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter SaferCloseLevel (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter AmsiUninitialize (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter NtQueryWnfStateData (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetProcAddress\" with a parameter RtlUnregisterFeatureConfigurationChangeNotification (UID: 00000000-00007424)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00006788)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-242","type":2,"relevance":1,"name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-204","type":2,"relevance":1,"name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")\n Found reference to API \"- bpo-31446: Copy command line that was passed to CreateProcessW since this\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","description_v2":["Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"- bpo-31446: Copy command line that was passed to CreateProcessW since this\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"- bpo-31446: Copy command line that was passed to CreateProcessW since this\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-423","type":2,"relevance":1,"name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-307","type":2,"relevance":1,"name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; File: \"WannaCry.exe.sample\")","Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-315","type":2,"relevance":1,"name":"Contains ability to create/open files (API string)","description":"$30","description_v2":["Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-345","type":2,"relevance":1,"name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"WannaCry.exe.sample\")","Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-79","type":0,"relevance":1,"name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: WannaCry.exe.sample)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: taskse.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: u.wnry)","description_v2":["Found GetProcAddress() and LoadLibraryA() in an import section (Source: WannaCry.exe.sample)","Found GetProcAddress() and LoadLibraryA() in an import section (Source: taskse.exe)","Found GetProcAddress() and LoadLibraryA() in an import section (Source: u.wnry)"],"description_v3":[{"type":"text","value":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: WannaCry.exe.sample)"},{"type":"linebreak"},{"type":"text","value":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: taskse.exe)"},{"type":"linebreak"},{"type":"text","value":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: u.wnry)"}],"origin":"Static Parser","attck_id":"T1027.007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-101","type":2,"relevance":1,"name":"Contains ability to execute Windows APIs","description":"$31","description_v2":["Found reference to API (Indicator: \"CryptReleaseContext\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"RegQueryValueExA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CreateServiceA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"StartServiceA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"RegCreateKeyW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"OpenSCManagerA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"RegSetValueExA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"OpenServiceA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"RegCloseKey\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CloseServiceHandle\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"DeleteCriticalSection\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetStartupInfoA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetExitCodeProcess\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SetFilePointer\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"LoadLibraryA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"HeapAlloc\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetModuleHandleA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"IsBadReadPtr\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CreateProcessA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"EnterCriticalSection\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetCurrentDirectoryA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetProcessHeap\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"WriteFile\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetFileAttributesA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CreateDirectoryA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"MultiByteToWideChar\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"FreeLibrary\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetFileSizeEx\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CreateFileA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetWindowsDirectoryW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"OpenMutexA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SetFileAttributesW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SystemTimeToFileTime\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetProcAddress\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"ReadFile\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"VirtualAlloc\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CopyFileA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"HeapFree\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GlobalAlloc\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetFileSize\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"LeaveCriticalSection\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"FindResourceA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"Sleep\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"InitializeCriticalSection\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GlobalFree\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SetFileTime\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"LocalFileTimeToFileTime\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SetCurrentDirectoryW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"LockResource\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"LoadResource\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"VirtualFree\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SetCurrentDirectoryA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetFileAttributesW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"TerminateProcess\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SetLastError\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetFullPathNameA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SizeofResource\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CreateDirectoryW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetComputerNameW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"VirtualProtect\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetTempPathW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CloseHandle\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetModuleFileNameA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"WaitForSingleObject\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"wsprintfA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"DeleteFileW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"MoveFileExW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"MoveFileW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CreateFileW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CryptGenKey\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CryptDecrypt\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CryptEncrypt\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CryptDestroyKey\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CryptImportKey\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CryptAcquireContextA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetNativeSystemInfo\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"FindFirstFileW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"FindClose\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"FindNextFileW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetDriveTypeW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetLogicalDrives\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetUserNameA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"FreeSid\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"AllocateAndInitializeSid\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CheckTokenMembership\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetDeviceCaps\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"ExtTextOutA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetObjectA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetTextExtentPoint32A\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CreateCompatibleBitmap\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"BitBlt\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CreateFontIndirectA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"TextOutA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CreateSolidBrush\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CreateCompatibleDC\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CreateFontA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"DeleteObject\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CreateThread\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"WideCharToMultiByte\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"DeleteFileA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CopyFileW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GlobalLock\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetComputerNameA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetTempFileNameA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GlobalUnlock\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"FindNextFileA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetExitCodeThread\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"FindFirstFileA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetUserDefaultLangID\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetDiskFreeSpaceExW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"TerminateThread\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetLocaleInfoA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetTickCount\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"ExitProcess\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SystemTimeToTzSpecificLocalTime\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SetFilePointerEx\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SetEndOfFile\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetFileTime\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetTimeZoneInformation\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SHGetFolderPathW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"ShellExecuteExA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"ShellExecuteA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetSystemMetrics\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GrayStringA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SetWindowTextW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetSysColor\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SetWindowPos\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"DrawIcon\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SendMessageA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetClientRect\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"IsIconic\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SetTimer\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"FillRect\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"ShowWindow\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SystemParametersInfoW\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"InvalidateRect\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"GetParent\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CloseClipboard\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"BringWindowToTop\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SetClipboardData\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SetFocus\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"OpenClipboard\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SetCursor\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SetForegroundWindow\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SetActiveWindow\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"EmptyClipboard\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"LoadCursorA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"TabbedTextOutA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"DrawTextA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"EnableWindow\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"SystemParametersInfoA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"RedrawWindow\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"KillTimer\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"LoadIconA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"OffsetRect\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"DeleteUrlCacheEntry\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"inet_ntoa\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"__WSAFDIsSet\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"WSAStartup\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"ioctlsocket\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"htons\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"gethostbyname\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"WSAGetLastError\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"closesocket\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"inet_addr\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"URLDownloadToFileA\"; File: \"WannaCry.exe.sample\")","Found reference to API (Indicator: \"CryptImportKey\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptEncrypt\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found reference to API (Indicator: \"GetExitCodeProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"CreateProcessA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetTickCount\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GlobalFree\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"LoadLibraryA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GlobalAlloc\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"LocalFree\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetCurrentDirectoryA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetComputerNameW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"CreateThread\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"InitializeCriticalSection\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"SetFileAttributesW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"SetFileTime\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"SetFilePointer\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetFileTime\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetFileSizeEx\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"MultiByteToWideChar\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"FindClose\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"FindNextFileW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"FindFirstFileW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"ExitThread\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetTempFileNameW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"FlushFileBuffers\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"CopyFileW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found reference to API (Indicator: \"CreateFileA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"ReadFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found reference to API (Indicator: \"GetFileSize\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetFileAttributesA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"CreateMutexA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"OpenMutexA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetFullPathNameA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"CopyFileA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"CreateDirectoryW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetTempPathW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetWindowsDirectoryW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"DeleteFileW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found reference to API (Indicator: \"GetDiskFreeSpaceExW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"MoveFileExW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found reference to API (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"WideCharToMultiByte\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"InterlockedExchange\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"InterlockedExchangeAdd\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"DeleteFileA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"SetCurrentDirectoryW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"SystemParametersInfoW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetTokenInformation\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"GetUserNameW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"FreeSid\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"SetEntriesInAclA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptReleaseContext\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptExportKey\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptGetKeyParam\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptGenRandom\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"SHGetFolderPathW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API (Indicator: \"ConvertSidToStringSidW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found reference to API (Indicator: \"MoveFileW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptGenKey\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptDestroyKey\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptAcquireContextA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found reference to API (Indicator: \"SetCurrentDirectoryA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"SizeofResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"LockResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"FindResourceA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleFileNameA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"VirtualAlloc\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"VirtualFree\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"FreeLibrary\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"VirtualProtect\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"IsBadReadPtr\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"LocalFileTimeToFileTime\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateDirectoryA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"wsprintfA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"RegCloseKey\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"RegQueryValueExA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"RegSetValueExA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"RegCreateKeyW\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateServiceA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"StartServiceA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"OpenServiceA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"OpenSCManagerA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API (Indicator: \"GetStartupInfoA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API (Indicator: \"CryptReleaseContext\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegQueryValueExA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateServiceA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"StartServiceA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCreateKeyW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenSCManagerA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegSetValueExA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenServiceA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCloseKey\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseServiceHandle\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteCriticalSection\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStartupInfoA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeProcess\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointer\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapAlloc\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsBadReadPtr\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateProcessA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnterCriticalSection\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentDirectoryA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessHeap\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFile\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectoryA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MultiByteToWideChar\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibrary\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSizeEx\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowsDirectoryW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenMutexA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileAttributesW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemTimeToFileTime\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadFile\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualAlloc\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyFileA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapFree\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalAlloc\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSize\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LeaveCriticalSection\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindResourceA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSection\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalFree\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileTime\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocalFileTimeToFileTime\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCurrentDirectoryW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LockResource\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadResource\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualFree\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCurrentDirectoryA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetLastError\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFullPathNameA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SizeofResource\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectoryW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetComputerNameW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualProtect\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPathW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseHandle\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObject\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"wsprintfA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MoveFileExW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MoveFileW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptGenKey\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDecrypt\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptEncrypt\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDestroyKey\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptImportKey\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptAcquireContextA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetNativeSystemInfo\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindClose\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindNextFileW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDriveTypeW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLogicalDrives\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserNameA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeSid\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AllocateAndInitializeSid\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CheckTokenMembership\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDeviceCaps\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExtTextOutA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetObjectA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTextExtentPoint32A\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateCompatibleBitmap\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"BitBlt\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFontIndirectA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TextOutA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateSolidBrush\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateCompatibleDC\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFontA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteObject\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThread\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WideCharToMultiByte\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyFileW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalLock\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetComputerNameA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempFileNameA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalUnlock\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindNextFileA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeThread\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLangID\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDiskFreeSpaceExW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateThread\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocaleInfoA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitProcess\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemTimeToTzSpecificLocalTime\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointerEx\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEndOfFile\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileTime\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeZoneInformation\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHGetFolderPathW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShellExecuteExA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShellExecuteA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemMetrics\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GrayStringA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowTextW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSysColor\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowPos\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawIcon\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SendMessageA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetClientRect\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsIconic\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetTimer\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FillRect\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowWindow\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemParametersInfoW\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InvalidateRect\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetParent\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseClipboard\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"BringWindowToTop\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetClipboardData\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFocus\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenClipboard\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCursor\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetForegroundWindow\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetActiveWindow\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EmptyClipboard\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadCursorA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TabbedTextOutA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawTextA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnableWindow\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemParametersInfoA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RedrawWindow\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"KillTimer\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadIconA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OffsetRect\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteUrlCacheEntry\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"inet_ntoa\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"__WSAFDIsSet\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAStartup\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ioctlsocket\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"htons\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"gethostbyname\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAGetLastError\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"closesocket\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"inet_addr\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"URLDownloadToFileA\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptImportKey\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptEncrypt\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateProcessA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalFree\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalAlloc\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocalFree\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentDirectoryA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetComputerNameW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThread\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSection\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileAttributesW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileTime\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointer\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileTime\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSizeEx\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MultiByteToWideChar\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindClose\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindNextFileW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitThread\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempFileNameW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushFileBuffers\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyFileW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSize\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateMutexA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenMutexA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFullPathNameA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyFileA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectoryW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPathW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowsDirectoryW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDiskFreeSpaceExW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MoveFileExW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WideCharToMultiByte\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InterlockedExchange\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InterlockedExchangeAdd\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCurrentDirectoryW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemParametersInfoW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTokenInformation\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserNameW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeSid\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEntriesInAclA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptReleaseContext\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptExportKey\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptGetKeyParam\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptGenRandom\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHGetFolderPathW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ConvertSidToStringSidW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MoveFileW\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptGenKey\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDestroyKey\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptAcquireContextA\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCurrentDirectoryA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SizeofResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LockResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindResourceA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualAlloc\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualFree\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibrary\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualProtect\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsBadReadPtr\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocalFileTimeToFileTime\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectoryA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"wsprintfA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCloseKey\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegQueryValueExA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegSetValueExA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCreateKeyW\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateServiceA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"StartServiceA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenServiceA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenSCManagerA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStartupInfoA\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-240","type":2,"relevance":1,"name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"- bpo-23253: Delay-load ShellExecute[AW] in os.startfile for reduced startup\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","description_v2":["Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; File: \"WannaCry.exe.sample\")","Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"WannaCry.exe.sample\")","Found reference to API \"- bpo-23253: Delay-load ShellExecute[AW] in os.startfile for reduced startup\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"- bpo-23253: Delay-load ShellExecute[AW] in os.startfile for reduced startup\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-174","type":2,"relevance":1,"name":"Contains ability to executes commands or batch file","description":"$32","description_v2":["Found string \"cmd.exe /c \"%s\"\" (Indicator: \"cmd.exe /c\"; File: \"WannaCry.exe.sample\")","Found string \"%WINDIR%\\system32\\cmd.exe /c 88831743893367.bat\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")","Found string \"%WINDIR%\\system32\\cmd.exe /c 88831743893367.bat\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")","Found string \"cmd.exe /c reg add %s /v \"%s\" /t REG_SZ /d \"\\\"%s\\\"\" /f\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found string \"cmd.exe /c start /b %s vs\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"cmd.exe /c \"%s\"\" (Indicator: \"cmd.exe /c\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c 88831743893367.bat\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c 88831743893367.bat\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"cmd.exe /c reg add %s /v \"%s\" /t REG_SZ /d \"\\\"%s\\\"\" /f\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"cmd.exe /c start /b %s vs\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-550","type":2,"relevance":1,"name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")\n Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; File: \"WannaCry.exe.sample\")","Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"WannaCry.exe.sample\")","Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"WannaCry.exe.sample\")","Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"WannaCry.exe.sample\")","Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-322","type":2,"relevance":1,"name":"Contains ability to move file or directory (API string)","description":"$33","description_v2":["Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"WannaCry.exe.sample\")","Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"WannaCry.exe.sample\")","Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-161","type":2,"relevance":1,"name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-272","type":2,"relevance":1,"name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"WannaCry.exe.sample\")","Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-319","type":2,"relevance":1,"name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")\n Found reference to API \"- bpo-32890: Fix usage of GetLastError() instead of errno in os.execve() and\" (Indicator: \"GetLastError\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","description_v2":["Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"WannaCry.exe.sample\")","Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","Found reference to API \"- bpo-32890: Fix usage of GetLastError() instead of errno in os.execve() and\" (Indicator: \"GetLastError\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"- bpo-32890: Fix usage of GetLastError() instead of errno in os.execve() and\" (Indicator: \"GetLastError\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-208","type":2,"relevance":1,"name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"WannaCry.exe.sample\")","description_v2":["Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"WannaCry.exe.sample\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"WannaCry.exe.sample\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-209","type":2,"relevance":1,"name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; File: \"WannaCry.exe.sample\")","Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-120","type":2,"relevance":1,"name":"Contains registry location strings","description":"\"Software\\\" in Source: WannaCry.exe.sample\n \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: 00000000-00006996.00000000.281787.00810000.00000004.mdmp\n 00000000-00006996.00000000.281787.1000C000.00000004.mdmp\n 00000000-00006996.00000001.283709.00810000.00000004.mdmp\n 00000000-00006996.00000001.283709.1000C000.00000004.mdmp\n 00000000-00006996.00000002.285629.00810000.00000004.mdmp\n 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\n \"ISTRY\\USER\\S-1-5-21-1271187874-1938232448-3812392235-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00006996.00000002.285629.00810000.00000004.mdmp","description_v2":["\"Software\\\" in Source: WannaCry.exe.sample","\"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: 00000000-00006996.00000000.281787.00810000.00000004.mdmp","00000000-00006996.00000000.281787.1000C000.00000004.mdmp","00000000-00006996.00000001.283709.00810000.00000004.mdmp","00000000-00006996.00000001.283709.1000C000.00000004.mdmp","00000000-00006996.00000002.285629.00810000.00000004.mdmp","00000000-00006996.00000002.285629.1000C000.00000004.mdmp","\"ISTRY\\USER\\S-1-5-21-1271187874-1938232448-3812392235-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00006996.00000002.285629.00810000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\"Software\\\" in Source: WannaCry.exe.sample"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: 00000000-00006996.00000000.281787.00810000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000000.281787.1000C000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000001.283709.00810000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000001.283709.1000C000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000002.285629.00810000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000002.285629.1000C000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"ISTRY\\USER\\S-1-5-21-1271187874-1938232448-3812392235-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00006996.00000002.285629.00810000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"\"MsWinZonesCacheCounterMutexA\"\n \"Local\\SM0:10448:168:WilStaging_02\"\n \"Local\\SM0:3516:168:WilStaging_02\"\n \"Local\\SM0:7424:168:WilStaging_02\"\n \"Local\\SM0:7424:64:WilError_03\"\n \"SM0:7424:64:WilError_03\"\n \"Local\\SM0:6384:168:WilStaging_02\"","description_v2":["\"MsWinZonesCacheCounterMutexA\"","\"Local\\SM0:10448:168:WilStaging_02\"","\"Local\\SM0:3516:168:WilStaging_02\"","\"Local\\SM0:7424:168:WilStaging_02\"","\"Local\\SM0:7424:64:WilError_03\"","\"SM0:7424:64:WilError_03\"","\"Local\\SM0:6384:168:WilStaging_02\""],"description_v3":[{"type":"text","value":"\"MsWinZonesCacheCounterMutexA\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\SM0:10448:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\SM0:3516:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\SM0:7424:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\SM0:7424:64:WilError_03\""},{"type":"linebreak"},{"type":"text","value":"\"SM0:7424:64:WilError_03\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\SM0:6384:168:WilStaging_02\""}],"origin":"Created Mutant","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-220","type":9,"relevance":3,"name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c 88831743893367.bat\" (UID: 00000000-00003516)","description_v2":["Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c 88831743893367.bat\" (UID: 00000000-00003516)"],"description_v3":[{"type":"text","value":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c 88831743893367.bat\""},{"type":"process","process_uid":"00000000-00003516","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1059","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-179","type":2,"relevance":1,"name":"Found string that contains outlook file extensions .ost/.pst","description":"\".ost\" (Indicator: \".ost\") in Source: 00000000-00006996.00000000.281787.00810000.00000004.mdmp\n 00000000-00006996.00000000.281787.1000C000.00000004.mdmp\n 00000000-00006996.00000001.283709.00810000.00000004.mdmp\n 00000000-00006996.00000001.283709.1000C000.00000004.mdmp\n 00000000-00006996.00000002.285629.00810000.00000004.mdmp\n 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\n \".pst\" (Indicator: \".pst\") in Source: 00000000-00006996.00000000.281787.00810000.00000004.mdmp\n 00000000-00006996.00000000.281787.1000C000.00000004.mdmp\n 00000000-00006996.00000001.283709.00810000.00000004.mdmp\n 00000000-00006996.00000001.283709.1000C000.00000004.mdmp\n 00000000-00006996.00000002.285629.00810000.00000004.mdmp\n 00000000-00006996.00000002.285629.1000C000.00000004.mdmp","description_v2":["\".ost\" (Indicator: \".ost\") in Source: 00000000-00006996.00000000.281787.00810000.00000004.mdmp","00000000-00006996.00000000.281787.1000C000.00000004.mdmp","00000000-00006996.00000001.283709.00810000.00000004.mdmp","00000000-00006996.00000001.283709.1000C000.00000004.mdmp","00000000-00006996.00000002.285629.00810000.00000004.mdmp","00000000-00006996.00000002.285629.1000C000.00000004.mdmp","\".pst\" (Indicator: \".pst\") in Source: 00000000-00006996.00000000.281787.00810000.00000004.mdmp","00000000-00006996.00000000.281787.1000C000.00000004.mdmp","00000000-00006996.00000001.283709.00810000.00000004.mdmp","00000000-00006996.00000001.283709.1000C000.00000004.mdmp","00000000-00006996.00000002.285629.00810000.00000004.mdmp","00000000-00006996.00000002.285629.1000C000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\".ost\" (Indicator: \".ost\") in Source: 00000000-00006996.00000000.281787.00810000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000000.281787.1000C000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000001.283709.00810000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000001.283709.1000C000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000002.285629.00810000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000002.285629.1000C000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\".pst\" (Indicator: \".pst\") in Source: 00000000-00006996.00000000.281787.00810000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000000.281787.1000C000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000001.283709.00810000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000001.283709.1000C000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000002.285629.00810000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000002.285629.1000C000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1114.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1114/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-135","type":2,"relevance":1,"name":"Found well known domains (string)","description":"\"The CPython repository is https://github.com/python/cpython. The\" (Indicator: \"github.com\")\n \"IDLE Issues listing is https://github.com/orgs/python/projects/31.\" (Indicator: \"github.com\")\n \"https://github.com/libexpat/libexpat/issues/115\" (Indicator: \"github.com\")\n \"- A new version of typing.py from https://github.com/python/typing: -\" (Indicator: \"github.com\")\n \"https://github.com/python/pythondotorg/issues/945)\" (Indicator: \"github.com\")\n \"- A new version of typing.py from https://github.com/python/typing:\" (Indicator: \"github.com\")\n \"`\" (Indicator: \"github.com\")\n \"[typed_ast](https://github.com/python/typed_ast).\" (Indicator: \"github.com\")\n \"See `setuptools 100 `_ for\" (Indicator: \"github.com\")","description_v2":["\"The CPython repository is https://github.com/python/cpython. The\" (Indicator: \"github.com\")","\"IDLE Issues listing is https://github.com/orgs/python/projects/31.\" (Indicator: \"github.com\")","\"https://github.com/libexpat/libexpat/issues/115\" (Indicator: \"github.com\")","\"- A new version of typing.py from https://github.com/python/typing: -\" (Indicator: \"github.com\")","\"https://github.com/python/pythondotorg/issues/945)\" (Indicator: \"github.com\")","\"- A new version of typing.py from https://github.com/python/typing:\" (Indicator: \"github.com\")","\"`\" (Indicator: \"github.com\")","\"[typed_ast](https://github.com/python/typed_ast).\" (Indicator: \"github.com\")","\"See `setuptools 100 `_ for\" (Indicator: \"github.com\")"],"description_v3":[{"type":"text","value":"\"The CPython repository is https://github.com/python/cpython. The\" (Indicator: \"github.com\")"},{"type":"linebreak"},{"type":"text","value":"\"IDLE Issues listing is https://github.com/orgs/python/projects/31.\" (Indicator: \"github.com\")"},{"type":"linebreak"},{"type":"text","value":"\"https://github.com/libexpat/libexpat/issues/115\" (Indicator: \"github.com\")"},{"type":"linebreak"},{"type":"text","value":"\"- A new version of typing.py from https://github.com/python/typing: -\" (Indicator: \"github.com\")"},{"type":"linebreak"},{"type":"text","value":"\"https://github.com/python/pythondotorg/issues/945)\" (Indicator: \"github.com\")"},{"type":"linebreak"},{"type":"text","value":"\"- A new version of typing.py from https://github.com/python/typing:\" (Indicator: \"github.com\")"},{"type":"linebreak"},{"type":"text","value":"\"`\" (Indicator: \"github.com\")"},{"type":"linebreak"},{"type":"text","value":"\"[typed_ast](https://github.com/python/typed_ast).\" (Indicator: \"github.com\")"},{"type":"linebreak"},{"type":"text","value":"\"See `setuptools 100 `_ for\" (Indicator: \"github.com\")"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-72","type":9,"relevance":10,"name":"Launches a VBS file","description":"Process \"cscript.exe\" with commandline \"//nologo m.vbs\" (UID: 00000000-00007424)","description_v2":["Process \"cscript.exe\" with commandline \"//nologo m.vbs\" (UID: 00000000-00007424)"],"description_v3":[{"type":"text","value":"Process \"cscript.exe\" with commandline \"//nologo m.vbs\""},{"type":"process","process_uid":"00000000-00007424","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1059.005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-7","type":6,"relevance":1,"name":"Loads modules at runtime","description":"$34","description_v2":["\"WannaCry.exe.sample.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 76d50000","\"WannaCry.exe.sample.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 76d50000","\"WannaCry.exe.sample.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 76d50000","\"WannaCry.exe.sample.exe\" loaded module \"KERNEL32\" at base 76630000","\"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 72c50000","\"WannaCry.exe.sample.exe\" loaded module \"NTDLL.DLL\" at base 76fe0000","\"WannaCry.exe.sample.exe\" loaded module \"KERNELBASE\" at base 76d50000","\"WannaCry.exe.sample.exe\" loaded module \"ADVAPI32.DLL\" at base 75a70000","\"WannaCry.exe.sample.exe\" loaded module \"KERNEL32.DLL\" at base 76630000","\"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 72bc0000","\"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 75590000","\"WannaCry.exe.sample.exe\" loaded module \"USER32.DLL\" at base 768a0000","\"WannaCry.exe.sample.exe\" loaded module \"SHELL32.DLL\" at base 74cf0000","\"WannaCry.exe.sample.exe\" loaded module \"MSVCRT.DLL\" at base 76b70000","\"WannaCry.exe.sample.exe\" loaded module \"MSVCP60.DLL\" at base 72b10000","\"WannaCry.exe.sample.exe\" loaded module \"RPCRT4.DLL\" at base 76420000","\"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\SYSTEM32\\APPHELP.DLL\" at base 74410000","\"WannaCry.exe.sample.exe\" loaded module \"SSPICLI.DLL\" at base 739d0000","\"taskdl.exe\" loaded module \"KERNEL32\" at base 76630000","\"taskdl.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 76d50000","\"taskdl.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 76d50000","\"taskdl.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 76d50000","\"taskdl.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 76ae0000","\"taskdl.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 76d50000","\"taskdl.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 76d50000","\"taskdl.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 76d50000","\"taskdl.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 72c50000","\"cmd.exe\" loaded module \"KERNEL32\" at base 76630000","\"cmd.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 76d50000","\"cmd.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 76d50000","\"cmd.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 76d50000","\"cmd.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 76ae0000","\"cmd.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 76d50000","\"cmd.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 76d50000","\"cmd.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 76d50000","\"cmd.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 72c50000","\"cmd.exe\" loaded module \"KERNEL32.DLL\" at base 76630000","\"cmd.exe\" loaded module \"NTDLL.DLL\" at base 76fe0000","\"cmd.exe\" loaded module \"KERNELBASE\" at base 76d50000","\"cmd.exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-2\" at base 744c0000","\"cscript.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 76d50000","\"cscript.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 76d50000","\"cscript.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 76d50000","\"cscript.exe\" loaded module \"KERNEL32\" at base 76630000","\"cscript.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 72c50000","\"cscript.exe\" loaded module \"KERNEL32.DLL\" at base 76630000","\"cscript.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 744e0000","\"cscript.exe\" loaded module \"RPCRT4.DLL\" at base 76420000","\"cscript.exe\" loaded module \"%WINDIR%\\SYSWOW64\\VBSCRIPT.DLL\" at base 729e0000","\"cscript.exe\" loaded module \"AMSI.DLL\" at base 729c0000","\"cscript.exe\" loaded module \"%WINDIR%\\SYSTEM32\\VERSION.DLL\" at base 74cd0000","\"cscript.exe\" loaded module \"%ALLUSERSPROFILE%\\MICROSOFT\\WINDOWS DEFENDER\\PLATFORM\\4.18.23090.2008-0\\X86\\MPOAV.DLL\" at base 72950000","\"cscript.exe\" loaded module \"WLDP.DLL\" at base 72900000","\"cscript.exe\" loaded module \"%WINDIR%\\SYSTEM32\\ADVAPI32.DLL\" at base 75a70000","\"cscript.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 72bc0000","\"cscript.exe\" loaded module \"%WINDIR%\\SYSWOW64\\MSISIP.DLL\" at base 728e0000","\"cscript.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPT32.DLL\" at base 76c40000","\"cscript.exe\" loaded module \"%WINDIR%\\SYSWOW64\\WSHEXT.DLL\" at base 728c0000","\"cscript.exe\" loaded module \"%WINDIR%\\SYSWOW64\\SCROBJ.DLL\" at base 72880000","\"cscript.exe\" loaded module \"%WINDIR%\\SYSWOW64\\WSHOM.OCX\" at base 72860000","\"cscript.exe\" loaded module \"%WINDIR%\\SYSWOW64\\WINDOWS.STORAGE.DLL\" at base 732d0000","\"cscript.exe\" loaded module \"%WINDIR%\\SYSTEM32\\PROPSYS.DLL\" at base 73a90000","\"cscript.exe\" loaded module \"CSCAPI.DLL\" at base 72dd0000"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"KERNEL32\" at base 76630000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 72c50000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"NTDLL.DLL\" at base 76fe0000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"KERNELBASE\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"ADVAPI32.DLL\" at base 75a70000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"KERNEL32.DLL\" at base 76630000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 72bc0000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 75590000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"USER32.DLL\" at base 768a0000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"SHELL32.DLL\" at base 74cf0000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"MSVCRT.DLL\" at base 76b70000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"MSVCP60.DLL\" at base 72b10000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"RPCRT4.DLL\" at base 76420000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\SYSTEM32\\APPHELP.DLL\" at base 74410000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"SSPICLI.DLL\" at base 739d0000"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" loaded module \"KERNEL32\" at base 76630000"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 76ae0000"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 72c50000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"KERNEL32\" at base 76630000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 76ae0000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 72c50000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"KERNEL32.DLL\" at base 76630000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"NTDLL.DLL\" at base 76fe0000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"KERNELBASE\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-2\" at base 744c0000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 76d50000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"KERNEL32\" at base 76630000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 72c50000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"KERNEL32.DLL\" at base 76630000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 744e0000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"RPCRT4.DLL\" at base 76420000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"%WINDIR%\\SYSWOW64\\VBSCRIPT.DLL\" at base 729e0000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"AMSI.DLL\" at base 729c0000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"%WINDIR%\\SYSTEM32\\VERSION.DLL\" at base 74cd0000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"%ALLUSERSPROFILE%\\MICROSOFT\\WINDOWS DEFENDER\\PLATFORM\\4.18.23090.2008-0\\X86\\MPOAV.DLL\" at base 72950000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"WLDP.DLL\" at base 72900000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"%WINDIR%\\SYSTEM32\\ADVAPI32.DLL\" at base 75a70000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 72bc0000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"%WINDIR%\\SYSWOW64\\MSISIP.DLL\" at base 728e0000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPT32.DLL\" at base 76c40000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"%WINDIR%\\SYSWOW64\\WSHEXT.DLL\" at base 728c0000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"%WINDIR%\\SYSWOW64\\SCROBJ.DLL\" at base 72880000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"%WINDIR%\\SYSWOW64\\WSHOM.OCX\" at base 72860000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"%WINDIR%\\SYSWOW64\\WINDOWS.STORAGE.DLL\" at base 732d0000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"%WINDIR%\\SYSTEM32\\PROPSYS.DLL\" at base 73a90000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"CSCAPI.DLL\" at base 72dd0000"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-8","type":10,"relevance":0,"name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 729C0000","description_v2":["\"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 729C0000"],"description_v3":[{"type":"text","value":"\"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 729C0000"}],"origin":"Loaded Module","attck_id":"T1562.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-9","type":10,"relevance":0,"name":"Loads the Bcrypt module DLL","description":"\"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75590000\n \"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72B90000\n \"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75590000","description_v2":["\"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75590000","\"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72B90000","\"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75590000"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75590000"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72B90000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75590000"}],"origin":"Loaded Module","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-10","type":10,"relevance":0,"name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76420000\n \"icacls.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76420000\n \"taskdl.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76420000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76420000\n \"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76420000","description_v2":["\"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76420000","\"icacls.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76420000","\"taskdl.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76420000","\"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76420000","\"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76420000"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76420000"},{"type":"linebreak"},{"type":"text","value":"\"icacls.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76420000"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76420000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76420000"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76420000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-64","type":6,"relevance":10,"name":"Logged script engine calls","description":"\"cscript.exe\" called \"WScript.CreateObject\" with result: \"IDispatch\" ...\n \"cscript.exe\" called \"WScript.Shell.1.CreateObject\" ... \n \"cscript.exe\" called \"WScript.Shell.1.Unnamed\" ... \n \"cscript.exe\" called \"WScript.Shell.1.CreateShortcut\" with result: \"C:\\@WanaDecryptor@.exe.lnk\" ...\n \"cscript.exe\" called \"WScript.Shell.1(\"CreateShortcut\").TargetPath\" ... ","description_v2":["\"cscript.exe\" called \"WScript.CreateObject\" with result: \"IDispatch\" ...","\"cscript.exe\" called \"WScript.Shell.1.CreateObject\" ...","\"cscript.exe\" called \"WScript.Shell.1.Unnamed\" ...","\"cscript.exe\" called \"WScript.Shell.1.CreateShortcut\" with result: \"C:\\@WanaDecryptor@.exe.lnk\" ...","\"cscript.exe\" called \"WScript.Shell.1(\"CreateShortcut\").TargetPath\" ..."],"description_v3":[{"type":"text","value":"\"cscript.exe\" called \"WScript.CreateObject\" with result: \"IDispatch\" ..."},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"WScript.Shell.1.CreateObject\" ..."},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"WScript.Shell.1.Unnamed\" ..."},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"WScript.Shell.1.CreateShortcut\" with result: \"C:\\@WanaDecryptor@.exe.lnk\" ..."},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"WScript.Shell.1(\"CreateShortcut\").TargetPath\" ..."}],"origin":"API Call","attck_id":"T1059","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-157","type":0,"relevance":0,"name":"Matched Compiler/Packer signature (DIE)","description":"$35","description_v2":["\"WannaCry.exe.sample\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"","\"WannaCry.exe.sample\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"","\"WannaCry.exe.sample\" was detected as \"Microsoft Linker\" and name: \"Linker\"","\"WannaCry.exe.sample\" was detected as \"Zip\" and name: \"Archive\"","\"taskse.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"","\"taskse.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"","\"taskse.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","\"taskse.exe\" was detected as \"Zip\" and name: \"Archive\"","\"taskdl.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"","\"taskdl.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"","\"taskdl.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","\"taskdl.exe\" was detected as \"Zip\" and name: \"Archive\"","\"u.wnry\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"","\"u.wnry\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"","\"u.wnry\" was detected as \"Microsoft Linker\" and name: \"Linker\"","\"u.wnry\" was detected as \"Zip\" and name: \"Archive\""],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample\" was detected as \"Microsoft Linker\" and name: \"Linker\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample\" was detected as \"Zip\" and name: \"Archive\""},{"type":"linebreak"},{"type":"text","value":"\"taskse.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"taskse.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"taskse.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\""},{"type":"linebreak"},{"type":"text","value":"\"taskse.exe\" was detected as \"Zip\" and name: \"Archive\""},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\""},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" was detected as \"Zip\" and name: \"Archive\""},{"type":"linebreak"},{"type":"text","value":"\"u.wnry\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"u.wnry\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"u.wnry\" was detected as \"Microsoft Linker\" and name: \"Linker\""},{"type":"linebreak"},{"type":"text","value":"\"u.wnry\" was detected as \"Zip\" and name: \"Archive\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-72","type":3,"relevance":3,"name":"Overview of unique CLSIDs touched in registry","description":"\"cscript.exe\" touched \"VB Script Language\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\")\n \"cscript.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")\n \"cscript.exe\" touched \"Constructor that allows hosts better control creating scriptlets\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\TREATAS\")\n \"cscript.exe\" touched \"Windows Script Host Shell Object\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\\TREATAS\")\n \"cscript.exe\" touched \"Shortcut\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00021401-0000-0000-C000-000000000046}\\TREATAS\")\n \"cscript.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")\n \"cscript.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","description_v2":["\"cscript.exe\" touched \"VB Script Language\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\")","\"cscript.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")","\"cscript.exe\" touched \"Constructor that allows hosts better control creating scriptlets\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\TREATAS\")","\"cscript.exe\" touched \"Windows Script Host Shell Object\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\\TREATAS\")","\"cscript.exe\" touched \"Shortcut\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00021401-0000-0000-C000-000000000046}\\TREATAS\")","\"cscript.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")","\"cscript.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")"],"description_v3":[{"type":"text","value":"\"cscript.exe\" touched \"VB Script Language\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" touched \"Constructor that allows hosts better control creating scriptlets\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" touched \"Windows Script Host Shell Object\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" touched \"Shortcut\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00021401-0000-0000-C000-000000000046}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")"}],"origin":"Registry Access","attck_id":"T1546.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-80","type":0,"relevance":1,"name":"PE file contains executable sections","description":"\"WannaCry.exe.sample\" has an executable section named \".text\"\n \"taskse.exe\" has an executable section named \".text\"\n \"taskdl.exe\" has an executable section named \".text\"\n \"u.wnry\" has an executable section named \".text\"","description_v2":["\"WannaCry.exe.sample\" has an executable section named \".text\"","\"taskse.exe\" has an executable section named \".text\"","\"taskdl.exe\" has an executable section named \".text\"","\"u.wnry\" has an executable section named \".text\""],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample\" has an executable section named \".text\""},{"type":"linebreak"},{"type":"text","value":"\"taskse.exe\" has an executable section named \".text\""},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" has an executable section named \".text\""},{"type":"linebreak"},{"type":"text","value":"\"u.wnry\" has an executable section named \".text\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-95","type":0,"relevance":0,"name":"PE file contains writable sections","description":"\"WannaCry.exe.sample\" has an writable section named \".data\"\n \"taskse.exe\" has an writable section named \".data\"\n \"taskdl.exe\" has an writable section named \".data\"\n \"u.wnry\" has an writable section named \".data\"","description_v2":["\"WannaCry.exe.sample\" has an writable section named \".data\"","\"taskse.exe\" has an writable section named \".data\"","\"taskdl.exe\" has an writable section named \".data\"","\"u.wnry\" has an writable section named \".data\""],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample\" has an writable section named \".data\""},{"type":"linebreak"},{"type":"text","value":"\"taskse.exe\" has an writable section named \".data\""},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" has an writable section named \".data\""},{"type":"linebreak"},{"type":"text","value":"\"u.wnry\" has an writable section named \".data\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-96","type":0,"relevance":0,"name":"PE file entrypoint instructions","description":"$36","description_v2":["\"WannaCry.exe.sample\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,push\t-1,push\t0x40d488,push\t0x4076f4,mov\teax, dword ptr fs:[0],push\teax,mov\tdword ptr fs:[0], esp,sub\tesp, 0x68,push\tebx,push\tesi,push\tedi,mov\tdword ptr [ebp - 0x18], esp,xor\tebx, ebx,mov\tdword ptr [ebp - 4], ebx,push\t2,call\tdword ptr [0x4081c4],pop\tecx,or\tdword ptr [0x40f94c], 0xffffffff,or\tdword ptr [0x40f950], 0xffffffff,call\tdword ptr [0x4081c0],mov\tecx, dword ptr [0x40f948],mov\tdword ptr [eax], ecx,call\tdword ptr [0x4081bc],mov\tecx, dword ptr [0x40f944],mov\tdword ptr [eax], ecx,mov\teax, dword ptr [0x4081b8],\"","\"taskse.exe\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,push\t-1,push\t0x402070,push\t0x401540,mov\teax, dword ptr fs:[0],push\teax,mov\tdword ptr fs:[0], esp,sub\tesp, 0x68,push\tebx,push\tesi,push\tedi,mov\tdword ptr [ebp - 0x18], esp,xor\tebx, ebx,mov\tdword ptr [ebp - 4], ebx,push\t2,call\tdword ptr [0x402050],pop\tecx,or\tdword ptr [0x4031b4], 0xffffffff,or\tdword ptr [0x4031b8], 0xffffffff,call\tdword ptr [0x40204c],mov\tecx, dword ptr [0x4031b0],mov\tdword ptr [eax], ecx,call\tdword ptr [0x402048],mov\tecx, dword ptr [0x4031ac],mov\tdword ptr [eax], ecx,mov\teax, dword ptr [0x402044],\"","\"taskdl.exe\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,push\t-1,push\t0x4020a8,push\t0x401a7c,mov\teax, dword ptr fs:[0],push\teax,mov\tdword ptr fs:[0], esp,sub\tesp, 0x68,push\tebx,push\tesi,push\tedi,mov\tdword ptr [ebp - 0x18], esp,xor\tebx, ebx,mov\tdword ptr [ebp - 4], ebx,push\t2,call\tdword ptr [0x40208c],pop\tecx,or\tdword ptr [0x403084], 0xffffffff,or\tdword ptr [0x403088], 0xffffffff,call\tdword ptr [0x402088],mov\tecx, dword ptr [0x403080],mov\tdword ptr [eax], ecx,call\tdword ptr [0x402084],mov\tecx, dword ptr [0x40307c],mov\tdword ptr [eax], ecx,mov\teax, dword ptr [0x402080],\"","\"u.wnry\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,push\t-1,push\t0x41baa8,push\t0x413050,mov\teax, dword ptr fs:[0],push\teax,mov\tdword ptr fs:[0], esp,sub\tesp, 0x68,push\tebx,push\tesi,push\tedi,mov\tdword ptr [ebp - 0x18], esp,xor\tebx, ebx,mov\tdword ptr [ebp - 4], ebx,push\t2,call\tdword ptr [0x415524],pop\tecx,or\tdword ptr [0x422298], 0xffffffff,or\tdword ptr [0x42229c], 0xffffffff,call\tdword ptr [0x415520],mov\tecx, dword ptr [0x42228c],mov\tdword ptr [eax], ecx,call\tdword ptr [0x41551c],mov\tecx, dword ptr [0x422288],mov\tdword ptr [eax], ecx,mov\teax, dword ptr [0x415518],\""],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,push\t-1,push\t0x40d488,push\t0x4076f4,mov\teax, dword ptr fs:[0],push\teax,mov\tdword ptr fs:[0], esp,sub\tesp, 0x68,push\tebx,push\tesi,push\tedi,mov\tdword ptr [ebp - 0x18], esp,xor\tebx, ebx,mov\tdword ptr [ebp - 4], ebx,push\t2,call\tdword ptr [0x4081c4],pop\tecx,or\tdword ptr [0x40f94c], 0xffffffff,or\tdword ptr [0x40f950], 0xffffffff,call\tdword ptr [0x4081c0],mov\tecx, dword ptr [0x40f948],mov\tdword ptr [eax], ecx,call\tdword ptr [0x4081bc],mov\tecx, dword ptr [0x40f944],mov\tdword ptr [eax], ecx,mov\teax, dword ptr [0x4081b8],\""},{"type":"linebreak"},{"type":"text","value":"\"taskse.exe\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,push\t-1,push\t0x402070,push\t0x401540,mov\teax, dword ptr fs:[0],push\teax,mov\tdword ptr fs:[0], esp,sub\tesp, 0x68,push\tebx,push\tesi,push\tedi,mov\tdword ptr [ebp - 0x18], esp,xor\tebx, ebx,mov\tdword ptr [ebp - 4], ebx,push\t2,call\tdword ptr [0x402050],pop\tecx,or\tdword ptr [0x4031b4], 0xffffffff,or\tdword ptr [0x4031b8], 0xffffffff,call\tdword ptr [0x40204c],mov\tecx, dword ptr [0x4031b0],mov\tdword ptr [eax], ecx,call\tdword ptr [0x402048],mov\tecx, dword ptr [0x4031ac],mov\tdword ptr [eax], ecx,mov\teax, dword ptr [0x402044],\""},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,push\t-1,push\t0x4020a8,push\t0x401a7c,mov\teax, dword ptr fs:[0],push\teax,mov\tdword ptr fs:[0], esp,sub\tesp, 0x68,push\tebx,push\tesi,push\tedi,mov\tdword ptr [ebp - 0x18], esp,xor\tebx, ebx,mov\tdword ptr [ebp - 4], ebx,push\t2,call\tdword ptr [0x40208c],pop\tecx,or\tdword ptr [0x403084], 0xffffffff,or\tdword ptr [0x403088], 0xffffffff,call\tdword ptr [0x402088],mov\tecx, dword ptr [0x403080],mov\tdword ptr [eax], ecx,call\tdword ptr [0x402084],mov\tecx, dword ptr [0x40307c],mov\tdword ptr [eax], ecx,mov\teax, dword ptr [0x402080],\""},{"type":"linebreak"},{"type":"text","value":"\"u.wnry\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,push\t-1,push\t0x41baa8,push\t0x413050,mov\teax, dword ptr fs:[0],push\teax,mov\tdword ptr fs:[0], esp,sub\tesp, 0x68,push\tebx,push\tesi,push\tedi,mov\tdword ptr [ebp - 0x18], esp,xor\tebx, ebx,mov\tdword ptr [ebp - 4], ebx,push\t2,call\tdword ptr [0x415524],pop\tecx,or\tdword ptr [0x422298], 0xffffffff,or\tdword ptr [0x42229c], 0xffffffff,call\tdword ptr [0x415520],mov\tecx, dword ptr [0x42228c],mov\tdword ptr [eax], ecx,call\tdword ptr [0x41551c],mov\tecx, dword ptr [0x422288],mov\tdword ptr [eax], ecx,mov\teax, dword ptr [0x415518],\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-125","type":0,"relevance":3,"name":"PE file has a big raw size section","description":"Raw size of \".rsrc\" is \"0x34a000\" greater than 0x100000","description_v2":["Raw size of \".rsrc\" is \"0x34a000\" greater than 0x100000"],"description_v3":[{"type":"text","value":"Raw size of \".rsrc\" is \"0x34a000\" greater than 0x100000"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-124","type":0,"relevance":3,"name":"PE file has a big virtual size section","description":"Virtual size of \".rsrc\" is \"0x349fa0\" greater than 0x100000","description_v2":["Virtual size of \".rsrc\" is \"0x349fa0\" greater than 0x100000"],"description_v3":[{"type":"text","value":"Virtual size of \".rsrc\" is \"0x349fa0\" greater than 0x100000"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-170","type":2,"relevance":1,"name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\cmd.exe\" [Source: 00000000-00006996-00000BC1-3410113738]\n Observed system executable string:\"%WINDIR%\\system32\\cscript.exe\" [Source: 00000000-00003516-00000C45-2936427092]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00003516-00000BC0-3410353701]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\cscript.exe\" [Source: 00000000-00003516-00000BC0-3411964192]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c 88831743893367.bat\" [Source: cmd.exe]","description_v2":["Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\cmd.exe\" [Source: 00000000-00006996-00000BC1-3410113738]","Observed system executable string:\"%WINDIR%\\system32\\cscript.exe\" [Source: 00000000-00003516-00000C45-2936427092]","Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00003516-00000BC0-3410353701]","Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\cscript.exe\" [Source: 00000000-00003516-00000BC0-3411964192]","Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c 88831743893367.bat\" [Source: cmd.exe]"],"description_v3":[{"type":"text","value":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\cmd.exe\" [Source: 00000000-00006996-00000BC1-3410113738]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\cscript.exe\" [Source: 00000000-00003516-00000C45-2936427092]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00003516-00000BC0-3410353701]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\cscript.exe\" [Source: 00000000-00003516-00000BC0-3411964192]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c 88831743893367.bat\" [Source: cmd.exe]"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-67","type":9,"relevance":10,"name":"Process launched with changed environment","description":"Process \"attrib.exe\" (UID: 00000000-00006392) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-8LD9T6N\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"attrib.exe\" (UID: 00000000-00006392) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"cscript.exe\" (UID: 00000000-00007424) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"taskdl.exe\" (UID: 00000000-00006384) was launched with missing environment variables: \"PROMPT\"","description_v2":["Process \"attrib.exe\" (UID: 00000000-00006392) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-8LD9T6N\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"","Process \"attrib.exe\" (UID: 00000000-00006392) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","Process \"cscript.exe\" (UID: 00000000-00007424) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","Process \"taskdl.exe\" (UID: 00000000-00006384) was launched with missing environment variables: \"PROMPT\""],"description_v3":[{"type":"text","value":"Process \"attrib.exe\""},{"type":"process","process_uid":"00000000-00006392","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-8LD9T6N\", PROCESSOR_ARCHITEW6432=\"AMD64\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"attrib.exe\""},{"type":"process","process_uid":"00000000-00006392","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\""},{"type":"linebreak"},{"type":"text","value":"Process \"cscript.exe\""},{"type":"process","process_uid":"00000000-00007424","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROMPT=\"$P$G\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00006384","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"PROMPT\""}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-20","type":3,"relevance":5,"name":"Reads Windows Trust Settings","description":"\"cscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","description_v2":["\"cscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")"],"description_v3":[{"type":"text","value":"\"cscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"taskdl.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","description_v2":["\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","\"taskdl.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","\"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","\"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-625","type":2,"relevance":1,"name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00007424-00000C29-3414020196]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00007424-00000C29-3414176528]","description_v2":["Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00007424-00000C29-3414020196]","Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00007424-00000C29-3414176528]"],"description_v3":[{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00007424-00000C29-3414020196]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00007424-00000C29-3414176528]"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-25","type":9,"relevance":3,"name":"Spawns new processes","description":"$37","description_v2":["Spawned process \"attrib.exe\" with commandline \"attrib +h .\" (UID: 00000000-00006392)","Spawned process \"icacls.exe\" with commandline \"icacls . /grant Everyone:F /T /C /Q\" (UID: 00000000-00001792)","Spawned process \"taskdl.exe\" (UID: 00000000-00010448)","Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c 88831743893367.bat\" (UID: 00000000-00003516)","Spawned process \"attrib.exe\" with commandline \"attrib +h +s Z:\\\\$RECYCLE\" (UID: 00000000-00008152)","Spawned process \"cscript.exe\" with commandline \"//nologo m.vbs\" (UID: 00000000-00007424)","Spawned process \"taskdl.exe\" (UID: 00000000-00006384)","Spawned process \"taskdl.exe\" (UID: 00000000-00010388)","Spawned process \"taskdl.exe\" (UID: 00000000-00008900)","Spawned process \"taskdl.exe\" (UID: 00000000-00006140)","Spawned process \"taskdl.exe\" (UID: 00000000-00006788)","Spawned process \"taskdl.exe\" (UID: 00000000-00004736)","Spawned process \"taskdl.exe\" (UID: 00000000-00011212)","Spawned process \"taskdl.exe\" (UID: 00000000-00007860)","Spawned process \"taskdl.exe\" (UID: 00000000-00005772)","Spawned process \"taskdl.exe\" (UID: 00000000-00009656)","Spawned process \"taskdl.exe\" (UID: 00000000-00010244)","Spawned process \"taskdl.exe\" (UID: 00000000-00007952)","Spawned process \"taskdl.exe\" (UID: 00000000-00008044)","Spawned process \"taskdl.exe\" (UID: 00000000-00005012)","Spawned process \"taskdl.exe\" (UID: 00000000-00002220)","Spawned process \"taskdl.exe\" (UID: 00000000-00011032)","Spawned process \"taskdl.exe\" (UID: 00000000-00005976)","Spawned process \"taskdl.exe\" (UID: 00000000-00010452)","Spawned process \"taskdl.exe\" (UID: 00000000-00009608)"],"description_v3":[{"type":"text","value":"Spawned process \"attrib.exe\" with commandline \"attrib +h .\""},{"type":"process","process_uid":"00000000-00006392","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"icacls.exe\" with commandline \"icacls . /grant Everyone:F /T /C /Q\""},{"type":"process","process_uid":"00000000-00001792","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00010448","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c 88831743893367.bat\""},{"type":"process","process_uid":"00000000-00003516","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"attrib.exe\" with commandline \"attrib +h +s %SAMPLEDIR%\\\\$RECYCLE\""},{"type":"process","process_uid":"00000000-00008152","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cscript.exe\" with commandline \"//nologo m.vbs\""},{"type":"process","process_uid":"00000000-00007424","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00006384","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00010388","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00008900","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00006140","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00006788","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00004736","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00011212","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00007860","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00005772","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00009656","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00010244","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00007952","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00008044","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00005012","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00002220","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00011032","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00005976","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00010452","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00009608","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-103","type":9,"relevance":3,"name":"Spawns new processes that are not known child processes","description":"$38","description_v2":["Spawned process \"attrib.exe\" with commandline \"attrib +h .\" (UID: 00000000-00006392)","Spawned process \"icacls.exe\" with commandline \"icacls . /grant Everyone:F /T /C /Q\" (UID: 00000000-00001792)","Spawned process \"taskdl.exe\" (UID: 00000000-00010448)","Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c 88831743893367.bat\" (UID: 00000000-00003516)","Spawned process \"attrib.exe\" with commandline \"attrib +h +s Z:\\\\$RECYCLE\" (UID: 00000000-00008152)","Spawned process \"cscript.exe\" with commandline \"//nologo m.vbs\" (UID: 00000000-00007424)","Spawned process \"taskdl.exe\" (UID: 00000000-00006384)","Spawned process \"taskdl.exe\" (UID: 00000000-00010388)","Spawned process \"taskdl.exe\" (UID: 00000000-00008900)","Spawned process \"taskdl.exe\" (UID: 00000000-00006140)","Spawned process \"taskdl.exe\" (UID: 00000000-00006788)","Spawned process \"taskdl.exe\" (UID: 00000000-00004736)","Spawned process \"taskdl.exe\" (UID: 00000000-00011212)","Spawned process \"taskdl.exe\" (UID: 00000000-00007860)","Spawned process \"taskdl.exe\" (UID: 00000000-00005772)","Spawned process \"taskdl.exe\" (UID: 00000000-00009656)","Spawned process \"taskdl.exe\" (UID: 00000000-00010244)","Spawned process \"taskdl.exe\" (UID: 00000000-00007952)","Spawned process \"taskdl.exe\" (UID: 00000000-00008044)","Spawned process \"taskdl.exe\" (UID: 00000000-00005012)","Spawned process \"taskdl.exe\" (UID: 00000000-00002220)","Spawned process \"taskdl.exe\" (UID: 00000000-00011032)","Spawned process \"taskdl.exe\" (UID: 00000000-00005976)","Spawned process \"taskdl.exe\" (UID: 00000000-00010452)","Spawned process \"taskdl.exe\" (UID: 00000000-00009608)"],"description_v3":[{"type":"text","value":"Spawned process \"attrib.exe\" with commandline \"attrib +h .\""},{"type":"process","process_uid":"00000000-00006392","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"icacls.exe\" with commandline \"icacls . /grant Everyone:F /T /C /Q\""},{"type":"process","process_uid":"00000000-00001792","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00010448","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c 88831743893367.bat\""},{"type":"process","process_uid":"00000000-00003516","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"attrib.exe\" with commandline \"attrib +h +s %SAMPLEDIR%\\\\$RECYCLE\""},{"type":"process","process_uid":"00000000-00008152","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cscript.exe\" with commandline \"//nologo m.vbs\""},{"type":"process","process_uid":"00000000-00007424","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00006384","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00010388","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00008900","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00006140","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00006788","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00004736","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00011212","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00007860","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00005772","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00009656","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00010244","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00007952","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00008044","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00005012","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00002220","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00011032","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00005976","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00010452","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00009608","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"binary-26","type":8,"relevance":5,"name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 553314)","description_v2":["Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 553314)"],"description_v3":[{"type":"text","value":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 553314)"}],"origin":"Binary File","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-153","type":0,"relevance":0,"name":"Uses 32 bit executable PE","description":"\"WannaCry.exe.sample\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"taskse.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"taskdl.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"u.wnry\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","description_v2":["\"WannaCry.exe.sample\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE","\"taskse.exe\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE","\"taskdl.exe\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE","\"u.wnry\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"},{"type":"linebreak"},{"type":"text","value":"\"taskse.exe\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"},{"type":"linebreak"},{"type":"text","value":"\"u.wnry\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-199","type":2,"relevance":1,"name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateServiceA\" (Indicator: \"CreateService\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CreateServiceA\" (Indicator: \"CreateService\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateServiceA\" (Indicator: \"CreateService\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CreateServiceA\" (Indicator: \"CreateService\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateServiceA\" (Indicator: \"CreateService\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateServiceA\" (Indicator: \"CreateService\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-310","type":2,"relevance":1,"name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"WannaCry.exe.sample\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-264","type":6,"relevance":3,"name":"Creates a thread in a self process","description":"\"WannaCry.exe.sample.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"cscript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","description_v2":["\"WannaCry.exe.sample.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","\"cscript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"}],"origin":"API Call","attck_id":"T1055.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"binary-0","type":8,"relevance":3,"name":"Dropped files","description":"$39","description_v2":["\"taskse.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\taskse.exe]- [targetUID: 00000000-00006996]","\"taskdl.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\taskdl.exe]- [targetUID: 00000000-00010448]","\"@WanaDecryptor@.exe.lnk\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Sat Apr 5 22:49:27 2025 mtime=Sat Apr 5 22:49:27 2025 atime=Fri May 12 09:22:56 2017 length=245760 window=hide\"- Location: [C:\\@WanaDecryptor@.exe.lnk]- [targetUID: 00000000-00006996]","\"88831743893367.bat\" has type \"DOS batch file ASCII text with CRLF CR line terminators\"- Location: [C:\\88831743893367.bat]- [targetUID: 00000000-00003516]","\"m.vbs\" has type \"ASCII text with CRLF line terminators\"- Location: [C:\\m.vbs]- [targetUID: 00000000-00003516]","\"s.wnry\" has type \"Zip archive data at least v1.0 to extract compression method=store\"- Location: [C:\\s.wnry]- [targetUID: 00000000-00006996]","\"u.wnry\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\u.wnry]- [targetUID: 00000000-00006996]","\"m_vietnamese.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_vietnamese.wnry]- [targetUID: 00000000-00006996]","\"m_korean.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_korean.wnry]- [targetUID: 00000000-00006996]","\"m_japanese.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_japanese.wnry]- [targetUID: 00000000-00006996]","\"m_chinese _traditional_.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- [targetUID: N/A]","\"m_chinese _simplified_.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- [targetUID: N/A]","\"m_romanian.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_romanian.wnry]- [targetUID: 00000000-00006996]","\"m_greek.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_greek.wnry]- [targetUID: 00000000-00006996]","\"m_bulgarian.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_bulgarian.wnry]- [targetUID: 00000000-00006996]","\"m_russian.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_russian.wnry]- [targetUID: 00000000-00006996]","\"m_turkish.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_turkish.wnry]- [targetUID: 00000000-00006996]","\"m_slovak.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_slovak.wnry]- [targetUID: 00000000-00006996]","\"m_latvian.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_latvian.wnry]- [targetUID: 00000000-00006996]","\"m_czech.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_czech.wnry]- [targetUID: 00000000-00006996]","\"m_polish.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_polish.wnry]- [targetUID: 00000000-00006996]","\"m_croatian.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_croatian.wnry]- [targetUID: 00000000-00006996]","\"m_swedish.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_swedish.wnry]- [targetUID: 00000000-00006996]","\"m_french.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_french.wnry]- [targetUID: 00000000-00006996]","\"m_finnish.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_finnish.wnry]- [targetUID: 00000000-00006996]","\"m_portuguese.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_portuguese.wnry]- [targetUID: 00000000-00006996]","\"m_filipino.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_filipino.wnry]- [targetUID: 00000000-00006996]","\"m_norwegian.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_norwegian.wnry]- [targetUID: 00000000-00006996]","\"m_spanish.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_spanish.wnry]- [targetUID: 00000000-00006996]","\"m_indonesian.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_indonesian.wnry]- [targetUID: 00000000-00006996]","\"m_german.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_german.wnry]- [targetUID: 00000000-00006996]","\"m_danish.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_danish.wnry]- [targetUID: 00000000-00006996]","\"m_dutch.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_dutch.wnry]- [targetUID: 00000000-00006996]","\"m_english.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_english.wnry]- [targetUID: 00000000-00006996]","\"m_italian.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_italian.wnry]- [targetUID: 00000000-00006996]","\"@Please_Read_Me@.txt\" has type \"ASCII text with CRLF line terminators\"- Location: [C:\\@Please_Read_Me@.txt]- [targetUID: 00000000-00006996]","\"r.wnry\" has type \"ASCII text with CRLF line terminators\"- Location: [C:\\r.wnry]- [targetUID: 00000000-00006996]","\"f.wnry\" has type \"ASCII text with CRLF line terminators\"- Location: [C:\\f.wnry]- [targetUID: 00000000-00006996]"],"description_v3":[{"type":"text","value":"\"taskse.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\taskse.exe]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\taskdl.exe]- [targetUID: 00000000-00010448]"},{"type":"linebreak"},{"type":"text","value":"\"@WanaDecryptor@.exe.lnk\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Sat Apr 5 22:49:27 2025 mtime=Sat Apr 5 22:49:27 2025 atime=Fri May 12 09:22:56 2017 length=245760 window=hide\"- Location: [C:\\@WanaDecryptor@.exe.lnk]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"88831743893367.bat\" has type \"DOS batch file ASCII text with CRLF CR line terminators\"- Location: [C:\\88831743893367.bat]- [targetUID: 00000000-00003516]"},{"type":"linebreak"},{"type":"text","value":"\"m.vbs\" has type \"ASCII text with CRLF line terminators\"- Location: [C:\\m.vbs]- [targetUID: 00000000-00003516]"},{"type":"linebreak"},{"type":"text","value":"\"s.wnry\" has type \"Zip archive data at least v1.0 to extract compression method=store\"- Location: [C:\\s.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"u.wnry\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\u.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_vietnamese.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_vietnamese.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_korean.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_korean.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_japanese.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_japanese.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_chinese _traditional_.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"m_chinese _simplified_.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"m_romanian.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_romanian.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_greek.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_greek.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_bulgarian.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_bulgarian.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_russian.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_russian.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_turkish.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_turkish.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_slovak.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_slovak.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_latvian.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_latvian.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_czech.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_czech.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_polish.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_polish.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_croatian.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_croatian.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_swedish.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_swedish.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_french.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_french.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_finnish.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_finnish.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_portuguese.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_portuguese.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_filipino.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_filipino.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_norwegian.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_norwegian.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_spanish.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_spanish.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_indonesian.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_indonesian.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_german.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_german.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_danish.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_danish.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_dutch.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_dutch.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_english.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_english.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"m_italian.wnry\" has type \"Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025\"- Location: [C:\\msg\\m_italian.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"@Please_Read_Me@.txt\" has type \"ASCII text with CRLF line terminators\"- Location: [C:\\@Please_Read_Me@.txt]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"r.wnry\" has type \"ASCII text with CRLF line terminators\"- Location: [C:\\r.wnry]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"f.wnry\" has type \"ASCII text with CRLF line terminators\"- Location: [C:\\f.wnry]- [targetUID: 00000000-00006996]"}],"origin":"Binary File","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-177","type":3,"relevance":1,"name":"Opens registry keys","description":"$3a","description_v2":["\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CODEPAGE\"; Key: \"\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\STATESEPARATION\\REDIRECTIONMAP\\KEYS\"; Key: \"\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CODEPAGE\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\STATESEPARATION\\REDIRECTIONMAP\\KEYS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-235","type":6,"relevance":1,"name":"Queries basic information of the specified process","description":"\"WannaCry.exe.sample.exe\" queries basic process information of the \"C:\\WannaCry.exe.sample.exe\" (UID: 6996)","description_v2":["\"WannaCry.exe.sample.exe\" queries basic process information of the \"C:\\WannaCry.exe.sample.exe\" (UID: 6996)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" queries basic process information of the \"C:\\WannaCry.exe.sample.exe\" (UID: 6996)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-172","type":3,"relevance":1,"name":"Queries registry keys","description":"$3b","description_v2":["\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CODEPAGE\"; Key: \"ACP\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CODEPAGE\"; Key: \"OEMCP\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RAISEEXCEPTIONONPOSSIBLEDEADLOCK\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RESOURCEPOLICIES\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"57A6ED1A-79F7-5011-B242-4784E5620CF7\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"WANNACRY.EXE.SAMPLE.EXE\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"3C74AFB9-8D82-44E3-B52C-365DBF48382A\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"B749553B-D950-5E03-6282-3145A61B1002\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"05F95EFE-7F75-49C7-A994-60A55CC09571\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"LONGPATHSENABLED\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"000604XX\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"F25BCD2E-2690-55DC-3BC4-07B65B1B41C9\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\GRE_INITIALIZE\"; Key: \"DISABLEMETAFILES\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"ENABLEPERPROCESSSYSTEMDPI\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CODEPAGE\"; Key: \"ACP\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CODEPAGE\"; Key: \"OEMCP\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RAISEEXCEPTIONONPOSSIBLEDEADLOCK\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RESOURCEPOLICIES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"57A6ED1A-79F7-5011-B242-4784E5620CF7\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"WANNACRY.EXE.SAMPLE.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"3C74AFB9-8D82-44E3-B52C-365DBF48382A\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"B749553B-D950-5E03-6282-3145A61B1002\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"05F95EFE-7F75-49C7-A994-60A55CC09571\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"LONGPATHSENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"000604XX\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"F25BCD2E-2690-55DC-3BC4-07B65B1B41C9\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\GRE_INITIALIZE\"; Key: \"DISABLEMETAFILES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"ENABLEPERPROCESSSYSTEMDPI\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-243","type":6,"relevance":1,"name":"Reads files","description":"\"WannaCry.exe.sample.exe\" reads file \"c:\\c.wnry\"\n \"WannaCry.exe.sample.exe\" reads file \"c:\\t.wnry\"\n \"WannaCry.exe.sample.exe\" reads file \"c:\\00000000.pky\"\n \"WannaCry.exe.sample.exe\" reads file \"c:\\u.wnry\"\n \"WannaCry.exe.sample.exe\" reads file \"c:\\r.wnry\"\n \"WannaCry.exe.sample.exe\" reads file \"c:\\@please_read_me@.txt\"\n \"WannaCry.exe.sample.exe\" reads file \"c:\\@wanadecryptor@.exe\"","description_v2":["\"WannaCry.exe.sample.exe\" reads file \"c:\\c.wnry\"","\"WannaCry.exe.sample.exe\" reads file \"c:\\t.wnry\"","\"WannaCry.exe.sample.exe\" reads file \"c:\\00000000.pky\"","\"WannaCry.exe.sample.exe\" reads file \"c:\\u.wnry\"","\"WannaCry.exe.sample.exe\" reads file \"c:\\r.wnry\"","\"WannaCry.exe.sample.exe\" reads file \"c:\\@please_read_me@.txt\"","\"WannaCry.exe.sample.exe\" reads file \"c:\\@wanadecryptor@.exe\""],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" reads file \"c:\\c.wnry\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" reads file \"c:\\t.wnry\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" reads file \"c:\\00000000.pky\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" reads file \"c:\\u.wnry\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" reads file \"c:\\r.wnry\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" reads file \"c:\\@please_read_me@.txt\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" reads file \"c:\\@wanadecryptor@.exe\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"summary-29","type":15,"relevance":1,"name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: The input sample possibly contains the RDTSCP instruction","description_v2":["The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)","Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","Matched sigs: Possibly tries to evade analysis by sleeping many times","Matched sigs: The input sample possibly contains the RDTSCP instruction"],"description_v3":[{"type":"text","value":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Possibly tries to evade analysis by sleeping many times"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: The input sample possibly contains the RDTSCP instruction"}],"origin":"Indicator Combinations","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-263","type":6,"relevance":1,"name":"Touches files","description":"\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"WannaCry.exe.sample.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"\n \"WannaCry.exe.sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\fltLib.dll\"\n \"WannaCry.exe.sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\cryptsp.dll\"\n \"WannaCry.exe.sample.exe\" trying to touch file \"C:\\windows\\temp\\VxOle32.dll\"\n \"WannaCry.exe.sample.exe\" trying to touch file \"C:\\Windows\\Temp\\VxOle32.dll\"\n \"WannaCry.exe.sample.exe\" trying to touch file \"C:\\\"\n \"WannaCry.exe.sample.exe\" trying to touch file \"C:\\b.wnry\"\n \"WannaCry.exe.sample.exe\" trying to touch file \"C:\\c.wnry\"\n \"WannaCry.exe.sample.exe\" trying to touch file \"C:\\msg\"\n \"WannaCry.exe.sample.exe\" trying to touch file \"C:\\msg\\\"","description_v2":["\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"","\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\fltLib.dll\"","\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\cryptsp.dll\"","\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\windows\\temp\\VxOle32.dll\"","\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\Windows\\Temp\\VxOle32.dll\"","\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\\"","\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\b.wnry\"","\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\c.wnry\"","\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\msg\"","\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\msg\\\""],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to touch file \"%WINDIR%\\SysWOW64\\imm32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\fltLib.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\cryptsp.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\windows\\temp\\VxOle32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\Windows\\Temp\\VxOle32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\b.wnry\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\c.wnry\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\msg\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to touch file \"C:\\msg\\\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-55","type":6,"relevance":7,"name":"Touches files in the Windows directory","description":"\"cscript.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"cscript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","description_v2":["\"cscript.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"","\"cscript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""],"description_v3":[{"type":"text","value":"\"cscript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-203","type":6,"relevance":3,"name":"Tries to access LNK files (Windows shortcut)","description":"\"WannaCry.exe.sample.exe\" trying to access LNK file \"C:\\@WanaDecryptor@.exe.lnk\"","description_v2":["\"WannaCry.exe.sample.exe\" trying to access LNK file \"C:\\@WanaDecryptor@.exe.lnk\""],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access LNK file \"C:\\@WanaDecryptor@.exe.lnk\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-126","type":6,"relevance":3,"name":"Tries to access non-existent files (executable)","description":"$3c","description_v2":["\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\attrib.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"attrib.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\icacls.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"icacls.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\CRYPTBASE.dll\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\crypt32.dll\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\bcrypt.dll\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\MSVCP60.dll\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\@WanaDecryptor@.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"@WanaDecryptor@.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\@WanaDecryptor@.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\system\\@WanaDecryptor@.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\@WanaDecryptor@.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\@WanaDecryptor@.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\@WanaDecryptor@.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\Wbem\\@WanaDecryptor@.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\@WanaDecryptor@.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\WindowsApps\\@WanaDecryptor@.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Program Files\\mitmproxy\\bin\\@WanaDecryptor@.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\nvm\\@WanaDecryptor@.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Program Files\\nodejs\\@WanaDecryptor@.exe\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\SspiCli.dll\""],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\attrib.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"attrib.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\icacls.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"icacls.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\CRYPTBASE.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\crypt32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\bcrypt.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\MSVCP60.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\@WanaDecryptor@.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"@WanaDecryptor@.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\@WanaDecryptor@.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\system\\@WanaDecryptor@.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\@WanaDecryptor@.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"%PROGRAMFILES%\\(x86)\\Common Files\\Oracle\\Java\\javapath\\@WanaDecryptor@.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\@WanaDecryptor@.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\Wbem\\@WanaDecryptor@.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\@WanaDecryptor@.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\WindowsApps\\@WanaDecryptor@.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Program Files\\mitmproxy\\bin\\@WanaDecryptor@.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\nvm\\@WanaDecryptor@.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Program Files\\nodejs\\@WanaDecryptor@.exe\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\SspiCli.dll\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-161","type":6,"relevance":3,"name":"Tries to access non-existent files (non-executable)","description":"$3d","description_v2":["\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\c.wnry\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\msg\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\en-US\\crypt32.dll.mui\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\00000000.dky\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\00000000.pky\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\00000000.res\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\f.wnry\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\@WanaDecryptor@.exe fi\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"@WanaDecryptor@.exe fi\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\@WanaDecryptor@.exe fi\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\system\\@WanaDecryptor@.exe fi\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\@WanaDecryptor@.exe fi\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\@WanaDecryptor@.exe fi\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\@WanaDecryptor@.exe fi\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\Wbem\\@WanaDecryptor@.exe fi\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\@WanaDecryptor@.exe fi\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\WindowsApps\\@WanaDecryptor@.exe fi\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Program Files\\mitmproxy\\bin\\@WanaDecryptor@.exe fi\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\nvm\\@WanaDecryptor@.exe fi\"","\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Program Files\\nodejs\\@WanaDecryptor@.exe fi\""],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\c.wnry\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\msg\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\en-US\\crypt32.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\00000000.dky\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\00000000.pky\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\00000000.res\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\f.wnry\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\@WanaDecryptor@.exe fi\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"@WanaDecryptor@.exe fi\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\@WanaDecryptor@.exe fi\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\system\\@WanaDecryptor@.exe fi\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\@WanaDecryptor@.exe fi\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"%PROGRAMFILES%\\(x86)\\Common Files\\Oracle\\Java\\javapath\\@WanaDecryptor@.exe fi\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\@WanaDecryptor@.exe fi\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\Wbem\\@WanaDecryptor@.exe fi\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\@WanaDecryptor@.exe fi\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\WindowsApps\\@WanaDecryptor@.exe fi\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Program Files\\mitmproxy\\bin\\@WanaDecryptor@.exe fi\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\nvm\\@WanaDecryptor@.exe fi\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to access non-existent file \"C:\\Program Files\\nodejs\\@WanaDecryptor@.exe fi\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-242","type":6,"relevance":1,"name":"Writes files","description":"\"WannaCry.exe.sample.exe\" writes file \"c:\\b.wnry\"","description_v2":["\"WannaCry.exe.sample.exe\" writes file \"c:\\b.wnry\""],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" writes file \"c:\\b.wnry\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-176","type":2,"relevance":1,"name":"Contains Tor Onion URL","description":"\"gx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;\" (Indicator: \".onion\") in Source: 00000000-00006996.00000000.281787.1000C000.00000004.mdmp\n 00000000-00006996.00000001.283709.1000C000.00000004.mdmp\n 00000000-00006996.00000002.285629.1000C000.00000004.mdmp","description_v2":["\"gx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;\" (Indicator: \".onion\") in Source: 00000000-00006996.00000000.281787.1000C000.00000004.mdmp","00000000-00006996.00000001.283709.1000C000.00000004.mdmp","00000000-00006996.00000002.285629.1000C000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\"gx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;\" (Indicator: \".onion\") in Source: 00000000-00006996.00000000.281787.1000C000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000001.283709.1000C000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006996.00000002.285629.1000C000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1090.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1090/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-228","type":2,"relevance":1,"name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"``ReadFile()`` or ``WSASend()`` overlapped operation fail immediately:\" (Indicator: \"WSASend\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","description_v2":["Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"WannaCry.exe.sample\")","Found reference to API \"``ReadFile()`` or ``WSASend()`` overlapped operation fail immediately:\" (Indicator: \"WSASend\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"``ReadFile()`` or ``WSASend()`` overlapped operation fail immediately:\" (Indicator: \"WSASend\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1095","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1095","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-601","type":2,"relevance":1,"name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"``ReadFile()`` or ``WSASend()`` overlapped operation fail immediately:\" (Indicator: \"WSASend\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","description_v2":["Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"WannaCry.exe.sample\")","Found reference to API \"``ReadFile()`` or ``WSASend()`` overlapped operation fail immediately:\" (Indicator: \"WSASend\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"``ReadFile()`` or ``WSASend()`` overlapped operation fail immediately:\" (Indicator: \"WSASend\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-210","type":2,"relevance":1,"name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"fix _winapi.PeekNamedPipe() and _winapi.ReadFile() for read larger than\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","description_v2":["Found reference to API \"fix _winapi.PeekNamedPipe() and _winapi.ReadFile() for read larger than\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"fix _winapi.PeekNamedPipe() and _winapi.ReadFile() for read larger than\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1559","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1559","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-241","type":2,"relevance":1,"name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; File: \"WannaCry.exe.sample\")","description_v2":["Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; File: \"WannaCry.exe.sample\")","Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; File: \"WannaCry.exe.sample\")"],"description_v3":[{"type":"text","value":"Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; File: \"WannaCry.exe.sample\")"}],"origin":"File/Memory","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-419","type":2,"relevance":1,"name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"WannaCry.exe.sample\")","description_v2":["Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"WannaCry.exe.sample\")"],"description_v3":[{"type":"text","value":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"WannaCry.exe.sample\")"}],"origin":"File/Memory","attck_id":"T1571","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1571","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-618","type":2,"relevance":1,"name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"Found reference to \"smtpd.SMTPChannel and smtpd.SMTPServer constructors is changed to False.\" (Indicator: \"SmtpServer\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")\n Found reference to \"the SMTPServerDisconnected error until the next command is issued.\" (Indicator: \"SmtpServer\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","description_v2":["Found reference to \"smtpd.SMTPChannel and smtpd.SMTPServer constructors is changed to False.\" (Indicator: \"SmtpServer\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found reference to \"the SMTPServerDisconnected error until the next command is issued.\" (Indicator: \"SmtpServer\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to \"smtpd.SMTPChannel and smtpd.SMTPServer constructors is changed to False.\" (Indicator: \"SmtpServer\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"the SMTPServerDisconnected error until the next command is issued.\" (Indicator: \"SmtpServer\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1505.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1505/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-494","type":2,"relevance":1,"name":"Contains reference to OpenSSL library string","description":"Found string \"openssl-core@openssl.org.\" (Indicator: \"openssl-\"; Source: \"00000000-00006996.00000001.283709.031B9000.00000004.mdmp\")","description_v2":["Found string \"openssl-core@openssl.org.\" (Indicator: \"openssl-\"; Source: \"00000000-00006996.00000001.283709.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"openssl-core@openssl.org.\" (Indicator: \"openssl-\"; Source: \"00000000-00006996.00000001.283709.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1573.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-169","type":2,"relevance":1,"name":"Found mail related domain names","description":"Observed email domain:\"- bpo-15014: smtp.auth() and smtp.login() now support rfc 4954's optional\" [Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp]\n Observed email domain:\":meth:`smtplib.smtp.connect` is called.\" [Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp]\n Observed email domain:\"- bpo-36348: the :meth:`imap.imap4.logout` method no longer ignores silently\" [Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp]\n Observed email domain:\"- bpo-34246: :meth:`smtplib.smtp.send_message` no longer modifies the\" [Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp]","description_v2":["Observed email domain:\"- bpo-15014: smtp.auth() and smtp.login() now support rfc 4954's optional\" [Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp]","Observed email domain:\":meth:`smtplib.smtp.connect` is called.\" [Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp]","Observed email domain:\"- bpo-36348: the :meth:`imap.imap4.logout` method no longer ignores silently\" [Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp]","Observed email domain:\"- bpo-34246: :meth:`smtplib.smtp.send_message` no longer modifies the\" [Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp]"],"description_v3":[{"type":"text","value":"Observed email domain:\"- bpo-15014: smtp.auth() and smtp.login() now support rfc 4954's optional\" [Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed email domain:\":meth:`smtplib.smtp.connect` is called.\" [Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed email domain:\"- bpo-36348: the :meth:`imap.imap4.logout` method no longer ignores silently\" [Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed email domain:\"- bpo-34246: :meth:`smtplib.smtp.send_message` no longer modifies the\" [Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp]"}],"origin":"File/Memory","attck_id":"T1071.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-14","type":2,"relevance":0,"name":"Found potential IP address in binary/memory","description":"Potential IP \"10.34.0.47\" found in string \"??\\C:\\Users\\HAPUBWS\\AppData\\Local\\Packages\\MicrosoftTeams_8wekyb3d8bbwe\\LocalCache\\Microsoft\\MSTeams\\EBWebView\\Subresource Filter\\Unindexed Rules\\10.34.0.47\\~SDF283.tmp\"\n Potential IP \"127.0.0.1\" found in string \"example, ``splithost('//127.0.0.1#@evil.com/')`` now correctly returns the\"\n Potential IP \"127.0.0.1\" found in string \"``127.0.0.1`` host, instead of treating ``@evil.com`` as the host in an\"\n Potential IP \"3.14.1.0\" found in string \"- bpo-27883: Update sqlite to 3.14.1.0 on Windows.\"\n Potential IP \"127.0.0.1\" found in string \"and all data after whitespace, e.g. '127.0.0.1 whatever'.\"\n Potential IP \"127.0.0.1\" found in string \"been added for your ``127.0.0.1`` needs, similar to the existing HOSTv6\"","description_v2":["Potential IP \"10.34.0.47\" found in string \"??\\C:\\Users\\HAPUBWS\\AppData\\Local\\Packages\\MicrosoftTeams_8wekyb3d8bbwe\\LocalCache\\Microsoft\\MSTeams\\EBWebView\\Subresource Filter\\Unindexed Rules\\10.34.0.47\\~SDF283.tmp\"","Potential IP \"127.0.0.1\" found in string \"example, ``splithost('//127.0.0.1#@evil.com/')`` now correctly returns the\"","Potential IP \"127.0.0.1\" found in string \"``127.0.0.1`` host, instead of treating ``@evil.com`` as the host in an\"","Potential IP \"3.14.1.0\" found in string \"- bpo-27883: Update sqlite to 3.14.1.0 on Windows.\"","Potential IP \"127.0.0.1\" found in string \"and all data after whitespace, e.g. '127.0.0.1 whatever'.\"","Potential IP \"127.0.0.1\" found in string \"been added for your ``127.0.0.1`` needs, similar to the existing HOSTv6\""],"description_v3":[{"type":"text","value":"Potential IP \"10.34.0.47\" found in string \"??\\%LOCALAPPDATA%\\Packages\\MicrosoftTeams_8wekyb3d8bbwe\\LocalCache\\Microsoft\\MSTeams\\EBWebView\\Subresource Filter\\Unindexed Rules\\10.34.0.47\\~SDF283.tmp\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"127.0.0.1\" found in string \"example, ``splithost('//127.0.0.1#@evil.com/')`` now correctly returns the\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"127.0.0.1\" found in string \"``127.0.0.1`` host, instead of treating ``@evil.com`` as the host in an\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"3.14.1.0\" found in string \"- bpo-27883: Update sqlite to 3.14.1.0 on Windows.\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"127.0.0.1\" found in string \"and all data after whitespace, e.g. '127.0.0.1 whatever'.\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"127.0.0.1\" found in string \"been added for your ``127.0.0.1`` needs, similar to the existing HOSTv6\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":3,"name":"Found potential URL in binary/memory","description":"$3e","description_v2":["Heuristic match: \"ax.id\"","Heuristic match: \"*g.ro\"","Heuristic match: \"}1.ng\"","Pattern match: \"http://%d/%d/%d\"","Heuristic match: \".exe.sa\"","Heuristic match: \"readme.md\"","Heuristic match: \"security.md\"","Heuristic match: \"c:\\tempdir\\node_modules\\@socket.io\"","Heuristic match: \"ce}-c\\proof.fr\"","Pattern match: \"https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip\"","Heuristic match: \"jloup@gzip.org madler@alumni.caltech.edu\"","Pattern match: \"http://www.openssl.org/\"","Pattern match: \"www.freetype.org\"","Heuristic match: \"o freetype@nongnu.org\"","Heuristic match: \"o freetype-devel@nongnu.org\"","Pattern match: \"http://www.freetype.org\"","Heuristic match: \"email domain: cam.ac.uk\"","Heuristic match: \"emain domain: freemail.hu\"","Pattern match: \"http://www.sqlite.org/copyright.html\"","Heuristic match: \"vhwd.gn\"","Heuristic match: \"$y.qa\"","Heuristic match: \"z).bz\"","Heuristic match: \"__main__.py\"","Heuristic match: \"segment.py\"","Heuristic match: \"spinner.py\"","Heuristic match: \"style.py\"","Heuristic match: \"table.py\"","Heuristic match: \"termin~1.py\"","Heuristic match: \"text.py\"","Heuristic match: \"theme.py\"","Heuristic match: \"traceb~1.py\"","Heuristic match: \"traceback.py\"","Heuristic match: \"tree.py\"","Heuristic match: \"_cell_~1.py\"","Heuristic match: \"_cell_widths.py\"","Heuristic match: \"_emoji~1.py\"","Heuristic match: \"_emoji_codes.py\"","Heuristic match: \"_emoji~2.py\"","Heuristic match: \"_emoji_replace.py\"","Heuristic match: \"_expor~1.py\"","Heuristic match: \"_exten~1.py\"","Heuristic match: \"_inspect.py\"","Heuristic match: \"_log_r~1.py\"","Heuristic match: \"_log_render.py\"","Heuristic match: \"_loop.py\"","Heuristic match: \"_palet~1.py\"","Heuristic match: \"_palettes.py\"","Heuristic match: \"_pick.py\"","Heuristic match: \"_spinn~1.py\"","Heuristic match: \"_spinners.py\"","Heuristic match: \"_stack.py\"","Heuristic match: \"_timer.py\"","Heuristic match: \"more.py\"","Heuristic match: \"recipes.py\"","Heuristic match: \"__init__.py\"","Heuristic match: \"markers.py\"","Heuristic match: \"requir~1.py\"","Heuristic match: \"requirements.py\"","Heuristic match: \"specif~1.py\"","Heuristic match: \"tags.py\"","Heuristic match: \"utils.py\"","Heuristic match: \"version.py\"","Heuristic match: \"_manyl~1.py\"","Heuristic match: \"_musll~1.py\"","Heuristic match: \"_musllinux.py\"","Heuristic match: \"_struc~1.py\"","Heuristic match: \"_structures.py\"","Heuristic match: \"__abou~1.py\"","Heuristic match: \"__about__.py\"","Heuristic match: \"extens~1.py\"","Heuristic match: \"extension.py\"","Heuristic match: \"glob.py\"","Heuristic match: \"instal~1.py\"","Heuristic match: \"installer.py\"","Heuristic match: \"logging.py\"","Heuristic match: \"msvc.py\"","Heuristic match: \"namesp~1.py\"","Heuristic match: \"namespaces.py\"","Heuristic match: \"packag~1.py\"","Heuristic match: \"package_index.py\"","Heuristic match: \"py34co~1.py\"","Heuristic match: \"sandbox.py\"","Heuristic match: \"unicod~1.py\"","Heuristic match: \"unicode_utils.py\"","Heuristic match: \"cmd.py\"","Heuristic match: \"core.py\"","Heuristic match: \"cygwin~1.py\"","Heuristic match: \"cygwinccompiler.py\"","Heuristic match: \"debug.py\"","Heuristic match: \"dep_util.py\"","Heuristic match: \"dir_util.py\"","Heuristic match: \"dist.py\"","Heuristic match: \"fancy_~1.py\"","Heuristic match: \"fancy_getopt.py\"","Heuristic match: \"filelist.py\"","Heuristic match: \"file_u~1.py\"","Heuristic match: \"file_util.py\"","Heuristic match: \"log.py\"","Heuristic match: \"msvc9c~1.py\"","Heuristic match: \"msvc9compiler.py\"","Heuristic match: \"msvcco~1.py\"","Heuristic match: \"msvccompiler.py\"","Heuristic match: \"py38co~1.py\"","Heuristic match: \"py39co~1.py\"","Heuristic match: \"spawn.py\"","Heuristic match: \"syscon~1.py\"","Heuristic match: \"sysconfig.py\"","Heuristic match: \"text_f~1.py\"","Heuristic match: \"text_file.py\"","Heuristic match: \"unixcc~1.py\"","Heuristic match: \"unixccompiler.py\"","Heuristic match: \"util.py\"","Heuristic match: \"versio~1.py\"","Heuristic match: \"versionpredicate.py\"","Heuristic match: \"_colle~1.py\"","Heuristic match: \"_collections.py\"","Heuristic match: \"_funct~1.py\"","Heuristic match: \"_functools.py\"","Heuristic match: \"_macos~1.py\"","Heuristic match: \"_macos_compat.py\"","Heuristic match: \"_msvcc~1.py\"","Heuristic match: \"_msvccompiler.py\"","Heuristic match: \"actions.py\"","Heuristic match: \"except~1.py\"","Heuristic match: \"helpers.py\"","Heuristic match: \"results.py\"","Heuristic match: \"testing.py\"","Heuristic match: \"unicode.py\"","Heuristic match: \"fix_next.py\"","Heuristic match: \"fix_no~1.py\"","Heuristic match: \"fix_nonzero.py\"","Heuristic match: \"fix_nu~1.py\"","Heuristic match: \"install_data.py\"","Heuristic match: \"instal~2.py\"","Heuristic match: \"install_egg_info.py\"","Heuristic match: \"instal~3.py\"","Heuristic match: \"install_headers.py\"","Heuristic match: \"instal~4.py\"","Heuristic match: \"install_lib.py\"","Heuristic match: \"in32d9~1.py\"","Heuristic match: \"install_scripts.py\"","Heuristic match: \"py37co~1.py\"","Heuristic match: \"register.py\"","Heuristic match: \"sdist.py\"","Heuristic match: \"upload.py\"","Heuristic match: \"_frame~1.py\"","Heuristic match: \"_framework_compat.py\"","Heuristic match: \"_adapt~1.py\"","Heuristic match: \"_adapters.py\"","Heuristic match: \"_compat.py\"","Heuristic match: \"_itert~1.py\"","Heuristic match: \"_meta.py\"","Heuristic match: \"_text.py\"","Heuristic match: \"easy_i~1.py\"","Heuristic match: \"easy_install.py\"","Heuristic match: \"editab~1.py\"","Heuristic match: \"egg_info.py\"","Heuristic match: \"install.py\"","Heuristic match: \"py36co~1.py\"","Heuristic match: \"saveopts.py\"","Heuristic match: \"test.py\"","Heuristic match: \"upload~1.py\"","Heuristic match: \"upload_docs.py\"","Heuristic match: \"langru~1.py\"","Heuristic match: \"langrussianmodel.py\"","Heuristic match: \"langth~1.py\"","Heuristic match: \"langthaimodel.py\"","Heuristic match: \"langtu~1.py\"","Heuristic match: \"langturkishmodel.py\"","Heuristic match: \"latin1~1.py\"","Heuristic match: \"latin1prober.pyw.py\"","Pattern match: \"https://github.com/python/cpython\"","Pattern match: \"https://github.com/orgs/python/projects/31\"","Heuristic match: \"- class browser now compatible with python2.3 version of pyclbr.py\"","Heuristic match: \"- fix tk root pop-ups in configsectionnamedialog.py and configdialog.py\"","Heuristic match: \"execbinding.py, loader.py, protocol.py, remote.py, spawn.py\"","Pattern match: \"https://github.com/libexpat/libexpat/issues/115\"","Pattern match: \"https://sourceforge.net/p/expat/bugs/537/\"","Pattern match: \"https://github.com/python/typing\"","Heuristic match: \"- bpo-27705: update message in validate_ucrtbase.py\"","Pattern match: \"https://github.com/python/pythondotorg/issues/945\"","Pattern match: \"sndhdr.what/whathdr\"","Pattern match: \"http://www.python.org/\"","Pattern match: \"http://www.example.com\"","Pattern match: \"https://github.com/python/typing/issues/751\"","Heuristic match: \"- bpo-40964: disable remote :mod:`imaplib` tests, host cyrus.andrew.cmu.edu\"","Heuristic match: \"in webbrowser.py\"","Pattern match: \"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242274\"","Pattern match: \"https://www.w3.org/tr/xml/#sec-prolog-dtd\"","Pattern match: \"https://importlib-metadata.readthedocs.io/en/latest/changelog%20(links).html#v1-5-0\"","Heuristic match: \"- bpo-39242: updated the gmane domain from news.gmane.org to news.gmane.io\"","Pattern match: \"https://fishshell.com/docs/current/commands.html#source\"","Heuristic match: \"- bpo-38586: now :func:`~logging.config.fileconfig` correctly sets the .name\"","Pattern match: \"https://gitlab.com/python-devs/importlib_metadata/blob/0.21/importlib_metadata/docs/changelog.rst\"","Pattern match: \"https://gitlab.com/python-devs/importlib_metadata/-/milestones/20\"","Pattern match: \"https://docs.python.org/zh-cn/\"","Heuristic match: \"- bpo-36544: fix regression introduced in bpo-36146 refactoring setup.py\"","Heuristic match: \"- bpo-34144: fixed activate.bat to correctly update codepage when chcp.com\"","Pattern match: \"https://github.com/python/typed_ast\"","Heuristic match: \"- bpo-34558: correct typo in lib/ctypes/_aix.py\"","Heuristic match: \"- bpo-33061: add missing ``noreturn`` to ``__all__`` in typing.py\"","Pattern match: \"https://www.openssl.org/docs/man1.1.0/ssl/ssl_ctx_set_min_proto_version.html\"","Pattern match: \"https://docs.python.org/3/\"","Pattern match: \"https://python.visualstudio.com/cpython\"","Heuristic match: \"- bpo-29442: replace optparse with argparse in setup.py\"","Pattern match: \"https://github.com/pypa/setuptools/issues/100\"","Heuristic match: \"ow.mv\"","Heuristic match: \"8d.sa\""],"description_v3":[{"type":"text","value":"Heuristic match: \"ax.id\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"*g.ro\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"}1.ng\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://%d/%d/%d\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \".exe.sa\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"readme.md\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"security.md\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"c:\\tempdir\\node_modules\\@socket.io\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ce}-c\\proof.fr\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"jloup@gzip.org madler@alumni.caltech.edu\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.openssl.org/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.freetype.org\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"o freetype@nongnu.org\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"o freetype-devel@nongnu.org\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.freetype.org\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"email domain: cam.ac.uk\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"emain domain: freemail.hu\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.sqlite.org/copyright.html\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"vhwd.gn\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"$y.qa\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"z).bz\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"__main__.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"segment.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"spinner.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"style.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"table.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"termin~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"text.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"theme.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"traceb~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"traceback.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"tree.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_cell_~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_cell_widths.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_emoji~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_emoji_codes.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_emoji~2.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_emoji_replace.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_expor~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_exten~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_inspect.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_log_r~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_log_render.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_loop.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_palet~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_palettes.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_pick.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_spinn~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_spinners.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_stack.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_timer.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"more.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"recipes.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"__init__.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"markers.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"requir~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"requirements.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"specif~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"tags.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"utils.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"version.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_manyl~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_musll~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_musllinux.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_struc~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_structures.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"__abou~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"__about__.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"extens~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"extension.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"glob.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"instal~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"installer.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"logging.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"msvc.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"namesp~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"namespaces.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"packag~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"package_index.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"py34co~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"sandbox.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"unicod~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"unicode_utils.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"cmd.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"core.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"cygwin~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"cygwinccompiler.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"debug.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"dep_util.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"dir_util.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"dist.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"fancy_~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"fancy_getopt.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"filelist.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"file_u~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"file_util.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"log.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"msvc9c~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"msvc9compiler.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"msvcco~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"msvccompiler.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"py38co~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"py39co~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"spawn.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"syscon~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"sysconfig.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"text_f~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"text_file.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"unixcc~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"unixccompiler.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"util.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"versio~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"versionpredicate.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_colle~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_collections.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_funct~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_functools.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_macos~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_macos_compat.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_msvcc~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_msvccompiler.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"actions.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"except~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"helpers.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"results.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"testing.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"unicode.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"fix_next.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"fix_no~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"fix_nonzero.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"fix_nu~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"install_data.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"instal~2.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"install_egg_info.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"instal~3.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"install_headers.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"instal~4.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"install_lib.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"in32d9~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"install_scripts.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"py37co~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"register.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"sdist.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"upload.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_frame~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_framework_compat.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_adapt~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_adapters.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_compat.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_itert~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_meta.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_text.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"easy_i~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"easy_install.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"editab~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"egg_info.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"install.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"py36co~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"saveopts.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"test.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"upload~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"upload_docs.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"langru~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"langrussianmodel.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"langth~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"langthaimodel.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"langtu~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"langturkishmodel.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"latin1~1.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"latin1prober.pyw.py\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.com/python/cpython\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.com/orgs/python/projects/31\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"- class browser now compatible with python2.3 version of pyclbr.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"- fix tk root pop-ups in configsectionnamedialog.py and configdialog.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"execbinding.py, loader.py, protocol.py, remote.py, spawn.py\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.com/libexpat/libexpat/issues/115\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://sourceforge.net/p/expat/bugs/537/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.com/python/typing\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"- bpo-27705: update message in validate_ucrtbase.py\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.com/python/pythondotorg/issues/945\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"sndhdr.what/whathdr\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.python.org/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.example.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.com/python/typing/issues/751\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"- bpo-40964: disable remote :mod:`imaplib` tests, host cyrus.andrew.cmu.edu\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"in webbrowser.py\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242274\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.w3.org/tr/xml/#sec-prolog-dtd\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://importlib-metadata.readthedocs.io/en/latest/changelog%20(links).html#v1-5-0\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"- bpo-39242: updated the gmane domain from news.gmane.org to news.gmane.io\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://fishshell.com/docs/current/commands.html#source\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"- bpo-38586: now :func:`~logging.config.fileconfig` correctly sets the .name\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://gitlab.com/python-devs/importlib_metadata/blob/0.21/importlib_metadata/docs/changelog.rst\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://gitlab.com/python-devs/importlib_metadata/-/milestones/20\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://docs.python.org/zh-cn/\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"- bpo-36544: fix regression introduced in bpo-36146 refactoring setup.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"- bpo-34144: fixed activate.bat to correctly update codepage when chcp.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.com/python/typed_ast\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"- bpo-34558: correct typo in lib/ctypes/_aix.py\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"- bpo-33061: add missing ``noreturn`` to ``__all__`` in typing.py\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.openssl.org/docs/man1.1.0/ssl/ssl_ctx_set_min_proto_version.html\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://docs.python.org/3/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://python.visualstudio.com/cpython\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"- bpo-29442: replace optparse with argparse in setup.py\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.com/pypa/setuptools/issues/100\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ow.mv\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"8d.sa\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"memorydump-2","type":20,"relevance":1,"name":"Found potential URLs in memory dumps","description":"$3f","description_v2":["Found URL \"https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip00000000.res00000000.pky00000000.eky\" - Source: \"00000000-00006996.00000000.281787.1000C000.00000004.mdmp\")","Found URL \"http://www.openssl.org/)\" - Source: \"00000000-00006996.00000001.283709.031B9000.00000004.mdmp\")","Found URL \"http://www.freetype.org\" - Source: \"00000000-00006996.00000001.283709.031B9000.00000004.mdmp\")","Found URL \"http://www.sqlite.org/copyright.html,\" - Source: \"00000000-00006996.00000001.283709.031B9000.00000004.mdmp\")","Found URL \"https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip00000000.res00000000.pky00000000.eky\" - Source: \"00000000-00006996.00000001.283709.1000C000.00000004.mdmp\")","Found URL \"https://github.com/python/cpython.\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found URL \"https://github.com/orgs/python/projects/31.the\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found URL \"https://github.com/libexpat/libexpat/issues/115-\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found URL \"https://sourceforge.net/p/expat/bugs/537/\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found URL \"https://github.com/python/typing:\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found URL \"https://github.com/python/pythondotorg/issues/945)build------\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found URL \"https://github.com/libexpat/libexpat/issues/115what's\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found URL \"https://github.com/python/pythondotorg/issues/945)tools/demos------------\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found URL \"http://www.python.org/\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found URL \"https://www.python.org:\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found URL \"http://www.example.com\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found URL \"https://github.com/python/typing/issues/751>\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found URL \"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242274-\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found URL \"https://www.w3.org/tr/xml/\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found URL \"https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip00000000.res00000000.pky00000000.eky\" - Source: \"00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found URL \"https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip00000000.res00000000.pky00000000.eky\" - Source: \"00000000-00006996.00000000.281787.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.openssl.org/)\" - Source: \"00000000-00006996.00000001.283709.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.freetype.org\" - Source: \"00000000-00006996.00000001.283709.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.sqlite.org/copyright.html,\" - Source: \"00000000-00006996.00000001.283709.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip00000000.res00000000.pky00000000.eky\" - Source: \"00000000-00006996.00000001.283709.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.com/python/cpython.\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.com/orgs/python/projects/31.the\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.com/libexpat/libexpat/issues/115-\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://sourceforge.net/p/expat/bugs/537/\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.com/python/typing:\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.com/python/pythondotorg/issues/945)build------\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.com/libexpat/libexpat/issues/115what's\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.com/python/pythondotorg/issues/945)tools/demos------------\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.python.org/\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.python.org:\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.example.com\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.com/python/typing/issues/751>\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242274-\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.w3.org/tr/xml/\" - Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip00000000.res00000000.pky00000000.eky\" - Source: \"00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"}],"origin":"Memory Dumps","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-55","type":7,"relevance":1,"name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 46f5131e766d248db0248a86c494b71c\n Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482\n Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee\n Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","description_v2":["Observed JA3 fingerprint: 46f5131e766d248db0248a86c494b71c","Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482","Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee","Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e","Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb"],"description_v3":[{"type":"text","value":"Observed JA3 fingerprint: 46f5131e766d248db0248a86c494b71c"},{"type":"linebreak"},{"type":"text","value":"Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482"},{"type":"linebreak"},{"type":"text","value":"Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee"},{"type":"linebreak"},{"type":"text","value":"Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e"},{"type":"linebreak"},{"type":"text","value":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c"},{"type":"linebreak"},{"type":"text","value":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb"}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-54","type":7,"relevance":1,"name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","description_v2":["Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]"],"description_v3":[{"type":"text","value":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]"}],"origin":"Network Traffic","attck_id":"T1573","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-5003","type":2,"relevance":1,"name":"References OpenSSL library string","description":"$40","description_v2":["Observed string: \"- bpo-30715: Address ALPN callback changes for OpenSSL 1.1.0f. The latest\" (Indicator: \"OpenSSL 1.\")","Observed string: \"version behaves like OpenSSL 1.0.2 and no longer aborts handshake.\" (Indicator: \"OpenSSL 1.\")","Observed string: \"- bpo-29572: Update Windows build and OS X installers to use OpenSSL 1.0.2k.\" (Indicator: \"OpenSSL 1.\")","Observed string: \"- bpo-28248: Update Windows build and OS X installers to use OpenSSL 1.0.2j.\" (Indicator: \"OpenSSL 1.\")","Observed string: \"module (requires OpenSSL 1.1.0).\" (Indicator: \"OpenSSL 1.\")","Observed string: \"(Required OpenSSL 1.1.0 or LibreSSL).\" (Indicator: \"OpenSSL 1.\")","Observed string: \"- bpo-26470: Port ssl and hashlib module to OpenSSL 1.1.0.\" (Indicator: \"OpenSSL 1.\")","Observed string: \"- bpo-26930: Update Windows builds to use OpenSSL 1.0.2h.\" (Indicator: \"OpenSSL 1.\")","Observed string: \"OpenSSL 1.0.2h.\" (Indicator: \"OpenSSL 1.\")","Observed string: \"- bpo-26465: Update Windows builds to use OpenSSL 1.0.2g.\" (Indicator: \"OpenSSL 1.\")","Observed string: \"OpenSSL 1.0.2g.\" (Indicator: \"OpenSSL 1.\")","Observed string: \"- bpo-26268: Update Windows builds to use OpenSSL 1.0.2f.\" (Indicator: \"OpenSSL 1.\")","Observed string: \"- bpo-23686: Update OS X 10.5 installer build to use OpenSSL 1.0.2a.\" (Indicator: \"OpenSSL 1.\")","Observed string: \"for ECDH key exchange on OpenSSL 1.0.2 and later, and otherwise default to\" (Indicator: \"OpenSSL 1.\")","Observed string: \"- bpo-30008: Fix :mod:`ssl` code to be compatible with OpenSSL 1.1.x builds\" (Indicator: \"OpenSSL 1.\")","Observed string: \"- bpo-40479: Update multissltest helper to test with latest OpenSSL 1.0.2,\" (Indicator: \"OpenSSL 1.\")","Observed string: \"- bpo-40162: Update Travis CI configuration to OpenSSL 1.1.1f.\" (Indicator: \"OpenSSL 1.\")","Observed string: \"- bpo-40164: Updates Windows to OpenSSL 1.1.1f\" (Indicator: \"OpenSSL 1.\")","Observed string: \"- bpo-40164: Update macOS installer builds to use OpenSSL 1.1.1g.\" (Indicator: \"OpenSSL 1.\")","Observed string: \"function with OpenSSL 1.1.0+.\" (Indicator: \"OpenSSL 1.\")","Observed string: \"- bpo-38117: Test with OpenSSL 1.1.1d\" (Indicator: \"OpenSSL 1.\")","Observed string: \"- bpo-37081: Test with OpenSSL 1.1.1c\" (Indicator: \"OpenSSL 1.\")","Observed string: \"- bpo-35926: Update to OpenSSL 1.1.1b for Windows.\" (Indicator: \"OpenSSL 1.\")","Observed string: \"- bpo-34405: Updated to OpenSSL 1.1.0i for Windows builds.\" (Indicator: \"OpenSSL 1.\")","Observed string: \"support with OpenSSL 1.1.1\" (Indicator: \"OpenSSL 1.\")"],"description_v3":[{"type":"text","value":"Observed string: \"- bpo-30715: Address ALPN callback changes for OpenSSL 1.1.0f. The latest\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"version behaves like OpenSSL 1.0.2 and no longer aborts handshake.\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"- bpo-29572: Update Windows build and OS X installers to use OpenSSL 1.0.2k.\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"- bpo-28248: Update Windows build and OS X installers to use OpenSSL 1.0.2j.\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"module (requires OpenSSL 1.1.0).\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"(Required OpenSSL 1.1.0 or LibreSSL).\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"- bpo-26470: Port ssl and hashlib module to OpenSSL 1.1.0.\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"- bpo-26930: Update Windows builds to use OpenSSL 1.0.2h.\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"OpenSSL 1.0.2h.\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"- bpo-26465: Update Windows builds to use OpenSSL 1.0.2g.\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"OpenSSL 1.0.2g.\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"- bpo-26268: Update Windows builds to use OpenSSL 1.0.2f.\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"- bpo-23686: Update OS X 10.5 installer build to use OpenSSL 1.0.2a.\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"for ECDH key exchange on OpenSSL 1.0.2 and later, and otherwise default to\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"- bpo-30008: Fix :mod:`ssl` code to be compatible with OpenSSL 1.1.x builds\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"- bpo-40479: Update multissltest helper to test with latest OpenSSL 1.0.2,\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"- bpo-40162: Update Travis CI configuration to OpenSSL 1.1.1f.\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"- bpo-40164: Updates Windows to OpenSSL 1.1.1f\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"- bpo-40164: Update macOS installer builds to use OpenSSL 1.1.1g.\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"function with OpenSSL 1.1.0+.\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"- bpo-38117: Test with OpenSSL 1.1.1d\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"- bpo-37081: Test with OpenSSL 1.1.1c\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"- bpo-35926: Update to OpenSSL 1.1.1b for Windows.\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"- bpo-34405: Updated to OpenSSL 1.1.0i for Windows builds.\" (Indicator: \"OpenSSL 1.\")"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"support with OpenSSL 1.1.1\" (Indicator: \"OpenSSL 1.\")"}],"origin":"File/Memory","attck_id":"T1573.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"summary-27","type":15,"relevance":2,"name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","description_v2":["Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network"],"description_v3":[{"type":"text","value":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network"}],"origin":"Indicator Combinations","attck_id":"T1119","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1119","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Pattern Matching","identifier":"yara-103","type":13,"relevance":5,"name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00006996\"\n YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on file \"u.wnry\"","description_v2":["YARA signature for AES encryption matched on process \"00000000-00006996\"","YARA signature for AES encryption matched on file \"sample.bin\"","YARA signature for AES encryption matched on file \"u.wnry\""],"description_v3":[{"type":"text","value":"YARA signature for AES encryption matched on process \"00000000-00006996\""},{"type":"linebreak"},{"type":"text","value":"YARA signature for AES encryption matched on file \"sample.bin\""},{"type":"linebreak"},{"type":"text","value":"YARA signature for AES encryption matched on file \"u.wnry\""}],"origin":"YARA Signature","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-102","type":6,"relevance":5,"name":"Calls an API typically used for searching a directory for files","description":"$41","description_v2":["\"WannaCry.exe.sample.exe\" called \"FindFirstFileW\" with parameter %USERPROFILE%\\Desktop\\* (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"FindNextFileW\" with parameter desktop.ini (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"FindFirstFileW\" with parameter %USERPROFILE%\\Documents\\* (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"FindNextFileW\" with parameter My Music (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"FindNextFileW\" with parameter My Pictures (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"FindNextFileW\" with parameter My Videos (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"FindFirstFileW\" with parameter %USERPROFILE%\\Documents\\My Music\\* (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"FindFirstFileW\" with parameter %USERPROFILE%\\Documents\\My Pictures\\* (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"FindFirstFileW\" with parameter %USERPROFILE%\\Documents\\My Videos\\* (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"FindFirstFileW\" with parameter C:\\Users\\*.* (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"FindNextFileW\" with parameter All Users (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"FindNextFileW\" with parameter Default (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"FindNextFileW\" with parameter Default User (UID: 00000000-00006996)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"FindFirstFileW\" with parameter %USERPROFILE%\\Desktop\\* (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"FindNextFileW\" with parameter desktop.ini (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"FindFirstFileW\" with parameter %USERPROFILE%\\Documents\\* (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"FindNextFileW\" with parameter My Music (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"FindNextFileW\" with parameter My Pictures (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"FindNextFileW\" with parameter My Videos (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"FindFirstFileW\" with parameter %USERPROFILE%\\Documents\\My Music\\* (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"FindFirstFileW\" with parameter %USERPROFILE%\\Documents\\My Pictures\\* (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"FindFirstFileW\" with parameter %USERPROFILE%\\Documents\\My Videos\\* (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"FindFirstFileW\" with parameter C:\\Users\\*.* (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"FindNextFileW\" with parameter All Users (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"FindNextFileW\" with parameter Default (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"FindNextFileW\" with parameter Default User (UID: 00000000-00006996)"}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-103","type":6,"relevance":3,"name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WannaCry.exe.sample.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"taskdl.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cscript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","description_v2":["\"WannaCry.exe.sample.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}","\"taskdl.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}","\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}","\"cscript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-141","type":6,"relevance":2,"name":"Calls an API typically used to retrieve computer name","description":"\"WannaCry.exe.sample.exe\" called \"GetComputerNameW\" (UID: 00000000-00006996)\n \"cscript.exe\" called \"GetComputerNameW\" (UID: 00000000-00007424)","description_v2":["\"WannaCry.exe.sample.exe\" called \"GetComputerNameW\" (UID: 00000000-00006996)","\"cscript.exe\" called \"GetComputerNameW\" (UID: 00000000-00007424)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetComputerNameW\" (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" called \"GetComputerNameW\" (UID: 00000000-00007424)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-108","type":6,"relevance":3,"name":"Calls an API typically used to retrieve information about the current system","description":"\"WannaCry.exe.sample.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","description_v2":["\"WannaCry.exe.sample.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-135","type":6,"relevance":2,"name":"Calls an API typically used to retrieve user name","description":"\"WannaCry.exe.sample.exe\" called \"GetUserNameW\" (UID: 00000000-00006996)","description_v2":["\"WannaCry.exe.sample.exe\" called \"GetUserNameW\" (UID: 00000000-00006996)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetUserNameW\" (UID: 00000000-00006996)"}],"origin":"API Call","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-57","type":2,"relevance":3,"name":"Contains CRYPTO related strings","description":"$42","description_v2":["Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; File: \"WannaCry.exe.sample\")","Found string \"7naesu\" (Indicator: \"aes\"; File: \"WannaCry.exe.sample\")","file/memory contains long string with (Indicator: \"aes\"; File: \"u.wnry\")","file/memory contains long string with (Indicator: \"rsa2\"; File: \"u.wnry\")","Found string \".aes\" (Indicator: \"aes\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found string \"t Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found string \"RSA2\" (Indicator: \"rsa2\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found string \"C:\\tempdir\\node_modules\\base64id\" (Indicator: \"base64\"; Source: \"00000000-00006996.00000000.281787.025B0000.00000004.mdmp\")","Found string \"\\??\\C:\\tempdir\\node_modules\\bson\\vendor\\base64\\LICENSE-MIT.txt\" (Indicator: \"base64\"; Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","file/memory contains long string with (Indicator: \"aes\"; Source: \"00000000-00006996.00000001.283709.031B9000.00000004.mdmp\")","file/memory contains long string with (Indicator: \"3des\"; Source: \"00000000-00006996.00000001.283709.031B9000.00000004.mdmp\")","file/memory contains long string with (Indicator: \"rsa2\"; Source: \"00000000-00006996.00000001.283709.031B9000.00000004.mdmp\")","Found string \"-u extralargefile to run test_zipfile64.\" (Indicator: \"zipfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-26293: Change resulted because of zipfile breakage. (See also:\" (Indicator: \"zipfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-28231: The zipfile module now accepts path-like objects for external\" (Indicator: \"zipfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"when executing ``__main__`` from a zipfile, directory, or other import\" (Indicator: \"zipfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-26937: The chown() method of the tarfile.TarFile class does not fail\" (Indicator: \"tarfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-28513: Documented command-line interface of zipfile.\" (Indicator: \"zipfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-28449: tarfile.open() with mode \"r\" or \"r:\" now tries to open a tar\" (Indicator: \"tarfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-27199: In tarfile, expose copyfileobj bufsize to improve throughput.\" (Indicator: \"tarfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-24693: Changed some RuntimeError's in the zipfile module to more\" (Indicator: \"zipfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-28047: Fixed calculation of line length used for the base64 CTE in the\" (Indicator: \"base64\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-27850: Remove 3DES from ssl module's default cipher list to counter\" (Indicator: \"3des\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-27766: Add ChaCha20 Poly1305 to ssl module's default cipher list.\" (Indicator: \"chacha\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"ZipFile.open().\" (Indicator: \"zipfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-26039: zipfile.ZipFile.open() can now be used to write data into a ZIP\" (Indicator: \"zipfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-24838: tarfile's ustar and gnu formats now correctly calculate name\" (Indicator: \"tarfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"7naesu\" (Indicator: \"aes\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"aes\"; File: \"u.wnry\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"rsa2\"; File: \"u.wnry\")"},{"type":"linebreak"},{"type":"text","value":"Found string \".aes\" (Indicator: \"aes\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"t Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"RSA2\" (Indicator: \"rsa2\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"C:\\tempdir\\node_modules\\base64id\" (Indicator: \"base64\"; Source: \"00000000-00006996.00000000.281787.025B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"\\??\\C:\\tempdir\\node_modules\\bson\\vendor\\base64\\LICENSE-MIT.txt\" (Indicator: \"base64\"; Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"aes\"; Source: \"00000000-00006996.00000001.283709.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"3des\"; Source: \"00000000-00006996.00000001.283709.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"rsa2\"; Source: \"00000000-00006996.00000001.283709.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"-u extralargefile to run test_zipfile64.\" (Indicator: \"zipfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-26293: Change resulted because of zipfile breakage. (See also:\" (Indicator: \"zipfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-28231: The zipfile module now accepts path-like objects for external\" (Indicator: \"zipfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"when executing ``__main__`` from a zipfile, directory, or other import\" (Indicator: \"zipfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-26937: The chown() method of the tarfile.TarFile class does not fail\" (Indicator: \"tarfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-28513: Documented command-line interface of zipfile.\" (Indicator: \"zipfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-28449: tarfile.open() with mode \"r\" or \"r:\" now tries to open a tar\" (Indicator: \"tarfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-27199: In tarfile, expose copyfileobj bufsize to improve throughput.\" (Indicator: \"tarfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-24693: Changed some RuntimeError's in the zipfile module to more\" (Indicator: \"zipfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-28047: Fixed calculation of line length used for the base64 CTE in the\" (Indicator: \"base64\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-27850: Remove 3DES from ssl module's default cipher list to counter\" (Indicator: \"3des\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-27766: Add ChaCha20 Poly1305 to ssl module's default cipher list.\" (Indicator: \"chacha\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ZipFile.open().\" (Indicator: \"zipfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-26039: zipfile.ZipFile.open() can now be used to write data into a ZIP\" (Indicator: \"zipfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-24838: tarfile's ustar and gnu formats now correctly calculate name\" (Indicator: \"tarfile\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-188","type":2,"relevance":1,"name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"WannaCry.exe.sample\")","description_v2":["Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"WannaCry.exe.sample\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"WannaCry.exe.sample\")"}],"origin":"File/Memory","attck_id":"T1115","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1115","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-78","type":2,"relevance":1,"name":"Contains ability to capture screen (API string)","description":"Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"WannaCry.exe.sample\")","description_v2":["Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"WannaCry.exe.sample\")","Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"WannaCry.exe.sample\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"WannaCry.exe.sample\")"}],"origin":"File/Memory","attck_id":"T1113","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1113","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-80","type":2,"relevance":1,"name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-83","type":2,"relevance":1,"name":"Contains ability to enumerate files on disk (API string)","description":"$43","description_v2":["Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"WannaCry.exe.sample\")","Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"WannaCry.exe.sample\")","Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"WannaCry.exe.sample\")","Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"WannaCry.exe.sample\")","Found reference to API \"276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.078\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")","Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"11828986232,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")","Found reference to API \"11828831804,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")","Found reference to API \"11814729952,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")","Found reference to API \"11795354458,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.890\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")","Found reference to API \"11813869190,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")","Found reference to API \"11825321894,9276,3116,,FindFirstFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")","Found reference to API \"11814316962,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")","Found reference to API \"11828506710,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")","Found reference to API \"11828759594,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")","Found reference to API \"11828606676,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")","Found reference to API \"11828902890,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")","Found reference to API \"83923920614,9276,3116,,FindFirstFileW,kernel32.dll,\"01:13:52.953\",RX=0,PX=0\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")","Found reference to API \"83901889032,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:52.937\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")","Found reference to API \"83893672384,9276,3116,,FindFirstFileW,kernel32.dll,\"01:13:52.937\",RX=0,PX=0\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")","Found reference to API \"83908223210,9276,3116,,FindFirstFileW,kernel32.dll,\"01:13:52.937\",RX=0,PX=0\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")","Found reference to API \"83907494842,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:52.937\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")","Found reference to API \"83923031206,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:52.953\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")","Found reference to API \"83887556034,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:52.937\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.078\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"11828986232,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"11828831804,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"11814729952,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"11795354458,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.890\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"11813869190,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"11825321894,9276,3116,,FindFirstFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"11814316962,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"11828506710,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"11828759594,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"11828606676,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"11828902890,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:22.906\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83923920614,9276,3116,,FindFirstFileW,kernel32.dll,\"01:13:52.953\",RX=0,PX=0\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83901889032,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:52.937\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83893672384,9276,3116,,FindFirstFileW,kernel32.dll,\"01:13:52.937\",RX=0,PX=0\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83908223210,9276,3116,,FindFirstFileW,kernel32.dll,\"01:13:52.937\",RX=0,PX=0\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83907494842,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:52.937\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83923031206,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:52.953\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"83887556034,9276,3118,,FindNextFileW,kernel32.dll,\"01:13:52.937\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006996.00000001.283709.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-85","type":2,"relevance":1,"name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-84","type":2,"relevance":1,"name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-229","type":2,"relevance":1,"name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; File: \"WannaCry.exe.sample\")","Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-534","type":2,"relevance":0,"name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","description_v2":["Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"WannaCry.exe.sample\")","Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-427","type":2,"relevance":1,"name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-317","type":2,"relevance":1,"name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-115","type":2,"relevance":3,"name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-207","type":2,"relevance":1,"name":"Contains ability to retrieve file and directory information (API string)","description":"$44","description_v2":["Found reference to API \"GetCurrentDirectoryA\" (Indicator: \"GetCurrentDirectory\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetTempFileNameA\" (Indicator: \"GetTempFileName\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetCurrentDirectoryA\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetCurrentDirectoryA\" (Indicator: \"GetCurrentDirectory\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempFileNameA\" (Indicator: \"GetTempFileName\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentDirectoryA\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-484","type":2,"relevance":1,"name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where needed, minimal tests are added to cover changes.\" (Indicator: \"where \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")\n Found string \"where the user does not have read access. Patch by Pablo Galindo and Matt\" (Indicator: \"where \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")\n Found string \"where an arena could be created and destroyed anew on each iteration.\" (Indicator: \"where \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")\n Found string \"where the first and third arguments are relatively prime.\" (Indicator: \"where \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")\n Found string \"where it could read bytes beyond the end of bounds of an array when\" (Indicator: \"where \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","description_v2":["Found string \"Where needed, minimal tests are added to cover changes.\" (Indicator: \"where \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"where the user does not have read access. Patch by Pablo Galindo and Matt\" (Indicator: \"where \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"where an arena could be created and destroyed anew on each iteration.\" (Indicator: \"where \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"where the first and third arguments are relatively prime.\" (Indicator: \"where \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"where it could read bytes beyond the end of bounds of an array when\" (Indicator: \"where \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Where needed, minimal tests are added to cover changes.\" (Indicator: \"where \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"where the user does not have read access. Patch by Pablo Galindo and Matt\" (Indicator: \"where \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"where an arena could be created and destroyed anew on each iteration.\" (Indicator: \"where \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"where the first and third arguments are relatively prime.\" (Indicator: \"where \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"where it could read bytes beyond the end of bounds of an array when\" (Indicator: \"where \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-328","type":2,"relevance":1,"name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir parameters and returns bytes in such situations (matching the os\" (Indicator: \"dir \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","description_v2":["Found string \"dir parameters and returns bytes in such situations (matching the os\" (Indicator: \"dir \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"dir parameters and returns bytes in such situations (matching the os\" (Indicator: \"dir \"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-122","type":2,"relevance":1,"name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-164","type":2,"relevance":1,"name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")","description_v2":["Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006996.00000002.285629.00408000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-224","type":2,"relevance":1,"name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"- bpo-30205: Fix getsockname() for unbound AF_UNIX sockets on Linux.\" (Indicator: \"getsockname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")\n Found reference to API \"- bpo-37405: Fixed regression bug for socket.getsockname() for non-CAN_ISOTP\" (Indicator: \"getsockname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")\n Found reference to API \"- bpo-34490: On AIX with AF_UNIX family sockets getsockname() does not\" (Indicator: \"getsockname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","description_v2":["Found reference to API \"- bpo-30205: Fix getsockname() for unbound AF_UNIX sockets on Linux.\" (Indicator: \"getsockname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found reference to API \"- bpo-37405: Fixed regression bug for socket.getsockname() for non-CAN_ISOTP\" (Indicator: \"getsockname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found reference to API \"- bpo-34490: On AIX with AF_UNIX family sockets getsockname() does not\" (Indicator: \"getsockname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"- bpo-30205: Fix getsockname() for unbound AF_UNIX sockets on Linux.\" (Indicator: \"getsockname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"- bpo-37405: Fixed regression bug for socket.getsockname() for non-CAN_ISOTP\" (Indicator: \"getsockname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"- bpo-34490: On AIX with AF_UNIX family sockets getsockname() does not\" (Indicator: \"getsockname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-131","type":2,"relevance":1,"name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"WannaCry.exe.sample\")","description_v2":["Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"WannaCry.exe.sample\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"WannaCry.exe.sample\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-205","type":2,"relevance":1,"name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-437","type":2,"relevance":1,"name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1134","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-121","type":2,"relevance":1,"name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$45","description_v2":["Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-475","type":2,"relevance":1,"name":"Contains string like password/secret","description":"$46","description_v2":["Found string \"expat secret using ``XML_SetHashSalt()``.\" (Indicator: \"secret\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-29061: Fixed bug in secrets.randbelow() which would hang when given a\" (Indicator: \"secret\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-27928: Add scrypt (password-based key derivation function) to hashlib\" (Indicator: \"password\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-26996: Add secrets module as described in :pep:`506`.\" (Indicator: \"secret\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"usernames and passwords to UTF8.\" (Indicator: \"password\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"in the password database). This change fix the :mod:`site` module if the\" (Indicator: \"password\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"current user doesn't exist in the password database (if the user has no\" (Indicator: \"password\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"expat secret using ``XML_SetHashSalt()``.\" (Indicator: \"secret\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-29061: Fixed bug in secrets.randbelow() which would hang when given a\" (Indicator: \"secret\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-27928: Add scrypt (password-based key derivation function) to hashlib\" (Indicator: \"password\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-26996: Add secrets module as described in :pep:`506`.\" (Indicator: \"secret\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"usernames and passwords to UTF8.\" (Indicator: \"password\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"in the password database). This change fix the :mod:`site` module if the\" (Indicator: \"password\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"current user doesn't exist in the password database (if the user has no\" (Indicator: \"password\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1555","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1555","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-556","type":2,"relevance":1,"name":"Found strings related to keylogger","description":"Found string \"- Issue #4676: toggle failing on Tk 8.5, causing IDLE exits and strange selection\" (Indicator: \"\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")\n Found string \"- Issue #3851: toggle non-functional when NumLock set on Windows.\" (Indicator: \"\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","description_v2":["Found string \"- Issue #4676: toggle failing on Tk 8.5, causing IDLE exits and strange selection\" (Indicator: \"\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- Issue #3851: toggle non-functional when NumLock set on Windows.\" (Indicator: \"\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"- Issue #4676: toggle failing on Tk 8.5, causing IDLE exits and strange selection\" (Indicator: \"\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- Issue #3851: toggle non-functional when NumLock set on Windows.\" (Indicator: \"\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1056.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-729","type":2,"relevance":1,"name":"Able to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"taskse.exe\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006996-00000C2A-3407930309\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"taskse.exe\")","Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006996-00000C2A-3407930309\")","Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"taskse.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006996-00000C2A-3407930309\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-474","type":2,"relevance":1,"name":"Contains ability to access device drivers","description":"$47","description_v2":["Found string \"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\cmd.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006996-00000BC1-3410113738\")","Found string \"C:\\tempdir\\node_modules\\mongoose\\lib\\drivers\\*\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00006996-00000C2C-30266538766\")","Found string \"C:\\tempdir\\node_modules\\mongoose\\lib\\drivers\\browser\\*\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00006996-00000C2C-30271695462\")","Found string \"C:\\tempdir\\node_modules\\mongoose\\lib\\drivers\\node-mongodb-native\\*\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00006996-00000C2C-30276556068\")","Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003516-00000BC0-3410353701\")","Found string \"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\cscript.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003516-00000BC0-3411964192\")","Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.025B0000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.025B0000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.025B0000.00000004.mdmp\")","Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.025B0000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.025B0000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.025B0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\cmd.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006996-00000BC1-3410113738\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"C:\\tempdir\\node_modules\\mongoose\\lib\\drivers\\*\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00006996-00000C2C-30266538766\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"C:\\tempdir\\node_modules\\mongoose\\lib\\drivers\\browser\\*\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00006996-00000C2C-30271695462\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"C:\\tempdir\\node_modules\\mongoose\\lib\\drivers\\node-mongodb-native\\*\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00006996-00000C2C-30276556068\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003516-00000BC0-3410353701\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\cscript.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003516-00000BC0-3411964192\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"DriverData=%WINDIR%\\System32\\Drivers\\DriverData\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.025B0000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.025B0000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.025B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.025B0000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.025B0000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.025B0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-308","type":2,"relevance":1,"name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"WannaCry.exe.sample\")","Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"WannaCry.exe.sample\")","Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-77","type":2,"relevance":1,"name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1134","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-426","type":2,"relevance":1,"name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"WannaCry.exe.sample\")","Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1222","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1222","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-132","type":2,"relevance":1,"name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"WannaCry.exe.sample\")","Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"WannaCry.exe.sample\")","Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1098","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1098","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-114","type":2,"relevance":1,"name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$48","description_v2":["Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"WannaCry.exe.sample\")","Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"WannaCry.exe.sample\")","Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; File: \"WannaCry.exe.sample\")","Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"SetEntriesInAclA\" (Indicator: \"SetEntriesInAcl\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetEntriesInAclA\" (Indicator: \"SetEntriesInAcl\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1134.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-406","type":2,"relevance":1,"name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: WannaCry.exe.sample\n Observed string: \"shutdown to call objects destructors. So \"unclosed file\" resource warnings\" (Indicator: \"shutdown \") in Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp\n Observed string: \"shutdown even when there was a custom handler set previously. Patch by\" (Indicator: \"shutdown \") in Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp","description_v2":["Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: WannaCry.exe.sample","Observed string: \"shutdown to call objects destructors. So \"unclosed file\" resource warnings\" (Indicator: \"shutdown \") in Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp","Observed string: \"shutdown even when there was a custom handler set previously. Patch by\" (Indicator: \"shutdown \") in Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp"],"description_v3":[{"type":"text","value":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: WannaCry.exe.sample"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"shutdown to call objects destructors. So \"unclosed file\" resource warnings\" (Indicator: \"shutdown \") in Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"shutdown even when there was a custom handler set previously. Patch by\" (Indicator: \"shutdown \") in Source: 00000000-00006996.00000002.285629.031B9000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1529","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1529","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-316","type":2,"relevance":1,"name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"WannaCry.exe.sample\")","Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"WannaCry.exe.sample\")","Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-535","type":2,"relevance":0,"name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")","description_v2":["Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"WannaCry.exe.sample\")","Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-67","type":3,"relevance":10,"name":"Creates or modifies windows services","description":"\"WannaCry.exe.sample.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSWOW64\\CMD.EXE\"; Value: \"470A02FC7CA6DB0100000000000000000000000002000000\")","description_v2":["\"WannaCry.exe.sample.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSWOW64\\CMD.EXE\"; Value: \"470A02FC7CA6DB0100000000000000000000000002000000\")"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSWOW64\\CMD.EXE\"; Value: \"470A02FC7CA6DB0100000000000000000000000002000000\")"}],"origin":"Registry Access","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"static-87","type":0,"relevance":1,"name":"Imports system security related APIs","description":"Observed import api \"AllocateAndInitializeSid\" which can \"Allocates and initializes a security identifier (SID) with up to eight subauthorities\" [Source: u.wnry]\n Observed import api \"CheckTokenMembership\" which can \"Determines whether a specified security identifier (SID) is enabled in an access token\" [Source: u.wnry]\n Observed import api \"FreeSid\" which can \"Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\" [Source: u.wnry]\n Observed import api \"InitializeSid\" which can \"Initializes a security identifier (SID)\" [Source: u.wnry]","description_v2":["Observed import api \"AllocateAndInitializeSid\" which can \"Allocates and initializes a security identifier (SID) with up to eight subauthorities\" [Source: u.wnry]","Observed import api \"CheckTokenMembership\" which can \"Determines whether a specified security identifier (SID) is enabled in an access token\" [Source: u.wnry]","Observed import api \"FreeSid\" which can \"Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\" [Source: u.wnry]","Observed import api \"InitializeSid\" which can \"Initializes a security identifier (SID)\" [Source: u.wnry]"],"description_v3":[{"type":"text","value":"Observed import api \"AllocateAndInitializeSid\" which can \"Allocates and initializes a security identifier (SID) with up to eight subauthorities\" [Source: u.wnry]"},{"type":"linebreak"},{"type":"text","value":"Observed import api \"CheckTokenMembership\" which can \"Determines whether a specified security identifier (SID) is enabled in an access token\" [Source: u.wnry]"},{"type":"linebreak"},{"type":"text","value":"Observed import api \"FreeSid\" which can \"Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\" [Source: u.wnry]"},{"type":"linebreak"},{"type":"text","value":"Observed import api \"InitializeSid\" which can \"Initializes a security identifier (SID)\" [Source: u.wnry]"}],"origin":"Static Parser","attck_id":"T1134.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-173","type":3,"relevance":1,"name":"Queries services related registry keys","description":"$49","description_v2":["\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSWOW64\\ATTRIB.EXE\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSWOW64\\ICACLS.EXE\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSWOW64\\CMD.EXE\"; Value: \"\")","\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\TASKDL.EXE\"; Value: \"\")","\"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","\"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSWOW64\\CSCRIPT.EXE\"; Value: \"\")","\"cscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")","\"cscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")","\"cscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSWOW64\\ATTRIB.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSWOW64\\ICACLS.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSWOW64\\CMD.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\TASKDL.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSWOW64\\CSCRIPT.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"string-354","type":2,"relevance":1,"name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; File: \"WannaCry.exe.sample\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")\n Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","description_v2":["Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; File: \"WannaCry.exe.sample\")","Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")","Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; File: \"WannaCry.exe.sample\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; Source: \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.10007000.00000002.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.00408000.00000002.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"static-18","type":0,"relevance":10,"name":"Matched Compiler/Packer signature","description":"\"WannaCry.exe.sample\" was detected as \"Microsoft visual C++ 5.0\"\n \"taskse.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"taskdl.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"u.wnry\" was detected as \"Microsoft visual C++ 5.0\"","description_v2":["\"WannaCry.exe.sample\" was detected as \"Microsoft visual C++ 5.0\"","\"taskse.exe\" was detected as \"Microsoft visual C++ 5.0\"","\"taskdl.exe\" was detected as \"Microsoft visual C++ 5.0\"","\"u.wnry\" was detected as \"Microsoft visual C++ 5.0\""],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample\" was detected as \"Microsoft visual C++ 5.0\""},{"type":"linebreak"},{"type":"text","value":"\"taskse.exe\" was detected as \"Microsoft visual C++ 5.0\""},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" was detected as \"Microsoft visual C++ 5.0\""},{"type":"linebreak"},{"type":"text","value":"\"u.wnry\" was detected as \"Microsoft visual C++ 5.0\""}],"origin":"Static Parser","attck_id":"T1027.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"registry-26","type":3,"relevance":2,"name":"Reads the windows installation language","description":"\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"taskdl.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","description_v2":["\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","\"taskdl.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","\"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")"},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")"}],"origin":"Registry Access","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"static-6","type":0,"relevance":1,"name":"Section contains high entropy","description":"\"WannaCry.exe.sample\" has section name .text with entropy \"6.404235106100747\"\n \"WannaCry.exe.sample\" has section name .rdata with entropy \"6.66357096840794\"\n \"WannaCry.exe.sample\" has section name .rsrc with entropy \"7.999867975099678\"\n \"u.wnry\" has section name .text with entropy \"6.241006022718853\"","description_v2":["\"WannaCry.exe.sample\" has section name .text with entropy \"6.404235106100747\"","\"WannaCry.exe.sample\" has section name .rdata with entropy \"6.66357096840794\"","\"WannaCry.exe.sample\" has section name .rsrc with entropy \"7.999867975099678\"","\"u.wnry\" has section name .text with entropy \"6.241006022718853\""],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample\" has section name .text with entropy \"6.404235106100747\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample\" has section name .rdata with entropy \"6.66357096840794\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample\" has section name .rsrc with entropy \"7.999867975099678\""},{"type":"linebreak"},{"type":"text","value":"\"u.wnry\" has section name .text with entropy \"6.241006022718853\""}],"origin":"Static Parser","attck_id":"T1027.009","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/009","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"api-47","type":6,"relevance":10,"name":"Possibly tries to evade analysis by sleeping many times","description":"\"WannaCry.exe.sample.exe\" (Thread ID: 5680) slept \"525\" times (threshold: 500)","description_v2":["\"WannaCry.exe.sample.exe\" (Thread ID: 5680) slept \"525\" times (threshold: 500)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" (Thread ID: 5680) slept \"525\" times (threshold: 500)"}],"origin":"API Call","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"string-2","type":2,"relevance":10,"name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"USRCLA~1.BLFusrClass.dat{06c2dd5b-fa72-11ed-8888-080027147e37}.TM.blf\" (Indicator: \"080027\")\n \"USRCLA~1.REGusrClass.dat{06c2dd5b-fa72-11ed-8888-080027147e37}.TMContainer00000000000000000001.regtrans-ms\" (Indicator: \"080027\")","description_v2":["\"USRCLA~1.BLFusrClass.dat{06c2dd5b-fa72-11ed-8888-080027147e37}.TM.blf\" (Indicator: \"080027\")","\"USRCLA~1.REGusrClass.dat{06c2dd5b-fa72-11ed-8888-080027147e37}.TMContainer00000000000000000001.regtrans-ms\" (Indicator: \"080027\")"],"description_v3":[{"type":"text","value":"\"USRCLA~1.BLFusrClass.dat{06c2dd5b-fa72-11ed-8888-080027147e37}.TM.blf\" (Indicator: \"080027\")"},{"type":"linebreak"},{"type":"text","value":"\"USRCLA~1.REGusrClass.dat{06c2dd5b-fa72-11ed-8888-080027147e37}.TMContainer00000000000000000001.regtrans-ms\" (Indicator: \"080027\")"}],"origin":"File/Memory","attck_id":"T1518.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1518/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"api-6","type":6,"relevance":4,"name":"Reads configuration files (.ini files)","description":"\"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","description_v2":["\"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","\"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"","\"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"","\"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"","\"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"","\"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"","\"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\""],"description_v3":[{"type":"text","value":"\"cscript.exe\" reads file \"%USERPROFILE%\\Desktop\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" reads file \"C:\\Users\\%USERNAME%\\Documents\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" reads file \"C:\\Users\\%USERNAME%\\Music\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" reads file \"C:\\Users\\%USERNAME%\\Pictures\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" reads file \"C:\\Users\\%USERNAME%\\Videos\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" reads file \"C:\\Users\\%USERNAME%\\Downloads\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"cscript.exe\" reads file \"C:\\Users\\%USERNAME%\\OneDrive\\desktop.ini\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistence","identifier":"binary-1","type":8,"relevance":10,"name":"Drops executable files","description":"\"taskse.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\taskse.exe]- [targetUID: 00000000-00006996]\n \"taskdl.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\taskdl.exe]- [targetUID: 00000000-00010448]\n \"u.wnry\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\u.wnry]- [targetUID: 00000000-00006996]","description_v2":["\"taskse.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\taskse.exe]- [targetUID: 00000000-00006996]","\"taskdl.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\taskdl.exe]- [targetUID: 00000000-00010448]","\"u.wnry\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\u.wnry]- [targetUID: 00000000-00006996]"],"description_v3":[{"type":"text","value":"\"taskse.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\taskse.exe]- [targetUID: 00000000-00006996]"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\taskdl.exe]- [targetUID: 00000000-00010448]"},{"type":"linebreak"},{"type":"text","value":"\"u.wnry\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\u.wnry]- [targetUID: 00000000-00006996]"}],"origin":"Binary File","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistence","identifier":"api-43","type":6,"relevance":10,"name":"Writes a PE file header to disc","description":"$4a","description_v2":["\"WannaCry.exe.sample.exe\" wrote 16384 bytes starting with PE header signature to file \"C:\\taskdl.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","\"WannaCry.exe.sample.exe\" wrote 16384 bytes starting with PE header signature to file \"C:\\taskse.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","\"WannaCry.exe.sample.exe\" wrote 16384 bytes starting with PE header signature to file \"C:\\u.wnry\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ..."],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 16384 bytes starting with PE header signature to file \"C:\\taskdl.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ..."},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 16384 bytes starting with PE header signature to file \"C:\\taskse.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ..."},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 16384 bytes starting with PE header signature to file \"C:\\u.wnry\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ..."}],"origin":"API Call","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"target-413","type":9,"relevance":3,"name":"Spawned processes likely due to injection","description":"Process \"C:\\taskdl.exe\" spawned likely due to injection","description_v2":["Process \"C:\\taskdl.exe\" spawned likely due to injection"],"description_v3":[{"type":"text","value":"Process \"C:\\taskdl.exe\" spawned likely due to injection"}],"origin":"Monitored Target","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Pattern Matching","identifier":"yara-62","type":13,"relevance":5,"name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"\n YARA signature for RSA public and private key matched on file \"u.wnry\"","description_v2":["YARA signature for RSA public and private key matched on file \"sample.bin\"","YARA signature for RSA public and private key matched on file \"u.wnry\""],"description_v3":[{"type":"text","value":"YARA signature for RSA public and private key matched on file \"sample.bin\""},{"type":"linebreak"},{"type":"text","value":"YARA signature for RSA public and private key matched on file \"u.wnry\""}],"origin":"YARA Signature","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Pattern Matching","identifier":"yara-134","type":13,"relevance":1,"name":"YARA signature match - Web shell","description":"YARA signature to detect web shell activity in process \"00000000-00006996\"","description_v2":["YARA signature to detect web shell activity in process \"00000000-00006996\""],"description_v3":[{"type":"text","value":"YARA signature to detect web shell activity in process \"00000000-00006996\""}],"origin":"YARA Signature","attck_id":"T1505.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1505/003","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Ransomware/Banking","identifier":"string-52","type":2,"relevance":10,"name":"Contains many references to file extensions (often found in ransomware)","description":"Found reference to a lot of file cls.extensions in file \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\" : .lay6\n .sqlite3\n .sqlitedb\n .accdb\n .java\n .class\n .mpeg\n .djvu\n .tiff\n .jpeg\n .backup\n .vmdk\n .sldm\n .sldx\n .onetoc2\n .potm\n .potx\n .ppam\n .ppsx\n .ppsm\n .pptm\n .pptx\n .xltm\n .xltx\n .xlsb\n .xlsm\n .xlsx\n .dotx\n .dotm\n .docm\n .docb\n .docx\n .der\n .pfx\n .key\n .crt\n .csr\n .p12\n .pem\n .odt\n .ott\n .sxw\n .stw\n .uot\n .3ds\n .max\n .3dm\n .ods\n .ots\n .sxc\n .stc\n .dif\n .slk\n .wb2\n .odp\n .otp\n .sxd\n .std\n .uop\n .odg\n .otg\n .sxm\n .mml\n .lay\n .lay6","description_v2":["Found reference to a lot of file cls.extensions in file \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\" : .lay6",".sqlite3",".sqlitedb",".accdb",".java",".class",".mpeg",".djvu",".tiff",".jpeg",".backup",".vmdk",".sldm",".sldx",".onetoc2",".potm",".potx",".ppam",".ppsx",".ppsm",".pptm",".pptx",".xltm",".xltx",".xlsb",".xlsm",".xlsx",".dotx",".dotm",".docm",".docb",".docx",".der",".pfx",".key",".crt",".csr",".p12",".pem",".odt",".ott",".sxw",".stw",".uot",".3ds",".max",".3dm",".ods",".ots",".sxc",".stc",".dif",".slk",".wb2",".odp",".otp",".sxd",".std",".uop",".odg",".otg",".sxm",".mml",".lay",".lay6"],"description_v3":[{"type":"text","value":"Found reference to a lot of file cls.extensions in file \"00000000-00006996.00000000.281787.00810000.00000004.mdmp, 00000000-00006996.00000000.281787.1000C000.00000004.mdmp, 00000000-00006996.00000001.283709.00810000.00000004.mdmp, 00000000-00006996.00000001.283709.1000C000.00000004.mdmp, 00000000-00006996.00000002.285629.00810000.00000004.mdmp, 00000000-00006996.00000002.285629.1000C000.00000004.mdmp\" : .lay6"},{"type":"linebreak"},{"type":"text","value":".sqlite3"},{"type":"linebreak"},{"type":"text","value":".sqlitedb"},{"type":"linebreak"},{"type":"text","value":".accdb"},{"type":"linebreak"},{"type":"text","value":".java"},{"type":"linebreak"},{"type":"text","value":".class"},{"type":"linebreak"},{"type":"text","value":".mpeg"},{"type":"linebreak"},{"type":"text","value":".djvu"},{"type":"linebreak"},{"type":"text","value":".tiff"},{"type":"linebreak"},{"type":"text","value":".jpeg"},{"type":"linebreak"},{"type":"text","value":".backup"},{"type":"linebreak"},{"type":"text","value":".vmdk"},{"type":"linebreak"},{"type":"text","value":".sldm"},{"type":"linebreak"},{"type":"text","value":".sldx"},{"type":"linebreak"},{"type":"text","value":".onetoc2"},{"type":"linebreak"},{"type":"text","value":".potm"},{"type":"linebreak"},{"type":"text","value":".potx"},{"type":"linebreak"},{"type":"text","value":".ppam"},{"type":"linebreak"},{"type":"text","value":".ppsx"},{"type":"linebreak"},{"type":"text","value":".ppsm"},{"type":"linebreak"},{"type":"text","value":".pptm"},{"type":"linebreak"},{"type":"text","value":".pptx"},{"type":"linebreak"},{"type":"text","value":".xltm"},{"type":"linebreak"},{"type":"text","value":".xltx"},{"type":"linebreak"},{"type":"text","value":".xlsb"},{"type":"linebreak"},{"type":"text","value":".xlsm"},{"type":"linebreak"},{"type":"text","value":".xlsx"},{"type":"linebreak"},{"type":"text","value":".dotx"},{"type":"linebreak"},{"type":"text","value":".dotm"},{"type":"linebreak"},{"type":"text","value":".docm"},{"type":"linebreak"},{"type":"text","value":".docb"},{"type":"linebreak"},{"type":"text","value":".docx"},{"type":"linebreak"},{"type":"text","value":".der"},{"type":"linebreak"},{"type":"text","value":".pfx"},{"type":"linebreak"},{"type":"text","value":".key"},{"type":"linebreak"},{"type":"text","value":".crt"},{"type":"linebreak"},{"type":"text","value":".csr"},{"type":"linebreak"},{"type":"text","value":".p12"},{"type":"linebreak"},{"type":"text","value":".pem"},{"type":"linebreak"},{"type":"text","value":".odt"},{"type":"linebreak"},{"type":"text","value":".ott"},{"type":"linebreak"},{"type":"text","value":".sxw"},{"type":"linebreak"},{"type":"text","value":".stw"},{"type":"linebreak"},{"type":"text","value":".uot"},{"type":"linebreak"},{"type":"text","value":".3ds"},{"type":"linebreak"},{"type":"text","value":".max"},{"type":"linebreak"},{"type":"text","value":".3dm"},{"type":"linebreak"},{"type":"text","value":".ods"},{"type":"linebreak"},{"type":"text","value":".ots"},{"type":"linebreak"},{"type":"text","value":".sxc"},{"type":"linebreak"},{"type":"text","value":".stc"},{"type":"linebreak"},{"type":"text","value":".dif"},{"type":"linebreak"},{"type":"text","value":".slk"},{"type":"linebreak"},{"type":"text","value":".wb2"},{"type":"linebreak"},{"type":"text","value":".odp"},{"type":"linebreak"},{"type":"text","value":".otp"},{"type":"linebreak"},{"type":"text","value":".sxd"},{"type":"linebreak"},{"type":"text","value":".std"},{"type":"linebreak"},{"type":"text","value":".uop"},{"type":"linebreak"},{"type":"text","value":".odg"},{"type":"linebreak"},{"type":"text","value":".otg"},{"type":"linebreak"},{"type":"text","value":".sxm"},{"type":"linebreak"},{"type":"text","value":".mml"},{"type":"linebreak"},{"type":"text","value":".lay"},{"type":"linebreak"},{"type":"text","value":".lay6"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Ransomware/Banking","identifier":"string-13","type":2,"relevance":5,"name":"Detected indicator that file is ransomware","description":"$4b","description_v2":["\"Q: What's wrong with my files?A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting!Q: What do I do?A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named \"@WanaDecryptor@.exe\". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust?A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking on the decryptor window.\" (Source: @Please_Read_Me@.txt, Indicator: \"decrypt your files\")","\"Q: What's wrong with my files?A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting!Q: What do I do?A: First, you need to pay service fees for the decryption. Please send %s to this bitcoin address: %s Next, please find an application file named \"%s\". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust?A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking on the decryptor window.\" (Source: r.wnry, Indicator: \"decrypt your files\")","\"A: Ooops, your important files are encrypted. It means you will not be able to access them akw\" (Source: 00000000-00006996.00000000.281787.025B0000.00000004.mdmp, 00000000-00006996.00000001.283709.025B0000.00000004.mdmp, 00000000-00006996.00000002.285629.025B0000.00000004.mdmp, Indicator: \"files are encrypted\")"],"description_v3":[{"type":"text","value":"\"Q: What's wrong with my files?A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting!Q: What do I do?A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named \"@WanaDecryptor@.exe\". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust?A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking on the decryptor window.\" (Source: @Please_Read_Me@.txt, Indicator: \"decrypt your files\")"},{"type":"linebreak"},{"type":"text","value":"\"Q: What's wrong with my files?A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting!Q: What do I do?A: First, you need to pay service fees for the decryption. Please send %s to this bitcoin address: %s Next, please find an application file named \"%s\". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust?A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking on the decryptor window.\" (Source: r.wnry, Indicator: \"decrypt your files\")"},{"type":"linebreak"},{"type":"text","value":"\"A: Ooops, your important files are encrypted. It means you will not be able to access them akw\" (Source: 00000000-00006996.00000000.281787.025B0000.00000004.mdmp, 00000000-00006996.00000001.283709.025B0000.00000004.mdmp, 00000000-00006996.00000002.285629.025B0000.00000004.mdmp, Indicator: \"files are encrypted\")"}],"origin":"File/Memory","attck_id":"T1491.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1491/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"api-110","type":6,"relevance":10,"name":"Calls an API typically used to find and list the Windows drive types","description":"$4c","description_v2":["\"WannaCry.exe.sample.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00006996)","\"WannaCry.exe.sample.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006996)","\"taskdl.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00010448)","\"taskdl.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006384)","\"taskdl.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00010388)","\"taskdl.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00008900)","\"taskdl.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006140)","\"taskdl.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00006788)","\"taskdl.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006788)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetDriveTypeW\" with parameter %SAMPLEDIR%\\ (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006996)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetDriveTypeW\" with parameter %SAMPLEDIR%\\ (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00010448)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetDriveTypeW\" with parameter %SAMPLEDIR%\\ (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006384)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetDriveTypeW\" with parameter %SAMPLEDIR%\\ (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00010388)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetDriveTypeW\" with parameter %SAMPLEDIR%\\ (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00008900)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetDriveTypeW\" with parameter %SAMPLEDIR%\\ (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006140)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetDriveTypeW\" with parameter %SAMPLEDIR%\\ (UID: 00000000-00006788)"},{"type":"linebreak"},{"type":"text","value":"\"taskdl.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006788)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"string-126","type":2,"relevance":3,"name":"Found system commands related strings","description":"$4d","description_v2":["Found string \"names that happen to have a bypassed hostname as a suffix. Patch by Xiang\" (Indicator: \"hostname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"gethostbyname_ex() functions of the socket module now decode the hostname\" (Indicator: \"hostname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-35545: Fix asyncio discarding IPv6 scopes when ensuring hostname\" (Indicator: \"hostname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-32370: Use the correct encoding for ipconfig output in the uuid\" (Indicator: \"ipconfig\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"and X509_VERIFY_PARAM_set1_ip() API to verify hostname and IP addresses.\" (Indicator: \"hostname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"- bpo-23033: Wildcard is now supported in hostname when it is one and only\" (Indicator: \"hostname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")","Found string \"character in the left most segment of hostname in second argument of\" (Indicator: \"hostname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"names that happen to have a bypassed hostname as a suffix. Patch by Xiang\" (Indicator: \"hostname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"gethostbyname_ex() functions of the socket module now decode the hostname\" (Indicator: \"hostname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-35545: Fix asyncio discarding IPv6 scopes when ensuring hostname\" (Indicator: \"hostname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-32370: Use the correct encoding for ipconfig output in the uuid\" (Indicator: \"ipconfig\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"and X509_VERIFY_PARAM_set1_ip() API to verify hostname and IP addresses.\" (Indicator: \"hostname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"- bpo-23033: Wildcard is now supported in hostname when it is one and only\" (Indicator: \"hostname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"character in the left most segment of hostname in second argument of\" (Indicator: \"hostname\"; Source: \"00000000-00006996.00000002.285629.031B9000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Destruction","identifier":"api-25","type":6,"relevance":7,"name":"Opens file with deletion access rights","description":"$4e","description_v2":["\"WannaCry.exe.sample.exe\" opened \"C:\\00000000.res\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\%OSUSER%\\Desktop\\~SD28A0.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\%OSUSER%\\Documents\\~SD28A1.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\Default\\Desktop\\~SD28C1.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\Default User\\Desktop\\~SD2920.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\Default\\Desktop\\~SD2920.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\%OSUSER%\\Desktop\\~SD2940.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\Public\\Desktop\\~SD2941.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\Default\\Documents\\~SD2962.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\Default User\\Documents\\~SD2963.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\Default\\Documents\\~SD2963.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\%OSUSER%\\Documents\\~SD2964.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\Public\\Documents\\~SD2974.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\share\\$RECYCLE\\0.WNCRYT\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\~SD29A4.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\$Recycle.Bin\\~SD29A5.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\$Recycle.Bin\\S-1-5-18\\~SD29A6.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\$Recycle.Bin\\S-1-5-21-1271187874-1938232448-3812392235-1000\\~SD29A7.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\$Recycle.Bin\\S-1-5-21-1271187874-1938232448-3812392235-1001\\~SD29A8.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\$Recycle.Bin\\S-1-5-21-1271187874-1938232448-3812392235-1001\\$RZ5Y3SM\\~SD29B9.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\$Recycle.Bin\\S-1-5-21-1271187874-1938232448-3812392235-1001\\$RZ5Y3SM\\1.0\\~SD29BA.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\$Recycle.Bin\\S-1-5-21-1271187874-1938232448-3812392235-1001\\$RZ5Y3SM\\1.0\\Cache\\~SD29BB.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\$WinREAgent\\~SD29BC.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\$WinREAgent\\Scratch\\~SD29BD.tmp\" with delete access","\"WannaCry.exe.sample.exe\" opened \"C:\\Config.Msi\\~SD29CD.tmp\" with delete access"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\00000000.res\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"%USERPROFILE%\\Desktop\\~SD28A0.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\%USERNAME%\\Documents\\~SD28A1.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\%USERNAME%\\Desktop\\~SD28C1.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\%USERNAME%\\Desktop\\~SD2920.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\%USERNAME%\\Desktop\\~SD2920.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\%USERNAME%\\Desktop\\~SD2940.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\%USERNAME%\\Desktop\\~SD2941.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\%USERNAME%\\Documents\\~SD2962.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\%USERNAME%\\Documents\\~SD2963.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\%USERNAME%\\Documents\\~SD2963.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\%USERNAME%\\Documents\\~SD2964.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\Users\\%USERNAME%\\Documents\\~SD2974.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\share\\$RECYCLE\\0.WNCRYT\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\~SD29A4.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\$Recycle.Bin\\~SD29A5.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\$Recycle.Bin\\S-1-5-18\\~SD29A6.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\$Recycle.Bin\\S-1-5-21-1271187874-1938232448-3812392235-1000\\~SD29A7.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\$Recycle.Bin\\S-1-5-21-1271187874-1938232448-3812392235-1001\\~SD29A8.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\$Recycle.Bin\\S-1-5-21-1271187874-1938232448-3812392235-1001\\$RZ5Y3SM\\~SD29B9.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\$Recycle.Bin\\S-1-5-21-1271187874-1938232448-3812392235-1001\\$RZ5Y3SM\\1.0\\~SD29BA.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\$Recycle.Bin\\S-1-5-21-1271187874-1938232448-3812392235-1001\\$RZ5Y3SM\\1.0\\Cache\\~SD29BB.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\$WinREAgent\\~SD29BC.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\$WinREAgent\\Scratch\\~SD29BD.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" opened \"C:\\Config.Msi\\~SD29CD.tmp\" with delete access"}],"origin":"API Call","attck_id":"T1070.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-1","type":0,"relevance":1,"name":"Imports suspicious APIs","description":"CreateServiceA\n StartServiceA\n RegCreateKeyW\n RegCloseKey\n GetStartupInfoA\n LoadLibraryA\n GetModuleHandleA\n CreateProcessA\n WriteFile\n GetFileAttributesA\n CreateDirectoryA\n GetFileSizeEx\n CreateFileA\n GetProcAddress\n VirtualAlloc\n CopyFileA\n GetFileSize\n FindResourceA\n Sleep\n LockResource\n GetFileAttributesW\n TerminateProcess\n CreateDirectoryW\n GetComputerNameW\n VirtualProtect\n GetTempPathW\n GetModuleFileNameA\n FindFirstFileW\n FindNextFileW\n DeleteFileW\n GetDriveTypeW\n GetLogicalDrives\n GetUserNameA\n CreateThread\n DeleteFileA\n CopyFileW\n GetComputerNameA\n GetTempFileNameA\n FindNextFileA\n FindFirstFileA\n GetTickCount\n ShellExecuteExA\n ShellExecuteA\n FindWindowW\n WSAStartup\n connect\n bind\n socket\n send\n closesocket\n recv\n URLDownloadToFileA","description_v2":["CreateServiceA","StartServiceA","RegCreateKeyW","RegCloseKey","GetStartupInfoA","LoadLibraryA","GetModuleHandleA","CreateProcessA","WriteFile","GetFileAttributesA","CreateDirectoryA","GetFileSizeEx","CreateFileA","GetProcAddress","VirtualAlloc","CopyFileA","GetFileSize","FindResourceA","Sleep","LockResource","GetFileAttributesW","TerminateProcess","CreateDirectoryW","GetComputerNameW","VirtualProtect","GetTempPathW","GetModuleFileNameA","FindFirstFileW","FindNextFileW","DeleteFileW","GetDriveTypeW","GetLogicalDrives","GetUserNameA","CreateThread","DeleteFileA","CopyFileW","GetComputerNameA","GetTempFileNameA","FindNextFileA","FindFirstFileA","GetTickCount","ShellExecuteExA","ShellExecuteA","FindWindowW","WSAStartup","connect","bind","socket","send","closesocket","recv","URLDownloadToFileA"],"description_v3":[{"type":"text","value":"CreateServiceA"},{"type":"linebreak"},{"type":"text","value":"StartServiceA"},{"type":"linebreak"},{"type":"text","value":"RegCreateKeyW"},{"type":"linebreak"},{"type":"text","value":"RegCloseKey"},{"type":"linebreak"},{"type":"text","value":"GetStartupInfoA"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryA"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleA"},{"type":"linebreak"},{"type":"text","value":"CreateProcessA"},{"type":"linebreak"},{"type":"text","value":"WriteFile"},{"type":"linebreak"},{"type":"text","value":"GetFileAttributesA"},{"type":"linebreak"},{"type":"text","value":"CreateDirectoryA"},{"type":"linebreak"},{"type":"text","value":"GetFileSizeEx"},{"type":"linebreak"},{"type":"text","value":"CreateFileA"},{"type":"linebreak"},{"type":"text","value":"GetProcAddress"},{"type":"linebreak"},{"type":"text","value":"VirtualAlloc"},{"type":"linebreak"},{"type":"text","value":"CopyFileA"},{"type":"linebreak"},{"type":"text","value":"GetFileSize"},{"type":"linebreak"},{"type":"text","value":"FindResourceA"},{"type":"linebreak"},{"type":"text","value":"Sleep"},{"type":"linebreak"},{"type":"text","value":"LockResource"},{"type":"linebreak"},{"type":"text","value":"GetFileAttributesW"},{"type":"linebreak"},{"type":"text","value":"TerminateProcess"},{"type":"linebreak"},{"type":"text","value":"CreateDirectoryW"},{"type":"linebreak"},{"type":"text","value":"GetComputerNameW"},{"type":"linebreak"},{"type":"text","value":"VirtualProtect"},{"type":"linebreak"},{"type":"text","value":"GetTempPathW"},{"type":"linebreak"},{"type":"text","value":"GetModuleFileNameA"},{"type":"linebreak"},{"type":"text","value":"FindFirstFileW"},{"type":"linebreak"},{"type":"text","value":"FindNextFileW"},{"type":"linebreak"},{"type":"text","value":"DeleteFileW"},{"type":"linebreak"},{"type":"text","value":"GetDriveTypeW"},{"type":"linebreak"},{"type":"text","value":"GetLogicalDrives"},{"type":"linebreak"},{"type":"text","value":"GetUserNameA"},{"type":"linebreak"},{"type":"text","value":"CreateThread"},{"type":"linebreak"},{"type":"text","value":"DeleteFileA"},{"type":"linebreak"},{"type":"text","value":"CopyFileW"},{"type":"linebreak"},{"type":"text","value":"GetComputerNameA"},{"type":"linebreak"},{"type":"text","value":"GetTempFileNameA"},{"type":"linebreak"},{"type":"text","value":"FindNextFileA"},{"type":"linebreak"},{"type":"text","value":"FindFirstFileA"},{"type":"linebreak"},{"type":"text","value":"GetTickCount"},{"type":"linebreak"},{"type":"text","value":"ShellExecuteExA"},{"type":"linebreak"},{"type":"text","value":"ShellExecuteA"},{"type":"linebreak"},{"type":"text","value":"FindWindowW"},{"type":"linebreak"},{"type":"text","value":"WSAStartup"},{"type":"linebreak"},{"type":"text","value":"connect"},{"type":"linebreak"},{"type":"text","value":"bind"},{"type":"linebreak"},{"type":"text","value":"socket"},{"type":"linebreak"},{"type":"text","value":"send"},{"type":"linebreak"},{"type":"text","value":"closesocket"},{"type":"linebreak"},{"type":"text","value":"recv"},{"type":"linebreak"},{"type":"text","value":"URLDownloadToFileA"}],"origin":"Static Parser","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Anti-Detection/Stealthyness","identifier":"target-166","type":9,"relevance":3,"name":"Attempts to change the attributes of the files","description":"Process \"attrib.exe\" with commandline \"attrib +h .\" (UID: 00000000-00006392)\n Process \"attrib.exe\" with commandline \"attrib +h +s Z:\\\\$RECYCLE\" (UID: 00000000-00008152)","description_v2":["Process \"attrib.exe\" with commandline \"attrib +h .\" (UID: 00000000-00006392)","Process \"attrib.exe\" with commandline \"attrib +h +s Z:\\\\$RECYCLE\" (UID: 00000000-00008152)"],"description_v3":[{"type":"text","value":"Process \"attrib.exe\" with commandline \"attrib +h .\""},{"type":"process","process_uid":"00000000-00006392","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"attrib.exe\" with commandline \"attrib +h +s %SAMPLEDIR%\\\\$RECYCLE\""},{"type":"process","process_uid":"00000000-00008152","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1564.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/001","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"External Systems","identifier":"avtest-8","type":12,"relevance":10,"name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","description_v2":["CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)"],"description_v3":[{"type":"text","value":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Installation/Persistence","identifier":"api-0","type":6,"relevance":6,"name":"Writes data to a remote process","description":"$4f","description_v2":["\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\attrib.exe\" (Handle: 444)","\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\icacls.exe\" (Handle: 152)","\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 632)","\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\attrib.exe\" (Handle: 796)","\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 788)","\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 784)","\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 800)","\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 820)","\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 844)","\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 816)","\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 852)","\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 808)","\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 836)","\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 860)","\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 596)","\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 880)","\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 720)","\"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\cscript.exe\" (Handle: 480)"],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"%WINDIR%\\SysWOW64\\attrib.exe\" (Handle: 444)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\icacls.exe\" (Handle: 152)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 632)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\attrib.exe\" (Handle: 796)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 788)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 784)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 800)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 820)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 844)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 816)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 852)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 808)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 836)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 860)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 596)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 880)"},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" wrote 00000004 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 720)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\cscript.exe\" (Handle: 480)"}],"origin":"API Call","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Pattern Matching","identifier":"yara-0","type":13,"relevance":9,"name":"YARA signature match","description":"YARA signature \"WannCry_BAT\" classified process \"00000000-00006996\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth)\n YARA signature \"WannaDecryptor\" classified process \"00000000-00006996\" as \"ransomware,wcry,wannacry,wanacrypt0r\"\n YARA signature \"WanaCrypt0r\" classified process \"00000000-00006996\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Author: Leo Fernandes - iDefense)\n YARA signature \"WannaDecryptor\" classified file \"sample.bin\" as \"ransomware,wcry,wannacry,wanacrypt0r\"\n YARA signature \"WannaCry_RansomwareEx\" classified file \"sample.bin\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth (with the help of binar.ly))\n YARA signature \"win_wannacryptor_g0\" classified file \"u.wnry\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Author: Daniel Plohmann fkie.fraunhofer.de>)","description_v2":["YARA signature \"WannCry_BAT\" classified process \"00000000-00006996\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth)","YARA signature \"WannaDecryptor\" classified process \"00000000-00006996\" as \"ransomware,wcry,wannacry,wanacrypt0r\"","YARA signature \"WanaCrypt0r\" classified process \"00000000-00006996\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Author: Leo Fernandes - iDefense)","YARA signature \"WannaDecryptor\" classified file \"sample.bin\" as \"ransomware,wcry,wannacry,wanacrypt0r\"","YARA signature \"WannaCry_RansomwareEx\" classified file \"sample.bin\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth (with the help of binar.ly))","YARA signature \"win_wannacryptor_g0\" classified file \"u.wnry\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Author: Daniel Plohmann fkie.fraunhofer.de>)"],"description_v3":[{"type":"text","value":"YARA signature \"WannCry_BAT\" classified process \"00000000-00006996\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth)"},{"type":"linebreak"},{"type":"text","value":"YARA signature \"WannaDecryptor\" classified process \"00000000-00006996\" as \"ransomware,wcry,wannacry,wanacrypt0r\""},{"type":"linebreak"},{"type":"text","value":"YARA signature \"WanaCrypt0r\" classified process \"00000000-00006996\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Author: Leo Fernandes - iDefense)"},{"type":"linebreak"},{"type":"text","value":"YARA signature \"WannaDecryptor\" classified file \"sample.bin\" as \"ransomware,wcry,wannacry,wanacrypt0r\""},{"type":"linebreak"},{"type":"text","value":"YARA signature \"WannaCry_RansomwareEx\" classified file \"sample.bin\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth (with the help of binar.ly))"},{"type":"linebreak"},{"type":"text","value":"YARA signature \"win_wannacryptor_g0\" classified file \"u.wnry\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Author: Daniel Plohmann fkie.fraunhofer.de>)"}],"origin":"YARA Signature","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Spyware/Information Retrieval","identifier":"api-96","type":6,"relevance":10,"name":"Tries to steal browser sensitive information (file access)","description":"$50","description_v2":["\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\MamLog.txt\"","\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\EADPData Component\\4.0.3.0\\data.txt\"","\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Edge Wallet\\126.17756.17717.64\\driver-signature.txt\"","\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Edge Wallet\\126.17756.17717.64\\hub-signature.txt\"","\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Edge Wallet\\126.17756.17717.64\\vendor.bundle.js.LICENSE.txt\"","\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Edge Wallet\\126.17756.17717.64\\bnpl\\bnpl.bundle.js.LICENSE.txt\"","\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Edge Wallet\\126.17756.17717.64\\Notification\\notification.bundle.js.LICENSE.txt\"","\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Edge Wallet\\126.17756.17717.64\\Tokenized-Card\\tokenized-card.bundle.js.LICENSE.txt\"","\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Edge Wallet\\126.17756.17717.64\\Wallet-Checkout\\wallet-drawer.bundle.js.LICENSE.txt\""],"description_v3":[{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\MamLog.txt\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Edge\\User Data\\EADPData Component\\4.0.3.0\\data.txt\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Edge Wallet\\126.17756.17717.64\\driver-signature.txt\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Edge Wallet\\126.17756.17717.64\\hub-signature.txt\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Edge Wallet\\126.17756.17717.64\\vendor.bundle.js.LICENSE.txt\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Edge Wallet\\126.17756.17717.64\\bnpl\\bnpl.bundle.js.LICENSE.txt\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Edge Wallet\\126.17756.17717.64\\Notification\\notification.bundle.js.LICENSE.txt\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Edge Wallet\\126.17756.17717.64\\Tokenized-Card\\tokenized-card.bundle.js.LICENSE.txt\""},{"type":"linebreak"},{"type":"text","value":"\"WannaCry.exe.sample.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Edge Wallet\\126.17756.17717.64\\Wallet-Checkout\\wallet-drawer.bundle.js.LICENSE.txt\""}],"origin":"API Call","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"System Security","identifier":"target-12","type":9,"relevance":5,"name":"Modifies the access control lists of files","description":"Process \"icacls.exe\" with commandline \"icacls . /grant Everyone:F /T /C /Q\" (UID: 00000000-00001792)","description_v2":["Process \"icacls.exe\" with commandline \"icacls . /grant Everyone:F /T /C /Q\" (UID: 00000000-00001792)"],"description_v3":[{"type":"text","value":"Process \"icacls.exe\" with commandline \"icacls . /grant Everyone:F /T /C /Q\""},{"type":"process","process_uid":"00000000-00001792","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1222.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1222/001","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Unusual Characteristics","identifier":"target-14","type":9,"relevance":8,"name":"Spawns a lot of processes","description":"$51","description_v2":["Spawned process \"WannaCry.exe.sample.exe\" (UID: 00000000-00006996)","Spawned process \"attrib.exe\" with commandline \"attrib +h .\" (UID: 00000000-00006392)","Spawned process \"icacls.exe\" with commandline \"icacls . /grant Everyone:F /T /C /Q\" (UID: 00000000-00001792)","Spawned process \"taskdl.exe\" (UID: 00000000-00010448)","Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c 88831743893367.bat\" (UID: 00000000-00003516)","Spawned process \"attrib.exe\" with commandline \"attrib +h +s Z:\\\\$RECYCLE\" (UID: 00000000-00008152)","Spawned process \"cscript.exe\" with commandline \"//nologo m.vbs\" (UID: 00000000-00007424)","Spawned process \"taskdl.exe\" (UID: 00000000-00006384)","Spawned process \"taskdl.exe\" (UID: 00000000-00010388)","Spawned process \"taskdl.exe\" (UID: 00000000-00008900)","Spawned process \"taskdl.exe\" (UID: 00000000-00006140)","Spawned process \"taskdl.exe\" (UID: 00000000-00006788)","Spawned process \"taskdl.exe\" (UID: 00000000-00004736)","Spawned process \"taskdl.exe\" (UID: 00000000-00011212)","Spawned process \"taskdl.exe\" (UID: 00000000-00007860)","Spawned process \"taskdl.exe\" (UID: 00000000-00005772)","Spawned process \"taskdl.exe\" (UID: 00000000-00009656)","Spawned process \"taskdl.exe\" (UID: 00000000-00010244)","Spawned process \"taskdl.exe\" (UID: 00000000-00007952)","Spawned process \"taskdl.exe\" (UID: 00000000-00008044)","Spawned process \"taskdl.exe\" (UID: 00000000-00005012)","Spawned process \"taskdl.exe\" (UID: 00000000-00002220)","Spawned process \"taskdl.exe\" (UID: 00000000-00011032)","Spawned process \"taskdl.exe\" (UID: 00000000-00005976)","Spawned process \"taskdl.exe\" (UID: 00000000-00010452)","Spawned process \"taskdl.exe\" (UID: 00000000-00009608)","Spawned process \"taskdl.exe\" (UID: 00000000-00002224)","Spawned process \"taskdl.exe\" (UID: 00000000-00002564)","Spawned process \"taskdl.exe\" (UID: 00000000-00004780)","Spawned process \"taskdl.exe\" (UID: 00000000-00009020)","Spawned process \"taskdl.exe\" (UID: 00000000-00010252)","Spawned process \"taskdl.exe\" (UID: 00000000-00005096)"],"description_v3":[{"type":"text","value":"Spawned process \"WannaCry.exe.sample.exe\""},{"type":"process","process_uid":"00000000-00006996","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"attrib.exe\" with commandline \"attrib +h .\""},{"type":"process","process_uid":"00000000-00006392","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"icacls.exe\" with commandline \"icacls . /grant Everyone:F /T /C /Q\""},{"type":"process","process_uid":"00000000-00001792","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00010448","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c 88831743893367.bat\""},{"type":"process","process_uid":"00000000-00003516","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"attrib.exe\" with commandline \"attrib +h +s %SAMPLEDIR%\\\\$RECYCLE\""},{"type":"process","process_uid":"00000000-00008152","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cscript.exe\" with commandline \"//nologo m.vbs\""},{"type":"process","process_uid":"00000000-00007424","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00006384","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00010388","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00008900","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00006140","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00006788","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00004736","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00011212","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00007860","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00005772","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00009656","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00010244","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00007952","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00008044","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00005012","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00002220","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00011032","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00005976","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00010452","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00009608","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00002224","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00002564","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00004780","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00009020","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00010252","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"taskdl.exe\""},{"type":"process","process_uid":"00000000-00005096","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null}],"detonation_parameters":{"action_script":"default_maxantievasion","experimental_anti_evasion":true,"script_logging":true,"allow_sample_tampering":true,"network_mode":"default","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":142,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default_maxantievasion.au3","monitor_script_description":"Heavy Anti-Evasion","windows_version_name":"Windows 11","windows_version_edition":"Professional","windows_version_service_pack":null,"windows_version_version":"10.0 (build 22621)","windows_version_bitness":"64","custom_date_time":null,"sandbox_version":"12.1.1","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[{"name":"Ransomware","details":["Detected indicator that file is ransomware"]},{"name":"Spyware","details":["Found a string that may be used as part of an injection method","Tries to steal browser sensitive information (file access)"]},{"name":"Persistence","details":["Writes data to a remote process","Spawns a lot of processes","Grants permissions using icacls (DACL modification)"]},{"name":"Fingerprint","details":["Queries process information"]},{"name":"Evasive","details":["Possibly tries to evade analysis by sleeping many times","Possibly tries to implement anti-virtualization techniques using MAC address detection","Input file contains API references not part of its Import Address Table (IAT)"]}],"icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC","visualization":"$52","classification":["37.8% (.EXE) Win32 Executable MS Visual C++ (generic)","20.0% (.EXE) Microsoft Visual C++ compiled executable (generic)","12.7% (.EXE) Win64 Executable (generic)","7.9% (.DLL) Win32 Dynamic Link Library (generic)","6.1% (.EXE) Win16 NE executable (generic)"],"dns_requests":[],"contacted_hosts":[],"contacted_countries":{"countries":[],"coordinates":[]},"port_infos":[],"extracted_strings":{"all":[{"value":"IS5Nclh4XVoy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"IWt1WTInR1A6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"$53","type":"Ansi","source":"File String Dumps","process":null,"filename":"u.wnry","compromised":null,"detection_total":null,"total":null},{"value":"$54","type":"Ansi","source":"File String Dumps","process":null,"filename":"taskse.exe","compromised":null,"detection_total":null,"total":null},{"value":"$55","type":"Ansi","source":"File String Dumps","process":null,"filename":"taskdl.exe","compromised":null,"detection_total":null,"total":null},{"value":"IlIwbF9BVF1L","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"InQ9LnxWYnEt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"InZjb3siT3lj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Inkpcj91VGk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"I2NNZSYoO1tJcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"I2kuKivDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JC8lVDUzeGNi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"JDgsNC02Jzk2JDouPyoxI0hwWGhBflNlWmxOclNiRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"JEBeIFkra0NNMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"JFwpe0NmMHZs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"JGBHblArJTxn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"JEZ1bmN0aW9u","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JSJpbWU2P3g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"JSlVd25vKjk5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNvbXB1dGVyIiU=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBVQkxJQyVcRGVza3RvcFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBVQkxJQyVcRG9jdW1lbnRzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBVQkxJQyVcRG9jdW1lbnRzXE15IE11c2ljXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBVQkxJQyVcRG9jdW1lbnRzXE15IFBpY3R1cmVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBVQkxJQyVcRG9jdW1lbnRzXE15IFZpZGVvc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JXNcSW50ZWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"JXNcUHJvZ3JhbURhdGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXCouV05DUllU","type":"Unicode","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxEZXNrdG9wXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxEb2N1bWVudHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxEb2N1bWVudHNcTXkgTXVzaWNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxEb2N1bWVudHNcTXkgUGljdHVyZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxEb2N1bWVudHNcTXkgVmlkZW9zXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcYWR2YXBpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcY21kLmV4ZSAvYyA4ODgzMTc0Mzg5MzM2Ny5iYXQ=","type":"Ansi","source":"Process Commandline","process":"cmd.exe","filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcY3NjcmlwdC5leGU=","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcdmVyc2lvbi5kbGw=","type":"Unicode","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JiZMajY2bFo/P35B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"JkxqJjZsWjY/fkE/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Jk1JRUVQIypHZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"JyE9ZkU/U1Rc","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"JyIndCRXZWpY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"JzRfaihCe1U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"KSwmKFRbSDF0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"KUZEfnA1UGdQbHs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"KXFJVzgsYH4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"KmcuUk8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"K2tBJFB3Pm0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"K25XXSRKcEE3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"LDQkOCc5LTY6LjYkMSM/KlhoSHBTZUF+TnJabEU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"LE1GM2o7MkA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"LSB1bnppcCAwLjE1IENvcHlyaWdodCAxOTk4IEdpbGxlcyBWb2xsYW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"LSNQQmBGJC1WJjI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmV4Y2VwdGlvbkBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnR5cGVfaW5mb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"LnNxbGl0ZTM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"LnNxbGl0ZWRi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Ly9ub2xvZ28gbS52YnM=","type":"Ansi","source":"Process Commandline","process":"cscript.exe","filename":"cscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"L156b1M0KlE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"L0M6XEBXQU5BRH4xLkVYRUM6XEBXYW5hRGVjcnlwdG9yQC5leGVkNzl6bnJnZmZkZGRlNmsxU1BTfE8pRHY8IC11Vg==","type":"Ansi","source":"File String Dumps","process":null,"filename":"@WanaDecryptor@.exe.lnk","compromised":null,"detection_total":null,"total":null},{"value":"L0lYaDo7eFU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"L1ond2VNZls=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"L8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDVmOTVlZmUtN2Y3NS00OWM3LWE5OTQtNjBhNTVjYzA5NTcx","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MD19cjliaFo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"MD5SMzZqPzxG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"MGJjYTQ3ODQtODI1Ny01MWEwLWQ5ZWMtMjRmZTFmZTRjOTBk","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MHkvLHt9PGgsNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"MHxDdFDDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MTE1cDdVTU1uZ29qMXBNdmtwSGlqY1JkZkpOWGo2THJMbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"MTJ0OVlEUGd3dWVaOU55TWd3NTE5cDdBQThpc2pyNlNNdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"MTNBTTRWVzJkaHhZZ1hlUWVwb0hrSFNRdXk2TmdhRWI5NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"MTg2MDhlNjItYTYyOC00OWQ5LThjMDItNTU5NzJlMDk3ZDI0","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MTktdVN2OSpY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"MWFmZjYwODktZTg2My00ZDM2LWJkZmQtMzU4MWYwNzQ0MGJl","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MWFVSUhNKGY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"MUU3Kls2KDQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"MUkoTi/Dr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MX1tJXt0JmNZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"MisoIFZQT0w=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Mi9PLV8uWDh3Lis=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"MjhkY2MyOGItM2UzMS01MjdiLWVmZDYtYjRjYzRkNzNkMTU3","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MmZyUDVUUWA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"MnswT05VVDg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"MyF4Nmh8ZiU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"MylkSyN8RTs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"MzAzMzZlZDQtZTMyNy00NDdjLTlkZTAtNTFiNjUyYzg2MTA4","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzI5ODBmMjYtYzhmNS01NzY3LTZiMjYtNjM1YjNmYTgzYzYx","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2M3NGFmYjktOGQ4Mi00NGUzLWI1MmMtMzY1ZGJmNDgzODJh","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M0owWCZnS1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"NCQ4LDktNicuNiQ6Iz8qMWhIcFhlQX5TclpsTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"NDk2YjNjMTktOWRjYS01MWE1LTE4N2MtNWM3NDY3ODVmZTRl","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NGU3YWRkMWEtNjk0NS00MzVhLTgyYjYtNjEyNjg4YmE5ZjU3","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTdhNmVkMWEtNzlmNy01MDExLWIyNDItNDc4NGU1NjIwY2Y3","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NWViNjBiMzYtNjIwNi01NTM4LWU2MGEtMGE3YWY4YTFlNTlk","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ni4xLjc2MDEuMTc1MTQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Ni4xLjc2MDEuMTc1MTQgKHdpbjdzcDFfcnRtLjEwMTExOS0xODUwKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"NjczY2Y4MDAtMjA4YS01MzI3LTNmNGItMmJlNDRhNjY2Mjdh","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NmNhNTJhOTAtNDJhMC01ODA4LWViYmYtYTE3OWMyYTM4ZjMz","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NlA+WUteJHI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"NyZ8XiJPVXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"NzAzZmNjMTMtYjY2Zi01ODY4LWRkZDktZTJkYjdmMzgxZmZi","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"N2EwMWU3ZmItYjZhNC00NTg1LWIxYTgtZWEyMDk0ZWNiNGM1","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"N25hZXN1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"OCw0JDYnOS0kOi42KjEjP3BYaEh+U2VBbE5yWmJF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"OCxaUnojdEg9OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ODU4MGZhNTktZDhkNy00MDMwLWJhNmItMDZhMTQ2Y2M3Mjc0","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ODg4MzE3NDM4OTMzNjcuYmF0","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ODx0alZcQEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"OEAwOid9WH5B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"OGNjY2EyN2QtZjFkOC00ZGRhLWI1ZGQtMzM5YWVlOTM3NzMx","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OS9mN29pW1A=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"OWEyZWRiOGYtNTg4My00OTlmLWFjZWQtNmU0YjY5ZDQzZGRm","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OVpDV0cgRTY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"OjJqJUc8fGky","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"OzIyZFY6OnRO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"O0BBL29halg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"O04tLjJzIkc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"O3FYc2FodGs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"O3U+SDRxNy5j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"PCBITUI9XSk1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"PC5xblQjJVI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"PEJgSUhSZDU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"PE5IMEV0dWE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"PTFhelQpOF55","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"PWlGLXM0InQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"PWomJkxaNjZsQT8/fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"PW5bKHB7QnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"PU5NO1NdVjJu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"PVhuRlEtSWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"PkxZRkp1XiRSTw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Pm51R2w9Q21lNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Pn5AZipeWyplRSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"PyF9bFZHQkY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"PzlRM2VueX0w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRQUVAQUJRQkRAWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRQUVAQUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQFFBRUBYWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xZXhjZXB0aW9uQEBVQUVAWFo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xdHlwZV9pbmZvQEBVQUVAWFo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Pz8yQFlBUEFYSUBa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Pz8zQFlBWFBBWEBa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P19DQD8xPz9fTnVsbHN0ckA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAQ0FQQkdYWkA0R0I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P19Fb3NAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQEFBRVhJQFo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P19Hcm93QD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEBBQUVfTklfTkBa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P19TcGxpdEA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAQUFFWFha","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P19UaWR5QD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEBBQUVYX05AWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P19YbGVuQHN0ZEBAWUFYWFo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P19YcmFuQHN0ZEBAWUFYWFo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P2Fzc2lnbkA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAUUFFQUFWMTJAQUJWMTJASUlAWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P2Fzc2lnbkA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAUUFFQUFWMTJAUEJHSUBa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P25wb3NAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQDJJQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P1dvYUgnW0A=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"QGVjaG8gb2ZmZWNobyBTRVQgb3cgPSBXU2NyaXB0LkNyZWF0ZU9iamVjdCgiV1NjcmlwdC5TaGVsbCIpPiBtLnZic2VjaG8gU0VUIG9tID0gb3cuQ3JlYXRlU2hvcnRjdXQoIkM6XEBXYW5hRGVjcnlwdG9yQC5leGUubG5rIik+PiBtLnZic2VjaG8gb20uVGFyZ2V0UGF0aCA9ICJDOlxAV2FuYURlY3J5cHRvckAuZXhlIj4+IG0udmJzZWNobyBvbS5TYXZlPj4gbS52YnNjc2NyaXB0LmV4ZSAvL25vbG9nbyBtLnZic2RlbCBtLnZic2RlbCAvYSAlMA==","type":"Ansi","source":"File String Dumps","process":null,"filename":"88831743893367.bat","compromised":null,"detection_total":null,"total":null},{"value":"QFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QFdhbmFEZWNyeXB0b3JALmV4ZSBmaQ==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"WzE1ViF0Qlta","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"W2hGL2k2Z3BO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"XD8/XEM6XHRlbXBkaXJcbm9kZV9tb2R1bGVzXEBwbTJcYWdlbnRcbm9kZV9tb2R1bGVzXGV2ZW50ZW1pdHRlcjJcTElDRU5TRS50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcV2luZG93c1xTeXN0ZW0zMlxjb25ob3N0LmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcV2luZG93c1xTeXNXT1c2NFxjbWQuZXhl","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcV2luZG93c1xTeXNXT1c2NFxjc2NyaXB0LmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFBJUEVcc3J2c3Zj","type":"Unicode","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XSV6cERJaWI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"XTwiMUI6Z3o9X2k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"XWlIfE9WIl1uNX4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"XVBDKHIodCl0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"XnR6UEwjaTI7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Xy1UUHNQVXY6IFY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X19DeHhGcmFtZUhhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X19kbGxvbmV4aXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X19nZXRtYWluYXJncw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19fYXJnYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19fYXJndg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19jb21tb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19mbW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXRfYXBwX3R5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXR1c2VybWF0aGVycg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X19XU0FGRElzU2V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X2FkanVzdF9mZGl2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X2NvbnRyb2xmcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X0N4eFRocm93RXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X2V4Y2VwdF9oYW5kbGVyMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X2luaXR0ZXJt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X2xvY2FsX3Vud2luZDI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X3BHV0tsREk3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X3B1cmVjYWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X3NldG1iY3A=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X3N0cmljbXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X3N0cm5pY21w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X1RyYWNrTW91c2VFdmVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X3djc25pY21w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X1hjcHRGaWx0ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YCpya207OSw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YFszfUpsWFc0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YGk0P1Fvd3w=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YFV2MUowb1pbTXFJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YSF6XjM/w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YSN5d30zI2VVcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YTMwNjRmYzktNGQyMi01NGM5LTAwMDMtMWY5MDU5NDU1NGQz","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YTQwYjQ1NWMtMjUzYy00MzExLWFjNmQtNmU2NjdlZGNjZWZj","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVBdFN0b3JhZ2U=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVPbkhvc3RGbGFncw==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QURWQVBJMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YWR2YXBpMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"QWdncmVzc2l2ZU1UQVRlc3Rpbmc=","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YUpgM3BVLHs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb2NhdGVBbmRJbml0aWFsaXplU2lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dEZXZlbG9wbWVudFdpdGhvdXREZXZMaWNlbnNl","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dGaWxlQ0xTSURKdW5jdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJuYXRlQ29kZVBhZ2U=","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaUluaXRpYWxpemU=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaVNjYW5TdHJpbmc=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaVVuaW5pdGlhbGl6ZQ==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW5vbnltb3VzQXBwQ29udGFpbmVySW1wZXJzb25hdGlvbkxldmVsQ2hlY2s=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXByb2Nlc3N0aHJlYWRzLWwxLTEtMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwSURGbGFncw==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwc1VzZUxpZ2h0VGhlbWU=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXJlRmlsZUFwaXNBTlNJ","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXR0cmliICtoICtzICVTQU1QTEVESVIlXCRSRUNZQ0xF","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXR0cmliICtoIC4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlcw==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlc18zNjM1NDQ4OQ==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRpb25MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljb2RlRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXZvaWRLbm93bkZvbGRlckNhY2hpbmc=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXguaUQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YXoofFdZQDU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Yi53bnJ5UDg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YjQoWDI7ZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YjZmZDcxMGItZjc4My00YjFjLWFiOWMtYzY4MDk5ZGNjMGM3","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Yjc0OTU1M2ItZDk1MC01ZTAzLTYyODItMzE0NWE2MWIxMDAy","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Yj1odFpvJmY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YkI2WXwydk4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YmYzMDQ2NWItZTkzYy00NmZkLTljZGYtZjQxYzg5MDRhMDFm","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Qml0Qmx0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YkojXU9dOUUl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YnFKIFpweG4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"QnFaPShKalE6Y1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"QnJpbmdXaW5kb3dUb1RvcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YnVmZmVyIGVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"QlYwaWAoeFQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"QlcyPmBxa3s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YzEzNzYzMzgtMDk4NC00OGI4LWI5MzMtOWM3ZDc3OWZkODRk","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzJ4TmxiKHo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YzdlMDllMmEtYzY2My01Mzk5LWFmNzktMmZjY2QzMjFkMTlh","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzlYUUoyVV8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFJlY3ljbGUuQmluXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFJlY3ljbGUuQmluXFMtMS01LTE4XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFJlY3ljbGUuQmluXFMtMS01LTIxLTEyNzExODc4NzQtMTkzODIzMjQ0OC0zODEyMzkyMjM1LTEwMDBcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFJlY3ljbGUuQmluXFMtMS01LTIxLTEyNzExODc4NzQtMTkzODIzMjQ0OC0zODEyMzkyMjM1LTEwMDFcJFJaNVkzU01cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFJlY3ljbGUuQmluXFMtMS01LTIxLTEyNzExODc4NzQtMTkzODIzMjQ0OC0zODEyMzkyMjM1LTEwMDFcJFJaNVkzU01cMS4wXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFJlY3ljbGUuQmluXFMtMS01LTIxLTEyNzExODc4NzQtMTkzODIzMjQ0OC0zODEyMzkyMjM1LTEwMDFcJFJaNVkzU01cMS4wXENhY2hlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFJlY3ljbGUuQmluXFMtMS01LTIxLTEyNzExODc4NzQtMTkzODIzMjQ0OC0zODEyMzkyMjM1LTEwMDFcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFdpblJFQWdlbnRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFdpblJFQWdlbnRcU2NyYXRjaFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcQ29uZmlnLk1zaVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcRG9jdW1lbnRzIGFuZCBTZXR0aW5nc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDExLTAwMDAtMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDExLTAwMDAtMTAwMC0wMDAwMDAwRkYxQ0V9LUNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDExLTAwMDAtMTAwMC0wMDAwMDAwRkYxQ0V9LUNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDE2LTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDE4LTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDE5LTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDFBLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDFCLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDJDLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDJDLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcUHJvb2YuZW5cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDJDLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcUHJvb2YuZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDJDLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcUHJvb2YuZnJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDQzLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDQ0LTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMEExLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMEJBLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMTE1LTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMTE1LTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcMTAzM1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMTE3LTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMTE3LTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcQWNjZXNzLmVuLXVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcUGVyZkxvZ3NcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcUmVjb3ZlcnlcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcU3lzdGVtIFZvbHVtZSBJbmZvcm1hdGlvblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcLmJpblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcLmJpblxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcLmJpblxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcZXhhbXBsZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcZXhhbXBsZXNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcZXhhbXBsZXNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcbGliXGN1c3RvbVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcbGliXG1hcHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcbGliXHN5c3RlbVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcdGhlbWVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcdGhlbWVzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcdGhlbWVzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQG1vbmdvZGItanNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQG1vbmdvZGItanNcc2FzbHByZXBcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQG1vbmdvZGItanNcc2FzbHByZXBcZGlzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQG1vbmdvZGItanNcc2FzbHByZXBcZGlzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQG1vbmdvZGItanNcc2FzbHByZXBcZGlzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFwudnNjb2RlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcLmJpblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcY2hhbGtcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcY2hhbGtcc291cmNlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXGxvY2FsZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxhZHZhbmNlZEZvcm1hdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxiYWRNdXRhYmxlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxidWRkaGlzdEVyYVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxjYWxlbmRhclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxjdXN0b21QYXJzZUZvcm1hdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxkYXlPZlllYXJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxkdXJhdGlvblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc0JldHdlZW5cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc0xlYXBZZWFyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc01vbWVudFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc29XZWVrXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc29XZWVrc0luWWVhclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc1NhbWVPckFmdGVyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc1NhbWVPckJlZm9yZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc1RvZGF5XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc1RvbW9ycm93XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc1llc3RlcmRheVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxsb2NhbGVEYXRhXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxsb2NhbGl6ZWRGb3JtYXRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxtaW5NYXhcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxvYmplY3RTdXBwb3J0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxwbHVyYWxHZXRTZXRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxxdWFydGVyT2ZZZWFyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxyZWxhdGl2ZVRpbWVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblx0aW1lem9uZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblx0b0FycmF5XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblx0b09iamVjdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblx1cGRhdGVMb2NhbGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblx1dGNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblx3ZWVrZGF5XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblx3ZWVrT2ZZZWFyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblx3ZWVrWWVhclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNcbG9jYWxlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGF5anNccGx1Z2luXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGVidWdcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZGVidWdcc3JjXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZXZlbnRlbWl0dGVyMlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcZXZlbnRlbWl0dGVyMlxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcbHJ1LWNhY2hlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcbXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcc2VtdmVyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcc2VtdmVyXGJpblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcc2VtdmVyXGNsYXNzZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcc2VtdmVyXGZ1bmN0aW9uc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcc2VtdmVyXGludGVybmFsXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcc2VtdmVyXHJhbmdlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcd3NcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxub2RlX21vZHVsZXNcd3NcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxzcmNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxzcmNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxzcmNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxzcmNccHVzaFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxzcmNccmV2ZXJzZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxzcmNcdHJhbnNwb3J0ZXJzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxzcmNcdXRpbHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxhZ2VudFxzcmNcdXRpbHNccHJvYmVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1wudnNjb2RlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xidWlsZFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xidWlsZFxtYWluXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xidWlsZFxtYWluXGZlYXR1cmVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xidWlsZFxtYWluXG1ldHJpY3NcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xidWlsZFxtYWluXHByb2ZpbGVyc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xidWlsZFxtYWluXHNlcnZpY2VzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xidWlsZFxtYWluXHRyYW5zcG9ydHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xidWlsZFxtYWluXHV0aWxzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xidWlsZFxtYWluXHV0aWxzXG1ldHJpY3NcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xkb2NzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcLmJpblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcYXN5bmNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcYXN5bmNcZGlzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcYXN5bmNcaW50ZXJuYWxcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcZGVidWdcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcZGVidWdcc3JjXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcZXZlbnRlbWl0dGVyMlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcZXZlbnRlbWl0dGVyMlxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcbHJ1LWNhY2hlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcbXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcc2VtdmVyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcc2VtdmVyXGJpblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcc2VtdmVyXGNsYXNzZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcc2VtdmVyXGZ1bmN0aW9uc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcc2VtdmVyXGludGVybmFsXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xub2RlX21vZHVsZXNcc2VtdmVyXHJhbmdlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xwcmVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xwcmVzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxpb1xwcmVzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcZGlzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcZGlzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcZGlzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcbm9kZV9tb2R1bGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcbm9kZV9tb2R1bGVzXGFzeW5jXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcbm9kZV9tb2R1bGVzXGFzeW5jXGRpc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcbm9kZV9tb2R1bGVzXGFzeW5jXGludGVybmFsXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcbm9kZV9tb2R1bGVzXGRlYnVnXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcbm9kZV9tb2R1bGVzXGRlYnVnXHNyY1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcbm9kZV9tb2R1bGVzXGV2ZW50ZW1pdHRlcjJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcbm9kZV9tb2R1bGVzXGV2ZW50ZW1pdHRlcjJcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcbm9kZV9tb2R1bGVzXG1zXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcbm9kZV9tb2R1bGVzXHdzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcbm9kZV9tb2R1bGVzXHdzXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcc3JjXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcc3JjXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcc3JjXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcc3JjXGF1dGhfc3RyYXRlZ2llc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxqcy1hcGlcc3JjXHV0aWxzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxwbTItdmVyc2lvbi1jaGVja1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxwbTItdmVyc2lvbi1jaGVja1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxwbTItdmVyc2lvbi1jaGVja1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxwbTItdmVyc2lvbi1jaGVja1xub2RlX21vZHVsZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxwbTItdmVyc2lvbi1jaGVja1xub2RlX21vZHVsZXNcZGVidWdcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxwbTItdmVyc2lvbi1jaGVja1xub2RlX21vZHVsZXNcZGVidWdcc3JjXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHBtMlxwbTItdmVyc2lvbi1jaGVja1xub2RlX21vZHVsZXNcbXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHNvY2tldC5pb1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHNvY2tldC5pb1xjb21wb25lbnQtZW1pdHRlclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHNvY2tldC5pb1xjb21wb25lbnQtZW1pdHRlclxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHNvY2tldC5pb1xjb21wb25lbnQtZW1pdHRlclxsaWJcY2pzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHNvY2tldC5pb1xjb21wb25lbnQtZW1pdHRlclxsaWJcZXNtXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHRvb3RhbGxuYXRlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHRvb3RhbGxuYXRlXHF1aWNranMtZW1zY3JpcHRlblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHRvb3RhbGxuYXRlXHF1aWNranMtZW1zY3JpcHRlblxjXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHRvb3RhbGxuYXRlXHF1aWNranMtZW1zY3JpcHRlblxjXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHRvb3RhbGxuYXRlXHF1aWNranMtZW1zY3JpcHRlblxjXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHRvb3RhbGxuYXRlXHF1aWNranMtZW1zY3JpcHRlblxkaXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHRvb3RhbGxuYXRlXHF1aWNranMtZW1zY3JpcHRlblxkaXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHRvb3RhbGxuYXRlXHF1aWNranMtZW1zY3JpcHRlblxkaXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHRvb3RhbGxuYXRlXHF1aWNranMtZW1zY3JpcHRlblxkaXN0XGdlbmVyYXRlZFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHR5cGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHR5cGVzXGNvb2tpZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHR5cGVzXGNvcnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHR5cGVzXG5vZGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHR5cGVzXG5vZGVcYXNzZXJ0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHR5cGVzXG5vZGVcZG5zXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHR5cGVzXG5vZGVcZnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHR5cGVzXG5vZGVccmVhZGxpbmVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHR5cGVzXG5vZGVcc3RyZWFtXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHR5cGVzXG5vZGVcdGltZXJzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHR5cGVzXHdlYmlkbC1jb252ZXJzaW9uc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHR5cGVzXHdoYXR3Zy11cmxcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQHR5cGVzXHdoYXR3Zy11cmxcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYWJicmV2XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYWJicmV2XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYWJicmV2XEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYWNjZXB0c1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYWNjZXB0c1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYWNjZXB0c1xAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYWdlbnQtYmFzZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYWdlbnQtYmFzZVxkaXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYWdlbnQtYmFzZVxkaXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYWdlbnQtYmFzZVxkaXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYWdlbnQtYmFzZVxub2RlX21vZHVsZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYWdlbnQtYmFzZVxub2RlX21vZHVsZXNcZGVidWdcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYWdlbnQtYmFzZVxub2RlX21vZHVsZXNcZGVidWdcc3JjXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYWdlbnQtYmFzZVxub2RlX21vZHVsZXNcbXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYWdlbnQtYmFzZVxub2RlX21vZHVsZXNcbXNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYWdlbnQtYmFzZVxub2RlX21vZHVsZXNcbXNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW1wLW1lc3NhZ2VcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW1wLW1lc3NhZ2VcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW1wLW1lc3NhZ2VcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW1wXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW1wXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW1wXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW1wXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW1wXGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW1wXGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW5zaS1jb2xvcnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW5zaS1jb2xvcnNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW5zaS1jb2xvcnNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW5zaS1jb2xvcnNcdHlwZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW5zaS1yZWdleFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW5zaS1yZWdleFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW5zaS1yZWdleFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW5zaS1zdHlsZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW5zaS1zdHlsZXNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW5zaS1zdHlsZXNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW55bWF0Y2hcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW55bWF0Y2hcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYW55bWF0Y2hcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcbGliXGFjdGlvblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcbGliXGFjdGlvblxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcbGliXGFjdGlvblxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcbGliXGFjdGlvblxhcHBlbmRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcbGliXGFjdGlvblxzdG9yZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcbGliXGFyZ3VtZW50XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcbGliXGFyZ3VtZW50XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcbGliXGFyZ3VtZW50XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcbGliXGhlbHBcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcbGliXGhlbHBcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJncGFyc2VcbGliXGhlbHBcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJyYXktZWFjaFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJyYXktZWFjaFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJyYXktZWFjaFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJyYXktZmxhdHRlblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJyYXktZmxhdHRlblxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJyYXktZmxhdHRlblxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJyYXktc2xpY2VcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJyYXktc2xpY2VcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXJyYXktc2xpY2VcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXC5naXRodWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXC5naXRodWJcd29ya2Zsb3dzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXGRlZlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXGRlZlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXGRlZlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXGdlblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXGdlblxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXGdlblxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXG5vZGVfbW9kdWxlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXG5vZGVfbW9kdWxlc1x0c2xpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXG5vZGVfbW9kdWxlc1x0c2xpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXG5vZGVfbW9kdWxlc1x0c2xpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN0LXR5cGVzXG5vZGVfbW9kdWxlc1x0c2xpYlxtb2R1bGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN5bmNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN5bmNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN5bmNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN5bmNcZGlzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN5bmNcZGlzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN5bmNcZGlzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN5bmNcaW50ZXJuYWxcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN5bmNcaW50ZXJuYWxcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN5bmNcaW50ZXJuYWxcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN5bmNraXRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN5bmNraXRcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN5bmNraXRcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN5bmNraXRcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN5bmNraXRcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXN5bmNraXRcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcZGlzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcZGlzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcZGlzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcZGlzdFxicm93c2VyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcZGlzdFxlc21cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcZGlzdFxlc21cQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcZGlzdFxlc21cQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcZGlzdFxub2RlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGFkYXB0ZXJzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGFkYXB0ZXJzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGFkYXB0ZXJzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGNhbmNlbFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGNhbmNlbFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGNhbmNlbFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGNvcmVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGNvcmVcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGNvcmVcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGRlZmF1bHRzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGRlZmF1bHRzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGRlZmF1bHRzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGVudlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGVudlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGVudlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGVudlxjbGFzc2VzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGhlbHBlcnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGhlbHBlcnNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXGhlbHBlcnNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXHBsYXRmb3JtXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXHBsYXRmb3JtXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXHBsYXRmb3JtXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXHBsYXRmb3JtXGJyb3dzZXJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXHBsYXRmb3JtXGJyb3dzZXJcY2xhc3Nlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXHBsYXRmb3JtXGNvbW1vblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXHBsYXRmb3JtXG5vZGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYXhpb3NcbGliXHBsYXRmb3JtXG5vZGVcY2xhc3Nlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFiZWxcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFiZWxcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFiZWxcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFiZWxcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFiZWxcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFiZWxcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFsYW5jZWQtbWF0Y2hcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFsYW5jZWQtbWF0Y2hcLmdpdGh1Ylwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFsYW5jZWQtbWF0Y2hcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFsYW5jZWQtbWF0Y2hcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFzZTY0aWRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFzZTY0aWRcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFzZTY0aWRcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFzZTY0aWRcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFzaWMtZnRwXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFzaWMtZnRwXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFzaWMtZnRwXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFzaWMtZnRwXGRpc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFzaWMtZnRwXGRpc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmFzaWMtZnRwXGRpc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmluYXJ5LWV4dGVuc2lvbnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmluYXJ5LWV4dGVuc2lvbnNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmluYXJ5LWV4dGVuc2lvbnNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxiaW5cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxiaW5cQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxiaW5cQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxicm93c2VyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxicm93c2VyXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxicm93c2VyXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxleGFtcGxlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxleGFtcGxlXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxleGFtcGxlXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxleGFtcGxlXGFuc2ktdmlld2VyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxleGFtcGxlXGFuc2ktdmlld2VyXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxleGFtcGxlXGFuc2ktdmlld2VyXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxsaWJcd2lkZ2V0c1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxsaWJcd2lkZ2V0c1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFxsaWJcd2lkZ2V0c1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFx1c3JcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFx1c3JcZm9udHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFx2ZW5kb3JcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFx2ZW5kb3JcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmxlc3NlZFx2ZW5kb3JcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmx1ZWJpcmRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmx1ZWJpcmRcanNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmx1ZWJpcmRcanNcYnJvd3Nlclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmx1ZWJpcmRcanNcYnJvd3NlclxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmx1ZWJpcmRcanNcYnJvd3NlclxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmx1ZWJpcmRcanNccmVsZWFzZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmx1ZWJpcmRcanNccmVsZWFzZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYmx1ZWJpcmRcanNccmVsZWFzZVxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYm9kZWNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYm9kZWNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYm9kZWNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYm9keS1wYXJzZXJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYm9keS1wYXJzZXJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYm9keS1wYXJzZXJcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYm9keS1wYXJzZXJcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYm9keS1wYXJzZXJcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYm9keS1wYXJzZXJcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYm9keS1wYXJzZXJcbGliXHR5cGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYm9keS1wYXJzZXJcbGliXHR5cGVzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYm9keS1wYXJzZXJcbGliXHR5cGVzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnJhY2UtZXhwYW5zaW9uXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnJhY2UtZXhwYW5zaW9uXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnJhY2UtZXhwYW5zaW9uXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnJhY2VzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnJhY2VzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnJhY2VzXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnJhY2VzXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnJhY2VzXGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnJhY2VzXGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnJvd3Nlci1zdGRvdXRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnJvd3Nlci1zdGRvdXRcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnJvd3Nlci1zdGRvdXRcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblxldGNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblxldGNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblxldGNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblxsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblxsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblxzcmNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblxzcmNccGFyc2VyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblxzcmNccGFyc2VyXG9uX2RlbWFuZFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblxzcmNcdXRpbHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblx2ZW5kb3JcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblx2ZW5kb3JcYmFzZTY0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblx2ZW5kb3JcYmFzZTY0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblx2ZW5kb3JcYmFzZTY0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblx2ZW5kb3JcdGV4dC1lbmNvZGluZ1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblx2ZW5kb3JcdGV4dC1lbmNvZGluZ1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblx2ZW5kb3JcdGV4dC1lbmNvZGluZ1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnNvblx2ZW5kb3JcdGV4dC1lbmNvZGluZ1xsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnVmZmVyLWZyb21cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnVmZmVyLWZyb21cQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnVmZmVyLWZyb21cQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnl0ZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnl0ZXNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcYnl0ZXNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2FsbC1iaW5kXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2FsbC1iaW5kXC5naXRodWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2FsbC1iaW5kXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2FsbC1iaW5kXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2FsbC1iaW5kXHRlc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2FsbC1iaW5kXHRlc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2FsbC1iaW5kXHRlc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2FtZWxjYXNlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2FtZWxjYXNlXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2FtZWxjYXNlXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hhbGtcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hhbGtcc291cmNlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hhbGtcc291cmNlXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hhbGtcc291cmNlXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hhcm1cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hhcm1cQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hhcm1cQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hhcm1cZXhhbXBsZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hhcm1cZXhhbXBsZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hhcm1cZXhhbXBsZVxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hhcm1cbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hhcm1cbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hhcm1cbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hva2lkYXJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hva2lkYXJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hva2lkYXJcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hva2lkYXJcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hva2lkYXJcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hva2lkYXJcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2hva2lkYXJcdHlwZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xpLXRhYmxlYXVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xpLXRhYmxlYXVcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xpLXRhYmxlYXVcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xpLXRhYmxlYXVcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xpLXRhYmxlYXVcbm9kZV9tb2R1bGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xpLXRhYmxlYXVcbm9kZV9tb2R1bGVzXGNoYWxrXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xpLXRhYmxlYXVcbm9kZV9tb2R1bGVzXGNoYWxrXHNvdXJjZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xpdWlcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xpdWlcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xpdWlcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xpdWlcYnVpbGRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xpdWlcYnVpbGRcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xpdWlcYnVpbGRcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xpdWlcYnVpbGRcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcYW5hbHlzaXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcYW5hbHlzaXNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcYW5hbHlzaXNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcYXBpX2NsaWVudFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcYXBpX2NsaWVudFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcYXBpX2NsaWVudFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcY2FjaGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcY2FjaGVcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcY2FjaGVcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJccHJvdmlzaW9uaW5nXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJccHJvdmlzaW9uaW5nXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJccHJvdmlzaW9uaW5nXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcdXRpbHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcdXRpbHNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcdXRpbHNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcdXRpbHNcYW5hbHl0aWNzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcdXRpbHNcZW5jb2RpbmdcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcdXRpbHNccGFyc2luZ1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcdjJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcdjJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVxsaWJcdjJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY2xvdWRpbmFyeVx0eXBlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3ItY29udmVydFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3ItY29udmVydFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3ItY29udmVydFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3ItbmFtZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3ItbmFtZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3ItbmFtZVxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXGV4YW1wbGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXGV4YW1wbGVzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXGV4YW1wbGVzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXGxpYlxjdXN0b21cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXGxpYlxjdXN0b21cQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXGxpYlxjdXN0b21cQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXGxpYlxtYXBzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXGxpYlxtYXBzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXGxpYlxtYXBzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXGxpYlxzeXN0ZW1cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXGxpYlxzeXN0ZW1cQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXGxpYlxzeXN0ZW1cQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXHRoZW1lc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXHRoZW1lc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29sb3JzXHRoZW1lc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29tYmluZWQtc3RyZWFtXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29tYmluZWQtc3RyZWFtXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29tYmluZWQtc3RyZWFtXGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29tYmluZWQtc3RyZWFtXGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29tbWFuZGVyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29tbWFuZGVyXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29tbWFuZGVyXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29tbWFuZGVyXHR5cGluZ3NcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29uY2F0LW1hcFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29uY2F0LW1hcFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29uY2F0LW1hcFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29uY2F0LW1hcFxleGFtcGxlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29uY2F0LW1hcFxleGFtcGxlXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29uY2F0LW1hcFxleGFtcGxlXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29uY2F0LW1hcFx0ZXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29uY2F0LW1hcFx0ZXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29uY2F0LW1hcFx0ZXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29ubmVjdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29ubmVjdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29ubmVjdFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29ubmVjdFxub2RlX21vZHVsZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29ubmVjdFxub2RlX21vZHVsZXNcZmluYWxoYW5kbGVyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29ubmVjdFxub2RlX21vZHVsZXNcZmluYWxoYW5kbGVyXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29ubmVjdFxub2RlX21vZHVsZXNcZmluYWxoYW5kbGVyXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29ubmVjdFxub2RlX21vZHVsZXNcb24tZmluaXNoZWRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29ubmVjdFxub2RlX21vZHVsZXNcb24tZmluaXNoZWRcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29ubmVjdFxub2RlX21vZHVsZXNcb24tZmluaXNoZWRcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29ubmVjdFxub2RlX21vZHVsZXNcc3RhdHVzZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29ubmVjdFxub2RlX21vZHVsZXNcc3RhdHVzZXNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29ubmVjdFxub2RlX21vZHVsZXNcc3RhdHVzZXNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29udGVudC1kaXNwb3NpdGlvblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29udGVudC1kaXNwb3NpdGlvblxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29udGVudC1kaXNwb3NpdGlvblxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29udGVudC10eXBlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29udGVudC10eXBlXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29udGVudC10eXBlXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29va2llLXNpZ25hdHVyZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29va2llLXNpZ25hdHVyZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29va2llLXNpZ25hdHVyZVxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29va2llXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29va2llXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29va2llXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29yc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29yc1xsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29yc1xsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY29yc1xsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3JvbmVyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3JvbmVyXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3JvbmVyXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3JvbmVyXGRpc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3JvbmVyXGRpc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3JvbmVyXGRpc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3JvbmVyXHNyY1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3JvbmVyXHNyY1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3JvbmVyXHNyY1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3JvbmVyXHR5cGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3VsdmVydFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3VsdmVydFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3VsdmVydFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3VzdG9tLWV2ZW50XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3VzdG9tLWV2ZW50XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3VzdG9tLWV2ZW50XEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3VzdG9tLWV2ZW50XHRlc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3VzdG9tLWV2ZW50XHRlc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcY3VzdG9tLWV2ZW50XHRlc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF0YS11cmktdG8tYnVmZmVyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF0YS11cmktdG8tYnVmZmVyXGRpc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF0YS11cmktdG8tYnVmZmVyXGRpc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF0YS11cmktdG8tYnVmZmVyXGRpc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF0ZS1mb3JtYXRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF0ZS1mb3JtYXRcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF0ZS1mb3JtYXRcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF0ZS1mb3JtYXRcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF0ZWZvcm1hdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF0ZWZvcm1hdFxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF0ZWZvcm1hdFxsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF0ZWZvcm1hdFxsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXGxvY2FsZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXGxvY2FsZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXGxvY2FsZVxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxhZHZhbmNlZEZvcm1hdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxhcnJheVN1cHBvcnRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxiYWRNdXRhYmxlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxiaWdJbnRTdXBwb3J0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxidWRkaGlzdEVyYVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxjYWxlbmRhclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxjdXN0b21QYXJzZUZvcm1hdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxkYXlPZlllYXJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxkZXZIZWxwZXJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxkdXJhdGlvblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc0JldHdlZW5cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc0xlYXBZZWFyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc01vbWVudFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc29XZWVrXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc29XZWVrc0luWWVhclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc1NhbWVPckFmdGVyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc1NhbWVPckJlZm9yZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc1RvZGF5XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc1RvbW9ycm93XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxpc1llc3RlcmRheVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxsb2NhbGVEYXRhXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxsb2NhbGl6ZWRGb3JtYXRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxtaW5NYXhcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxvYmplY3RTdXBwb3J0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxwbHVyYWxHZXRTZXRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxwcmVQYXJzZVBvc3RGb3JtYXRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxxdWFydGVyT2ZZZWFyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblxyZWxhdGl2ZVRpbWVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblx0aW1lem9uZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblx0b0FycmF5XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblx0b09iamVjdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblx1cGRhdGVMb2NhbGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblx1dGNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblx3ZWVrZGF5XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblx3ZWVrT2ZZZWFyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcZXNtXHBsdWdpblx3ZWVrWWVhclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcbG9jYWxlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcbG9jYWxlXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNcbG9jYWxlXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNccGx1Z2luXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNccGx1Z2luXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGF5anNccGx1Z2luXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVidWdcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVidWdcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVidWdcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVidWdcc3JjXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVidWdcc3JjXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVidWdcc3JjXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVjYW1lbGl6ZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVjYW1lbGl6ZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVjYW1lbGl6ZVxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVmaW5lLWRhdGEtcHJvcGVydHlcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVmaW5lLWRhdGEtcHJvcGVydHlcLmdpdGh1Ylwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVmaW5lLWRhdGEtcHJvcGVydHlcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVmaW5lLWRhdGEtcHJvcGVydHlcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVmaW5lLWRhdGEtcHJvcGVydHlcdGVzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVmaW5lLWRhdGEtcHJvcGVydHlcdGVzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVmaW5lLWRhdGEtcHJvcGVydHlcdGVzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVnZW5lcmF0b3JcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVnZW5lcmF0b3JcZGlzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVnZW5lcmF0b3JcZGlzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVnZW5lcmF0b3JcZGlzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVsYXllZC1zdHJlYW1cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVsYXllZC1zdHJlYW1cbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVsYXllZC1zdHJlYW1cbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVsYXllZC1zdHJlYW1cbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVwZFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVwZFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVwZFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVwZFxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVwZFxsaWJcYnJvd3Nlclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVwZFxsaWJcYnJvd3NlclxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVwZFxsaWJcYnJvd3NlclxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVzdHJveVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVzdHJveVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGVzdHJveVxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGV0ZWN0LWZpbGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGV0ZWN0LWZpbGVcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGV0ZWN0LWZpbGVcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxkaXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxkaXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxkaXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxsaWJcY29udmVydFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxsaWJcY29udmVydFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxsaWJcY29udmVydFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxsaWJcZGlmZlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxsaWJcZGlmZlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxsaWJcZGlmZlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxsaWJccGF0Y2hcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxsaWJccGF0Y2hcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxsaWJccGF0Y2hcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxsaWJcdXRpbFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxsaWJcdXRpbFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZGlmZlxsaWJcdXRpbFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZG9tLXNlcmlhbGl6ZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZG9tLXNlcmlhbGl6ZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZG9tLXNlcmlhbGl6ZVxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZG9tLXNlcmlhbGl6ZVx0ZXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZG9tLXNlcmlhbGl6ZVx0ZXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZG9tLXNlcmlhbGl6ZVx0ZXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZWUtZmlyc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZWUtZmlyc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZWUtZmlyc3RcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW1vamktcmVnZXhcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW1vamktcmVnZXhcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW1vamktcmVnZXhcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW1vamktcmVnZXhcZXMyMDE1XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW1vamktcmVnZXhcZXMyMDE1XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW1vamktcmVnZXhcZXMyMDE1XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5jb2RldXJsXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5jb2RldXJsXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5jb2RldXJsXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvLXBhcnNlclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvLXBhcnNlclxidWlsZFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvLXBhcnNlclxidWlsZFxjanNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvLXBhcnNlclxidWlsZFxjanNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvLXBhcnNlclxidWlsZFxjanNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvLXBhcnNlclxidWlsZFxjanNcY29udHJpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvLXBhcnNlclxidWlsZFxlc21cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvLXBhcnNlclxidWlsZFxlc21cQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvLXBhcnNlclxidWlsZFxlc21cQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvLXBhcnNlclxidWlsZFxlc21cY29udHJpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXGJ1aWxkXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXGJ1aWxkXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXGJ1aWxkXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXGJ1aWxkXHBhcnNlci12M1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXGJ1aWxkXHBhcnNlci12M1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXGJ1aWxkXHBhcnNlci12M1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXGJ1aWxkXHRyYW5zcG9ydHMtdXdzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXGJ1aWxkXHRyYW5zcG9ydHMtdXdzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXGJ1aWxkXHRyYW5zcG9ydHMtdXdzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXGJ1aWxkXHRyYW5zcG9ydHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXGJ1aWxkXHRyYW5zcG9ydHNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXGJ1aWxkXHRyYW5zcG9ydHNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXG5vZGVfbW9kdWxlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXG5vZGVfbW9kdWxlc1xjb29raWVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXG5vZGVfbW9kdWxlc1xjb29raWVcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXG5vZGVfbW9kdWxlc1xjb29raWVcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXG5vZGVfbW9kdWxlc1xkZWJ1Z1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXG5vZGVfbW9kdWxlc1xkZWJ1Z1xzcmNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXG5vZGVfbW9kdWxlc1xtc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXG5vZGVfbW9kdWxlc1xtc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5naW5lLmlvXG5vZGVfbW9kdWxlc1xtc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5xdWlyZXJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5xdWlyZXJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5xdWlyZXJcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5xdWlyZXJcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5xdWlyZXJcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5xdWlyZXJcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5xdWlyZXJcbGliXHByb21wdHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5xdWlyZXJcbGliXHByb21wdHNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5xdWlyZXJcbGliXHByb21wdHNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5xdWlyZXJcbGliXHR5cGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5xdWlyZXJcbGliXHR5cGVzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW5xdWlyZXJcbGliXHR5cGVzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW50XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW50XC5naXRodWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW50XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW50XEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW50XGV4YW1wbGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW50XGV4YW1wbGVzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW50XGV4YW1wbGVzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW50XHRlc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW50XHRlc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZW50XHRlc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXMtZGVmaW5lLXByb3BlcnR5XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXMtZGVmaW5lLXByb3BlcnR5XC5naXRodWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXMtZGVmaW5lLXByb3BlcnR5XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXMtZGVmaW5lLXByb3BlcnR5XEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXMtZGVmaW5lLXByb3BlcnR5XHRlc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXMtZGVmaW5lLXByb3BlcnR5XHRlc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXMtZGVmaW5lLXByb3BlcnR5XHRlc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXMtZXJyb3JzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXMtZXJyb3JzXC5naXRodWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXMtZXJyb3JzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXMtZXJyb3JzXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXMtZXJyb3JzXHRlc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXMtZXJyb3JzXHRlc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXMtZXJyb3JzXHRlc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjYWxhZGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjYWxhZGVcZGlzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjYWxhZGVcZGlzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjYWxhZGVcZGlzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjYWxhZGVcc3luY1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjYWxhZGVcc3luY1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjYWxhZGVcc3luY1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjYXBlLWh0bWxcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjYXBlLWh0bWxcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjYXBlLWh0bWxcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjYXBlLXN0cmluZy1yZWdleHBcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjYXBlLXN0cmluZy1yZWdleHBcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjYXBlLXN0cmluZy1yZWdleHBcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjb2RlZ2VuXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjb2RlZ2VuXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjb2RlZ2VuXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjb2RlZ2VuXGJpblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjb2RlZ2VuXGJpblxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNjb2RlZ2VuXGJpblxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNwcmltYVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNwcmltYVxiaW5cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNwcmltYVxiaW5cQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNwcmltYVxiaW5cQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNwcmltYVxkaXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNwcmltYVxkaXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXNwcmltYVxkaXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXN0cmF2ZXJzZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXN0cmF2ZXJzZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXN0cmF2ZXJzZVxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXN1dGlsc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXN1dGlsc1xsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXN1dGlsc1xsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXN1dGlsc1xsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXRhZ1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXRhZ1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXRhZ1xAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXZlbnRlbWl0dGVyMlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXZlbnRlbWl0dGVyMlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXZlbnRlbWl0dGVyMlxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXZlbnRlbWl0dGVyMlxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXZlbnRlbWl0dGVyMlxsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXZlbnRlbWl0dGVyMlxsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXZlbnRlbWl0dGVyM1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXZlbnRlbWl0dGVyM1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXZlbnRlbWl0dGVyM1xAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXZlbnRlbWl0dGVyM1x1bWRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXZlbnRlbWl0dGVyM1x1bWRcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXZlbnRlbWl0dGVyM1x1bWRcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhpdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhpdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhpdFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhpdFxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhpdFxsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhpdFxsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhpdFx0ZXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhpdFx0ZXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhpdFx0ZXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhpdFx0ZXN0XGZpeHR1cmVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhpdFx0ZXN0XGZpeHR1cmVzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhpdFx0ZXN0XGZpeHR1cmVzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhwYW5kLXRpbGRlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhwYW5kLXRpbGRlXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhwYW5kLXRpbGRlXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhwcmVzc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhwcmVzc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhwcmVzc1xAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhwcmVzc1xsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhwcmVzc1xsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhwcmVzc1xsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhwcmVzc1xsaWJcbWlkZGxld2FyZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhwcmVzc1xsaWJcbWlkZGxld2FyZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhwcmVzc1xsaWJcbWlkZGxld2FyZVxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhwcmVzc1xsaWJccm91dGVyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhwcmVzc1xsaWJccm91dGVyXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXhwcmVzc1xsaWJccm91dGVyXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0ZW5kXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0ZW5kXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0ZW5kXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxkaXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxkaXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxkaXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxsaWJcYWRhcHRlcnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxsaWJcYWRhcHRlcnNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxsaWJcYWRhcHRlcnNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxsaWJcY2FuY2VsXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxsaWJcY2FuY2VsXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxsaWJcY2FuY2VsXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxsaWJcY29yZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxsaWJcY29yZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxsaWJcY29yZVxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxsaWJcaGVscGVyc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxsaWJcaGVscGVyc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZXh0cmFyZXFwMlxsaWJcaGVscGVyc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmFzdC1qc29uLXBhdGNoXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmFzdC1qc29uLXBhdGNoXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmFzdC1qc29uLXBhdGNoXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmFzdC1qc29uLXBhdGNoXGNvbW1vbmpzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmFzdC1qc29uLXBhdGNoXGNvbW1vbmpzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmFzdC1qc29uLXBhdGNoXGNvbW1vbmpzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmFzdC1qc29uLXBhdGNoXGRpc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmFzdC1qc29uLXBhdGNoXGRpc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmFzdC1qc29uLXBhdGNoXGRpc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmFzdC1qc29uLXBhdGNoXG1vZHVsZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmNsb25lXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmNsb25lXGJlbmNoXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmNsb25lXGJlbmNoXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmNsb25lXGJlbmNoXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmNsb25lXGRpc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmNsb25lXGRpc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmNsb25lXGRpc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmNsb25lXHNyY1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmNsb25lXHNyY1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmNsb25lXHNyY1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmlsbC1yYW5nZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmlsbC1yYW5nZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmlsbC1yYW5nZVxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmluYWxoYW5kbGVyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmluYWxoYW5kbGVyXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmluYWxoYW5kbGVyXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmluZC11cFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmluZC11cFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmluZC11cFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmluZHVwLXN5bmNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmluZHVwLXN5bmNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmluZHVwLXN5bmNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmluZWRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmluZWRcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmluZWRcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhZ2dlZC1yZXNwYXduXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhZ2dlZC1yZXNwYXduXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhZ2dlZC1yZXNwYXduXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhZ2dlZC1yZXNwYXduXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhZ2dlZC1yZXNwYXduXGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhZ2dlZC1yZXNwYXduXGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdFx0ZXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdFx0ZXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdFx0ZXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdHRlZFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdHRlZFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdHRlZFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdHRlZFxjanNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdHRlZFxjanNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdHRlZFxjanNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdHRlZFxlc21cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdHRlZFxlc21cQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdHRlZFxlc21cQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdHRlZFxwaHBcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdHRlZFxwaHBcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdHRlZFxwaHBcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdHRlZFxweXRob25cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdHRlZFxweXRob25cX19weWNhY2hlX19cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZmxhdHRlZFx0eXBlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9sbG93LXJlZGlyZWN0c1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9sbG93LXJlZGlyZWN0c1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9sbG93LXJlZGlyZWN0c1xAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9yLWluXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9yLWluXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9yLWluXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9yLW93blwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9yLW93blxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9yLW93blxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9ybS1kYXRhXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9ybS1kYXRhXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9ybS1kYXRhXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9ybS1kYXRhXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9ybS1kYXRhXGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9ybS1kYXRhXGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9yd2FyZGVkXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9yd2FyZGVkXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZm9yd2FyZGVkXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnJlc2hcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnJlc2hcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnJlc2hcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXGNvcHlcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXGNvcHlcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXGNvcHlcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXGVtcHR5XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXGVtcHR5XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXGVtcHR5XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXGVuc3VyZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXGVuc3VyZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXGVuc3VyZVxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXGZzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXGZzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXGZzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXGpzb25cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXGpzb25cQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXGpzb25cQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXG1rZGlyc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXG1rZGlyc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXG1rZGlyc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXG1vdmVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXG1vdmVcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXG1vdmVcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXG91dHB1dC1maWxlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXG91dHB1dC1maWxlXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXG91dHB1dC1maWxlXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXHBhdGgtZXhpc3RzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXHBhdGgtZXhpc3RzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXHBhdGgtZXhpc3RzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXHJlbW92ZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXHJlbW92ZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXHJlbW92ZVxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXHV0aWxcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXHV0aWxcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMtZXh0cmFcbGliXHV0aWxcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMucmVhbHBhdGhcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMucmVhbHBhdGhcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnMucmVhbHBhdGhcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnVuY3Rpb24tYmluZFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnVuY3Rpb24tYmluZFwuZ2l0aHViXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnVuY3Rpb24tYmluZFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnVuY3Rpb24tYmluZFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnVuY3Rpb24tYmluZFx0ZXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnVuY3Rpb24tYmluZFx0ZXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZnVuY3Rpb24tYmluZFx0ZXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LWNhbGxlci1maWxlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LWNhbGxlci1maWxlXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LWNhbGxlci1maWxlXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LWludHJpbnNpY1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LWludHJpbnNpY1wuZ2l0aHViXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LWludHJpbnNpY1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LWludHJpbnNpY1xAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LWludHJpbnNpY1x0ZXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LWludHJpbnNpY1x0ZXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LWludHJpbnNpY1x0ZXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LXVyaVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LXVyaVxkaXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LXVyaVxkaXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LXVyaVxkaXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LXVyaVxub2RlX21vZHVsZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LXVyaVxub2RlX21vZHVsZXNcZGVidWdcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LXVyaVxub2RlX21vZHVsZXNcZGVidWdcc3JjXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LXVyaVxub2RlX21vZHVsZXNcbXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LXVyaVxub2RlX21vZHVsZXNcbXNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0LXVyaVxub2RlX21vZHVsZXNcbXNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0b2JqZWN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0b2JqZWN0XGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0b2JqZWN0XGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2V0b2JqZWN0XGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2l0LW5vZGUtZnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2l0LW5vZGUtZnNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2l0LW5vZGUtZnNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2l0LW5vZGUtZnNcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2l0LW5vZGUtZnNcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2l0LW5vZGUtZnNcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2l0LW5vZGUtZnNcbWl4aW5zXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2l0LW5vZGUtZnNcbWl4aW5zXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2l0LW5vZGUtZnNcbWl4aW5zXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2l0LW5vZGUtZnNcdGVzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2l0LW5vZGUtZnNcdGVzdFxmaXh0dXJlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2l0LW5vZGUtZnNcdGVzdFxmaXh0dXJlc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2l0LW5vZGUtZnNcdGVzdFxmaXh0dXJlc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2l0LXNoYTFcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2l0LXNoYTFcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2l0LXNoYTFcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYi1wYXJlbnRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYi1wYXJlbnRcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYi1wYXJlbnRcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYlxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYmFsLW1vZHVsZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYmFsLW1vZHVsZXNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYmFsLW1vZHVsZXNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYmFsLXByZWZpeFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYmFsLXByZWZpeFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYmFsLXByZWZpeFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYmFsLXByZWZpeFxub2RlX21vZHVsZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYmFsLXByZWZpeFxub2RlX21vZHVsZXNcLmJpblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYmFsLXByZWZpeFxub2RlX21vZHVsZXNcLmJpblxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYmFsLXByZWZpeFxub2RlX21vZHVsZXNcLmJpblxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYmFsLXByZWZpeFxub2RlX21vZHVsZXNcd2hpY2hcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYmFsLXByZWZpeFxub2RlX21vZHVsZXNcd2hpY2hcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYmFsLXByZWZpeFxub2RlX21vZHVsZXNcd2hpY2hcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ2xvYmFsLXByZWZpeFxub2RlX21vZHVsZXNcd2hpY2hcYmluXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ29wZFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ29wZFwuZ2l0aHViXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ29wZFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ29wZFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ29wZFx0ZXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ29wZFx0ZXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ29wZFx0ZXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3JhY2VmdWwtZnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3JhY2VmdWwtZnNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3JhY2VmdWwtZnNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtY2xpXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtY2xpXGJpblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtY2xpXGNvbXBsZXRpb25cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtY2xpXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtY2xpXGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtY2xpXGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtY2xpXG5vZGVfbW9kdWxlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtY2xpXG5vZGVfbW9kdWxlc1wuYmluXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtY2xpXG5vZGVfbW9kdWxlc1wuYmluXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtY2xpXG5vZGVfbW9kdWxlc1wuYmluXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtY2xpXG5vZGVfbW9kdWxlc1xub3B0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtY2xpXG5vZGVfbW9kdWxlc1xub3B0XGJpblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtY2xpXG5vZGVfbW9kdWxlc1xub3B0XGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQta25vd24tb3B0aW9uc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQta25vd24tb3B0aW9uc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQta25vd24tb3B0aW9uc1xAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LWxvZy11dGlsc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LWxvZy11dGlsc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LWxvZy11dGlsc1xAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LWxvZ1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LWxvZ1wuZ2l0aHViXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LWxvZ1wuZ2l0aHViXHdvcmtmbG93c1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LWxvZ1wuaWRlYVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LWxvZ1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LWxvZ1xAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LWxvZ1x0ZXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LWxvZ1x0ZXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LWxvZ1x0ZXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LXV0aWxcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LXV0aWxcLmdpdGh1Ylwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LXV0aWxcLmdpdGh1Ylx3b3JrZmxvd3NcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LXV0aWxcLmlkZWFcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LXV0aWxcLmlkZWFcaW5zcGVjdGlvblByb2ZpbGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LXV0aWxcLmlkZWFcanNMaW50ZXJzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LXV0aWxcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LXV0aWxcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LXV0aWxcdGVzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LXV0aWxcdGVzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LXV0aWxcdGVzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LXV0aWxcdGVzdFxmaXh0dXJlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LXV0aWxcdGVzdFxmaXh0dXJlc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnQtbGVnYWN5LXV0aWxcdGVzdFxmaXh0dXJlc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcYmluXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbGliXGdydW50XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbGliXGdydW50XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbGliXGdydW50XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbGliXHV0aWxcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbGliXHV0aWxcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbGliXHV0aWxcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbm9kZV9tb2R1bGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbm9kZV9tb2R1bGVzXGdsb2JcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbm9kZV9tb2R1bGVzXGdsb2JcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbm9kZV9tb2R1bGVzXGdsb2JcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbm9kZV9tb2R1bGVzXGljb252LWxpdGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbm9kZV9tb2R1bGVzXGljb252LWxpdGVcLmdpdGh1Ylwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbm9kZV9tb2R1bGVzXGljb252LWxpdGVcLmlkZWFcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbm9kZV9tb2R1bGVzXGljb252LWxpdGVcLmlkZWFcY29kZVN0eWxlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbm9kZV9tb2R1bGVzXGljb252LWxpdGVcLmlkZWFcaW5zcGVjdGlvblByb2ZpbGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbm9kZV9tb2R1bGVzXGljb252LWxpdGVcZW5jb2RpbmdzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbm9kZV9tb2R1bGVzXGljb252LWxpdGVcZW5jb2RpbmdzXHRhYmxlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbm9kZV9tb2R1bGVzXGljb252LWxpdGVcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbm9kZV9tb2R1bGVzXG1pbmltYXRjaFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbm9kZV9tb2R1bGVzXG1pbmltYXRjaFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcZ3J1bnRcbm9kZV9tb2R1bGVzXG1pbmltYXRjaFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLWZsYWdcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLWZsYWdcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLWZsYWdcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXByb3BlcnR5LWRlc2NyaXB0b3JzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXByb3BlcnR5LWRlc2NyaXB0b3JzXC5naXRodWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXByb3BlcnR5LWRlc2NyaXB0b3JzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXByb3BlcnR5LWRlc2NyaXB0b3JzXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXByb3BlcnR5LWRlc2NyaXB0b3JzXHRlc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXByb3BlcnR5LWRlc2NyaXB0b3JzXHRlc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXByb3BlcnR5LWRlc2NyaXB0b3JzXHRlc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXByb3RvXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXByb3RvXC5naXRodWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXByb3RvXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXByb3RvXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXByb3RvXHRlc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXByb3RvXHRlc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXByb3RvXHRlc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXN5bWJvbHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXN5bWJvbHNcLmdpdGh1Ylwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXN5bWJvbHNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXN5bWJvbHNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXN5bWJvbHNcdGVzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXN5bWJvbHNcdGVzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXN5bWJvbHNcdGVzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXN5bWJvbHNcdGVzdFxzaGFtc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXN5bWJvbHNcdGVzdFxzaGFtc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzLXN5bWJvbHNcdGVzdFxzaGFtc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzb3duXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzb3duXC5naXRodWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzb3duXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGFzb3duXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGVcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGVcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGVcYmluXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaGVcbWFuXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaG9tZWRpci1wb2x5ZmlsbFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaG9tZWRpci1wb2x5ZmlsbFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaG9tZWRpci1wb2x5ZmlsbFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaG9va2VyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaG9va2VyXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaG9va2VyXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaG9va2VyXGRpc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaG9va2VyXGRpc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaG9va2VyXGRpc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaG9va2VyXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaG9va2VyXGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaG9va2VyXGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaG9va2VyXHRlc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaG9va2VyXHRlc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaG9va2VyXHRlc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1lcnJvcnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1lcnJvcnNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1lcnJvcnNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eS1hZ2VudFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eS1hZ2VudFxkaXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eS1hZ2VudFxkaXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eS1hZ2VudFxkaXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eS1hZ2VudFxub2RlX21vZHVsZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eS1hZ2VudFxub2RlX21vZHVsZXNcZGVidWdcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eS1hZ2VudFxub2RlX21vZHVsZXNcZGVidWdcc3JjXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eS1hZ2VudFxub2RlX21vZHVsZXNcbXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eS1hZ2VudFxub2RlX21vZHVsZXNcbXNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eS1hZ2VudFxub2RlX21vZHVsZXNcbXNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eVxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eVxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eVxsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eVxsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eVxsaWJcaHR0cC1wcm94eVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eVxsaWJcaHR0cC1wcm94eVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eVxsaWJcaHR0cC1wcm94eVxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cC1wcm94eVxsaWJcaHR0cC1wcm94eVxwYXNzZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cHMtcHJveHktYWdlbnRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cHMtcHJveHktYWdlbnRcZGlzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cHMtcHJveHktYWdlbnRcZGlzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cHMtcHJveHktYWdlbnRcZGlzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cHMtcHJveHktYWdlbnRcbm9kZV9tb2R1bGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cHMtcHJveHktYWdlbnRcbm9kZV9tb2R1bGVzXGRlYnVnXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cHMtcHJveHktYWdlbnRcbm9kZV9tb2R1bGVzXGRlYnVnXHNyY1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cHMtcHJveHktYWdlbnRcbm9kZV9tb2R1bGVzXG1zXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cHMtcHJveHktYWdlbnRcbm9kZV9tb2R1bGVzXG1zXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaHR0cHMtcHJveHktYWdlbnRcbm9kZV9tb2R1bGVzXG1zXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaWNvbnYtbGl0ZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaWNvbnYtbGl0ZVxlbmNvZGluZ3NcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaWNvbnYtbGl0ZVxlbmNvZGluZ3NcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaWNvbnYtbGl0ZVxlbmNvZGluZ3NcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaWNvbnYtbGl0ZVxlbmNvZGluZ3NcdGFibGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaWNvbnYtbGl0ZVxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaWNvbnYtbGl0ZVxsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaWNvbnYtbGl0ZVxsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaW5mbGlnaHRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaW5mbGlnaHRcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaW5mbGlnaHRcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaW5oZXJpdHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaW5oZXJpdHNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaW5oZXJpdHNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaW5pXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaW5pXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaW5pXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaW50ZXJwcmV0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaW50ZXJwcmV0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaW50ZXJwcmV0XEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1xkaXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1xkaXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1xkaXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1xkaXN0XHY0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1xkaXN0XHY0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1xkaXN0XHY0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1xkaXN0XHY2XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1xkaXN0XHY2XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1xkaXN0XHY2XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1xub2RlX21vZHVsZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1xub2RlX21vZHVsZXNcc3ByaW50Zi1qc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1xub2RlX21vZHVsZXNcc3ByaW50Zi1qc1xkaXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1xub2RlX21vZHVsZXNcc3ByaW50Zi1qc1xzcmNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1xzcmNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1xzcmNcdjRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXAtYWRkcmVzc1xzcmNcdjZcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXBhZGRyLmpzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXBhZGRyLmpzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXBhZGRyLmpzXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXBhZGRyLmpzXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXBhZGRyLmpzXGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXBhZGRyLmpzXGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtYWJzb2x1dGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtYWJzb2x1dGVcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtYWJzb2x1dGVcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtYmluYXJ5LXBhdGhcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtYmluYXJ5LXBhdGhcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtYmluYXJ5LXBhdGhcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtY29yZS1tb2R1bGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtY29yZS1tb2R1bGVcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtY29yZS1tb2R1bGVcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtY29yZS1tb2R1bGVcdGVzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtY29yZS1tb2R1bGVcdGVzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtY29yZS1tb2R1bGVcdGVzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtZXh0Z2xvYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtZXh0Z2xvYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtZXh0Z2xvYlxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtZnVsbHdpZHRoLWNvZGUtcG9pbnRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtZnVsbHdpZHRoLWNvZGUtcG9pbnRcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtZnVsbHdpZHRoLWNvZGUtcG9pbnRcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtZ2xvYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtZ2xvYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtZ2xvYlxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtbnVtYmVyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtbnVtYmVyXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtbnVtYmVyXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtcGxhaW4tb2JqXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtcGxhaW4tb2JqXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtcGxhaW4tb2JqXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtcGxhaW4tb2JqZWN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtcGxhaW4tb2JqZWN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtcGxhaW4tb2JqZWN0XEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtcmVsYXRpdmVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtcmVsYXRpdmVcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtcmVsYXRpdmVcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtdW5jLXBhdGhcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtdW5jLXBhdGhcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtdW5jLXBhdGhcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtdW5pY29kZS1zdXBwb3J0ZWRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtdW5pY29kZS1zdXBwb3J0ZWRcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtdW5pY29kZS1zdXBwb3J0ZWRcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtd2luZG93c1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtd2luZG93c1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXMtd2luZG93c1xAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXNiaW5hcnlmaWxlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXNiaW5hcnlmaWxlXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXNiaW5hcnlmaWxlXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXNiaW5hcnlmaWxlXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXNiaW5hcnlmaWxlXGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXNiaW5hcnlmaWxlXGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXNleGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXNleGVcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXNleGVcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXNleGVcdGVzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXNleGVcdGVzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXNleGVcdGVzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXNvYmplY3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXNvYmplY3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcaXNvYmplY3RcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XGFydFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XGFydFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XGFydFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XGRvY1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XGRvY1xsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XGRvY1xtaXhpbnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XG1peGluc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XG1peGluc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XG1peGluc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XG5ldFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XG5ldFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XG5ldFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XHRlc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XHRlc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMtZ2l0XHRlc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxiaW5cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxiaW5cQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxiaW5cQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxkaXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxkaXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxkaXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxsaWJcanMteWFtbFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxsaWJcanMteWFtbFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxsaWJcanMteWFtbFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxsaWJcanMteWFtbFxzY2hlbWFcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxsaWJcanMteWFtbFx0eXBlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanMteWFtbFxsaWJcanMteWFtbFx0eXBlXGpzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanNiblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanNiblxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanNiblxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanNiblx0ZXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanNiblx0ZXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanNiblx0ZXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanNvbi1zdHJpbmdpZnktc2FmZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanNvbi1zdHJpbmdpZnktc2FmZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanNvbi1zdHJpbmdpZnktc2FmZVxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanNvbi1zdHJpbmdpZnktc2FmZVx0ZXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanNvbi1zdHJpbmdpZnktc2FmZVx0ZXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanNvbi1zdHJpbmdpZnktc2FmZVx0ZXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanNvbmZpbGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanNvbmZpbGVcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcanNvbmZpbGVcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FyZWVtXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FyZWVtXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FyZWVtXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcYmluXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcY29tbW9uXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcY29tbW9uXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcY29tbW9uXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcY29udGV4dFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcY29udGV4dFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcY29udGV4dFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXGluaXRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXGluaXRcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXGluaXRcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXGxhdW5jaGVyc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXGxhdW5jaGVyc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXGxhdW5jaGVyc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXG1pZGRsZXdhcmVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXG1pZGRsZXdhcmVcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXG1pZGRsZXdhcmVcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXHJlcG9ydGVyc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXHJlcG9ydGVyc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXHJlcG9ydGVyc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXHV0aWxzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXHV0aWxzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbGliXHV0aWxzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbm9kZV9tb2R1bGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbm9kZV9tb2R1bGVzXC5iaW5cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbm9kZV9tb2R1bGVzXC5iaW5cQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbm9kZV9tb2R1bGVzXC5iaW5cQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbm9kZV9tb2R1bGVzXG1pbWVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbm9kZV9tb2R1bGVzXG1pbWVcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbm9kZV9tb2R1bGVzXG1pbWVcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcbm9kZV9tb2R1bGVzXG1pbWVcdHlwZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcc2NyaXB0c1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcc2NyaXB0c1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcc2NyaXB0c1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcc3RhdGljXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcc3RhdGljXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2FybWFcc3RhdGljXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2luZC1vZlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2luZC1vZlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNca2luZC1vZlxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbGF6eVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbGF6eVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbGF6eVxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbGF6eVx0ZXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbGF6eVx0ZXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbGF6eVx0ZXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbGlmdHVwXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbGlmdHVwXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbGlmdHVwXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbGlmdHVwXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbGlmdHVwXGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbGlmdHVwXGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbGlmdHVwXG5vZGVfbW9kdWxlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbGlmdHVwXG5vZGVfbW9kdWxlc1xmaW5kdXAtc3luY1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbGlmdHVwXG5vZGVfbW9kdWxlc1xmaW5kdXAtc3luY1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbGlmdHVwXG5vZGVfbW9kdWxlc1xmaW5kdXAtc3luY1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9jYXRlLXBhdGhcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9jYXRlLXBhdGhcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9jYXRlLXBhdGhcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9kYXNoXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9kYXNoXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9kYXNoXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9kYXNoXGZwXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9kYXNoXGZwXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9kYXNoXGZwXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nLXN5bWJvbHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nLXN5bWJvbHNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nLXN5bWJvbHNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nNGpzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nNGpzXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nNGpzXGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nNGpzXGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nNGpzXGxpYlxhcHBlbmRlcnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nNGpzXGxpYlxhcHBlbmRlcnNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nNGpzXGxpYlxhcHBlbmRlcnNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nNGpzXG5vZGVfbW9kdWxlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nNGpzXG5vZGVfbW9kdWxlc1xkZWJ1Z1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nNGpzXG5vZGVfbW9kdWxlc1xkZWJ1Z1xzcmNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nNGpzXG5vZGVfbW9kdWxlc1xtc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nNGpzXG5vZGVfbW9kdWxlc1xtc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nNGpzXG5vZGVfbW9kdWxlc1xtc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbG9nNGpzXHR5cGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbHJ1LWNhY2hlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbHJ1LWNhY2hlXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbHJ1LWNhY2hlXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWFrZS1pdGVyYXRvclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWFrZS1pdGVyYXRvclxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWFrZS1pdGVyYXRvclxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWFwLWNhY2hlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWFwLWNhY2hlXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWFwLWNhY2hlXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWVkaWEtdHlwZXJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWVkaWEtdHlwZXJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWVkaWEtdHlwZXJcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWVtb3J5LXBhZ2VyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWVtb3J5LXBhZ2VyXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWVtb3J5LXBhZ2VyXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWVyZ2UtZGVzY3JpcHRvcnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWVyZ2UtZGVzY3JpcHRvcnNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWVyZ2UtZGVzY3JpcHRvcnNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWV0aG9kc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWV0aG9kc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWV0aG9kc1xAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWljcm9tYXRjaFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWljcm9tYXRjaFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWljcm9tYXRjaFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWltZS1kYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWltZS1kYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWltZS1kYlxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWltZS10eXBlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWltZS10eXBlc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWltZS10eXBlc1xAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWltZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWltZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWltZVxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWltZVxzcmNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWltZVxzcmNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWltZVxzcmNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWluaW1hdGNoXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWluaW1hdGNoXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWluaW1hdGNoXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWluaW1pc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWluaW1pc3RcLmdpdGh1Ylwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWluaW1pc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWluaW1pc3RcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWluaW1pc3RcZXhhbXBsZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWluaW1pc3RcZXhhbXBsZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWluaW1pc3RcZXhhbXBsZVxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWluaW1pc3RcdGVzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWluaW1pc3RcdGVzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWluaW1pc3RcdGVzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWtkaXJwXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWtkaXJwXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWtkaXJwXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWtkaXJwXGJpblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWtkaXJwXGJpblxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbWtkaXJwXGJpblxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcYmluXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcYmluXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcYmluXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXGJyb3dzZXJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXGJyb3dzZXJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXGJyb3dzZXJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXGNsaVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXGNsaVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXGNsaVxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXGludGVyZmFjZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXGludGVyZmFjZXNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXGludGVyZmFjZXNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXG5vZGVqc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXG5vZGVqc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXG5vZGVqc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXG5vZGVqc1xyZXBvcnRlcnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXHJlcG9ydGVyc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXHJlcG9ydGVyc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbGliXHJlcG9ydGVyc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXC5iaW5cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXC5iaW5cQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXC5iaW5cQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGFyZ3BhcnNlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGFyZ3BhcnNlXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGFyZ3BhcnNlXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGFyZ3BhcnNlXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGJyYWNlLWV4cGFuc2lvblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGJyYWNlLWV4cGFuc2lvblwuZ2l0aHViXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGJyYWNlLWV4cGFuc2lvblxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGJyYWNlLWV4cGFuc2lvblxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGRlYnVnXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGRlYnVnXG5vZGVfbW9kdWxlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGRlYnVnXG5vZGVfbW9kdWxlc1xtc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGRlYnVnXHNyY1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGdsb2JcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGdsb2JcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGdsb2JcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGpzLXlhbWxcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGpzLXlhbWxcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGpzLXlhbWxcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGpzLXlhbWxcYmluXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGpzLXlhbWxcZGlzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGpzLXlhbWxcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGpzLXlhbWxcbGliXHNjaGVtYVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXGpzLXlhbWxcbGliXHR5cGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXG1pbmltYXRjaFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXG1pbmltYXRjaFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXG1pbmltYXRjaFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXG1pbmltYXRjaFxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXG1zXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXG1zXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXG1zXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXHN1cHBvcnRzLWNvbG9yXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXHN1cHBvcnRzLWNvbG9yXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9jaGFcbm9kZV9tb2R1bGVzXHN1cHBvcnRzLWNvbG9yXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9kdWxlLWRldGFpbHMtZnJvbS1wYXRoXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9kdWxlLWRldGFpbHMtZnJvbS1wYXRoXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9kdWxlLWRldGFpbHMtZnJvbS1wYXRoXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9sZWN1bGFyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9sZWN1bGFyXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9sZWN1bGFyXGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9sZWN1bGFyXGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XGRpc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XGRpc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XGRpc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XGRpc3RcbG9jYWxlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XGRpc3RcbG9jYWxlXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XGRpc3RcbG9jYWxlXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XGxvY2FsZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XGxvY2FsZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XGxvY2FsZVxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XG1pblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XG1pblxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XG1pblxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XHNyY1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XHNyY1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XHNyY1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XHNyY1xsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XHNyY1xsaWJcY3JlYXRlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XHNyY1xsaWJcZHVyYXRpb25cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XHNyY1xsaWJcZm9ybWF0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XHNyY1xsaWJcbG9jYWxlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XHNyY1xsaWJcbW9tZW50XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XHNyY1xsaWJccGFyc2VcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XHNyY1xsaWJcdW5pdHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XHNyY1xsaWJcdXRpbHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XHNyY1xsb2NhbGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XHNyY1xsb2NhbGVcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XHNyY1xsb2NhbGVcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9tZW50XHRzMy4xLXR5cGluZ3NcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYi1jb25uZWN0aW9uLXN0cmluZy11cmxcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYi1jb25uZWN0aW9uLXN0cmluZy11cmxcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYi1jb25uZWN0aW9uLXN0cmluZy11cmxcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYi1jb25uZWN0aW9uLXN0cmluZy11cmxcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxldGNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxldGNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxldGNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcYnVsa1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcYnVsa1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcYnVsa1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcY2xpZW50LXNpZGUtZW5jcnlwdGlvblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcY2xpZW50LXNpZGUtZW5jcnlwdGlvblxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcY2xpZW50LXNpZGUtZW5jcnlwdGlvblxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcY2xpZW50LXNpZGUtZW5jcnlwdGlvblxwcm92aWRlcnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcY21hcFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcY21hcFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcY21hcFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcY21hcFxhdXRoXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcY21hcFxhdXRoXG1vbmdvZGJfb2lkY1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcY21hcFxoYW5kc2hha2VcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcY21hcFx3aXJlX3Byb3RvY29sXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcY21hcFx3aXJlX3Byb3RvY29sXG9uX2RlbWFuZFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcY3Vyc29yXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcY3Vyc29yXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcY3Vyc29yXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcZ3JpZGZzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcZ3JpZGZzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcZ3JpZGZzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcb3BlcmF0aW9uc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcb3BlcmF0aW9uc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcb3BlcmF0aW9uc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcb3BlcmF0aW9uc1xzZWFyY2hfaW5kZXhlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcc2RhbVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcc2RhbVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxsaWJcc2RhbVxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxzcmNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxzcmNcYnVsa1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxzcmNcY2xpZW50LXNpZGUtZW5jcnlwdGlvblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxzcmNcY2xpZW50LXNpZGUtZW5jcnlwdGlvblxwcm92aWRlcnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxzcmNcY21hcFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxzcmNcY21hcFxhdXRoXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxzcmNcY21hcFxhdXRoXG1vbmdvZGJfb2lkY1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxzcmNcY21hcFxoYW5kc2hha2VcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxzcmNcY21hcFx3aXJlX3Byb3RvY29sXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxzcmNcY21hcFx3aXJlX3Byb3RvY29sXG9uX2RlbWFuZFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxzcmNcY3Vyc29yXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxzcmNcZ3JpZGZzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxzcmNcb3BlcmF0aW9uc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxzcmNcb3BlcmF0aW9uc1xzZWFyY2hfaW5kZXhlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29kYlxzcmNcc2RhbVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcZGlzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcZGlzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcZGlzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGNhc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGNhc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGNhc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGN1cnNvclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGN1cnNvclxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGN1cnNvclxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGRyaXZlcnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGRyaXZlcnNcYnJvd3Nlclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGRyaXZlcnNcbm9kZS1tb25nb2RiLW5hdGl2ZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGVycm9yXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGVycm9yXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGVycm9yXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNcYWdncmVnYXRlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNcY3Vyc29yXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNcZGlzY3JpbWluYXRvclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNcZG9jdW1lbnRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNcZXJyb3JcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNcaW5kZXhlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNcbW9kZWxcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNccGF0aFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNccG9wdWxhdGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNccHJvamVjdGlvblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNccXVlcnlcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNcc2NoZW1hXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNcc2NoZW1hdHlwZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNcdGltZXN0YW1wc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNcdG9wb2xvZ3lcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXGhlbHBlcnNcdXBkYXRlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXG9wdGlvbnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXG9wdGlvbnNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXG9wdGlvbnNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXHBsdWdpbnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXHBsdWdpbnNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXHBsdWdpbnNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXHNjaGVtYVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXHNjaGVtYVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXHNjaGVtYVxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXHNjaGVtYVxvcGVyYXRvcnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXHR5cGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXHR5cGVzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXHR5cGVzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXHR5cGVzXGFycmF5XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXHR5cGVzXGFycmF5XG1ldGhvZHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXHR5cGVzXGRvY3VtZW50QXJyYXlcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcbGliXHR5cGVzXGRvY3VtZW50QXJyYXlcbWV0aG9kc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2Vcbm9kZV9tb2R1bGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2Vcbm9kZV9tb2R1bGVzXG1zXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2Vcbm9kZV9tb2R1bGVzXG1zXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2Vcbm9kZV9tb2R1bGVzXG1zXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbW9uZ29vc2VcdHlwZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXBhdGhcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXBhdGhcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXBhdGhcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXBhdGhcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXBhdGhcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXBhdGhcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXBhdGhcdGVzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXBhdGhcdGVzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXBhdGhcdGVzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXF1ZXJ5XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXF1ZXJ5XC5naXRodWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXF1ZXJ5XGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXF1ZXJ5XGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXF1ZXJ5XGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXF1ZXJ5XGxpYlxjb2xsZWN0aW9uXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXF1ZXJ5XGxpYlxjb2xsZWN0aW9uXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXF1ZXJ5XGxpYlxjb2xsZWN0aW9uXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXF1ZXJ5XG5vZGVfbW9kdWxlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXF1ZXJ5XG5vZGVfbW9kdWxlc1xkZWJ1Z1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXF1ZXJ5XG5vZGVfbW9kdWxlc1xkZWJ1Z1xzcmNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXF1ZXJ5XG5vZGVfbW9kdWxlc1xtc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXF1ZXJ5XG5vZGVfbW9kdWxlc1xtc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXF1ZXJ5XG5vZGVfbW9kdWxlc1xtc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXV0ZS1zdHJlYW1cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXV0ZS1zdHJlYW1cQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbXV0ZS1zdHJlYW1cQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXGJpblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXGV4YW1wbGVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXGV4YW1wbGVzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXGV4YW1wbGVzXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXGxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXGxpYlxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXGxpYlxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXG5vZGVfbW9kdWxlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXG5vZGVfbW9kdWxlc1xkZWJ1Z1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXG5vZGVfbW9kdWxlc1xkZWJ1Z1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXG5vZGVfbW9kdWxlc1xkZWJ1Z1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXG5vZGVfbW9kdWxlc1xkZWJ1Z1xzcmNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXG5vZGVfbW9kdWxlc1xtc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXG5vZGVfbW9kdWxlc1xtc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXG5vZGVfbW9kdWxlc1xtc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXHRlc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXHRlc3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXHRlc3RcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXHRlc3RcdXRpbHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXHRlc3RcdXRpbHNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVlZGxlXHRlc3RcdXRpbHNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVnb3RpYXRvclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVnb3RpYXRvclxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVnb3RpYXRvclxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVnb3RpYXRvclxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVnb3RpYXRvclxsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmVnb3RpYXRvclxsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmV0bWFza1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmV0bWFza1xleGFtcGxlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmV0bWFza1xsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmV0bWFza1xsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmV0bWFza1xsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmV0bWFza1x0ZXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmV0bWFza1x0ZXN0c1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmV0bWFza1x0ZXN0c1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbmV0bWFza1x0ZXN0c1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbm9wdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbm9wdFxiaW5cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbm9wdFxiaW5cQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbm9wdFxiaW5cQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbm9wdFxleGFtcGxlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbm9wdFxleGFtcGxlc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbm9wdFxleGFtcGxlc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbm9wdFxsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbm9wdFxsaWJcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbm9wdFxsaWJcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbm9wdFx0ZXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbm9wdFx0ZXN0XEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbm9wdFx0ZXN0XEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbm9ybWFsaXplLXBhdGhcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbm9ybWFsaXplLXBhdGhcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbm9ybWFsaXplLXBhdGhcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbnNzb2NrZXRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbnNzb2NrZXRcZXhhbXBsZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbnNzb2NrZXRcZXhhbXBsZXNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbnNzb2NrZXRcZXhhbXBsZXNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbnNzb2NrZXRcbGliXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbnNzb2NrZXRcbGliXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbnNzb2NrZXRcbGliXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbnNzb2NrZXRcdGVzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbnNzb2NrZXRcdGVzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbnNzb2NrZXRcdGVzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbnNzb2NrZXRcdGVzdFxmaXh0dXJlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbnNzb2NrZXRcdGVzdFxmaXh0dXJlc1xAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcbnNzb2NrZXRcdGVzdFxmaXh0dXJlc1xAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LWFzc2lnblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LWFzc2lnblxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LWFzc2lnblxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LWluc3BlY3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LWluc3BlY3RcLmdpdGh1Ylwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LWluc3BlY3RcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LWluc3BlY3RcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LWluc3BlY3RcZXhhbXBsZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LWluc3BlY3RcZXhhbXBsZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LWluc3BlY3RcZXhhbXBsZVxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LWluc3BlY3RcdGVzdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LWluc3BlY3RcdGVzdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LWluc3BlY3RcdGVzdFxAV2FuYURlY3J5cHRvckAuZXhlLmxuaw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LWluc3BlY3RcdGVzdFxicm93c2VyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LWluc3BlY3RcdGVzdFxicm93c2VyXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LWluc3BlY3RcdGVzdFxicm93c2VyXEBXYW5hRGVjcnlwdG9yQC5leGUubG5r","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LmRlZmF1bHRzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LmRlZmF1bHRzXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LmRlZmF1bHRzXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0Lm1hcFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0Lm1hcFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0Lm1hcFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LnBpY2tcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LnBpY2tcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb2JqZWN0LnBpY2tcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb24tZmluaXNoZWRcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb24tZmluaXNoZWRcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb24tZmluaXNoZWRcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb25jZVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb25jZVxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb25jZVxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb3MtaG9tZWRpclwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb3MtaG9tZWRpclxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb3MtaG9tZWRpclxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb3MtdG1wZGlyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb3MtdG1wZGlyXEBQbGVhc2VfUmVhZF9NZUAudHh0","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb3MtdG1wZGlyXEBXYW5hRGVjcnlwdG9yQC5leGU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb3NlbnZcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb3NlbnZcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcb3NlbnZcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccC1saW1pdFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccC1saW1pdFxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccC1saW1pdFxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccC1sb2NhdGVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccC1sb2NhdGVcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccC1sb2NhdGVcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccGFjLXByb3h5LWFnZW50XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccGFjLXByb3h5LWFnZW50XGRpc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccGFjLXByb3h5LWFnZW50XG5vZGVfbW9kdWxlc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccGFjLXByb3h5LWFnZW50XG5vZGVfbW9kdWxlc1xkZWJ1Z1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccGFjLXByb3h5LWFnZW50XG5vZGVfbW9kdWxlc1xkZWJ1Z1xzcmNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccGFjLXByb3h5LWFnZW50XG5vZGVfbW9kdWxlc1xtc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccGFjLXJlc29sdmVyXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccGFjLXJlc29sdmVyXGRpc3RcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccGFrb1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccGFrb1xkaXN0XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccGFrb1xsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccGFrb1xsaWJcdXRpbHNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccGFrb1xsaWJcemxpYlwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccGFyc2UtZmlsZXBhdGhcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccGFyc2UtcGFzc3dkXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNccGFyc2V1cmxcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcVXNlcnNcKi4q","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUxPQ0FMQVBQREFUQSVcUGFja2FnZXNcTWljcm9zb2Z0V2luZG93cy5DbGllbnQuQ0JTX2N3NW4xaDJ0eHlld3lcQUNcSU5ldENhY2hlXEdKWkRGM05JXHRoTElBMFo3MUEuanBnLldOQ1JZQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFBhY2thZ2VzXE1pY3Jvc29mdFdpbmRvd3MuQ2xpZW50LkNCU19jdzVuMWgydHh5ZXd5XEFDXElOZXRDYWNoZVxHSlpERjNOSVx0aE05SzdWMVZRLmpwZy5XTkNSWUM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxMb2NhbFxQYWNrYWdlc1xNaWNyb3NvZnRXaW5kb3dzLkNsaWVudC5DQlNfY3c1bjFoMnR4eWV3eVxMb2NhbFN0YXRlXENvbnN0cmFpbnRJbmRleFxJbnB1dF97OTdhZDQ4ZTQtOWY2Yi00YTU4LWExODItYjgwM2U0YTA4ODA1fVxhcHBzZ2xvYmFscy50eHQuV05DUlk=","type":"Ansi","source":"File String Dumps","process":null,"filename":"f.wnry","compromised":null,"detection_total":null,"total":null},{"value":"Y2E5NjdjNzUtMDRiZi00MGI1LTlhMTYtOThiNWY5MzMyYTky","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZvckF0dHJpYnV0ZXM=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0FQSVBSSVZBVEVCTE9C","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2F0ZWdvcnk=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2giQzNZUEQq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tUb2tlbk1lbWJlcnNoaXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Y2pcIl9+RytM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q0ttZD0uQDM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VTZXJ2aWNlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Y2xvc2Vzb2NrZXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sVGltZXI=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV2FpdA==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV29yaw==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y21kLmV4ZSAvYyAiJXMi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDbGFzc09iamVjdA==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIERlc2t0b3A=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIERvY3VtZW50cw==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uRmlsZXNEaXI=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uRmlsZXNEaXIgKHg4Nik=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uTXVzaWM=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uUGljdHVyZXM=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uVmlkZW8=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uVzY0MzJEaXI=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGxldGlvbkNoYXI=","type":"Ansi","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udmVydFNpZFRvU3RyaW5nU2lkVw==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29tcGF0aWJsZUJpdG1hcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29tcGF0aWJsZURD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGlyZWN0b3J5QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRFeFc=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRm9udEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRm9udEluZGlyZWN0QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTXV0ZXhB","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJvY2Vzc0E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUmVjdFJnbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlRXhX","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlVw==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VydmljZUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU29saWRCcnVzaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU3ltYm9saWNMaW5rVw==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRBY3F1aXJlQ29udGV4dEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREZWNyeXB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREZXN0cm95S2V5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRFbmNyeXB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRFeHBvcnRLZXk=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRHZW5LZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRHZW5SYW5kb20=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRHZXRLZXlQYXJhbQ==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRJbXBvcnRLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRSZWxlYXNlQ29udGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Y3NjcmlwdC5leGU=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y3NjcmlwdC5leGUgIC8vbm9sb2dvIG0udmJz","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZDBmMWE1YzYtZmM0My00OGFlLTk5YmYtZWZiMWMzOGJlOWQx","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZDVQTTFeRWRudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ZD9yW2EpOVki","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ZGF0YSBlcnJvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ZGU1ZGNhZWUtNmY4OC01ODVhLTA1ZWUtZDhiMDViOTEyNzcy","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdENvbG9y","type":"Ansi","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmZXJQcmVjcmVhdGVBbmRSZWRpcmVjdA==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmaW5pdGlvbkZsYWdz","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsYXllZEV4cGFuc2lvbg==","type":"Ansi","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlQ3JpdGljYWxTZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlT2JqZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlVXJsQ2FjaGVFbnRyeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGYiIlR+Kio7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RGlhZ0xldmVs","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhZ01hdGNoQW55TWFzaw==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUNNRA==","type":"Ansi","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZURvdWJsZVF1ZXJ5U2Ricw==","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVVOQ0NoZWNr","type":"Ansi","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlza1BhcnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ZGlza3BhcnQuZXhl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheUxvZ28=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"REtqdXNObzBg","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RGxsU3Vycm9nYXRl","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZE0vLjJYN0wxcTok","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ZE52JSguJko=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RFBMUHJvdGVjdGlvbkxldmVs","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhd0ljb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RHJhd1RleHRB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVNYXNr","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RTY1ZXRSSVx2NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ZWApKjdPPEY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ZWFkZyUvRSo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ZWJhZGY3NzUtNDhhYS00YmYzLThmOGUtZWM2OGQxMTNjOThl","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RUdCa1Y2InJuTDk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ZW1wdHkgZGlzdGFuY2UgdHJlZSB3aXRoIGxlbmd0aHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RW1wdHlDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlRXh0ZW5zaW9ucw==","type":"Ansi","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RW5jZyhVSFk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RXZlcnlvbmVJbmNsdWRlc0Fub255bW91cw==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFRocmVhZA==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXh0VGV4dE91dEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ZjA1NTg0MzgtZjU2YS01OTg3LTQ3ZGEtMDQwY2E3NWFlZjA1","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjBGYExsLT8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ZjI1YmNkMmUtMjY5MC01NWRjLTNiYzQtMDdiNjViMWI0MWM5","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjNhNzFhNGItNjExOC00MjU3LThjY2ItMzlhMzNiYTA1OWQ0","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RjdBKXg6cGRJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Zjg1YjQ3OTMtMTM0Ny01NjIwLTc1NzItYjc5ZDVhMjhkYTgy","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RjhUYCpYRy5o","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RmF2b3JpdGVz","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZmIyYTZkM2YtMDg5Ni01MzJlLTc3ZmMtMmQ5MTkxZDFjNzE3","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmVhdHVyZUJpdHM=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZmYzMmFkYTEtNWE0Yi01ODNjLTg4OWUtYTNjMDI3YjIwMWY1","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Zmd8dExSS1ZqYFE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ZmlsZSBlcnJvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RmlsbFJlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RmluZENsb3Nl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RmluZFJlc291cmNlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RmluZFdpbmRvd1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzU2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hGaWxlQnVmZmVycw==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hQcm9jZXNzV3JpdGVCdWZmZXJz","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVHlwZUlE","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVmFsdWVGbGFncw==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnlXaGVuQ2FsbGJhY2tSZXR1cm5z","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZVNpZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"RlR2JCcvemFO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Rn5UYkt3Wmk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R15Dc1ZwNlk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Z2UtIkVYTHZp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2VuZXJhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpZW50UmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudERpcmVjdG9yeUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3Nvck51bWJlcg==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGV2aWNlQ2Fwcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHJpdmVUeXBlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVQcm9jZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVUaHJlYWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvRXhX","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvU2l6ZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1lQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0aG9zdGJ5bmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9naWNhbERyaXZlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVX","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmF0aXZlU3lzdGVtSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0T2JqZWN0QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UGFyZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0hlYXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U2VjdXJpdHlJbmZv","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RhcnR1cEluZm9B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzQ29sb3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtTWV0cmljcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcEZpbGVOYW1lQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcEZpbGVOYW1lVw==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGV4dEV4dGVudFBvaW50MzJB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50NjQ=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZVpvbmVJbmZvcm1hdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5JbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMYW5nSUQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVX","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Vmlld3BvcnRPcmdFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93T3JnRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93c0RpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsXE1zV2luWm9uZXNDYWNoZUNvdW50ZXJNdXRleEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsXE1zV2luWm9uZXNDYWNoZUNvdW50ZXJNdXRleFc=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsTG9jaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsVW5sb2Nr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"R3JheVN0cmluZ0E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"SD4qIk5KeCw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEFsbG9j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEZyZWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFNldEluZm9ybWF0aW9u","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aHRvbnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"SHl9VjJsMGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"SSFSd1gtI00=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ST5GZSApTihSZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aWNhY2xzIC4gL2dyYW50IEV2ZXJ5b25lOkYgL1QgL0MgL1E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"SWRsZVRpbWVyV2luZG93","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWZ7VidjXiI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"SWdub3JlVXNlclNldHRpbmdz","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW5jb21wYXRpYmxlIHZlcnNpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aW5jb21wbGV0ZSBkaXN0YW5jZSB0cmVl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aW5jb21wbGV0ZSBkeW5hbWljIGJpdCBsZW5ndGhzIHRyZWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aW5jb21wbGV0ZSBsaXRlcmFsL2xlbmd0aCB0cmVl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aW5jb3JyZWN0IGRhdGEgY2hlY2s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aW5jb3JyZWN0IGhlYWRlciBjaGVjaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aW5ldF9hZGRy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aW5ldF9udG9h","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aW5mbGF0ZSAxLjEuMyBDb3B5cmlnaHQgMTk5NS0xOTk4IE1hcmsgQWRsZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdEZvbGRlckhhbmRsZXI=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkV4","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNSV0xvY2s=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VFeGVjdXRlT25jZQ==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExhbmd1YWdlRmFsbGJhY2s=","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW5zdWZmaWNpZW50IG1lbW9yeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRFeGNoYW5nZQ==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRFeGNoYW5nZUFkZA==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJuYWxOYW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBiaXQgbGVuZ3RoIHJlcGVhdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBibG9jayB0eXBl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBkaXN0YW5jZSBjb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBsaXRlcmFsL2xlbmd0aCBjb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzdG9yZWQgYmxvY2sgbGVuZ3Rocw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCB3aW5kb3cgc2l6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"SW52YWxpZGF0ZVJlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aW9jdGxzb2NrZXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"SXNCYWRSZWFkUHRy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"SXNJY29uaWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aVN3SipjV2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"aXRmd2Jca18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"SXZ3Wix4Nj9G","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"amtFN2zDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SzVvSkV+RE8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Szdfai1ZNzEzUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsYmFzZS5kbGw=","type":"Unicode","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2lsbFRpbWVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"S25xI0JVeUM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"S1YlYFl0SmJg","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"a3dRQW4lN2o=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TDNrb3FfID4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TF9eMlYvbT0/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TGF1bmNoUGVybWlzc2lvbg==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdFeA==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bEQueW4pVV83PDlD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TGUiekVeZjE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TGVhdmVDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWN5QXV0aGVudGljYXRpb25MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWN5SW1wZXJzb25hdGlvbkxldmVs","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxDb3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TGomJmxaNjZ+QT8/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bE16RC81SGVXXk19I30=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEN1cnNvckE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEljb25B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFJlc291cmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFVzZXJTZXR0aW5ncw==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGaWxlVGltZVRvRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxTZXJ2aWNl","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9ja1Jlc291cmNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TG9nRmlsZU5hbWU=","type":"Ansi","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nU2VjdXJpdHlTdWNjZXNzZXM=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nU3RhZ2VkRmVhdHVyZVVzYWdl","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ1BhdGhzRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHNhcG9saWN5bG9va3Vw","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHNhc3NwaXJwYw==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bSEqIDljT1Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TTpVU0BPeE4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bUM9KHdFcVk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TURNRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUdPVEZsYWdz","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IENvcnBvcmF0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IENvcnBvcmF0aW9uLiBBbGwgcmlnaHRzIHJlc2VydmVkLg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IEVuaGFuY2VkIFJTQSBhbmQgQUVTIENyeXB0b2dyYXBoaWMgUHJvdmlkZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TUw0TTZCdG9S","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TW9uaXRvclJlZ2lzdHJ5","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TW92ZUZpbGVFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TW92ZUZpbGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fYnVsZ2FyaWFuLnducnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fY2hpbmVzZSAoc2ltcGxpZmllZCkud25yeVI5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fY2hpbmVzZSAodHJhZGl0aW9uYWwpLnducnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fY3JvYXRpYW4ud25yeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fY3plY2gud25yeW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fZGFuaXNoLnducnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fZHV0Y2gud25yeTk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fZW5nbGlzaC53bnJ5Rg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fZmlsaXBpbm8ud25yeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fZmlubmlzaC53bnJ5fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fZnJlbmNoLnducnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fZ2VybWFuLnducnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fZ3JlZWsud25yeTRu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21faW5kb25lc2lhbi53bnJ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21faXRhbGlhbi53bnJ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21famFwYW5lc2Uud25yeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fa29yZWFuLnducnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fbGF0dmlhbi53bnJ5YE4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fbm9yd2VnaWFuLnducnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fcG9saXNoLnducnknfTc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fcG9ydHVndWVzZS53bnJ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fcm9tYW5pYW4ud25yeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fcnVzc2lhbi53bnJ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fc2xvdmFrLnducnkx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fc3BhbmlzaC53bnJ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fc3dlZGlzaC53bnJ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fdHVya2lzaC53bnJ5Tw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bXNnL21fdmlldG5hbWVzZS53bnJ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TVNWQ1A2MC5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TVNWQ1JULmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TXVsdGlCeXRlVG9XaWRlQ2hhcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TXkgUGljdHVyZXM=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXkgVmlkZW8=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TX1rJn1QQyVdMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"bmNhY25fbnA6W1xcUElQRVxcc3J2c3ZjLFNlY3VyaXR5PUltcGVyc29uYXRpb24gRHluYW1pYyBGYWxzZV0=","type":"Unicode","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbHNhcG9saWN5bG9va3VwXQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbHNhc3NwaXJwY10=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmRyT2xlRXh0RExM","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmVlZCBkaWN0aW9uYXJ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Tm9Db21tb25Hcm91cHM=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Db250cm9sUGFuZWw=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9JbnRlcm5ldEljb24=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Qcm9wZXJ0aWVzTXlDb21wdXRlcg==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Qcm9wZXJ0aWVzUmVjeWNsZUJpbg==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9TZXRGb2xkZXJz","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bnRkbGwuZGxs","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeVduZlN0YXRlRGF0YQ==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bnlNWj8lZzs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"byUlSnIuLlwk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TzVVdlJUUTdw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"TzxoYX1LRylU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"T2FONCJ6Z1o=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"T2Zmc2V0UmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"T0pULE0gbzM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"T0xFQVVUMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"b25Ae1FoZm0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkNsaXBib2FyZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"T3Blbk11dGV4QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblNDTWFuYWdlckE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblNlcnZpY2VB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"T3BlcmF0aW5nIFN5c3RlbQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"T3JpZ2luYWxGaWxlbmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"b3ZlcnN1YnNjcmliZWQgZGlzdGFuY2UgdHJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"b3ZlcnN1YnNjcmliZWQgZHluYW1pYyBiaXQgbGVuZ3RocyB0cmVl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"b3ZlcnN1YnNjcmliZWQgbGl0ZXJhbC9sZW5ndGggdHJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"T8Ovwr/CvcOvwr/CvcOvwr/CvXnDr8K/wr0jTQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UDQ8SjZBY20=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cEFxR2stYysu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UGFyZW50Rm9sZGVy","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWU=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWVfMzYzNTQ0ODk=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGF0aENvbXBsZXRpb25DaGFy","type":"Ansi","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGVuZGluZ0ZpbGVSZW5hbWVPcGVyYXRpb25z","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGVyc29uYWw=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGgpP0w5eipL","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"cEksM08rKEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UEtnUVVGYXs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UG9saWN5U2NvcGU=","type":"Ansi","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlQ3JlYXRl","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVyRXh0ZXJuYWxNYW5pZmVzdA==","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkU2VydmVyQml0bmVzcw==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc01pdGlnYXRpb25Qb2xpY3k=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdE5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZmlsZUltYWdlUGF0aA==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ3JhbURhdGE=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ3JhbUZpbGVzRGly","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ3JhbUZpbGVzRGlyICh4ODYp","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ3JhbVc2NDMyRGly","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdGVjdGlvbkxldmVs","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHRWaXNpYmxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UHVibGlzaEV4cGFuZGVkUGF0aA==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UFhVXUB9WWk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UMOvwr/CvUV0w6/Cv8K9","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UTgtOHxOS0xjUCU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"$56","type":"Ansi","source":"File String Dumps","process":null,"filename":"@Please_Read_Me@.txt","compromised":null,"detection_total":null,"total":null},{"value":"$57","type":"Ansi","source":"File String Dumps","process":null,"filename":"r.wnry","compromised":null,"detection_total":null,"total":null},{"value":"UWVGYkZ+VGlLd1o=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UWVUYkZ+WmlLdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UVJJeSBaLiZm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"cVJQTilXeSRPdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQcm90ZWN0ZWRQb2xpY3k=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cVZ5V0QuM2pe","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"cXcgSUI4IVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UX5UYkZ3WmlL","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UiNGWmxyNG4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"cjIoXFNnIDky","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UjUoVE50WX0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"cjsjcjdpU3wx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UjxDdD0tLjhRKA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VBY3RpdmF0aW9uQXV0aGVudGljYXRpb25MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VFeGNlcHRpb25PblBvc3NpYmxlRGVhZGxvY2s=","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEZpbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UmVjdFZpc2libGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UmVkcmF3V2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ3JlYXRlS2V5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UmVnU2V0VmFsdWVFeEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"UmVsYXRpdmVQYXRo","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlU2VydmVyTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2VQb2xpY2llcw==","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzdHJpY3RlZEF0dHJpYnV0ZXM=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Umo6NnRTbzk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Uk9URmxhZ3M=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnBjQ2FjaGVUaW1lb3V0","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UlNBUFVCTElDQkxPQg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsRGlzb3duTW9kdWxlSGVhcEFsbG9jYXRpb24=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsRGxsU2h1dGRvd25JblByb2dyZXNz","type":"Ansi","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsR2V0VmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsUXVlcnlGZWF0dXJlQ29uZmlndXJhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsUmVnaXN0ZXJGZWF0dXJlQ29uZmlndXJhdGlvbkNoYW5nZU5vdGlmaWNhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsVW5yZWdpc3RlckZlYXR1cmVDb25maWd1cmF0aW9uQ2hhbmdlTm90aWZpY2F0aW9u","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnVsZUNvdW50","type":"Ansi","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cnkjYj8pNkc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Un06XmRCL1k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U0B0cT7Dr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c11SIixYQyg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZXJDbG9zZUxldmVs","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZXJDb21wdXRlVG9rZW5Gcm9tTGV2ZWw=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZXJJZGVudGlmeUxldmVs","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZXR5IFdhcm5pbmcgTGV2ZWw=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2JFXGxIdFFlRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"c0Jae24sMzhI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk9SW1wZXJzb25hdGlvbiBEeW5hbWljIEZhbHNl","type":"Unicode","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VuZE1lc3NhZ2VB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U0VUIG93ID0gV1NjcmlwdC5DcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKVNFVCBvbSA9IG93LkNyZWF0ZVNob3J0Y3V0KCJDOlxAV2FuYURlY3J5cHRvckAuZXhlLmxuayIpb20uVGFyZ2V0UGF0aCA9ICJDOlxAV2FuYURlY3J5cHRvckAuZXhlIm9tLlNhdmU=","type":"Ansi","source":"File String Dumps","process":null,"filename":"m.vbs","compromised":null,"detection_total":null,"total":null},{"value":"U2V0QWN0aXZlV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q2xpcGJvYXJkRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q3VycmVudERpcmVjdG9yeUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q3VycmVudERpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q3Vyc29y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW5kT2ZGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW50cmllc0luQWNsQQ==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXJFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Rm9jdXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Rm9yZWdyb3VuZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2V0U2VjdXJpdHlJbmZv","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2V0c29ja29wdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkVUlMYW5ndWFnZQ==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGltZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93UG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93VGV4dFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwzMi5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFeGVjdXRlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFeGVjdXRlRXhB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGb2xkZXJQYXRoVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0RlYnVnSW5mbw==","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1dpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"c2h1dGRvd24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2l6ZW9mUmVzb3VyY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZUNT","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZVNSVw==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlCYXNlWWllbGQ=","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlNYXhZaWVsZA==","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlTbGVlcExvb3BXaW5kb3dTaXpl","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlTcGluQ291bnRUaHJlc2hvbGQ=","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RmFjdG9yWWllbGQ=","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U29mdHdhcmVc","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U1JQVHJ1c3RMZXZlbA==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RhcnRTZXJ2aWNlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"c3RyZWFtIGVuZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"c3RyZWFtIGVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2U=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2VUeXBl","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U3VibWl0VGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3dwcmludGY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"c3lzbWFpbi5zZGI=","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3lzTWVyZ2Uuc2Ri","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtUGFyYW1ldGVyc0luZm9B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtUGFyYW1ldGVyc0luZm9X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtVGltZVRvRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtVGltZVRvVHpTcGVjaWZpY0xvY2FsVGltZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VGFiYmVkVGV4dE91dEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"dGFza2RsLmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGFza3NjaGUuZXhl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VGFza1N0YXJ0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VGV4dE91dEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VGYtKFV5K2dg","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5nTW9kZWw=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dG9vIG1hbnkgbGVuZ3RoIG9yIGRpc3RhbmNlIHN5bWJvbHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNsYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ1c3RQb2xpY3k=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ5QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNBcHBDb21wYXQ=","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNVc2VyRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHRaRCZKSU1R","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"dW5rbm93biBjb21wcmVzc2lvbiBtZXRob2Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VVJMRG93bmxvYWRUb0ZpbGVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VVNFUjMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VXNlV0lOU0FGRVI=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXp4ZSUkZmJX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"di1TZFFuVDNhY1U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VmFsaWRhdGVSZWdJdGVtcw==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmFyRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VmFyaWFudFRpbWVUb1N5c3RlbVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VkJTY3JpcHRTZXRTY3JpcHRTdGF0ZVN0YXJ0ZWQ=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmVyUXVlcnlWYWx1ZVc=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dmVyc2lvbi5kbGw=","type":"Unicode","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dmkjPCFkKlM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbEFsbG9j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbEZyZWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbFByb3RlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Vkx1XXFVWDg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"dyogRT41Slc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"VzA1dT1ufHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"dzhjXiB9Iz5d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"V2BlPy0nKnw+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclNpbmdsZU9iamVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclRocmVhZHBvb2xUaW1lckNhbGxiYWNrcw==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUFsbENvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FuYUNyeXB0MHI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"V2lkZUNoYXJUb011bHRpQnl0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"V2xkcEdldExvY2tkb3duUG9saWN5","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2xkcElzQ2xhc3NJbkFwcHJvdmVkTGlzdA==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V05jcnlAMm9sNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"V1MyXzMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"V1NBR2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"V1NBU3RhcnR1cA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"d3NwcmludGZB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"d1dHaGEvKGRF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"d3oxSlYrVV51Vg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"eCVKbyUuXHIu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"WDZXOVJKQG8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"WD46Pzc2NE0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"WFxQVm9Me0A=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"WGFiTSB6QUov","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"eEk3MHFsN2s0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"eHhKbyUlXHIuLjgk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"eVR+MyYuT19dJA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"WilnWFVeWzA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ei5oRXZvfGByLg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"JVNBTVBMRURJUiVcJFJFQ1lDTEU=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVNBTVBMRURJUiVcJFJFQ1lDTEVcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVNBTVBMRURJUiVcJFJFQ1lDTEVcKi5XTkNSWVQ=","type":"Unicode","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"eyo4MT4pV2E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"eytjMiBpRksp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ezBEREQwMTVELUIwNkMtNDVENS04QzRDLUY1OTcxMzg1NDYzOX0=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezFCM0VBNURDLUI1ODctNDc4Ni1CNEVGLUJEMURDMzMyQUVBRX0=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezM1Mjg2QTY4LTNDNTctNDFBMS1CQkIxLTBFQUU3M0Q3NkM5NX0=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezM3NERFMjkwLTEyM0YtNDU2NS05MTY0LTM5QzQ5MjVFNDY3Qn0=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezNCMTkzODgyLUQzQUQtNEVBQi05NjVBLTY5ODI5RDFGQjU5Rn0=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezNENjQ0QzlCLTFGQjgtNEYzMC05QjQ1LUY2NzAyMzVGNzlDMH0=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezdEODNFRTlCLTIyNDQtNEU3MC1CMUY1LTUzOTMwNDJBRjFFNH0=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezgyT34iWkxUbF4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"e0EwQzY5QTk5LTIxQzgtNDY3MS04NzAzLTc5MzQxNjJGQ0YxRH0=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0E1MkJCQTQ2LUU5RTEtNDM1Ri1CM0Q5LTI4REFBNjQ4QzBGNn0=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0FCNUZCODdCLTdDRTItNEY4My05MTVELTU1MDg0NkM5NTM3Qn0=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0RFOTJDMUM3LTgzN0YtNEY2OS1BM0JCLTg2RTYzMTIwNEEyM30=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0Y0MkVFMkQzLTkwOUYtNDkwNy04ODcxLTRDMjJGQzBCRjc1Nn0=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e2xda11ZPC9+YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"e3kyTSJzR0A6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"fER2c35GKl5s","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"fEhEQSQ1LipyL2o=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"fTEubkc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"fTl6Zl1BImcgMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"fXUjaitRfms=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"fi1mVnM5Sik=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"fkomI0RMbi4y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"fnxjPGNhS20y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null}],"interesting":[{"value":"$58","type":"Ansi","source":"File String Dumps","process":null,"filename":"u.wnry","compromised":null,"detection_total":null,"total":null},{"value":"$59","type":"Ansi","source":"File String Dumps","process":null,"filename":"taskse.exe","compromised":null,"detection_total":null,"total":null},{"value":"$5a","type":"Ansi","source":"File String Dumps","process":null,"filename":"taskdl.exe","compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNvbXB1dGVyIiU=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcYWR2YXBpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcY21kLmV4ZSAvYyA4ODgzMTc0Mzg5MzM2Ny5iYXQ=","type":"Ansi","source":"Process Commandline","process":"cmd.exe","filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcY3NjcmlwdC5leGU=","type":"Unicode","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcdmVyc2lvbi5kbGw=","type":"Unicode","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"KmcuUk8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnR5cGVfaW5mb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Ly9ub2xvZ28gbS52YnM=","type":"Ansi","source":"Process Commandline","process":"cscript.exe","filename":"cscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"L0M6XEBXQU5BRH4xLkVYRUM6XEBXYW5hRGVjcnlwdG9yQC5leGVkNzl6bnJnZmZkZGRlNmsxU1BTfE8pRHY8IC11Vg==","type":"Ansi","source":"File String Dumps","process":null,"filename":"@WanaDecryptor@.exe.lnk","compromised":null,"detection_total":null,"total":null},{"value":"MDVmOTVlZmUtN2Y3NS00OWM3LWE5OTQtNjBhNTVjYzA5NTcx","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MGJjYTQ3ODQtODI1Ny01MWEwLWQ5ZWMtMjRmZTFmZTRjOTBk","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MTg2MDhlNjItYTYyOC00OWQ5LThjMDItNTU5NzJlMDk3ZDI0","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MWFmZjYwODktZTg2My00ZDM2LWJkZmQtMzU4MWYwNzQ0MGJl","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Mi9PLV8uWDh3Lis=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"MjhkY2MyOGItM2UzMS01MjdiLWVmZDYtYjRjYzRkNzNkMTU3","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzAzMzZlZDQtZTMyNy00NDdjLTlkZTAtNTFiNjUyYzg2MTA4","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzI5ODBmMjYtYzhmNS01NzY3LTZiMjYtNjM1YjNmYTgzYzYx","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2M3NGFmYjktOGQ4Mi00NGUzLWI1MmMtMzY1ZGJmNDgzODJh","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NDk2YjNjMTktOWRjYS01MWE1LTE4N2MtNWM3NDY3ODVmZTRl","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NGU3YWRkMWEtNjk0NS00MzVhLTgyYjYtNjEyNjg4YmE5ZjU3","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTdhNmVkMWEtNzlmNy01MDExLWIyNDItNDc4NGU1NjIwY2Y3","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NWViNjBiMzYtNjIwNi01NTM4LWU2MGEtMGE3YWY4YTFlNTlk","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ni4xLjc2MDEuMTc1MTQgKHdpbjdzcDFfcnRtLjEwMTExOS0xODUwKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"NjczY2Y4MDAtMjA4YS01MzI3LTNmNGItMmJlNDRhNjY2Mjdh","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NmNhNTJhOTAtNDJhMC01ODA4LWViYmYtYTE3OWMyYTM4ZjMz","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NzAzZmNjMTMtYjY2Zi01ODY4LWRkZDktZTJkYjdmMzgxZmZi","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"N2EwMWU3ZmItYjZhNC00NTg1LWIxYTgtZWEyMDk0ZWNiNGM1","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"N25hZXN1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"ODU4MGZhNTktZDhkNy00MDMwLWJhNmItMDZhMTQ2Y2M3Mjc0","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ODg4MzE3NDM4OTMzNjcuYmF0","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OGNjY2EyN2QtZjFkOC00ZGRhLWI1ZGQtMzM5YWVlOTM3NzMx","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OWEyZWRiOGYtNTg4My00OTlmLWFjZWQtNmU0YjY5ZDQzZGRm","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRQUVAQUJRQkRAWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRQUVAQUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQFFBRUBYWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xdHlwZV9pbmZvQEBVQUVAWFo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P19DQD8xPz9fTnVsbHN0ckA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAQ0FQQkdYWkA0R0I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P19Fb3NAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQEFBRVhJQFo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P19Hcm93QD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEBBQUVfTklfTkBa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P19TcGxpdEA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAQUFFWFha","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P19UaWR5QD8kYmFzaWNfc3RyaW5nQEdVPyRjaGFyX3RyYWl0c0BHQHN0ZEBAVj8kYWxsb2NhdG9yQEdAMkBAc3RkQEBBQUVYX05AWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P2Fzc2lnbkA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAUUFFQUFWMTJAQUJWMTJASUlAWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P2Fzc2lnbkA/JGJhc2ljX3N0cmluZ0BHVT8kY2hhcl90cmFpdHNAR0BzdGRAQFY/JGFsbG9jYXRvckBHQDJAQHN0ZEBAUUFFQUFWMTJAUEJHSUBa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"P25wb3NAPyRiYXNpY19zdHJpbmdAR1U/JGNoYXJfdHJhaXRzQEdAc3RkQEBWPyRhbGxvY2F0b3JAR0AyQEBzdGRAQDJJQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"QGVjaG8gb2ZmZWNobyBTRVQgb3cgPSBXU2NyaXB0LkNyZWF0ZU9iamVjdCgiV1NjcmlwdC5TaGVsbCIpPiBtLnZic2VjaG8gU0VUIG9tID0gb3cuQ3JlYXRlU2hvcnRjdXQoIkM6XEBXYW5hRGVjcnlwdG9yQC5leGUubG5rIik+PiBtLnZic2VjaG8gb20uVGFyZ2V0UGF0aCA9ICJDOlxAV2FuYURlY3J5cHRvckAuZXhlIj4+IG0udmJzZWNobyBvbS5TYXZlPj4gbS52YnNjc2NyaXB0LmV4ZSAvL25vbG9nbyBtLnZic2RlbCBtLnZic2RlbCAvYSAlMA==","type":"Ansi","source":"File String Dumps","process":null,"filename":"88831743893367.bat","compromised":null,"detection_total":null,"total":null},{"value":"QFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QFdhbmFEZWNyeXB0b3JALmV4ZSBmaQ==","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XD8/XEM6XHRlbXBkaXJcbm9kZV9tb2R1bGVzXEBwbTJcYWdlbnRcbm9kZV9tb2R1bGVzXGV2ZW50ZW1pdHRlcjJcTElDRU5TRS50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcV2luZG93c1xTeXN0ZW0zMlxjb25ob3N0LmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcV2luZG93c1xTeXNXT1c2NFxjbWQuZXhl","type":"Ansi","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcV2luZG93c1xTeXNXT1c2NFxjc2NyaXB0LmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"cmd.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFBJUEVcc3J2c3Zj","type":"Unicode","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XVBDKHIodCl0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X19DeHhGcmFtZUhhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X19nZXRtYWluYXJncw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19jb21tb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X19XU0FGRElzU2V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"X2xvY2FsX3Vud2luZDI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YTMwNjRmYzktNGQyMi01NGM5LTAwMDMtMWY5MDU5NDU1NGQz","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YTQwYjQ1NWMtMjUzYy00MzExLWFjNmQtNmU2NjdlZGNjZWZj","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb2NhdGVBbmRJbml0aWFsaXplU2lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"QW1zaUluaXRpYWxpemU=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaVNjYW5TdHJpbmc=","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaVVuaW5pdGlhbGl6ZQ==","type":"Ansi","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXByb2Nlc3N0aHJlYWRzLWwxLTEtMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"cscript.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXguaUQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YjZmZDcxMGItZjc4My00YjFjLWFiOWMtYzY4MDk5ZGNjMGM3","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Yjc0OTU1M2ItZDk1MC01ZTAzLTYyODItMzE0NWE2MWIxMDAy","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmYzMDQ2NWItZTkzYy00NmZkLTljZGYtZjQxYzg5MDRhMDFm","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Qml0Qmx0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"QnJpbmdXaW5kb3dUb1RvcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YnVmZmVyIGVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"WannaCry.exe.sample","compromised":null,"detection_total":null,"total":null},{"value":"YzEzNzYzMzgtMDk4NC00OGI4LWI5MzMtOWM3ZDc3OWZkODRk","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzdlMDllMmEtYzY2My01Mzk5LWFmNzktMmZjY2QzMjFkMTlh","type":"Ansi","source":"Runtime Data","process":"taskdl.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFJlY3ljbGUuQmluXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFJlY3ljbGUuQmluXFMtMS01LTE4XCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFJlY3ljbGUuQmluXFMtMS01LTIxLTEyNzExODc4NzQtMTkzODIzMjQ0OC0zODEyMzkyMjM1LTEwMDBcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFJlY3ljbGUuQmluXFMtMS01LTIxLTEyNzExODc4NzQtMTkzODIzMjQ0OC0zODEyMzkyMjM1LTEwMDFcJFJaNVkzU01cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFJlY3ljbGUuQmluXFMtMS01LTIxLTEyNzExODc4NzQtMTkzODIzMjQ0OC0zODEyMzkyMjM1LTEwMDFcJFJaNVkzU01cMS4wXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFJlY3ljbGUuQmluXFMtMS01LTIxLTEyNzExODc4NzQtMTkzODIzMjQ0OC0zODEyMzkyMjM1LTEwMDFcJFJaNVkzU01cMS4wXENhY2hlXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFJlY3ljbGUuQmluXFMtMS01LTIxLTEyNzExODc4NzQtMTkzODIzMjQ0OC0zODEyMzkyMjM1LTEwMDFcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcJFdpblJFQWdlbnRcU2NyYXRjaFwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcQ29uZmlnLk1zaVwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDExLTAwMDAtMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDExLTAwMDAtMTAwMC0wMDAwMDAwRkYxQ0V9LUNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDExLTAwMDAtMTAwMC0wMDAwMDAwRkYxQ0V9LUNcQFdhbmFEZWNyeXB0b3JALmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDE2LTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDE4LTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDE5LTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDFBLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDFCLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDJDLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDJDLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcUHJvb2YuZW5cKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDJDLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcUHJvb2YuZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDJDLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcUHJvb2YuZnJcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDQzLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMDQ0LTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMEExLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMEJBLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMTE1LTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMTE1LTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcMTAzM1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMTE3LTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcTVNPQ2FjaGVcQWxsIFVzZXJzXHs5MDE0MDAwMC0wMTE3LTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcQWNjZXNzLmVuLXVzXCo=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcU3lzdGVtIFZvbHVtZSBJbmZvcm1hdGlvblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcLmJpblwq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcLmJpblxAUGxlYXNlX1JlYWRfTWVALnR4dA==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcLmJpblxAV2FuYURlY3J5cHRvckAuZXhl","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1wq","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcQFdhbmFEZWNyeXB0b3JALmV4ZS5sbms=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcZXhhbXBsZXNcKg==","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcdGVtcGRpclxub2RlX21vZHVsZXNcQGNvbG9yc1xjb2xvcnNcZXhhbXBsZXNcQFBsZWFzZV9SZWFkX01lQC50eHQ=","type":"Unicode","source":"Runtime Data","process":"WannaCry.exe.sample.exe","filen