diff --git a/data/model.json b/data/model.json index ad5cfaf..af2b8c7 100644 --- a/data/model.json +++ b/data/model.json @@ -1 +1 @@ -{"rules": [{"id": "7e4bfe58-4a47-4709-828d-d86c78b7cc1f", "title": "Cleartext Protocol Usage Via Netflow", "file": "../sigma/rules/compliance/netflow_cleartext_protocols.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": null}, {"id": "1a395cbc-a84a-463a-9086-ed8a70e573c7", "title": "Default Credentials Usage", "file": "../sigma/rules/compliance/default_credentials_usage.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "qualys"}, {"id": "6b2066c8-3dc7-4db7-9db0-6cc1d7b0dde9", "title": "Host Without Firewall", "file": "../sigma/rules/compliance/host_without_firewall.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "qualys"}, {"id": "fd435618-981e-4a7c-81f8-f78ce480d616", "title": "Django Framework Exceptions", "file": "../sigma/rules/application/django/appframework_django_exceptions.yml", "status": "stable", "level": "medium", "logsource.category": "application", "logsource.product": "django"}, {"id": "0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a", "title": "Ruby on Rails Framework Exceptions", "file": "../sigma/rules/application/ruby/appframework_ruby_on_rails_exceptions.yml", "status": "stable", "level": "medium", "logsource.category": "application", "logsource.product": "ruby_on_rails"}, {"id": "19aefed0-ffd4-47dc-a7fc-f8b1425e84f9", "title": "Python SQL Exceptions", "file": "../sigma/rules/application/python/app_python_sql_exceptions.yml", "status": "stable", "level": "medium", "logsource.category": "application", "logsource.product": "python"}, {"id": "8a670c6d-7189-4b1c-8017-a417ca84a086", "title": "Suspicious SQL Error Messages", "file": "../sigma/rules/application/sql/app_sqlinjection_errors.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "sql"}, {"id": "97661d9d-2beb-4630-b423-68985291a8af", "title": "Potential RCE Exploitation Attempt In NodeJS", "file": "../sigma/rules/application/nodejs/nodejs_rce_exploitation_attempt.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "nodejs"}, {"id": "e9edd087-89d8-48c9-b0b4-5b9bb10896b8", "title": "Potential SpEL Injection In Spring Framework", "file": "../sigma/rules/application/spring/spring_spel_injection.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "spring"}, {"id": "ae48ab93-45f7-4051-9dfe-5d30a3f78e33", "title": "Spring Framework Exceptions", "file": "../sigma/rules/application/spring/spring_application_exceptions.yml", "status": "stable", "level": "medium", "logsource.category": "application", "logsource.product": "spring"}, {"id": "68050b10-e477-4377-a99b-3721b422d6ef", "title": "Remote DCOM/WMI Lateral Movement", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_remote_dcom_or_wmi.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "b6ea3cc7-542f-43ef-bbe4-980fbed444c7", "title": "Remote Server Service Abuse", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_remote_server_service_abuse.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "6d580420-ff3f-4e0e-b6b0-41b90c787e28", "title": "SharpHound Recon Sessions", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_sharphound_recon_sessions.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "0a3ff354-93fc-4273-8a03-1078782de5b7", "title": "Recon Activity via SASec", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_sasec_recon.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "2053961f-44c7-4a64-b62d-f6e72800af0d", "title": "Remote Event Log Recon", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_eventlog_recon.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "65f77b1e-8e79-45bf-bb67-5988a8ce45a5", "title": "SharpHound Recon Account Discovery", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_sharphound_recon_account.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "56fda488-113e-4ce9-8076-afc2457922c3", "title": "Possible DCSync Attack", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_dcsync_attack.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d", "title": "Remote Schedule Task Lateral Movement via ITaskSchedulerService", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_lateral_movement.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "10018e73-06ec-46ec-8107-9172f1e04ff2", "title": "Remote Server Service Abuse for Lateral Movement", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_remote_service_lateral_movement.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "bc3a4b0c-e167-48e1-aa88-b3020950e560", "title": "Remote Printing Abuse for Lateral Movement", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_printing_lateral_movement.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "5f92fff9-82e2-48eb-8fc1-8b133556a551", "title": "Remote Encrypting File System Abuse", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_efs_abuse.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "0fcd1c79-4eeb-4746-aba9-1b458f7a79cb", "title": "Remote Schedule Task Lateral Movement via ATSvc", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_atsvc_lateral_movement.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "f177f2bc-5f3e-4453-b599-57eefce9a59c", "title": "Remote Schedule Task Recon via AtScv", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_atsvc_recon.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "35c55673-84ca-4e99-8d09-e334f3c29539", "title": "Remote Registry Lateral Movement", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_remote_registry_lateral_movement.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "aff229ab-f8cd-447b-b215-084d11e79eb0", "title": "Remote Schedule Task Lateral Movement via SASec", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_sasec_lateral_movement.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "d8ffe17e-04be-4886-beb9-c1dd1944b9a8", "title": "Remote Registry Recon", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_remote_registry_recon.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "7f7c49eb-2977-4ac8-8ab0-ab1bae14730e", "title": "Remote Schedule Task Recon via ITaskSchedulerService", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_recon.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "bb0e9cec-d4da-46f5-997f-22efc59f3dca", "title": "Potential JNDI Injection Exploitation In JVM Based Application", "file": "../sigma/rules/application/jvm/java_jndi_injection_exploitation_attempt.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "jvm"}, {"id": "d65f37da-a26a-48f8-8159-3dde96680ad2", "title": "Process Execution Error In JVM Based Application", "file": "../sigma/rules/application/jvm/java_rce_exploitation_attempt.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "jvm"}, {"id": "e032f5bc-4563-4096-ae3b-064bab588685", "title": "Potential Local File Read Vulnerability In JVM Based Application", "file": "../sigma/rules/application/jvm/java_local_file_read.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "jvm"}, {"id": "4d0af518-828e-4a04-a751-a7d03f3046ad", "title": "Potential OGNL Injection Exploitation In JVM Based Application", "file": "../sigma/rules/application/jvm/java_ognl_injection_exploitation_attempt.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "jvm"}, {"id": "c4e06896-e27c-4583-95ac-91ce2279345d", "title": "Potential XXE Exploitation Attempt In JVM Based Application", "file": "../sigma/rules/application/jvm/java_xxe_exploitation_attempt.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "jvm"}, {"id": "16c86189-b556-4ee8-b4c7-7e350a195a4f", "title": "Potential Server Side Template Injection In Velocity", "file": "../sigma/rules/application/velocity/velocity_ssti_injection.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "velocity"}, {"id": "3132570d-cab2-4561-9ea6-1743644b2290", "title": "Kubernetes Events Deleted", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_events_deleted.yml", "status": "experimental", "level": "medium", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "a80d927d-ac6e-443f-a867-e8d6e3897318", "title": "Creation Of Pod In System Namespace", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_pod_in_system_namespace.yml", "status": "experimental", "level": "medium", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "0c9b3bda-41a6-4442-9345-356ae86343dc", "title": "Kubernetes CronJob/Job Modification", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_cronjob_modification.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "kubernetes"}, {"id": "a1b0ca4e-7835-413e-8471-3ff2b8a66be6", "title": "Potential Remote Command Execution In Pod Container", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_exec_into_container.yml", "status": "experimental", "level": "medium", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "0d933542-1f1f-420d-97d4-21b2c3c492d9", "title": "Kubernetes Unauthorized or Unauthenticated Access", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_unauthorized_unauthenticated_actions.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "kubernetes"}, {"id": "84b777bd-c946-4d17-aa2e-c39f5a454325", "title": "RBAC Permission Enumeration Attempt", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_rbac_permisions_listing.yml", "status": "experimental", "level": "low", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "58d31a75-a4f8-4c40-985b-373d58162ca2", "title": "Kubernetes Secrets Modified or Deleted", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_secrets_modified_or_deleted.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "kubernetes"}, {"id": "eed82177-38f5-4299-8a76-098d50d225ab", "title": "Kubernetes Admission Controller Modification", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_change_admission_controller.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "kubernetes"}, {"id": "eeb3e9e1-b685-44e4-9232-6bb701f925b5", "title": "Kubernetes Secrets Enumeration", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_secrets_enumeration.yml", "status": "experimental", "level": "low", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "ad9012a6-e518-4432-9890-f3b82b8fc71f", "title": "Potential Sidecar Injection Into Running Deployment", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_sidecar_injection.yml", "status": "experimental", "level": "medium", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "402b955c-8fe0-4a8c-b635-622b4ac5f902", "title": "Container With A hostPath Mount Created", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_hostpath_mount.yml", "status": "experimental", "level": "low", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "40967487-139b-4811-81d9-c9767a92aa5a", "title": "Deployment Deleted From Kubernetes Cluster", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_deployment_deleted.yml", "status": "experimental", "level": "low", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "c5cd1b20-36bb-488d-8c05-486be3d0cb97", "title": "Privileged Container Deployed", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_privileged_pod_creation.yml", "status": "experimental", "level": "low", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "10b97915-ec8d-455f-a815-9a78926585f6", "title": "Kubernetes Rolebinding Modification", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_rolebinding_modification.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "kubernetes"}, {"id": "e31bae15-83ed-473e-bf31-faf4f8a17d36", "title": "New Kubernetes Service Account Created", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_serviceaccount_creation.yml", "status": "experimental", "level": "low", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "e9856028-fd4e-46e6-b3d1-10f7ceb95078", "title": "OpenCanary - SNMP OID Request", "file": "../sigma/rules/application/opencanary/opencanary_snmp_cmd.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "547dfc53-ebf6-4afe-8d2e-793d9574975d", "title": "OpenCanary - REDIS Action Command Attempt", "file": "../sigma/rules/application/opencanary/opencanary_redis_command.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "512cff7a-683a-43ad-afe0-dd398e872f36", "title": "OpenCanary - Telnet Login Attempt", "file": "../sigma/rules/application/opencanary/opencanary_telnet_login_attempt.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "4fe17521-aef3-4e6a-9d6b-4a7c8de155a8", "title": "OpenCanary - GIT Clone Request", "file": "../sigma/rules/application/opencanary/opencanary_git_clone_request.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "af1ac430-df6b-4b38-b976-0b52f07a0252", "title": "OpenCanary - HTTP POST Login Attempt", "file": "../sigma/rules/application/opencanary/opencanary_http_post_login_attempt.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "6991bc2b-ae2e-447f-bc55-3a1ba04c14e5", "title": "OpenCanary - FTP Login Attempt", "file": "../sigma/rules/application/opencanary/opencanary_ftp_login_attempt.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "b4e6b016-a2ac-4759-ad85-8000b300d61e", "title": "OpenCanary - TFTP Request", "file": "../sigma/rules/application/opencanary/opencanary_tftp_request.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "22777c9e-873a-4b49-855f-6072ab861a52", "title": "OpenCanary - SMB File Open Request", "file": "../sigma/rules/application/opencanary/opencanary_smb_file_open.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "af6c3078-84cd-4c68-8842-08b76bd81b13", "title": "OpenCanary - HTTP GET Request", "file": "../sigma/rules/application/opencanary/opencanary_http_get.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "cd55f721-5623-4663-bd9b-5229cab5237d", "title": "OpenCanary - SSH New Connection Attempt", "file": "../sigma/rules/application/opencanary/opencanary_ssh_new_connection.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "ff7139bc-fdb1-4437-92f2-6afefe8884cb", "title": "OpenCanary - SSH Login Attempt", "file": "../sigma/rules/application/opencanary/opencanary_ssh_login_attempt.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "5498fc09-adc6-4804-b9d9-5cca1f0b8760", "title": "OpenCanary - HTTPPROXY Login Attempt", "file": "../sigma/rules/application/opencanary/opencanary_httpproxy_login_attempt.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "7cded4b3-f09e-405a-b96f-24248433ba44", "title": "OpenCanary - NTP Monlist Request", "file": "../sigma/rules/application/opencanary/opencanary_ntp_monlist.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "3ec9a16d-0b4f-4967-9542-ebf38ceac7dd", "title": "OpenCanary - MSSQL Login Attempt Via SQLAuth", "file": "../sigma/rules/application/opencanary/opencanary_mssql_login_sqlauth.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "9db5446c-b44a-4291-8b89-fcab5609c3b3", "title": "OpenCanary - VNC Connection Attempt", "file": "../sigma/rules/application/opencanary/opencanary_vnc_connection_attempt.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "e30de276-68ec-435c-ab99-ef3befec6c61", "title": "OpenCanary - SIP Request", "file": "../sigma/rules/application/opencanary/opencanary_sip_request.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "e7d79a1b-25ed-4956-bd56-bd344fa8fd06", "title": "OpenCanary - MySQL Login Attempt", "file": "../sigma/rules/application/opencanary/opencanary_mysql_login_attempt.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "6e78f90f-0043-4a01-ac41-f97681613a66", "title": "OpenCanary - MSSQL Login Attempt Via Windows Authentication", "file": "../sigma/rules/application/opencanary/opencanary_mssql_login_winauth.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "dfe8b941-4e54-4242-b674-6b613d521962", "title": "Startup Item File Created - MacOS", "file": "../sigma/rules/macos/file_event/file_event_macos_susp_startup_item_created.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "macos"}, {"id": "23c43900-e732-45a4-8354-63e4a6c187ce", "title": "MacOS Emond Launch Daemon", "file": "../sigma/rules/macos/file_event/file_event_macos_emond_launch_daemon.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "macos"}, {"id": "47d65ac0-c06f-4ba2-a2e3-d263139d0f51", "title": "Potential XCSSET Malware Infection", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_xcsset_malware_infection.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "65d506d3-fcfe-4071-b4b2-bcefe721bbbb", "title": "Potential Persistence Via PlistBuddy", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_persistence_via_plistbuddy.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "5d0fdb62-f225-42fb-8402-3dfe64da468a", "title": "User Added To Admin Group Via DseditGroup", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_dseditgroup_add_to_admin_group.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "b743623c-2776-40e0-87b1-682b975d0ca5", "title": "User Added To Admin Group Via Dscl", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_dscl_add_user_to_admin_group.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "089dbdf6-b960-4bcc-90e3-ffc3480c20f6", "title": "File and Directory Discovery - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_file_and_directory_discovery.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "2d5e7a8b-f484-4a24-945d-7f0efd52eab0", "title": "System Information Discovery Using Ioreg", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "58800443-f9fc-4d55-ae0c-98a3966dfb97", "title": "System Network Discovery - macOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_susp_system_network_discovery.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "5de06a6f-673a-4fc0-8d48-bcfe3837b033", "title": "System Information Discovery Using sw_vers", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_swvers_discovery.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "1cf98dc2-fcb0-47c9-8aea-654c9284d1ae", "title": "Disk Image Creation Via Hdiutil - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "7ed2c9f7-c59d-4c82-a7e2-f859aa676099", "title": "Suspicious MacOS Firmware Activity", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_susp_macos_firmware_activity.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "b120b587-a4c2-4b94-875d-99c9807d6955", "title": "Credentials from Password Stores - Keychain", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_creds_from_keychain.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "7c3b43d8-d794-47d2-800a-d277715aa460", "title": "Scheduled Cron Task/Job - MacOs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_schedule_task_job_cron.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "9a7a0393-2144-4626-9bf1-7c2f5a7321db", "title": "System Network Connections Discovery - MacOs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_system_network_connections_discovery.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "2316929c-01aa-438c-970f-099145ab1ee6", "title": "JAMF MDM Potential Suspicious Child Process", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_jamf_susp_child.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "6d8a7cf1-8085-423b-b87d-7e880faabbdf", "title": "File Download Via Nscurl - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_nscurl_usage.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "2c95fa8a-8b8d-4787-afce-7117ceb8e3da", "title": "Time Machine Backup Disabled Via Tmutil - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "95361ce5-c891-4b0a-87ca-e24607884a96", "title": "Binary Padding - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_binary_padding.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "1bc2e6c5-0885-472b-bed6-be5ea8eace55", "title": "MacOS Scripting Interpreter AppleScript", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_applescript.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "acf61bd8-d814-4272-81f0-a7a269aa69aa", "title": "Indicator Removal on Host - Clear Mac System Logs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_clear_system_logs.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "ddf36b67-e872-4507-ab2e-46bda21b842c", "title": "Local System Accounts Discovery - MacOs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_local_account.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "bf241472-f014-4f01-a869-96f99330ca8c", "title": "Disk Image Mounting Via Hdiutil - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "e0cfaecd-602d-41af-988d-f6ccebb2af26", "title": "Suspicious Installer Package Child Process", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "69483748-1525-4a6c-95ca-90dc8d431b68", "title": "Suspicious Microsoft Office Child Process - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_office_susp_child_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "508a9374-ad52-4789-b568-fc358def2c65", "title": "Suspicious History File Operations", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_susp_histfile_operations.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "b9d9b652-d8ed-4697-89a2-a1186ee680ac", "title": "OSACompile Run-Only Execution", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_osacompile_runonly_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "f1408a58-0e94-4165-b80a-da9f96cf6fc3", "title": "JXA In-memory Execution Via OSAScript", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_jxa_in_memory_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "13db8d2e-7723-4c2c-93c1-a4d36994f7ef", "title": "Potential In-Memory Download And Compile Of Payloads", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_susp_in_memory_download_and_compile.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "be2e3a5c-9cc7-4d02-842a-68e9cb26ec49", "title": "JAMF MDM Execution", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_jamf_usage.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "84bae5d4-b518-4ae0-b331-6d4afd34d00f", "title": "MacOS Network Service Scanning", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_network_service_scanning.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "652c098d-dc11-4ba6-8566-c20e89042f2b", "title": "User Added To Admin Group Via Sysadminctl", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "0877ed01-da46-4c49-8476-d49cdd80dfa7", "title": "Screen Capture - macOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_screencapture.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "234dc5df-40b5-49d1-bf53-0d44ce778eca", "title": "Payload Decoded and Decrypted via Built-in Utilities", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_payload_decoded_and_decrypted.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "10227522-8429-47e6-a301-f2b2d014e7ad", "title": "Macos Remote System Discovery", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_remote_system_discovery.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "719c22d7-c11a-4f2c-93a6-2cfdd5412f68", "title": "Decode Base64 Encoded Text -MacOs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_base64_decode.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "a753a6af-3126-426d-8bd0-26ebbcb92254", "title": "Osacompile Execution By Potentially Suspicious Applet/Osascript", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_suspicious_applet_behaviour.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "0ed75b9c-c73b-424d-9e7d-496cd565fbe0", "title": "Security Software Discovery - MacOs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_security_software_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "51719bf5-e4fd-4e44-8ba8-b830e7ac0731", "title": "Creation Of A Local User Account", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_create_account.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "85de3a19-b675-4a51-bfc6-b11a5186c971", "title": "Potential Discovery Activity Using Find - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_susp_find_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "7794fa3c-edea-4cff-bec7-267dd4770fd7", "title": "Clipboard Data Collection Via OSAScript", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_clipboard_data_via_osascript.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "4809c683-059b-4935-879d-36835986f8cf", "title": "System Information Discovery Using System_Profiler", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "6ff08e55-ea53-4f27-94a1-eff92e6d9d5c", "title": "System Information Discovery Via Sysctl - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_sysctl_discovery.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "53821412-17b0-4147-ade0-14faae67d54b", "title": "System Integrity Protection (SIP) Enumeration", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4", "title": "Suspicious Execution via macOS Script Editor", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_susp_execution_macos_script_editor.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "40b1fbe2-18ea-4ee7-be47-0294285811de", "title": "System Shutdown/Reboot - MacOs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_system_shutdown_reboot.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "b22a5b36-2431-493a-8be1-0bae56c28ef3", "title": "Hidden User Creation", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_create_hidden_account.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e", "title": "Launch Agent/Daemon Execution Via Launchctl", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_launchctl_execution.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "f5141b6d-9f42-41c6-a7bf-2a780678b29b", "title": "Gatekeeper Bypass via Xattr", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "89bb1f97-c7b9-40e8-b52b-7d6afbd67276", "title": "Local Groups Discovery - MacOs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_local_groups.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "adc9bcc4-c39c-4f6b-a711-1884017bf043", "title": "Network Sniffing - MacOs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_network_sniffing.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "60f1ce20-484e-41bd-85f4-ac4afec2c541", "title": "GUI Input Capture - macOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_gui_input_capture.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "0250638a-2b28-4541-86fc-ea4c558fa0c6", "title": "Suspicious Browser Child Process - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_susp_browser_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "09a910bf-f71f-4737-9c40-88880ba5913d", "title": "Potential Base64 Decoded From Images", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_tail_base64_decode_from_image.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "821bcf4d-46c7-4b87-bc57-9509d3ba7c11", "title": "Root Account Enable Via Dsenableroot", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_dsenableroot_enable_root_account.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "9acf45ed-3a26-4062-bf08-56857613eb52", "title": "New File Exclusion Added To Time Machine Via Tmutil - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "ff39f1a6-84ac-476f-a1af-37fcdf53d7c0", "title": "Disable Security Tools", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_disable_security_tools.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe", "title": "Hidden Flag Set On File/Directory Via Chflags - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0", "title": "File Time Attribute Change", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_change_file_time_attr.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "3603f18a-ec15-43a1-9af2-d196c8a7fec6", "title": "System Integrity Protection (SIP) Disabled", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "f459ccb4-9805-41ea-b5b2-55e279e2424a", "title": "Remote Access Tool - Team Viewer Session Started On MacOS Host", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "452df256-da78-427a-866f-49fa04417d74", "title": "Time Machine Backup Deletion Attempt Via Tmutil - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "7f2bb9d5-6395-4de5-969c-70c11fbe6b12", "title": "Split A File Into Pieces", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_split_file_into_pieces.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "53b1b378-9b06-4992-b972-dde6e423d2b4", "title": "Credentials In Files", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_find_cred_in_files.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "f68c4a4f-19ef-4817-952c-50dce331f4b0", "title": "Potential WizardUpdate Malware Infection", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_wizardupdate_malware_infection.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "b6e2a2e3-2d30-43b1-a4ea-071e36595690", "title": "Space After Filename - macOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_space_after_filename.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "d7329412-13bd-44ba-a072-3387f804a106", "title": "Guest Account Enabled Via Sysadminctl", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "980a7598-1e7f-4962-9372-2d754c930d0e", "title": "Google Full Network Traffic Packet Capture", "file": "../sigma/rules/cloud/gcp/audit/gcp_full_network_traffic_packet_capture.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "6b67c12e-5e40-47c6-b3b0-1e6b571184cc", "title": "Google Cloud Service Account Modified", "file": "../sigma/rules/cloud/gcp/audit/gcp_service_account_modified.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "2f0bae2d-bf20-4465-be86-1311addebaa3", "title": "Google Cloud Kubernetes Secrets Modified or Deleted", "file": "../sigma/rules/cloud/gcp/audit/gcp_kubernetes_secrets_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "234f9f48-904b-4736-a34c-55d23919e4b7", "title": "Google Cloud Re-identifies Sensitive Information", "file": "../sigma/rules/cloud/gcp/audit/gcp_dlp_re_identifies_sensitive_information.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "cd3a808c-c7b7-4c50-a2f3-f4cfcd436435", "title": "Google Cloud Kubernetes CronJob", "file": "../sigma/rules/cloud/gcp/audit/gcp_kubernetes_cronjob.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "76737c19-66ee-4c07-b65a-a03301d1573d", "title": "GCP Break-glass Container Workload Deployed", "file": "../sigma/rules/cloud/gcp/audit/gcp_breakglass_container_workload_deployed.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "4d9f2ee2-c903-48ab-b9c1-8c0f474913d0", "title": "Google Cloud Storage Buckets Modified or Deleted", "file": "../sigma/rules/cloud/gcp/audit/gcp_bucket_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "6ad91e31-53df-4826-bd27-0166171c8040", "title": "Google Cloud Kubernetes Admission Controller", "file": "../sigma/rules/cloud/gcp/audit/gcp_kubernetes_admission_controller.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "f346bbd5-2c4e-4789-a221-72de7685090d", "title": "Google Cloud SQL Database Modified or Deleted", "file": "../sigma/rules/cloud/gcp/audit/gcp_sql_database_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "32438676-1dba-4ac7-bf69-b86cba995e05", "title": "GCP Access Policy Deleted", "file": "../sigma/rules/cloud/gcp/audit/gcp_access_policy_deleted.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "99980a85-3a61-43d3-ac0f-b68d6b4797b1", "title": "Google Cloud VPN Tunnel Modified or Deleted", "file": "../sigma/rules/cloud/gcp/audit/gcp_vpn_tunnel_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "28268a8f-191f-4c17-85b2-f5aa4fa829c3", "title": "Google Cloud DNS Zone Modified or Deleted", "file": "../sigma/rules/cloud/gcp/audit/gcp_dns_zone_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "fe513c69-734c-4d4a-8548-ac5f609be82b", "title": "Google Cloud Firewall Modified or Deleted", "file": "../sigma/rules/cloud/gcp/audit/gcp_firewall_rule_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "13f81a90-a69c-4fab-8f07-b5bb55416a9f", "title": "Google Cloud Service Account Disabled or Deleted", "file": "../sigma/rules/cloud/gcp/audit/gcp_service_account_disabled_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "0322d9f2-289a-47c2-b5e1-b63c90901a3e", "title": "Google Cloud Kubernetes RoleBinding", "file": "../sigma/rules/cloud/gcp/audit/gcp_kubernetes_rolebinding.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "e2feb918-4e77-4608-9697-990a1aaf74c3", "title": "Google Cloud Storage Buckets Enumeration", "file": "../sigma/rules/cloud/gcp/audit/gcp_bucket_enumeration.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "gcp"}, {"id": "780601d1-6376-4f2a-884e-b8d45599f78c", "title": "Google Workspace MFA Disabled", "file": "../sigma/rules/cloud/gcp/gworkspace/gcp_gworkspace_mfa_disabled.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "bf638ef7-4d2d-44bb-a1dc-a238252e6267", "title": "Google Workspace Role Privilege Deleted", "file": "../sigma/rules/cloud/gcp/gworkspace/gcp_gworkspace_role_privilege_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "04e2a23a-9b29-4a5c-be3a-3542e3f982ba", "title": "Google Workspace Granted Domain API Access", "file": "../sigma/rules/cloud/gcp/gworkspace/gcp_gworkspace_granted_domain_api_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "ee2803f0-71c8-4831-b48b-a1fc57601ee4", "title": "Google Workspace Application Removed", "file": "../sigma/rules/cloud/gcp/gworkspace/gcp_gworkspace_application_removed.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "6aef64e3-60c6-4782-8db3-8448759c714e", "title": "Google Workspace Role Modified or Deleted", "file": "../sigma/rules/cloud/gcp/gworkspace/gcp_gworkspace_role_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "2d1b83e4-17c6-4896-a37b-29140b40a788", "title": "Google Workspace User Granted Admin Privileges", "file": "../sigma/rules/cloud/gcp/gworkspace/gcp_gworkspace_user_granted_admin_privileges.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "22f2fb54-5312-435d-852f-7c74f81684ca", "title": "Google Workspace Application Access Level Modified", "file": "../sigma/rules/cloud/gcp/gworkspace/gcp_gworkspace_application_access_levels_modified.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "a3501e8e-af9e-43c6-8cd6-9360bdaae498", "title": "Activity from Suspicious IP Addresses", "file": "../sigma/rules/cloud/m365/threat_detection/microsoft365_from_susp_ip_addresses.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "42127bdd-9133-474f-a6f1-97b6c08a4339", "title": "New Federated Domain Added - Exchange", "file": "../sigma/rules/cloud/m365/exchange/microsoft365_new_federated_domain_added_exchange.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "18b88d08-d73e-4f21-bc25-4b9892a4fdd0", "title": "PST Export Alert Using eDiscovery Alert", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_pst_export_alert.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "d7eab125-5f94-43df-8710-795b80fa1189", "title": "Microsoft 365 - Impossible Travel Activity", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_impossible_travel_activity.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "c191e2fa-f9d6-4ccf-82af-4f2aba08359f", "title": "Logon from a Risky IP Address", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_logon_from_risky_ip_address.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "6c220477-0b5b-4b25-bb90-66183b4089e8", "title": "Suspicious Inbox Forwarding", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_susp_inbox_forwarding.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "m365"}, {"id": "78a34b67-3c39-4886-8fb4-61c46dc18ecd", "title": "Microsoft 365 - Unusual Volume of File Deletion", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_unusual_volume_of_file_deletion.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "0f2468a2-5055-4212-a368-7321198ee706", "title": "Activity from Infrequent Country", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_activity_from_infrequent_country.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "bd132164-884a-48f1-aa2d-c6d646b04c69", "title": "Microsoft 365 - Potential Ransomware Activity", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_potential_ransomware_activity.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "2e669ed8-742e-4fe5-b3c4-5a59b486c2ee", "title": "Activity Performed by Terminated User", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_activity_by_terminated_user.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "ff246f56-7f24-402a-baca-b86540e3925c", "title": "Microsoft 365 - User Restricted from Sending Email", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_user_restricted_from_sending_email.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "6897cd82-6664-11ed-9022-0242ac120002", "title": "PST Export Alert Using New-ComplianceSearchAction", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_pst_export_alert_using_new_compliancesearchaction.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "2b669496-d215-47d8-bd9a-f4a45bf07cda", "title": "Data Exfiltration to Unsanctioned Apps", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_data_exfiltration_to_unsanctioned_app.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "d8b0a4fe-07a8-41be-bd39-b14afa025d95", "title": "Activity from Anonymous IP Addresses", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_activity_from_anonymous_ip_addresses.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "ee111937-1fe7-40f0-962a-0eb44d57d174", "title": "Suspicious OAuth App File Download Activities", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_susp_oauth_app_file_download_activities.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "58f88172-a73d-442b-94c9-95eaed3cbb36", "title": "New Federated Domain Added", "file": "../sigma/rules/cloud/m365/audit/microsoft365_new_federated_domain_added_audit.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "60de9b57-dc4d-48b9-a6a0-b39e0469f876", "title": "Disabling Multi Factor Authentication", "file": "../sigma/rules/cloud/m365/audit/microsoft365_disabling_mfa.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "m365"}, {"id": "a607e1fe-74bf-4440-a3ec-b059b9103157", "title": "AWS SecurityHub Findings Evasion", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_securityhub_finding_evasion.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "db014773-d9d9-4792-91e5-133337c0ffee", "title": "AWS IAM S3Browser User or AccessKey Creation", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_iam_s3browser_user_or_accesskey_creation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "db014773-7375-4f4e-b83b-133337c0ffee", "title": "AWS IAM S3Browser Templated S3 Bucket Policy Creation", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_iam_s3browser_templated_s3_bucket_policy_creation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "97fbabf8-8e1b-47a2-b7d5-a418d2b95e3d", "title": "AWS Attached Malicious Lambda Layer", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_attached_malicious_lambda_layer.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "33d50d03-20ec-4b74-a74e-1e65a38af1c0", "title": "AWS EKS Cluster Created or Deleted", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_eks_cluster_created_or_deleted.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "38e7f511-3f74-41d4-836e-f57dfa18eead", "title": "Potential Malicious Usage of CloudTrail System Manager", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_ssm_malicious_usage.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "a136ac98-b2bc-4189-a14d-f0d0388e57a7", "title": "AWS S3 Bucket Versioning Disable", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_disable_bucket_versioning.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e", "title": "AWS Suspicious SAML Activity", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_susp_saml_activity.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "14f3f1c8-02d5-43a2-a191-91ffb52d3015", "title": "RDS Database Security Group Modification", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_rds.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "07330162-dba1-4746-8121-a9647d49d297", "title": "AWS Config Disabling Channel/Recorder", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_config_disable_recording.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df", "title": "AWS EC2 Startup Shell Script Change", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_ec2_startup_script_change.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "20f754db-d025-4a8f-9d74-e0037e999a9a", "title": "SES Identity Has Been Deleted", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_delete_identity.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "8ad1600d-e9dc-4251-b0ee-a65268f29add", "title": "AWS Root Credentials", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_root_account_usage.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "16124c2d-e40b-4fcc-8f2c-5ab7870a2223", "title": "AWS EC2 Disable EBS Encryption", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_ec2_disable_encryption.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "78b3756a-7804-4ef7-8555-7b9024a02e2d", "title": "AWS S3 Data Management Tampering", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_s3_data_management_tampering.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "54b9a76a-3c71-4673-b4b3-2edb4566ea7b", "title": "AWS EC2 VM Export Failure", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_ec2_vm_export_failure.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "e1f7febb-7b94-4234-b5c6-00fb8500f5dd", "title": "New Network ACL Entry Added", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_new_acl_entries.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "b94bf91e-c2bf-4047-9c43-c6810f43baad", "title": "AWS ECS Task Definition That Queries The Credential Endpoint", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_ecs_task_definition_cred_endpoint_query.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "4ae68615-866f-4304-b24b-ba048dfa5ca7", "title": "AWS ElastiCache Security Group Created", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_elasticache_security_group_created.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "7a4409fc-f8ca-45f6-8006-127d779eaad9", "title": "LoadBalancer Security Group Modification", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_loadbalancer.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "905d389b-b853-46d0-9d3d-dea0d3a3cd49", "title": "AWS STS AssumeRole Misuse", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_sts_assumerole_misuse.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "8a63cdd4-6207-414a-85bc-7e032bd3c1a2", "title": "AWS RDS Master Password Change", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_rds_change_master_password.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "6a7ba45c-63d8-473e-9736-2eaabff79964", "title": "AWS EFS Fileshare Mount Modified or Deleted", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_efs_fileshare_mount_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "c3f265c7-ff03-4056-8ab2-d486227b4599", "title": "Restore Public AWS RDS Instance", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_rds_public_db_restore.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "b45ab1d2-712f-4f01-a751-df3826969807", "title": "AWS STS GetSessionToken Misuse", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_sts_getsessiontoken_misuse.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "6fb77778-040f-4015-9440-572aa9b6b580", "title": "Ingress/Egress Security Group Modification", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_ingress_egress.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "7c797da2-9cf2-4523-ba64-33b06339f0cc", "title": "AWS ElastiCache Security Group Modified or Deleted", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_elasticache_security_group_modified_or_deleted.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2", "title": "AWS IAM Backdoor Users Keys", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_iam_backdoor_users_keys.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "b056de1a-6e6e-4e40-a67e-97c9808cf41b", "title": "AWS Route 53 Domain Transferred to Another Account", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_route_53_domain_transferred_to_another_account.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "4990c2e3-f4b8-45e3-bc3c-30b14ff0ed26", "title": "AWS Glue Development Endpoint Activity", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_passed_role_to_glue_development_endpoint.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "db014773-b1d3-46bd-ba26-133337c0ffee", "title": "AWS IAM S3Browser LoginProfile Creation", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_iam_s3browser_loginprofile_creation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "d3adb3ef-b7e7-4003-9092-1924c797db35", "title": "AWS Identity Center Identity Provider Change", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_sso_idp_change.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "3940b5f1-3f46-44aa-b746-ebe615b879e0", "title": "AWS Route 53 Domain Transfer Lock Disabled", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_route_53_domain_transferred_lock_disabled.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "f8103686-e3e8-46f3-be72-65f7fcb4aa53", "title": "AWS Console GetSigninToken Potential Abuse", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_console_getsignintoken.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "6e61ee20-ce00-4f8d-8aee-bedd8216f7e3", "title": "AWS GuardDuty Important Change", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_guardduty_disruption.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "abae8fec-57bd-4f87-aff6-6e3db989843d", "title": "AWS Snapshot Backup Exfiltration", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_snapshot_backup_exfiltration.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "4db60cc0-36fb-42b7-9b58-a5b53019fb74", "title": "AWS CloudTrail Important Change", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_disable_logging.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "c803b2ce-c4a2-4836-beae-b112010390b1", "title": "New Network Route Added", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_new_route_added.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "f305fd62-beca-47da-ad95-7690a0620084", "title": "Potential Bucket Enumeration on AWS", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_enum_buckets.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "25cb1ba1-8a19-4a23-a198-d252664c8cef", "title": "AWS EFS Fileshare Modified or Deleted", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_efs_fileshare_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "352a918a-34d8-4882-8470-44830c507aa3", "title": "Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_imds_malicious_usage.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "055fb148-60f8-462d-ad16-26926ce050f1", "title": "AWS User Login Profile Was Modified", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_update_login_profile.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "a717c561-d117-437e-b2d9-0118a7035d01", "title": "OneLogin User Account Locked", "file": "../sigma/rules/cloud/onelogin/onelogin_user_account_locked.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "onelogin"}, {"id": "62fff148-278d-497e-8ecd-ad6083231a35", "title": "OneLogin User Assumed Another User", "file": "../sigma/rules/cloud/onelogin/onelogin_assumed_another_user.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "onelogin"}, {"id": "6f7e1c10-2dc9-4312-adb6-9574ff09a5c8", "title": "Cisco Duo Successful MFA Authentication Via Bypass Code", "file": "../sigma/rules/cloud/cisco/duo/cisco_duo_mfa_bypass_via_bypass_code.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "cisco"}, {"id": "7899144b-e416-4c28-b0b5-ab8f9e0a541d", "title": "Okta Application Modified or Deleted", "file": "../sigma/rules/cloud/okta/okta_application_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "a0b38b70-3cb5-484b-a4eb-c4d8e7bcc0a9", "title": "Okta New Admin Console Behaviours", "file": "../sigma/rules/cloud/okta/okta_new_behaviours_admin_console.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "okta"}, {"id": "14701da0-4b0f-4ee6-9c95-2ffb4e73bb9a", "title": "Okta User Account Locked Out", "file": "../sigma/rules/cloud/okta/okta_user_account_locked_out.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "8f668cc4-c18e-45fe-ad00-624a981cf88a", "title": "Okta Application Sign-On Policy Modified or Deleted", "file": "../sigma/rules/cloud/okta/okta_application_sign_on_policy_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "b6c718dd-8f53-4b9f-98d8-93fdca966969", "title": "New Okta User Created", "file": "../sigma/rules/cloud/okta/okta_user_created.yml", "status": "test", "level": "informational", "logsource.category": null, "logsource.product": "okta"}, {"id": "139bdd4b-9cd7-49ba-a2f4-744d0a8f5d8c", "title": "Okta Admin Role Assignment Created", "file": "../sigma/rules/cloud/okta/okta_admin_role_assignment_created.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "6cc2b61b-d97e-42ef-a9dd-8aa8dc951657", "title": "Okta Unauthorized Access to App", "file": "../sigma/rules/cloud/okta/okta_unauthorized_access_to_app.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "cf1dbc6b-6205-41b4-9b88-a83980d2255b", "title": "Okta API Token Revoked", "file": "../sigma/rules/cloud/okta/okta_api_token_revoked.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "9f308120-69ed-4506-abde-ac6da81f4310", "title": "Okta Network Zone Deactivated or Deleted", "file": "../sigma/rules/cloud/okta/okta_network_zone_deactivated_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "19951c21-229d-4ccb-8774-b993c3ff3c5c", "title": "Okta API Token Created", "file": "../sigma/rules/cloud/okta/okta_api_token_created.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "5c82f0b9-3c6d-477f-a318-0e14a1df73e0", "title": "Okta Security Threat Detected", "file": "../sigma/rules/cloud/okta/okta_security_threat_detected.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "91b76b84-8589-47aa-9605-c837583b82a9", "title": "Potential Okta Password in AlternateID Field", "file": "../sigma/rules/cloud/okta/okta_password_in_alternateid_field.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "okta"}, {"id": "969c7590-8c19-4797-8c1b-23155de6e7ac", "title": "Okta Identity Provider Created", "file": "../sigma/rules/cloud/okta/okta_identity_provider_created.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "50e068d7-1e6b-4054-87e5-0a592c40c7e0", "title": "Okta MFA Reset or Deactivated", "file": "../sigma/rules/cloud/okta/okta_mfa_reset_or_deactivated.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e", "title": "Okta FastPass Phishing Detection", "file": "../sigma/rules/cloud/okta/okta_fastpass_phishing_detection.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "okta"}, {"id": "413d4a81-6c98-4479-9863-014785fd579c", "title": "Okta Admin Role Assigned to an User or Group", "file": "../sigma/rules/cloud/okta/okta_admin_role_assigned_to_user_or_group.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "9058ca8b-f397-4fd1-a9fa-2b7aad4d6309", "title": "Okta Admin Functions Access Through Proxy", "file": "../sigma/rules/cloud/okta/okta_admin_activity_from_proxy_query.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "1667a172-ed4c-463c-9969-efd92195319a", "title": "Okta Policy Modified or Deleted", "file": "../sigma/rules/cloud/okta/okta_policy_modified_or_deleted.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "okta"}, {"id": "bde30855-5c53-4c18-ae90-1ff79ebc9578", "title": "Okta User Session Start Via An Anonymising Proxy Service", "file": "../sigma/rules/cloud/okta/okta_user_session_start_via_anonymised_proxy.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "okta"}, {"id": "07e97cc6-aed1-43ae-9081-b3470d2367f1", "title": "Okta Suspicious Activity Reported by End-user", "file": "../sigma/rules/cloud/okta/okta_suspicious_activity_enduser_report.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "okta"}, {"id": "0c97c1d3-4057-45c9-b148-1de94b631931", "title": "Okta Policy Rule Modified or Deleted", "file": "../sigma/rules/cloud/okta/okta_policy_rule_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "16a71777-0b2e-4db7-9888-9d59cb75200b", "title": "Github Delete Action Invoked", "file": "../sigma/rules/cloud/github/github_delete_action_invoked.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "github"}, {"id": "3908d64a-3c06-4091-b503-b3a94424533b", "title": "New Github Organization Member Added", "file": "../sigma/rules/cloud/github/github_new_org_member.yml", "status": "test", "level": "informational", "logsource.category": null, "logsource.product": "github"}, {"id": "3883d9a0-fd0f-440f-afbb-445a2a799bb8", "title": "Github Secret Scanning Feature Disabled", "file": "../sigma/rules/cloud/github/github_secret_scanning_feature_disabled.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "github"}, {"id": "f9405037-bc97-4eb7-baba-167dad399b83", "title": "Github New Secret Created", "file": "../sigma/rules/cloud/github/github_new_secret_created.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "github"}, {"id": "8622c92d-c00e-463c-b09d-fd06166f6794", "title": "Github High Risk Configuration Disabled", "file": "../sigma/rules/cloud/github/github_disable_high_risk_configuration.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "github"}, {"id": "69b3bd1e-b38a-462f-9a23-fbdbf63d2294", "title": "Github Fork Private Repositories Setting Enabled/Cleared", "file": "../sigma/rules/cloud/github/github_fork_private_repos_enabled_or_cleared.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "github"}, {"id": "04ad83ef-1a37-4c10-b57a-81092164bf33", "title": "Github Repository/Organization Transferred", "file": "../sigma/rules/cloud/github/github_repo_or_org_transferred.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "github"}, {"id": "eaa9ac35-1730-441f-9587-25767bde99d7", "title": "Github Outside Collaborator Detected", "file": "../sigma/rules/cloud/github/github_outside_collaborator_detected.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "github"}, {"id": "2f575940-d85e-4ddc-af13-17dad6f1a0ef", "title": "Github SSH Certificate Configuration Changed", "file": "../sigma/rules/cloud/github/github_ssh_certificate_config_changed.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "github"}, {"id": "ccd55945-badd-4bae-936b-823a735d37dd", "title": "Github Push Protection Disabled", "file": "../sigma/rules/cloud/github/github_push_protection_disabled.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "github"}, {"id": "02cf536a-cf21-4876-8842-4159c8aee3cc", "title": "Github Push Protection Bypass Detected", "file": "../sigma/rules/cloud/github/github_push_protection_bypass_detected.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "github"}, {"id": "f8ed0e8f-7438-4b79-85eb-f358ef2fbebd", "title": "Github Self Hosted Runner Changes Detected", "file": "../sigma/rules/cloud/github/github_self_hosted_runner_changes_detected.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "github"}, {"id": "34e1c7d4-0cd5-419d-9f1b-1dad3f61018d", "title": "Outdated Dependency Or Vulnerability Alert Disabled", "file": "../sigma/rules/cloud/github/github_disabled_outdated_dependency_or_vulnerability.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "github"}, {"id": "adf9f4d2-559e-4f5c-95be-c28dff0b1476", "title": "New Country", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_new_coutry_region.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "53acd925-2003-440d-a1f3-71a5253fe237", "title": "Anonymous IP Address", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_address.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "19128e5e-4743-48dc-bd97-52e5775af817", "title": "Azure AD Account Credential Leaked", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_leaked_credentials.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "28ecba0a-c743-4690-ad29-9a8f6f25a6f9", "title": "Password Spray Activity", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_password_spray.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "e3393cba-31f0-4207-831e-aef90ab17a8c", "title": "SAML Token Issuer Anomaly", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_token_issuer_anomaly.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "1a41023f-1e70-4026-921a-4d9341a9038e", "title": "Atypical Travel", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_atypical_travel.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "821b4dc3-1295-41e7-b157-39ab212dd6bd", "title": "Sign-In From Malware Infected IP", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_malware_linked_ip.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "36440e1c-5c22-467a-889b-593e66498472", "title": "Malicious IP Address Sign-In Suspicious", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_malicious_ip_address_suspicious.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "a2cb56ff-4f46-437a-a0fa-ffa4d1303cba", "title": "Azure AD Threat Intelligence", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_threat_intel.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "944f6adb-7a99-4c69-80c1-b712579e93e6", "title": "Suspicious Browser Activity", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_suspicious_browser.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "128faeef-79dd-44ca-b43c-a9e236a60f49", "title": "Unfamiliar Sign-In Properties", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_unfamilar_sign_in.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "6555754e-5e7f-4a67-ad1c-4041c413a007", "title": "Anomalous Token", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_anomalous_token.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "a3f55ebd-0c01-4ed6-adc0-8fb76d8cd3cd", "title": "Malicious IP Address Sign-In Failure Rate", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_malicious_ip_address.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "be4d9c86-d702-4030-b52e-c7859110e5e8", "title": "Activity From Anonymous IP Address", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_activity.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "b2572bf9-e20a-4594-b528-40bde666525a", "title": "Impossible Travel", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_impossible_travel.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "ceb55fd0-726e-4656-bf4e-b585b7f7d572", "title": "Suspicious Inbox Manipulation Rules", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_inbox_manipulation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "27e4f1d6-ae72-4ea0-8a67-77a73a289c3d", "title": "Suspicious Inbox Forwarding Identity Protection", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_inbox_forwarding_rule.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "258b6593-215d-4a26-a141-c8e31c1299a6", "title": "Anomalous User Activity", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_anomalous_user.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "a84fc3b1-c9ce-4125-8e74-bdcdb24021f1", "title": "Primary Refresh Token Access Attempt", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_prt_access.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "7bbc309f-e2b1-4eb1-8369-131a367d67d3", "title": "Too Many Global Admins", "file": "../sigma/rules/cloud/azure/privileged_identity_management/azure_pim_too_many_global_admins.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "94a66f46-5b64-46ce-80b2-75dcbe627cc0", "title": "Roles Activation Doesn't Require MFA", "file": "../sigma/rules/cloud/azure/privileged_identity_management/azure_pim_role_no_mfa_required.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "58af08eb-f9e1-43c8-9805-3ad9b0482bd8", "title": "Invalid PIM License", "file": "../sigma/rules/cloud/azure/privileged_identity_management/azure_pim_invalid_license.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "e402c26a-267a-45bd-9615-bd9ceda6da85", "title": "Stale Accounts In A Privileged Role", "file": "../sigma/rules/cloud/azure/privileged_identity_management/azure_pim_account_stale.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "8c6ec464-4ae4-43ac-936a-291da66ed13d", "title": "Roles Are Not Being Used", "file": "../sigma/rules/cloud/azure/privileged_identity_management/azure_pim_role_not_used.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "645fd80d-6c07-435b-9e06-7bc1b5656cba", "title": "Roles Activated Too Frequently", "file": "../sigma/rules/cloud/azure/privileged_identity_management/azure_pim_role_frequent_activation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "b1bc08d1-8224-4758-a0e6-fbcfc98c73bb", "title": "Roles Assigned Outside PIM", "file": "../sigma/rules/cloud/azure/privileged_identity_management/azure_pim_role_assigned_outside_of_pim.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "8366030e-7216-476b-9927-271d79f13cf3", "title": "Azure Unusual Authentication Interruption", "file": "../sigma/rules/cloud/azure/signin_logs/azure_unusual_authentication_interruption.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "55695bc0-c8cf-461f-a379-2535f563c854", "title": "Applications That Are Using ROPC Authentication Flow", "file": "../sigma/rules/cloud/azure/signin_logs/azure_app_ropc_authentication.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "5496ff55-42ec-4369-81cb-00f417029e25", "title": "Multifactor Authentication Interrupted", "file": "../sigma/rules/cloud/azure/signin_logs/azure_mfa_interrupted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "248649b7-d64f-46f0-9fb2-a52774166fb5", "title": "Application Using Device Code Authentication Flow", "file": "../sigma/rules/cloud/azure/signin_logs/azure_app_device_code_authentication.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "28eea407-28d7-4e42-b0be-575d5ba60b2c", "title": "Azure AD Only Single Factor Authentication Required", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_only_single_factor_auth_required.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "azure"}, {"id": "4afac85c-224a-4dd7-b1af-8da40e1c60bd", "title": "Account Disabled or Blocked for Sign in Attempts", "file": "../sigma/rules/cloud/azure/signin_logs/azure_blocked_account_attempt.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "28870ae4-6a13-4616-bd1a-235a7fad7458", "title": "Failed Authentications From Countries You Do Not Operate Out Of", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_failed_auth_from_countries_you_do_not_operate_out_of.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "azure"}, {"id": "572b12d4-9062-11ed-a1eb-0242ac120002", "title": "Suspicious SignIns From A Non Registered Device", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "9a60e676-26ac-44c3-814b-0c2a8b977adf", "title": "User Access Blocked by Azure Conditional Access", "file": "../sigma/rules/cloud/azure/signin_logs/azure_user_login_blocked_by_conditional_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "60f6535a-760f-42a9-be3f-c9a0a025906e", "title": "Use of Legacy Authentication Protocols", "file": "../sigma/rules/cloud/azure/signin_logs/azure_legacy_authentication_protocols.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "908655e0-25cf-4ae1-b775-1c8ce9cf43d8", "title": "Login to Disabled Account", "file": "../sigma/rules/cloud/azure/signin_logs/azure_login_to_disabled_account.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "35b781cc-1a08-4a5a-80af-42fd7c315c6b", "title": "Discovery Using AzureHound", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_azurehound_discovery.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "4d136857-6a1a-432a-82fc-5dd497ee5e7c", "title": "Sign-ins by Unknown Devices", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_sign_ins_from_unknown_devices.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "azure"}, {"id": "5afa454e-030c-4ab4-9253-a90aa7fcc581", "title": "Device Registration or Join Without MFA", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_device_registration_or_join_without_mfa.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "67d5f8fc-8325-44e4-8f5f-7c0ac07cb5ae", "title": "Measurable Increase Of Successful Authentications", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_auth_sucess_increase.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "azure"}, {"id": "4f77e1d7-3982-4ee0-8489-abf2d6b75284", "title": "Sign-ins from Non-Compliant Devices", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_sign_ins_from_noncompliant_devices.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "b4a6d707-9430-4f5f-af68-0337f52d5c42", "title": "Sign-in Failure Due to Conditional Access Requirements Not Met", "file": "../sigma/rules/cloud/azure/signin_logs/azure_conditional_access_failure.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "e40f4962-b02b-4192-9bfe-245f7ece1f99", "title": "Multifactor Authentication Denied", "file": "../sigma/rules/cloud/azure/signin_logs/azure_mfa_denies.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "5f521e4b-0105-4b72-845b-2198a54487b9", "title": "Users Authenticating To Other Azure AD Tenants", "file": "../sigma/rules/cloud/azure/signin_logs/azure_users_authenticating_to_other_azure_ad_tenants.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "f272fb46-25f2-422c-b667-45837994980f", "title": "Authentications To Important Apps Using Single Factor Authentication", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_auth_to_important_apps_using_single_factor_auth.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "e1d02b53-c03c-4948-b11d-4d00cca49d03", "title": "Increased Failed Authentications Of Any Type", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_auth_failure_increase.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a", "title": "Account Lockout", "file": "../sigma/rules/cloud/azure/signin_logs/azure_account_lockout.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc", "title": "Potential MFA Bypass Using Legacy Client Authentication", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_suspicious_signin_bypassing_mfa.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "8c944ecb-6970-4541-8496-be554b8e2846", "title": "Successful Authentications From Countries You Do Not Operate Out Of", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_authentications_from_countries_you_do_not_operate_out_of.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "11c767ae-500b-423b-bae3-b234450736ed", "title": "Users Added to Global or Device Admin Roles", "file": "../sigma/rules/cloud/azure/audit_logs/azure_ad_users_added_to_device_admin_roles.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "5aecf3d5-f8a0-48e7-99be-3a759df7358f", "title": "App Granted Privileged Delegated Or App Permissions", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_privileged_permissions.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "d4c7758e-9417-4f2e-9109-6125d66dabef", "title": "User Risk and MFA Registration Policy Updated", "file": "../sigma/rules/cloud/azure/audit_logs/azure_update_risk_and_mfa_registration_policy.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "4d78a000-ab52-4564-88a5-7ab5242b20c7", "title": "Change to Authentication Method", "file": "../sigma/rules/cloud/azure/audit_logs/azure_change_to_authentication_method.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "91c95675-1f27-46d0-bead-d1ae96b97cd3", "title": "User Added To Group With CA Policy Modification Access", "file": "../sigma/rules/cloud/azure/audit_logs/azure_group_user_addition_ca_modification.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "0922467f-db53-4348-b7bf-dee8d0d348c6", "title": "New CA Policy by Non-approved Actor", "file": "../sigma/rules/cloud/azure/audit_logs/azure_aad_secops_new_ca_policy_addedby_bad_actor.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "6f583da0-3a90-4566-a4ed-83c09fe18bbf", "title": "Account Created And Deleted Within A Close Time Frame", "file": "../sigma/rules/cloud/azure/audit_logs/azure_ad_account_created_deleted.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "a6355fbe-f36f-45d8-8efc-ab42465cbc52", "title": "Delegated Permissions Granted For All Users", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_delegated_permissions_all_users.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "c1d147ae-a951-48e5-8b41-dcd0170c7213", "title": "App Granted Microsoft Permissions", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_permissions_msft.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "9b2cc4c4-2ad4-416d-8e8e-ee6aa6f5035a", "title": "End User Consent", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_end_user_consent.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "azure"}, {"id": "102e11e3-2db5-4c9e-bc26-357d42585d21", "title": "Bulk Deletion Changes To Privileged Account Permissions", "file": "../sigma/rules/cloud/azure/audit_logs/azure_priviledged_role_assignment_bulk_change.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "9494bff8-959f-4440-bbce-fb87a208d517", "title": "Changes to Device Registration Policy", "file": "../sigma/rules/cloud/azure/audit_logs/azure_ad_device_registration_policy_changes.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "1b45b0d1-773f-4f23-aedc-814b759563b1", "title": "Application AppID Uri Configuration Changes", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_appid_uri_changes.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "26e7c5e2-6545-481e-b7e6-050143459635", "title": "CA Policy Removed by Non Approved Actor", "file": "../sigma/rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_removedby_bad_actor.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "50a3c7aa-ec29-44a4-92c1-fce229eef6fc", "title": "CA Policy Updated by Non Approved Actor", "file": "../sigma/rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_updatedby_bad_actor.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "f7b5b004-dece-46e4-a4a5-f6fd0e1c6947", "title": "Privileged Account Creation", "file": "../sigma/rules/cloud/azure/audit_logs/azure_privileged_account_creation.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "4bb80281-3756-4ec8-a88e-523c5a6fda9e", "title": "New Root Certificate Authority Added", "file": "../sigma/rules/cloud/azure/audit_logs/azure_ad_new_root_ca_added.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "a4b25073-8947-489c-a8dd-93b41c23f26d", "title": "Windows LAPS Credential Dump From Entra ID", "file": "../sigma/rules/cloud/azure/audit_logs/azure_auditlogs_laps_credential_dumping.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "039a7469-0296-4450-84c0-f6966b16dc6d", "title": "PIM Approvals And Deny Elevation", "file": "../sigma/rules/cloud/azure/audit_logs/azure_pim_activation_approve_deny.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "b18454c8-0be3-41f7-86bc-9c614611b839", "title": "Multi Factor Authentication Disabled For User Account", "file": "../sigma/rules/cloud/azure/audit_logs/azure_user_account_mfa_disable.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "7091372f-623c-4293-bc37-20c32b3492be", "title": "End User Consent Blocked", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_end_user_consent_blocked.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "0b4b72e3-4c53-4d5b-b198-2c58cfef39a9", "title": "Guest User Invited By Non Approved Inviters", "file": "../sigma/rules/cloud/azure/audit_logs/azure_guest_invite_failure.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "8dee7a0d-43fd-4b3c-8cd1-605e189d195e", "title": "User State Changed From Guest To Member", "file": "../sigma/rules/cloud/azure/audit_logs/azure_guest_to_member.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "352a54e1-74ba-4929-9d47-8193d67aba1e", "title": "Azure Domain Federation Settings Modified", "file": "../sigma/rules/cloud/azure/audit_logs/azure_federation_modified.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "665e2d43-70dc-4ccc-9d27-026c9dd7ed9c", "title": "User Removed From Group With CA Policy Modification Access", "file": "../sigma/rules/cloud/azure/audit_logs/azure_group_user_removal_ca_modification.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "74298991-9fc4-460e-a92e-511aa60baec1", "title": "Added Owner To Application", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_owner_added.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "fa84aaf5-8142-43cd-9ec2-78cfebf878ce", "title": "Temporary Access Pass Added To An Account", "file": "../sigma/rules/cloud/azure/audit_logs/azure_tap_added.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "ca9bf243-465e-494a-9e54-bf9fc239057d", "title": "Azure Subscription Permission Elevation Via AuditLogs", "file": "../sigma/rules/cloud/azure/audit_logs/azure_subscription_permissions_elevation_via_auditlogs.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "aeaef14c-e5bf-4690-a9c8-835caad458bd", "title": "PIM Alert Setting Changes To Disabled", "file": "../sigma/rules/cloud/azure/audit_logs/azure_pim_alerts_disabled.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "db6c06c4-bf3b-421c-aa88-15672b88c743", "title": "Changes To PIM Settings", "file": "../sigma/rules/cloud/azure/audit_logs/azure_pim_change_settings.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "4ad97bf5-a514-41a4-abd3-4f3455ad4865", "title": "Guest Users Invited To Tenant By Non Approved Inviters", "file": "../sigma/rules/cloud/azure/audit_logs/azure_ad_guest_users_invited_to_tenant_by_non_approved_inviters.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "c2496b41-16a9-4016-a776-b23f8910dc58", "title": "Certificate-Based Authentication Enabled", "file": "../sigma/rules/cloud/azure/audit_logs/azure_ad_certificate_based_authencation_enabled.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "b04934b2-0a68-4845-8a19-bdfed3a68a7a", "title": "App Role Added", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_role_added.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "0055ad1f-be85-4798-83cf-a6da17c993b3", "title": "Application URI Configuration Changes", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_uri_modifications.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "49a268a4-72f4-4e38-8a7b-885be690c5b5", "title": "User Added To Privilege Role", "file": "../sigma/rules/cloud/azure/audit_logs/azure_priviledged_role_assignment_add.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "a0413867-daf3-43dd-9245-734b3a787942", "title": "Bitlocker Key Retrieval", "file": "../sigma/rules/cloud/azure/audit_logs/azure_ad_bitlocker_key_retrieval.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "cbb67ecc-fb70-4467-9350-c910bdf7c628", "title": "Added Credentials to Existing Application", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_credential_added.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "340ee172-4b67-4fb4-832f-f961bdc1f3aa", "title": "Password Reset By User Account", "file": "../sigma/rules/cloud/azure/audit_logs/azure_user_password_change.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "b831353c-1971-477b-abb6-2828edc3bca1", "title": "Azure Keyvault Secrets Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_keyvault_secrets_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "7ea78478-a4f9-42a6-9dcd-f861816122bf", "title": "Disabled MFA to Bypass Authentication Mechanisms", "file": "../sigma/rules/cloud/azure/activity_logs/azure_mfa_disabled.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "410d2a41-1e6d-452f-85e5-abdd8257a823", "title": "Azure Application Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_application_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "b02f9591-12c3-4965-986a-88028629b2e1", "title": "Azure Kubernetes Pods Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_pods_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "93e0ef48-37c8-49ed-a02c-038aab23628e", "title": "Azure Container Registry Created or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_container_registry_created_or_deleted.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "azure"}, {"id": "15ef3fac-f0f0-4dc4-ada0-660aa72980b3", "title": "Azure Virtual Network Device Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_network_virtual_device_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "d9557b75-267b-4b43-922f-a775e2d1f792", "title": "Azure Point-to-site VPN Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_network_p2s_vpn_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "61171ffc-d79c-4ae5-8e10-9323dba19cd3", "title": "Azure VPN Connection Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_vpn_connection_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "512cf937-ea9b-4332-939c-4c2c94baadcd", "title": "Azure Firewall Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_firewall_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "1c71e254-6655-42c1-b2d6-5e4718d7fc0a", "title": "Azure Kubernetes CronJob", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_cronjob.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "48739819-8230-4ee3-a8ea-e0289d1fb0ff", "title": "Azure Active Directory Hybrid Health AD FS Service Delete", "file": "../sigma/rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_service_delete.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "a61a3c56-4ce2-4351-a079-88ae4cbd2b58", "title": "Azure Kubernetes Admission Controller", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_admission_controller.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "af6925b0-8826-47f1-9324-337507a0babd", "title": "Azure DNS Zone Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_dns_zone_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "448fd1ea-2116-4c62-9cde-a92d120e0f08", "title": "Azure Service Principal Removed", "file": "../sigma/rules/cloud/azure/activity_logs/azure_service_principal_removed.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "ebbeb024-5b1d-4e16-9c0c-917f86c708a7", "title": "User Added to an Administrator's Azure AD Role", "file": "../sigma/rules/cloud/azure/activity_logs/azure_ad_user_added_to_admin_role.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "d2d901db-7a75-45a1-bc39-0cbf00812192", "title": "Number Of Resource Creation Or Deployment Activities", "file": "../sigma/rules/cloud/azure/activity_logs/azure_creating_number_of_resources_detection.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "72af37e2-ec32-47dc-992b-bc288a2708cb", "title": "Azure New CloudShell Created", "file": "../sigma/rules/cloud/azure/activity_logs/azure_new_cloudshell_created.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "0ddcff6d-d262-40b0-804b-80eb592de8e3", "title": "Azure Service Principal Created", "file": "../sigma/rules/cloud/azure/activity_logs/azure_service_principal_created.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "d22b4df4-5a67-4859-a578-8c9a0b5af9df", "title": "Azure Network Security Configuration Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_network_security_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "92cc3e5d-eb57-419d-8c16-5c63f325a401", "title": "Azure Suppression Rule Created", "file": "../sigma/rules/cloud/azure/activity_logs/azure_suppression_rule_created.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "7ee0b4aa-d8d4-4088-b661-20efdf41a04c", "title": "Azure Kubernetes Secret or Config Object Access", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "9541f321-7cba-4b43-80fc-fbd1fb922808", "title": "Azure Kubernetes Cluster Created or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_cluster_created_or_deleted.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "azure"}, {"id": "ad87d14e-7599-4633-ba81-aeb60cfe8cd6", "title": "Azure Application Gateway Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_application_gateway_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "bcfcc962-0e4a-4fd9-84bb-a833e672df3f", "title": "Azure Virtual Network Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_virtual_network_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "835747f1-9329-40b5-9cc3-97d465754ce6", "title": "Azure Application Security Group Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_application_security_group_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "459a2970-bb84-4e6a-a32e-ff0fbd99448d", "title": "Azure Key Vault Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_keyvault_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "83c17918-746e-4bd9-920b-8e098bf88c23", "title": "Azure Network Firewall Policy Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_network_firewall_policy_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "542b9912-c01f-4e3f-89a8-014c48cdca7d", "title": "Azure Device No Longer Managed or Compliant", "file": "../sigma/rules/cloud/azure/activity_logs/azure_device_no_longer_managed_or_compliant.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "288a39fc-4914-4831-9ada-270e9dc12cb4", "title": "Azure Active Directory Hybrid Health AD FS New Server", "file": "../sigma/rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_new_server.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "25cb259b-bbdc-4b87-98b7-90d7c72f8743", "title": "Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_rolebinding_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "025c9fe7-db72-49f9-af0d-31341dd7dd57", "title": "Azure Firewall Rule Collection Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_firewall_rule_collection_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "2a7d64cf-81fa-4daf-ab1b-ab80b789c067", "title": "Azure Firewall Rule Configuration Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_network_firewall_rule_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "c1182e02-49a3-481c-b3de-0fadc4091488", "title": "Rare Subscription-level Operations In Azure", "file": "../sigma/rules/cloud/azure/activity_logs/azure_rare_operations.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "12d027c3-b48c-4d9d-8bb6-a732200034b2", "title": "Azure Kubernetes Service Account Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_service_account_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "818fee0c-e0ec-4e45-824e-83e4817b0887", "title": "Azure Kubernetes Sensitive Role Access", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_role_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "225d8b09-e714-479c-a0e4-55e6f29adf35", "title": "Azure Kubernetes Events Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_events_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "08d6ac24-c927-4469-b3b7-2e422d6e3c43", "title": "Azure Kubernetes Network Policy Change", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_network_policy_change.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "80eeab92-0979-4152-942d-96749e11df40", "title": "Azure Keyvault Key Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_keyvault_key_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "a622fcd2-4b5a-436a-b8a2-a4171161833c", "title": "Granting Of Permissions To An Account", "file": "../sigma/rules/cloud/azure/activity_logs/azure_granting_permission_detection.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "46530378-f9db-4af9-a9e5-889c177d3881", "title": "Azure Device or Configuration Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_device_or_configuration_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "09438caa-07b1-4870-8405-1dbafe3dad95", "title": "Azure Subscription Permission Elevation Via ActivityLogs", "file": "../sigma/rules/cloud/azure/activity_logs/azure_subscription_permissions_elevation_via_activitylogs.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "cdeef967-f9a1-4375-90ee-6978c5f23974", "title": "Azure Application Credential Modified", "file": "../sigma/rules/cloud/azure/activity_logs/azure_app_credential_modification.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "636e30d5-3736-42ea-96b1-e6e2f8429fd6", "title": "Azure Owner Removed From Application or Service Principal", "file": "../sigma/rules/cloud/azure/activity_logs/azure_owner_removed_from_application_or_service_principal.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "87cc6698-3e07-4ba2-9b43-a85a73e151e2", "title": "Bitbucket User Permissions Export Attempt", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_user_permissions_export_attempt_detected.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "70ed1d26-0050-4b38-a599-92c53d57d45a", "title": "Bitbucket User Login Failure", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_user_login_failure_detected.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "aac6c4f4-87c7-4961-96ac-c3fd3a42c310", "title": "Bitbucket Global Permission Changed", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_global_permissions_change_detected.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05", "title": "Bitbucket Global Secret Scanning Rule Deleted", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_global_secret_scanning_rule_deleted.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "34d81081-03c9-4a7f-91c9-5e46af625cde", "title": "Bitbucket Unauthorized Full Data Export Triggered", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_unauthorized_full_data_export_triggered.yml", "status": "experimental", "level": "critical", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "5259cbf2-0a75-48bf-b57a-c54d6fabaef3", "title": "Bitbucket User Details Export Attempt Detected", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_user_details_export_attempt_detected.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "d3f90469-fb05-42ce-b67d-0fded91bbef3", "title": "Bitbucket User Login Failure Via SSH", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_user_login_failure_via_ssh_detected.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "ff91e3f0-ad15-459f-9a85-1556390c138d", "title": "Bitbucket Secret Scanning Rule Deleted", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_secret_scanning_rule_deleted.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "195e1b9d-bfc2-4ffa-ab4e-35aef69815f8", "title": "Bitbucket Full Data Export Triggered", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_full_data_export_triggered.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "16ab6143-510a-44e2-a615-bdb80b8317fc", "title": "Bitbucket Global SSH Settings Changed", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_global_ssh_settings_change_detected.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "42ccce6d-7bd3-4930-95cd-e4d83fa94a30", "title": "Bitbucket Project Secret Scanning Allowlist Added", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_project_secret_scanning_allowlist_added.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "b91e8d5e-0033-44fe-973f-b730316f23a1", "title": "Bitbucket Secret Scanning Exempt Repository Added", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_secret_scanning_exempt_repository_detected.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "7215374a-de4f-4b33-8ba5-70804c9251d3", "title": "Bitbucket Unauthorized Access To A Resource", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_unauthorized_access_detected.yml", "status": "experimental", "level": "critical", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "6aa12161-235a-4dfb-9c74-fe08df8d8da1", "title": "Bitbucket Audit Log Configuration Updated", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_log_configuration_update_detected.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "d84c0ded-edd7-4123-80ed-348bb3ccc4d5", "title": "Suspicious SQL Query", "file": "../sigma/rules/category/database/db_anomalous_query.yml", "status": "test", "level": "medium", "logsource.category": "database", "logsource.product": null}, {"id": "fdf135a2-9241-4f96-a114-bb404948f736", "title": "Antivirus Web Shell Detection", "file": "../sigma/rules/category/antivirus/av_webshell.yml", "status": "test", "level": "high", "logsource.category": "antivirus", "logsource.product": null}, {"id": "c9a88268-0047-4824-ba6e-4d81ce0b907c", "title": "Antivirus Relevant File Paths Alerts", "file": "../sigma/rules/category/antivirus/av_relevant_files.yml", "status": "test", "level": "high", "logsource.category": "antivirus", "logsource.product": null}, {"id": "238527ad-3c2c-4e4f-a1f6-92fd63adb864", "title": "Antivirus Exploitation Framework Detection", "file": "../sigma/rules/category/antivirus/av_exploiting.yml", "status": "stable", "level": "critical", "logsource.category": "antivirus", "logsource.product": null}, {"id": "4c6ca276-d4d0-4a8c-9e4c-d69832f8671f", "title": "Antivirus Ransomware Detection", "file": "../sigma/rules/category/antivirus/av_ransomware.yml", "status": "test", "level": "critical", "logsource.category": "antivirus", "logsource.product": null}, {"id": "fa0c05b6-8ad3-468d-8231-c1cbccb64fba", "title": "Antivirus Hacktool Detection", "file": "../sigma/rules/category/antivirus/av_hacktool.yml", "status": "stable", "level": "high", "logsource.category": "antivirus", "logsource.product": null}, {"id": "78cc2dd2-7d20-4d32-93ff-057084c38b93", "title": "Antivirus Password Dumper Detection", "file": "../sigma/rules/category/antivirus/av_password_dumper.yml", "status": "stable", "level": "critical", "logsource.category": "antivirus", "logsource.product": null}, {"id": "d7fb8f0e-bd5f-45c2-b467-19571c490d7e", "title": "Cleartext Protocol Usage", "file": "../sigma/rules/network/firewall/net_firewall_cleartext_protocols.yml", "status": "stable", "level": "low", "logsource.category": "firewall", "logsource.product": null}, {"id": "a557ffe6-ac54-43d2-ae69-158027082350", "title": "Huawei BGP Authentication Failures", "file": "../sigma/rules/network/huawei/bgp/huawei_bgp_auth_failed.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "huawei"}, {"id": "6d844f0f-1c18-41af-8f19-33e7654edfc3", "title": "Cisco Local Accounts", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_local_accounts.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "cisco"}, {"id": "9705a6a1-6db6-4a16-a987-15b7151e299b", "title": "Cisco Discovery", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_discovery.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "cisco"}, {"id": "5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59", "title": "Cisco Stage Data", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_moving_data.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "cisco"}, {"id": "671ffc77-50a7-464f-9e3d-9ea2b493b26b", "title": "Cisco Modify Configuration", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_modify_config.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "cisco"}, {"id": "ceb407f6-8277-439b-951f-e4210e3ed956", "title": "Cisco Clear Logs", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_clear_logs.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "cisco"}, {"id": "d94a35f0-7a29-45f6-90a0-80df6159967c", "title": "Cisco Denial of Service", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_dos.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "cisco"}, {"id": "b9e1f193-d236-4451-aaae-2f3d2102120d", "title": "Cisco Sniffing", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_net_sniff.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "cisco"}, {"id": "1f978c6a-4415-47fb-aca5-736a44d7ca3d", "title": "Cisco Crypto Commands", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_crypto_actions.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "cisco"}, {"id": "cd072b25-a418-4f98-8ebc-5093fb38fe1a", "title": "Cisco Collect Data", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_collect_data.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "cisco"}, {"id": "71d65515-c436-43c0-841b-236b1f32c21e", "title": "Cisco File Deletion", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_file_deletion.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "cisco"}, {"id": "9e8f6035-88bf-4a63-96b6-b17c0508257e", "title": "Cisco Disabling Logging", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_disable_logging.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "cisco"}, {"id": "b094d9fb-b1ad-4650-9f1a-fb7be9f1d34b", "title": "Cisco Show Commands Input", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_input_capture.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "cisco"}, {"id": "56fa3cd6-f8d6-4520-a8c7-607292971886", "title": "Cisco BGP Authentication Failures", "file": "../sigma/rules/network/cisco/bgp/cisco_bgp_md5_auth_failed.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "cisco"}, {"id": "50e606bf-04ce-4ca7-9d54-3449494bbd4b", "title": "Cisco LDP Authentication Failures", "file": "../sigma/rules/network/cisco/ldp/cisco_ldp_md5_auth_failed.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "cisco"}, {"id": "705072a5-bb6f-4ced-95b6-ecfa6602090b", "title": "WebDav Put Request", "file": "../sigma/rules/network/zeek/zeek_http_webdav_put_request.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "zeek"}, {"id": "b640c0b8-87f8-4daa-aef8-95a24261dd1d", "title": "MITRE BZAR Indicators for Execution", "file": "../sigma/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "a8322756-015c-42e7-afb1-436e85ed3ff5", "title": "DNS TOR Proxies", "file": "../sigma/rules/network/zeek/zeek_dns_torproxy.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "2e69f167-47b5-4ae7-a390-47764529eff5", "title": "Transferring Files with Credential Data via Network Shares - Zeek", "file": "../sigma/rules/network/zeek/zeek_smb_converted_win_transferring_files_with_credential_data.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "ede05abc-2c9e-4624-9944-9ff17fdc0bf5", "title": "Suspicious DNS Z Flag Bit Set", "file": "../sigma/rules/network/zeek/zeek_dns_susp_zbit_flag.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "92dae1ed-1c9d-4eff-a567-33acbd95b00e", "title": "Possible Impacket SecretDump Remote Activity - Zeek", "file": "../sigma/rules/network/zeek/zeek_smb_converted_win_impacket_secretdump.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "zeek"}, {"id": "ab6b1a39-a9ee-4ab4-b075-e83acf6e346b", "title": "OMIGOD HTTP No Authentication RCE", "file": "../sigma/rules/network/zeek/zeek_http_omigod_no_auth_rce.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "zeek"}, {"id": "bf74135c-18e8-4a72-a926-0e4f47888c19", "title": "DNS Events Related To Mining Pools", "file": "../sigma/rules/network/zeek/zeek_dns_mining_pools.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "zeek"}, {"id": "aac2fd97-bcba-491b-ad66-a6edf89c71bf", "title": "Executable from Webdav", "file": "../sigma/rules/network/zeek/zeek_http_executable_download_from_webdav.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "53389db6-ba46-48e3-a94c-e0f2cefe1583", "title": "MITRE BZAR Indicators for Persistence", "file": "../sigma/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "f1b3a22a-45e6-4004-afb5-4291f9c21166", "title": "Suspicious PsExec Execution - Zeek", "file": "../sigma/rules/network/zeek/zeek_smb_converted_win_susp_psexec.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "zeek"}, {"id": "7100f7e3-92ce-4584-b7b7-01b40d3d4118", "title": "Default Cobalt Strike Certificate", "file": "../sigma/rules/network/zeek/zeek_default_cobalt_strike_certificate.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "zeek"}, {"id": "dde85b37-40cd-4a94-b00c-0b8794f956b5", "title": "Remote Task Creation via ATSVC Named Pipe - Zeek", "file": "../sigma/rules/network/zeek/zeek_smb_converted_win_atsvc_task.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "286b47ed-f6fe-40b3-b3a8-35129acd43bc", "title": "Suspicious Access to Sensitive File Extensions - Zeek", "file": "../sigma/rules/network/zeek/zeek_smb_converted_win_susp_raccess_sensitive_fext.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "021310d9-30a6-480a-84b7-eaa69aeb92bb", "title": "First Time Seen Remote Named Pipe - Zeek", "file": "../sigma/rules/network/zeek/zeek_smb_converted_win_lm_namedpipe.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "zeek"}, {"id": "bae2865c-5565-470d-b505-9496c87d0c30", "title": "SMB Spoolss Name Piped Usage", "file": "../sigma/rules/network/zeek/zeek_dce_rpc_smb_spoolss_named_pipe.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "503fe26e-b5f2-4944-a126-eab405cc06e5", "title": "Kerberos Network Traffic RC4 Ticket Encryption", "file": "../sigma/rules/network/zeek/zeek_susp_kerberos_rc4.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "7b33baef-2a75-4ca3-9da4-34f9a15382d8", "title": "Possible PrintNightmare Print Driver Install", "file": "../sigma/rules/network/zeek/zeek_dce_rpc_printnightmare_print_driver_install.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "4096842a-8f9f-4d36-92b4-d0b2a62f9b2a", "title": "Potential PetitPotam Attack Via EFS RPC Calls", "file": "../sigma/rules/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "fa7703d6-0ee8-4949-889c-48c84bc15b6f", "title": "New Kind of Network (NKN) Detection", "file": "../sigma/rules/network/zeek/zeek_dns_nkn.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "zeek"}, {"id": "1fc0809e-06bf-4de3-ad52-25e5263b7623", "title": "Publicly Accessible RDP Service", "file": "../sigma/rules/network/zeek/zeek_rdp_public_listener.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "zeek"}, {"id": "a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43", "title": "Juniper BGP Missing MD5", "file": "../sigma/rules/network/juniper/bgp/juniper_bgp_missing_md5.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "juniper"}, {"id": "2975af79-28c4-4d2f-a951-9095f229df29", "title": "Cobalt Strike DNS Beaconing", "file": "../sigma/rules/network/dns/net_dns_mal_cobaltstrike.yml", "status": "test", "level": "critical", "logsource.category": "dns", "logsource.product": null}, {"id": "4153a907-2451-4e4f-a578-c52bb6881432", "title": "Suspicious DNS Query with B64 Encoded String", "file": "../sigma/rules/network/dns/net_dns_susp_b64_queries.yml", "status": "test", "level": "medium", "logsource.category": "dns", "logsource.product": null}, {"id": "8ae51330-899c-4641-8125-e39f2e07da72", "title": "DNS TXT Answer with Possible Execution Strings", "file": "../sigma/rules/network/dns/net_dns_susp_txt_exec_strings.yml", "status": "test", "level": "high", "logsource.category": "dns", "logsource.product": null}, {"id": "aff715fa-4dd5-497a-8db3-910bea555566", "title": "DNS Query to External Service Interaction Domains", "file": "../sigma/rules/network/dns/net_dns_external_service_interaction_domains.yml", "status": "test", "level": "high", "logsource.category": "dns", "logsource.product": null}, {"id": "3eaf6218-3bed-4d8a-8707-274096f12a18", "title": "Wannacry Killswitch Domain", "file": "../sigma/rules/network/dns/net_dns_wannacry_killswitch_domain.yml", "status": "test", "level": "high", "logsource.category": "dns", "logsource.product": null}, {"id": "c64c5175-5189-431b-a55e-6d9882158251", "title": "Telegram Bot API Request", "file": "../sigma/rules/network/dns/net_dns_susp_telegram_api.yml", "status": "test", "level": "medium", "logsource.category": "dns", "logsource.product": null}, {"id": "b593fd50-7335-4682-a36c-4edcb68e4641", "title": "Monero Crypto Coin Mining Pool Lookup", "file": "../sigma/rules/network/dns/net_dns_pua_cryptocoin_mining_xmr.yml", "status": "stable", "level": "high", "logsource.category": "dns", "logsource.product": null}, {"id": "ada3bc4f-f0fd-42b9-ba91-e105e8af7342", "title": "Server Side Template Injection Strings", "file": "../sigma/rules/web/webserver_generic/web_ssti_in_access_logs.yml", "status": "test", "level": "high", "logsource.category": "webserver", "logsource.product": null}, {"id": "7745c2ea-24a5-4290-b680-04359cb84b35", "title": "Path Traversal Exploitation Attempts", "file": "../sigma/rules/web/webserver_generic/web_path_traversal_exploitation_attempt.yml", "status": "test", "level": "medium", "logsource.category": "webserver", "logsource.product": null}, {"id": "65354b83-a2ea-4ea6-8414-3ab38be0d409", "title": "Cross Site Scripting Strings", "file": "../sigma/rules/web/webserver_generic/web_xss_in_access_logs.yml", "status": "test", "level": "high", "logsource.category": "webserver", "logsource.product": null}, {"id": "5513deaf-f49a-46c2-a6c8-3f111b5cb453", "title": "SQL Injection Strings In URI", "file": "../sigma/rules/web/webserver_generic/web_sql_injection_in_access_logs.yml", "status": "test", "level": "high", "logsource.category": "webserver", "logsource.product": null}, {"id": "412d55bc-7737-4d25-9542-5b396867ce55", "title": "JNDIExploit Pattern", "file": "../sigma/rules/web/webserver_generic/web_jndi_exploit.yml", "status": "test", "level": "high", "logsource.category": "webserver", "logsource.product": null}, {"id": "583aa0a2-30b1-4d62-8bf3-ab73689efe6c", "title": "Java Payload Strings", "file": "../sigma/rules/web/webserver_generic/web_java_payload_in_access_logs.yml", "status": "test", "level": "high", "logsource.category": "webserver", "logsource.product": null}, {"id": "19aa4f58-94ca-45ff-bc34-92e533c0994a", "title": "Suspicious User-Agents Related To Recon Tools", "file": "../sigma/rules/web/webserver_generic/web_susp_useragents.yml", "status": "test", "level": "medium", "logsource.category": "webserver", "logsource.product": null}, {"id": "7cb02516-6d95-4ffc-8eee-162075e111ac", "title": "Successful IIS Shortname Fuzzing Scan", "file": "../sigma/rules/web/webserver_generic/web_iis_tilt_shortname_scan.yml", "status": "test", "level": "medium", "logsource.category": "webserver", "logsource.product": null}, {"id": "953d460b-f810-420a-97a2-cfca4c98e602", "title": "Source Code Enumeration Detection by Keyword", "file": "../sigma/rules/web/webserver_generic/web_source_code_enumeration.yml", "status": "test", "level": "medium", "logsource.category": "webserver", "logsource.product": null}, {"id": "2ea44a60-cfda-11ea-87d0-0242ac130003", "title": "Webshell ReGeorg Detection Via Web Logs", "file": "../sigma/rules/web/webserver_generic/web_webshell_regeorg.yml", "status": "test", "level": "high", "logsource.category": "webserver", "logsource.product": null}, {"id": "9f6a34b4-2688-4eb7-a7f5-e39fef573d0e", "title": "Suspicious Windows Strings In URI", "file": "../sigma/rules/web/webserver_generic/web_susp_windows_path_uri.yml", "status": "test", "level": "high", "logsource.category": "webserver", "logsource.product": null}, {"id": "85254a62-22be-4239-b79c-2ec17e566c37", "title": "F5 BIG-IP iControl Rest API Command Execution - Webserver", "file": "../sigma/rules/web/webserver_generic/web_f5_tm_utility_bash_api_request.yml", "status": "test", "level": "medium", "logsource.category": "webserver", "logsource.product": null}, {"id": "7ff9db12-1b94-4a79-ba68-a2402c5d6729", "title": "Windows Webshell Strings", "file": "../sigma/rules/web/webserver_generic/web_win_webshells_in_access_logs.yml", "status": "test", "level": "high", "logsource.category": "webserver", "logsource.product": null}, {"id": "e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c", "title": "Apache Threading Error", "file": "../sigma/rules/web/product/apache/web_apache_threading_error.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": null}, {"id": "1da8ce0b-855d-4004-8860-7d64d42063b1", "title": "Apache Segmentation Fault", "file": "../sigma/rules/web/product/apache/web_apache_segfault.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": null}, {"id": "59ec40bb-322e-40ab-808d-84fa690d7e56", "title": "Nginx Core Dump", "file": "../sigma/rules/web/product/nginx/web_nginx_core_dump.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": null}, {"id": "fa935401-513b-467b-81f4-f9e77aa0dd78", "title": "Crypto Miner User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_cryptominer.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "195c1119-ef07-4909-bb12-e66f5e07bf3c", "title": "Download from Suspicious Dyndns Hosts", "file": "../sigma/rules/web/proxy_generic/proxy_download_susp_dyndns.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "00d0b5ab-1f55-4120-8e83-487c0a7baf19", "title": "Download From Suspicious TLD - Blacklist", "file": "../sigma/rules/web/proxy_generic/proxy_download_susp_tlds_blacklist.yml", "status": "test", "level": "low", "logsource.category": "proxy", "logsource.product": null}, {"id": "b5de2919-b74a-4805-91a7-5049accbaefe", "title": "Download From Suspicious TLD - Whitelist", "file": "../sigma/rules/web/proxy_generic/proxy_download_susp_tlds_whitelist.yml", "status": "test", "level": "low", "logsource.category": "proxy", "logsource.product": null}, {"id": "6ec820f2-e963-4801-9127-d8b2dce4d31b", "title": "APT User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_apt.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "1a9bb21a-1bb5-42d7-aa05-3219c7c8f47d", "title": "PUA - Advanced IP/Port Scanner Update Check", "file": "../sigma/rules/web/proxy_generic/proxy_pua_advanced_ip_scanner_update_check.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "304810ed-8853-437f-9e36-c4975c3dfd7e", "title": "HackTool - BabyShark Agent Default URL Pattern", "file": "../sigma/rules/web/proxy_generic/proxy_hktl_baby_shark_default_agent_url.yml", "status": "test", "level": "critical", "logsource.category": "proxy", "logsource.product": null}, {"id": "c8557060-9221-4448-8794-96320e6f3e74", "title": "Windows PowerShell User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_powershell.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "2c03648b-e081-41a5-b9fb-7d854a915091", "title": "Rclone Activity via Proxy", "file": "../sigma/rules/web/proxy_generic/proxy_ua_rclone.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "eb6c2004-1cef-427f-8885-9042974e5eb6", "title": "Suspicious Network Communication With IPFS", "file": "../sigma/rules/web/proxy_generic/proxy_susp_ipfs_cred_harvest.yml", "status": "test", "level": "low", "logsource.category": "proxy", "logsource.product": null}, {"id": "21e44d78-95e7-421b-a464-ffd8395659c4", "title": "HTTP Request With Empty User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_empty.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f", "title": "Exploit Framework User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_frameworks.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "b923f7d6-ac89-4a50-a71a-89fb846b4aa8", "title": "HackTool - Empire UserAgent URI Combo", "file": "../sigma/rules/web/proxy_generic/proxy_hktl_empire_ua_uri_patterns.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "b59c98c6-95e8-4d65-93ee-f594dfb96b17", "title": "F5 BIG-IP iControl Rest API Command Execution - Proxy", "file": "../sigma/rules/web/proxy_generic/proxy_f5_tm_utility_bash_api_request.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "4922a5dd-6743-4fc2-8e81-144374280997", "title": "Flash Player Update from Suspicious Location", "file": "../sigma/rules/web/proxy_generic/proxy_susp_flash_download_loc.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "8ccd35a2-1c7c-468b-b568-ac6cdf80eec3", "title": "Bitsadmin to Uncommon IP Server Address", "file": "../sigma/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_ip.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "7195a772-4b3f-43a4-a210-6a003d65caa1", "title": "Suspicious User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_susp.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "1ae64f96-72b6-48b3-ad3d-e71dff6c6398", "title": "Suspicious External WebDAV Execution", "file": "../sigma/rules/web/proxy_generic/proxy_webdav_external_execution.yml", "status": "experimental", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "9eb68894-7476-4cd6-8752-23b51f5883a7", "title": "Bitsadmin to Uncommon TLD", "file": "../sigma/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "5468045b-4fcc-4d1a-973c-c9c9578edacb", "title": "Raw Paste Service Access", "file": "../sigma/rules/web/proxy_generic/proxy_raw_paste_service_access.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "5c84856b-55a5-45f1-826f-13f37250cf4e", "title": "Malware User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_malware.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "894a8613-cf12-48b3-8e57-9085f54aa0c3", "title": "Potential Base64 Encoded User-Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_susp_base64.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "f3f21ce1-cdef-4bfc-8328-ed2e826f5fac", "title": "HackTool - CobaltStrike Malleable Profile Patterns - Proxy", "file": "../sigma/rules/web/proxy_generic/proxy_hktl_cobalt_strike_malleable_c2_requests.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "b494b165-6634-483d-8c47-2026a6c52372", "title": "Telegram API Access", "file": "../sigma/rules/web/proxy_generic/proxy_telegram_api.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "2b1ee7e4-89b6-4739-b7bb-b811b6607e5e", "title": "PwnDrp Access", "file": "../sigma/rules/web/proxy_generic/proxy_pwndrop.yml", "status": "test", "level": "critical", "logsource.category": "proxy", "logsource.product": null}, {"id": "d443095b-a221-4957-a2c4-cd1756c9b747", "title": "Suspicious Base64 Encoded User-Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_base64_encoded.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "c42a3073-30fb-48ae-8c99-c23ada84b103", "title": "Hack Tool User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_hacktool.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "e09aed7a-09e0-4c9a-90dd-f0d52507347e", "title": "Windows WebDAV User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_downloadcradle_webdav.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "47e0852a-cf81-4494-a8e6-31864f8c86ed", "title": "Pandemic Registry Key", "file": "../sigma/rules/windows/registry/registry_event/registry_event_apt_pandemic.yml", "status": "test", "level": "critical", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "title": "HybridConnectionManager Service Installation - Registry", "file": "../sigma/rules/windows/registry/registry_event/registry_event_hybridconnectionmgr_svc_installation.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "title": "New DLL Added to AppInit_DLLs Registry Key", "file": "../sigma/rules/windows/registry/registry_event/registry_event_new_dll_added_to_appinit_dlls_registry_key.yml", "status": "test", "level": "medium", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "title": "Path To Screensaver Binary Modified", "file": "../sigma/rules/windows/registry/registry_event/registry_event_modify_screensaver_binary_path.yml", "status": "test", "level": "medium", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "295a59c1-7b79-4b47-a930-df12c15fc9c2", "title": "Windows Registry Trust Record Modification", "file": "../sigma/rules/windows/registry/registry_event/registry_event_office_trust_record_modification.yml", "status": "test", "level": "medium", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "title": "Suspicious Run Key from Download", "file": "../sigma/rules/windows/registry/registry_event/registry_event_susp_download_run_key.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "title": "Run Once Task Configuration in Registry", "file": "../sigma/rules/windows/registry/registry_event/registry_event_runonce_persistence.yml", "status": "test", "level": "medium", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "9577edbb-851f-4243-8c91-1d5b50c1a39b", "title": "Atbroker Registry Change", "file": "../sigma/rules/windows/registry/registry_event/registry_event_susp_atbroker_change.yml", "status": "test", "level": "medium", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "title": "NetNTLM Downgrade Attack - Registry", "file": "../sigma/rules/windows/registry/registry_event/registry_event_net_ntlm_downgrade.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "5aad0995-46ab-41bd-a9ff-724f41114971", "title": "Esentutl Volume Shadow Copy Service Keys", "file": "../sigma/rules/windows/registry/registry_event/registry_event_esentutl_volume_shadow_copy_service_keys.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "460479f3-80b7-42da-9c43-2cc1d54dbccd", "title": "Creation of a Local Hidden User Account by Registry", "file": "../sigma/rules/windows/registry/registry_event/registry_event_add_local_hidden_user.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "4d431012-2ab5-4db7-a84e-b29809da2172", "title": "Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback", "file": "../sigma/rules/windows/registry/registry_event/registry_set_enable_anonymous_connection.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "6aa1d992-5925-4e9f-a49b-845e51d1de01", "title": "New DLL Added to AppCertDlls Registry Key", "file": "../sigma/rules/windows/registry/registry_event/registry_event_new_dll_added_to_appcertdlls_registry_key.yml", "status": "test", "level": "medium", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "title": "Security Support Provider (SSP) Added to LSA Configuration", "file": "../sigma/rules/windows/registry/registry_event/registry_event_ssp_added_lsa_config.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "b3503044-60ce-4bf4-bbcb-e3db98788823", "title": "DLL Load via LSASS", "file": "../sigma/rules/windows/registry/registry_event/registry_event_susp_lsass_dll_load.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "a6b33c02-8305-488f-8585-03cb2a7763f2", "title": "Windows Credential Editor Registry", "file": "../sigma/rules/windows/registry/registry_event/registry_event_hack_wce_reg.yml", "status": "test", "level": "critical", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "a54f842a-3713-4b45-8c84-5f136fdebd3c", "title": "New PortProxy Registry Entry Added", "file": "../sigma/rules/windows/registry/registry_event/registry_event_portproxy_registry_key.yml", "status": "test", "level": "medium", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "title": "Office Application Startup - Office Test", "file": "../sigma/rules/windows/registry/registry_event/registry_event_office_test_regadd.yml", "status": "test", "level": "medium", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "f663a6d9-9d1b-49b8-b2b1-0637914d199a", "title": "Narrator's Feedback-Hub Persistence", "file": "../sigma/rules/windows/registry/registry_event/registry_event_narrator_feedback_persistance.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "55e29995-75e7-451a-bef0-6225e2f13597", "title": "Potential Credential Dumping Via LSASS SilentProcessExit Technique", "file": "../sigma/rules/windows/registry/registry_event/registry_event_silentprocessexit_lsass.yml", "status": "test", "level": "critical", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "title": "Wdigest CredGuard Registry Modification", "file": "../sigma/rules/windows/registry/registry_event/registry_event_disable_wdigest_credential_guard.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "1c8e96cd-2bed-487d-9de0-b46c90cade56", "title": "Potential Qakbot Registry Activity", "file": "../sigma/rules/windows/registry/registry_event/registry_event_malware_qakbot_registry.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "b6d235fc-1d38-4b12-adbe-325f06728f37", "title": "CMSTP Execution Registry Event", "file": "../sigma/rules/windows/registry/registry_event/registry_event_cmstp_execution_by_registry.yml", "status": "stable", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "title": "WINEKEY Registry Modification", "file": "../sigma/rules/windows/registry/registry_event/registry_event_runkey_winekey.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "6ea3bf32-9680-422d-9f50-e90716b12a66", "title": "UAC Bypass Via Wsreset", "file": "../sigma/rules/windows/registry/registry_event/registry_event_bypass_via_wsreset.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "baca5663-583c-45f9-b5dc-ea96a22ce542", "title": "Sticky Key Like Backdoor Usage - Registry", "file": "../sigma/rules/windows/registry/registry_event/registry_event_stickykey_like_backdoor.yml", "status": "test", "level": "critical", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "5b175490-b652-4b02-b1de-5b5b4083c5f8", "title": "RedMimicry Winnti Playbook Registry Manipulation", "file": "../sigma/rules/windows/registry/registry_event/registry_event_redmimicry_winnti_reg.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "62120148-6b7a-42be-8b91-271c04e281a3", "title": "Suspicious Camera and Microphone Access", "file": "../sigma/rules/windows/registry/registry_event/registry_event_susp_mic_cam_access.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "title": "Shell Open Registry Keys Manipulation", "file": "../sigma/rules/windows/registry/registry_event/registry_event_shell_open_keys_manipulation.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "277efb8f-60be-4f10-b4d3-037802f37167", "title": "Registry Persistence Mechanisms in Recycle Bin", "file": "../sigma/rules/windows/registry/registry_event/registry_event_persistence_recycle_bin.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "title": "PrinterNightmare Mimikatz Driver Name", "file": "../sigma/rules/windows/registry/registry_event/registry_event_mimikatz_printernightmare.yml", "status": "test", "level": "critical", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "title": "Disable Security Events Logging Adding Reg Key MiniNt", "file": "../sigma/rules/windows/registry/registry_event/registry_event_disable_security_events_logging_adding_reg_key_minint.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7", "title": "Registry Entries For Azorult Malware", "file": "../sigma/rules/windows/registry/registry_event/registry_event_mal_azorult.yml", "status": "test", "level": "critical", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "41d1058a-aea7-4952-9293-29eaaf516465", "title": "Removal Of AMSI Provider Registry Keys", "file": "../sigma/rules/windows/registry/registry_delete/registry_delete_removal_amsi_registry_key.yml", "status": "test", "level": "high", "logsource.category": "registry_delete", "logsource.product": "windows"}, {"id": "96f697b0-b499-4e5d-9908-a67bec11cdb6", "title": "Removal of Potential COM Hijacking Registry Keys", "file": "../sigma/rules/windows/registry/registry_delete/registry_delete_removal_com_hijacking_registry_key.yml", "status": "test", "level": "medium", "logsource.category": "registry_delete", "logsource.product": "windows"}, {"id": "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "title": "Folder Removed From Exploit Guard ProtectedFolders List - Registry", "file": "../sigma/rules/windows/registry/registry_delete/registry_delete_exploit_guard_protected_folders.yml", "status": "test", "level": "high", "logsource.category": "registry_delete", "logsource.product": "windows"}, {"id": "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "title": "Terminal Server Client Connection History Cleared - Registry", "file": "../sigma/rules/windows/registry/registry_delete/registry_delete_mstsc_history_cleared.yml", "status": "test", "level": "high", "logsource.category": "registry_delete", "logsource.product": "windows"}, {"id": "acd74772-5f88-45c7-956b-6a7b36c294d2", "title": "Removal Of SD Value to Hide Schedule Task - Registry", "file": "../sigma/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal.yml", "status": "test", "level": "medium", "logsource.category": "registry_delete", "logsource.product": "windows"}, {"id": "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "title": "Removal Of Index Value to Hide Schedule Task - Registry", "file": "../sigma/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_index_value_removal.yml", "status": "test", "level": "medium", "logsource.category": "registry_delete", "logsource.product": "windows"}, {"id": "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "title": "Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted", "file": "../sigma/rules/windows/registry/registry_delete/registry_delete_enable_windows_recall.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_delete", "logsource.product": "windows"}, {"id": "92772523-d9c1-4c93-9547-b0ca500baba3", "title": "Potential Persistence Via Mpnotify", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_mpnotify.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "790317c0-0a36-4a6a-a105-6e576bf99a14", "title": "COM Object Hijacking Via Modification Of Default System CLSID Default Value", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_com_hijacking_builtin.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "707e097c-e20f-4f67-8807-1f72ff4500d6", "title": "Potential Persistence Via App Paths Default Property", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_app_paths.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "396ae3eb-4174-4b9b-880e-dc0364d78a19", "title": "Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_outlook_enable_load_macro_provider_on_boot.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e61e8a88-59a9-451c-874e-70fcc9740d67", "title": "New DNS ServerLevelPluginDll Installed", "file": "../sigma/rules/windows/registry/registry_set/registry_set_dns_server_level_plugin_dll.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "48437c39-9e5f-47fb-af95-3d663c3f2919", "title": "UAC Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_uac_disable.yml", "status": "stable", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "title": "Outlook EnableUnsafeClientMailRules Setting Enabled - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_outlook_enable_unsafe_client_mail_rules.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "509e84b9-a71a-40e0-834f-05470369bd1e", "title": "Default RDP Port Changed to Non Standard Port", "file": "../sigma/rules/windows/registry/registry_set/registry_set_change_rdp_port.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "title": "DNS-over-HTTPS Enabled by Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_dns_over_https_enabled.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "7d9263bd-dc47-4a58-bc92-5474abab390c", "title": "Change Winevt Channel Access Permission Via Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_change_winevt_channelaccess.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "c5f6a85d-b647-40f7-bbad-c10b66bab038", "title": "UAC Notification Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_uac_disable_notification.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "8ffc5407-52e3-478f-9596-0a7371eafe13", "title": "Disable PUA Protection on Windows Defender", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disabled_pua_protection_on_microsoft_defender.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "bf344fea-d947-4ef4-9192-34d008315d3a", "title": "Suspicious Shim Database Patching Activity", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_shim_database_susp_application.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "5a93eb65-dffa-4543-b761-94aa60098fb6", "title": "Registry Hide Function from User", "file": "../sigma/rules/windows/registry/registry_set/registry_set_hide_function_user.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "7c81fec3-1c1d-43b0-996a-46753041b1b6", "title": "UAC Bypass via Event Viewer", "file": "../sigma/rules/windows/registry/registry_set/registry_set_uac_bypass_eventvwr.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "title": "Modification of IE Registry Settings", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_ie.yml", "status": "test", "level": "low", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e3fdf743-f05b-4051-990a-b66919be1743", "title": "Change User Account Associated with the FAX Service", "file": "../sigma/rules/windows/registry/registry_set/registry_set_fax_change_service_user.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "6b6976a3-b0e6-4723-ac24-ae38a737af41", "title": "Potential Persistence Via Shim Database In Uncommon Location", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_shim_database_uncommon_location.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "f7997770-92c3-4ec9-b112-774c4ef96f96", "title": "Winlogon AllowMultipleTSSessions Enable", "file": "../sigma/rules/windows/registry/registry_set/registry_set_winlogon_allow_multiple_tssessions.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "966315ef-c5e1-4767-ba25-fce9c8de3660", "title": "Suspicious Environment Variable Has Been Registered", "file": "../sigma/rules/windows/registry/registry_set/registry_set_suspicious_env_variables.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e7b18879-676e-4a0e-ae18-27039185a8e7", "title": "New Netsh Helper DLL Registered From A Suspicious Location", "file": "../sigma/rules/windows/registry/registry_set/registry_set_netsh_help_dll_persistence_susp_location.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "title": "Change the Fax Dll", "file": "../sigma/rules/windows/registry/registry_set/registry_set_fax_dll_persistance.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "title": "ClickOnce Trust Prompt Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_clickonce_trust_prompt.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "8023f872-3f1d-4301-a384-801889917ab4", "title": "Usage of Renamed Sysinternals Tools - RegistrySet", "file": "../sigma/rules/windows/registry/registry_set/registry_set_renamed_sysinternals_eula_accepted.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "44a22d59-b175-4f13-8c16-cbaef5b581ff", "title": "New File Association Using Exefile", "file": "../sigma/rules/windows/registry/registry_set/registry_set_file_association_exefile.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "fe20dda1-6f37-4379-bbe0-a98d400cae90", "title": "Potential Persistence Via Scrobj.dll COM Hijacking", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_scrobj_dll.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "b7916c2a-fa2f-4795-9477-32b731f70f11", "title": "Registry Persistence via Explorer Run Key", "file": "../sigma/rules/windows/registry/registry_set/registry_set_susp_reg_persist_explorer_run.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "0cf2e1c6-8d10-4273-8059-738778f981ad", "title": "Potential WerFault ReflectDebugger Registry Value Abuse", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_reflectdebugger.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "b86852fb-4c77-48f9-8519-eb1b2c308b59", "title": "Potential Persistence Via AppCompat RegisterAppRestart Layer", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_app_cpmpat_layer_registerapprestart.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "title": "Potential Persistence Via Outlook Home Page", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_outlook_homepage.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "dc5c24af-6995-49b2-86eb-a9ff62199e82", "title": "COM Hijacking via TreatAs", "file": "../sigma/rules/windows/registry/registry_set/registry_set_treatas_persistence.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "92b0b372-a939-44ed-a11b-5136cf680e27", "title": "Blue Mockingbird - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_mal_blue_mockingbird.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "1c3121ed-041b-4d97-a075-07f54f20fb4a", "title": "Registry Explorer Policy Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_set_nopolicies_user.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "cd277474-5c52-4423-a52b-ac2d7969902f", "title": "New BgInfo.EXE Custom WMI Query Registry Configuration", "file": "../sigma/rules/windows/registry/registry_set/registry_set_bginfo_custom_wmi_query.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "9df5f547-c86a-433e-b533-f2794357e242", "title": "Classes Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_classes.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "46490193-1b22-4c29-bdd6-5bf63907216f", "title": "VBScript Payload Stored in Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_vbs_payload_stored.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "fa277e82-9b78-42dd-b05c-05555c7b6015", "title": "Enable Local Manifest Installation With Winget", "file": "../sigma/rules/windows/registry/registry_set/registry_set_winget_enable_local_manifest.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "title": "Lsass Full Dump Request Via DumpType Registry Settings", "file": "../sigma/rules/windows/registry/registry_set/registry_set_lsass_usermode_dumping.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "91239011-fe3c-4b54-9f24-15c86bb65913", "title": "Office Macros Warning Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_vba_warnings_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "2f78da12-f7c7-430b-8b19-a28f269b77a3", "title": "Disable Windows Event Logging Via Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_winevt_logging.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "18f2065c-d36c-464a-a748-bcf909acb2e3", "title": "Wow6432Node Classes Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_classes.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "title": "Scheduled TaskCache Change by Uncommon Program", "file": "../sigma/rules/windows/registry/registry_set/registry_set_taskcache_entry.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "title": "Outlook Security Settings Updated - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_outlook_security_settings.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "title": "Hiding User Account Via SpecialAccounts Registry Key", "file": "../sigma/rules/windows/registry/registry_set/registry_set_special_accounts.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "title": "Custom File Open Handler Executes PowerShell", "file": "../sigma/rules/windows/registry/registry_set/registry_set_custom_file_open_handler_powershell_execution.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "title": "Service Binary in Suspicious Folder", "file": "../sigma/rules/windows/registry/registry_set/registry_set_creation_service_susp_folder.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "7f2954d2-99c2-4d42-a065-ca36740f187b", "title": "Hypervisor Enforced Paging Translation Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedpagingtranslation_disabled.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "title": "Common Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_common.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "title": "MaxMpxCt Registry Value Changed", "file": "../sigma/rules/windows/registry/registry_set/registry_set_optimize_file_sharing_network.yml", "status": "experimental", "level": "low", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "83314318-052a-4c90-a1ad-660ece38d276", "title": "Blackbyte Ransomware Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_blackbyte_ransomware.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "07743f65-7ec9-404a-a519-913db7118a8d", "title": "COM Hijack via Sdclt", "file": "../sigma/rules/windows/registry/registry_set/registry_set_comhijack_sdclt.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "f674e36a-4b91-431e-8aef-f8a96c2aca35", "title": "CurrentControlSet Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentcontrolset.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "title": "Potential Persistence Via Event Viewer Events.asp", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_event_viewer_events_asp.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "title": "Potential Persistence Via Shim Database Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_shim_database.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "555155a2-03bf-4fe7-af74-d176b3fdbe16", "title": "Driver Added To Disallowed Images In HVCI - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_hvci_disallowed_images.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "df4dc653-1029-47ba-8231-3c44238cc0ae", "title": "Potential Persistence Using DebugPath", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_appx_debugger.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "title": "Disable Windows Firewall by Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_windows_firewall.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "1547e27c-3974-43e2-a7d7-7f484fb928ec", "title": "Registry Persistence via Service in Safe Mode", "file": "../sigma/rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "title": "Bypass UAC Using Event Viewer", "file": "../sigma/rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "9d3436ef-9476-4c43-acca-90ce06bdf33a", "title": "DHCP Callout DLL Installation", "file": "../sigma/rules/windows/registry/registry_set/registry_set_dhcp_calloutdll.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "title": "Outlook Macro Execution Without Warning Setting Enabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_outlook_enable_macro_execution.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "fad91067-08c5-4d1a-8d8c-d96a21b37814", "title": "Potential PowerShell Execution Policy Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_powershell_execution_policy.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a982fc9c-6333-4ffb-a51d-addb04e8b529", "title": "Windows Defender Exclusions Added - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_defender_exclusions.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "title": "Directory Service Restore Mode(DSRM) Registry Value Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_dsrm_tampering.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "title": "Trust Access Disable For VBApplications", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_access_vbom_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "title": "Potentially Suspicious ODBC Driver Registered", "file": "../sigma/rules/windows/registry/registry_set/registry_set_odbc_driver_registered_susp.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "90f342e1-1aaa-4e43-b092-39fda57ed11e", "title": "ETW Logging Disabled For rpcrt4.dll", "file": "../sigma/rules/windows/registry/registry_set/registry_set_rpcrt4_etw_tamper.yml", "status": "test", "level": "low", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "02ee49e2-e294-4d0f-9278-f5b3212fc588", "title": "New RUN Key Pointing to Suspicious Folder", "file": "../sigma/rules/windows/registry/registry_set/registry_set_susp_run_key_img_folder.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "title": "RDP Sensitive Settings Changed to Zero", "file": "../sigma/rules/windows/registry/registry_set/registry_set_terminal_server_suspicious.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "0eb46774-f1ab-4a74-8238-1155855f2263", "title": "Disable Windows Defender Functionalities Via Registry Keys", "file": "../sigma/rules/windows/registry/registry_set/registry_set_windows_defender_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "title": "Python Function Execution Security Warning Disabled In Excel - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_disable_python_security_warnings.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "c90362e0-2df3-4e61-94fe-b37615814cb1", "title": "Potential Persistence Via Netsh Helper DLL - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_netsh_helper_dll_potential_persistence.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "974515da-6cc5-4c95-ae65-f97f9150ec7f", "title": "Disable Microsoft Defender Firewall via Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_defender_firewall.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "title": "ScreenSaver Registry Key Set", "file": "../sigma/rules/windows/registry/registry_set/registry_set_scr_file_executed_by_rundll32.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "c420410f-c2d8-4010-856b-dffe21866437", "title": "Enable LM Hash Storage", "file": "../sigma/rules/windows/registry/registry_set/registry_set_system_lsa_nolmhash.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "title": "System Scripts Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_system_scripts.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "f37b4bce-49d0-4087-9f5b-58bffda77316", "title": "Potential AutoLogger Sessions Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_autologger_sessions.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "9827ae57-3802-418f-994b-d5ecf5cd974b", "title": "Potential Registry Persistence Attempt Via DbgManagedDebugger", "file": "../sigma/rules/windows/registry/registry_set/registry_set_dbgmanageddebugger_persistence.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "93d298a1-d28f-47f1-a468-d971e7796679", "title": "Disable Tamper Protection on Windows Defender", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disabled_tamper_protection_on_microsoft_defender.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "46dd5308-4572-4d12-aa43-8938f0184d4f", "title": "Bypass UAC Using DelegateExecute", "file": "../sigma/rules/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "title": "Disable Windows Security Center Notifications", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_security_center_notifications.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "title": "Potential CobaltStrike Service Installations - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_cobaltstrike_service_installs.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "title": "New BgInfo.EXE Custom VBScript Registry Configuration", "file": "../sigma/rules/windows/registry/registry_set/registry_set_bginfo_custom_vbscript.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "f742bde7-9528-42e5-bd82-84f51a8387d2", "title": "Uncommon Microsoft Office Trusted Location Added", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_trusted_location_uncommon.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "title": "Scripted Diagnostics Turn Off Check Enabled - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_enabling_turnoffcheck.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "8d85cf08-bf97-4260-ba49-986a2a65129c", "title": "Suspicious Powershell In Registry Run Keys", "file": "../sigma/rules/windows/registry/registry_set/registry_set_powershell_in_run_keys.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "title": "Potential Persistence Via DLLPathOverride", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_natural_language.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "title": "Wdigest Enable UseLogonCredential", "file": "../sigma/rules/windows/registry/registry_set/registry_set_wdigest_enable_uselogoncredential.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "2ff692c2-4594-41ec-8fcb-46587de769e0", "title": "CrashControl CrashDump Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_crashdump_disabled.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "title": "Potential Attachment Manager Settings Associations Tamper", "file": "../sigma/rules/windows/registry/registry_set/registry_set_policies_associations_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "title": "Potentially Suspicious Desktop Background Change Via Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_desktop_background_change.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "b23818c7-e575-4d13-8012-332075ec0a2b", "title": "Register New IFiltre For Persistence", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_ifilter.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "title": "Potential Signing Bypass Via Windows Developer Features - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_turn_on_dev_features.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "160d2780-31f7-4922-8b3a-efce30e63e96", "title": "Potential AMSI COM Server Hijacking", "file": "../sigma/rules/windows/registry/registry_set/registry_set_amsi_com_hijack.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "title": "New TimeProviders Registered With Uncommon DLL Name", "file": "../sigma/rules/windows/registry/registry_set/registry_set_timeproviders_dllname.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "ab567429-1dfb-4674-b6d2-979fd2f9d125", "title": "Internet Explorer DisableFirstRunCustomize Enabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_internet_explorer_disable_first_run_customize.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "title": "New ODBC Driver Registered", "file": "../sigma/rules/windows/registry/registry_set/registry_set_odbc_driver_registered.yml", "status": "test", "level": "low", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "title": "Wow6432Node CurrentVersion Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "title": "Windows Defender Service Disabled - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_windows_defender_service.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "title": "Uncommon Extension In Keyboard Layout IME File Registry Value", "file": "../sigma/rules/windows/registry/registry_set/registry_set_ime_non_default_extension.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "cbf93e5d-ca6c-4722-8bea-e9119007c248", "title": "CurrentVersion NT Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion_nt.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "title": "Potential EventLog File Location Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_evtx_file_key_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "275641a5-a492-45e2-a817-7c81e9d9d3e9", "title": "Add DisallowRun Execution to Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disallowrun_execution.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "961e33d1-4f86-4fcf-80ab-930a708b2f82", "title": "Potential Persistence Via Excel Add-in - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_xll.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "title": "PowerShell as a Service in Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_powershell_as_service.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "ad89044a-8f49-4673-9a55-cbd88a1b374f", "title": "Enabling COR Profiler Environment Variables", "file": "../sigma/rules/windows/registry/registry_set/registry_set_enabling_cor_profiler_env_variables.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "086ae989-9ca6-4fe7-895a-759c5544f247", "title": "Potential Persistence Via TypedPaths", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_typed_paths.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "5de03871-5d46-4539-a82d-3aa992a69a83", "title": "Registry Disable System Restore", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_system_restore.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "28036918-04d3-423d-91c0-55ecf99fb892", "title": "NET NGenAssemblyUsageLog Registry Key Tamper", "file": "../sigma/rules/windows/registry/registry_set/registry_set_net_cli_ngenassemblyusagelog.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "title": "Disable Macro Runtime Scan Scope", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_macroruntimescanscope.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "title": "Hypervisor Enforced Code Integrity Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "title": "Hide Schedule Task Via Index Value Tamper", "file": "../sigma/rules/windows/registry/registry_set/registry_set_hide_scheduled_task_via_index_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "title": "Persistence Via New SIP Provider", "file": "../sigma/rules/windows/registry/registry_set/registry_set_sip_persistence.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "046218bd-e0d8-4113-a3c3-895a12b2b298", "title": "Session Manager Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_session_manager.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "title": "CurrentVersion Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "title": "Microsoft Office Protected View Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_disable_protected_view_features.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "title": "Potential Persistence Via Custom Protocol Handler", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_custom_protocol_handler.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a80f662f-022f-4429-9b8c-b1a41aaa6688", "title": "Internet Explorer Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_internet_explorer.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "612e47e9-8a59-43a6-b404-f48683f45bd6", "title": "ServiceDll Hijack", "file": "../sigma/rules/windows/registry/registry_set/registry_set_servicedll_hijack.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "833ef470-fa01-4631-a79b-6f291c9ac498", "title": "Add Debugger Entry To Hangs Key For Persistence", "file": "../sigma/rules/windows/registry/registry_set/registry_set_hangs_debugger_persistence.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "9d8f9bb8-01af-4e15-a3a2-349071530530", "title": "Suspicious Path In Keyboard Layout IME File Registry Value", "file": "../sigma/rules/windows/registry/registry_set/registry_set_ime_suspicious_paths.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "title": "Potential Credential Dumping Attempt Using New NetworkProvider - REG", "file": "../sigma/rules/windows/registry/registry_set/registry_set_new_network_provider.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "5df86130-4e95-4a54-90f7-26541b40aec2", "title": "Registry Modification to Hidden File Extension", "file": "../sigma/rules/windows/registry/registry_set/registry_set_hidden_extention.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "title": "Winget Admin Settings Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_winget_admin_settings_tampering.yml", "status": "test", "level": "low", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "f10ed525-97fe-4fed-be7c-2feecca941b1", "title": "Persistence Via Hhctrl.ocx", "file": "../sigma/rules/windows/registry/registry_set/registry_set_hhctrl_persistence.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "5f9db380-ea57-4d1e-beab-8a2d33397e93", "title": "UAC Bypass Using Windows Media Player - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_uac_bypass_wmp.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "487bb375-12ef-41f6-baae-c6a1572b4dd1", "title": "Potential Persistence Via Outlook Today Page", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_outlook_todaypage.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "title": "Allow RDP Remote Assistance Feature", "file": "../sigma/rules/windows/registry/registry_set/registry_set_allow_rdp_remote_assistance_feature.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "8218c875-90b9-42e2-b60d-0b0069816d10", "title": "PowerShell Script Execution Policy Enabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_powershell_enablescripts_enabled.yml", "status": "test", "level": "low", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "53330955-dc52-487f-a3a2-da24dcff99b5", "title": "New BgInfo.EXE Custom DB Path Registry Configuration", "file": "../sigma/rules/windows/registry/registry_set/registry_set_bginfo_custom_db.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "f2485272-a156-4773-82d7-1d178bc4905b", "title": "Suspicious Service Installed", "file": "../sigma/rules/windows/registry/registry_set/registry_set_susp_service_installed.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "724ea201-6514-4f38-9739-e5973c34f49a", "title": "Bypass UAC Using SilentCleanup Task", "file": "../sigma/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "6c304b02-06e6-402d-8be4-d5833cdf8198", "title": "Potential SentinelOne Shell Context Menu Scan Command Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_sentinelone_shell_context_tampering.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "title": "Tamper With Sophos AV Registry Keys", "file": "../sigma/rules/windows/registry/registry_set/registry_set_sophos_av_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "4916a35e-bfc4-47d0-8e25-a003d7067061", "title": "Sysmon Driver Altitude Change", "file": "../sigma/rules/windows/registry/registry_set/registry_set_change_sysmon_driver_altitude.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "73a883d0-0348-4be4-a8d8-51031c2564f8", "title": "Potential Registry Persistence Attempt Via Windows Telemetry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_telemetry_persistence.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "title": "ETW Logging Disabled In .NET Processes - Sysmon Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_dot_net_etw_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "d223b46b-5621-4037-88fe-fda32eead684", "title": "New Root or CA or AuthRoot Certificate to Store", "file": "../sigma/rules/windows/registry/registry_set/registry_set_install_root_or_ca_certificat.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "31e124fb-5dc4-42a0-83b3-44a69c77b271", "title": "Antivirus Filter Driver Disallowed On Dev Drive - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_devdrv_disallow_antivirus_filter.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "title": "Activate Suppression of Windows Security Center Notifications", "file": "../sigma/rules/windows/registry/registry_set/registry_set_suppress_defender_notifications.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "480421f9-417f-4d3b-9552-fd2728443ec8", "title": "Wow6432Node Windows NT CurrentVersion Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "60936b49-fca0-4f32-993d-7415edcf9a5d", "title": "New Application in AppCompat", "file": "../sigma/rules/windows/registry/registry_set/registry_set_new_application_appcompat.yml", "status": "test", "level": "informational", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "title": "RestrictedAdminMode Registry Value Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_lsa_disablerestrictedadmin.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "6597be7b-ac61-4ac8-bef4-d3ec88174853", "title": "UAC Bypass Abusing Winsat Path Parsing - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_uac_bypass_winsat.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "5b872a46-3b90-45c1-8419-f675db8053aa", "title": "UAC Bypass via Sdclt", "file": "../sigma/rules/windows/registry/registry_set/registry_set_uac_bypass_sdclt.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "092af964-4233-4373-b4ba-d86ea2890288", "title": "Add Debugger Entry To AeDebug For Persistence", "file": "../sigma/rules/windows/registry/registry_set/registry_set_aedebug_persistence.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "b64a026b-8deb-4c1d-92fd-98893209dff1", "title": "Running Chrome VPN Extensions via the Registry 2 VPN Extension", "file": "../sigma/rules/windows/registry/registry_set/registry_set_chrome_extension.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "title": "Potential PendingFileRenameOperations Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_susp_pendingfilerenameoperations.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "34aa0252-6039-40ff-951f-939fd6ce47d8", "title": "Suspicious Keyboard Layout Load", "file": "../sigma/rules/windows/registry/registry_set/registry_set_susp_keyboard_layout_load.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "63647769-326d-4dde-a419-b925cc0caf42", "title": "Enable Microsoft Dynamic Data Exchange", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_enable_dde.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "title": "Macro Enabled In A Potentially Suspicious Document", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_trust_record_susp_location.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "title": "IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols", "file": "../sigma/rules/windows/registry/registry_set/registry_set_ie_security_zone_protocol_defaults_downgrade.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "title": "Potential Attachment Manager Settings Attachments Tamper", "file": "../sigma/rules/windows/registry/registry_set/registry_set_policies_attachments_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "9d15044a-7cfe-4d23-8085-6ebc11df7685", "title": "Potential Persistence Via Visual Studio Tools for Office", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_office_vsto.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "title": "Persistence Via Disk Cleanup Handler - Autorun", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disk_cleanup_handler_autorun_persistence.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "976dd1f2-a484-45ec-aa1d-0e87e882262b", "title": "Potential Persistence Via CHM Helper DLL", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_chm.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "title": "Windows Recall Feature Enabled - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_enable_windows_recall.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "944e8941-f6f6-4ee8-ac05-1c224e923c0e", "title": "Add Port Monitor Persistence in Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_add_port_monitor.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "title": "Periodic Backup For System Registry Hives Enabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_enable_periodic_backup.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "439957a7-ad86-4a8f-9705-a28131c6821b", "title": "Old TLS1.0/TLS1.1 Protocol Version Enabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_tls_protocol_old_version_enabled.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "5a5152f1-463f-436b-b2f5-8eceb3964b42", "title": "Displaying Hidden Files Feature Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_hide_file.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e0813366-0407-449a-9869-a2db1119dc41", "title": "Suspicious Printer Driver Empty Manufacturer", "file": "../sigma/rules/windows/registry/registry_set/registry_set_susp_printer_driver.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "title": "WinSock2 Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_winsock2.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "title": "Lolbas OneDriveStandaloneUpdater.exe Proxy Download", "file": "../sigma/rules/windows/registry/registry_set/registry_set_lolbin_onedrivestandaloneupdater.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "bf9e1387-b040-4393-9851-1598f8ecfae9", "title": "Disable Exploit Guard Network Protection on Windows Defender", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disabled_exploit_guard_net_protection_on_ms_defender.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "title": "Potential Persistence Via MyComputer Registry Keys", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_mycomputer.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "title": "Disable Administrative Share Creation at Startup", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_administrative_share.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "9c226817-8dc9-46c2-a58d-66655aafd7dc", "title": "Modify User Shell Folders Startup Value", "file": "../sigma/rules/windows/registry/registry_set/registry_set_susp_user_shell_folders.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "7021255e-5db3-4946-a8b9-0ba7a4644a69", "title": "Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG", "file": "../sigma/rules/windows/registry/registry_set/registry_set_provisioning_command_abuse.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "36803969-5421-41ec-b92f-8500f79c23b0", "title": "Potential Persistence Via GlobalFlags", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_globalflags.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "title": "Winlogon Notify Key Logon Persistence", "file": "../sigma/rules/windows/registry/registry_set/registry_set_winlogon_notify_key.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "title": "Disable Privacy Settings Experience in Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_privacy_settings_experience.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "42205c73-75c8-4a63-9db1-e3782e06fda0", "title": "Suspicious Application Allowed Through Exploit Guard", "file": "../sigma/rules/windows/registry/registry_set/registry_set_exploit_guard_susp_allowed_apps.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "41f6531d-af6e-4c6e-918f-b946f2b85a36", "title": "Potential Persistence Via LSA Extensions", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_lsa_extension.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e2482f8d-3443-4237-b906-cc145d87a076", "title": "Disable Internal Tools or Feature in Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_function_user.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "8b9606c9-28be-4a38-b146-0e313cc232c1", "title": "Potential Ransomware Activity Using LegalNotice Message", "file": "../sigma/rules/windows/registry/registry_set/registry_set_legalnotice_susp_message.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "title": "IE Change Domain Zone", "file": "../sigma/rules/windows/registry/registry_set/registry_set_change_security_zones.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "title": "RDP Sensitive Settings Changed", "file": "../sigma/rules/windows/registry/registry_set/registry_set_terminal_server_tampering.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "4f281b83-0200-4b34-bf35-d24687ea57c2", "title": "ETW Logging Disabled For SCM", "file": "../sigma/rules/windows/registry/registry_set/registry_set_services_etw_tamper.yml", "status": "test", "level": "low", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "243380fa-11eb-4141-af92-e14925e77c1b", "title": "Potential PSFactoryBuffer COM Hijacking", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_comhijack_psfactorybuffer.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "baecf8fb-edbf-429f-9ade-31fc3f22b970", "title": "Office Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_office.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "title": "Disabled Windows Defender Eventlog", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disabled_microsoft_defender_eventlog.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "0d7ceeef-3539-4392-8953-3dc664912714", "title": "UAC Secure Desktop Prompt Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_uac_disable_secure_desktop_prompt.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "fc014922-5def-4da9-a0fc-28c973f41bfb", "title": "Execution DLL of Choice Using WAB.EXE", "file": "../sigma/rules/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "title": "Potential Persistence Via AutodialDLL", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_autodial_dll.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7", "title": "PowerShell Logging Disabled Via Registry Key Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_powershell_logging_disabled.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "title": "Potential Persistence Via Disk Cleanup Handler - Registry", "file": "../sigma/rules/windows/registry/registry_add/registry_add_persistence_disk_cleanup_handler_entry.yml", "status": "test", "level": "medium", "logsource.category": "registry_add", "logsource.product": "windows"}, {"id": "9ace0707-b560-49b8-b6ca-5148b42f39fb", "title": "Potential Persistence Via Logon Scripts - Registry", "file": "../sigma/rules/windows/registry/registry_add/registry_add_persistence_logon_scripts_userinitmprlogonscript.yml", "status": "test", "level": "medium", "logsource.category": "registry_add", "logsource.product": "windows"}, {"id": "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "title": "PUA - Sysinternals Tools Execution - Registry", "file": "../sigma/rules/windows/registry/registry_add/registry_add_pua_sysinternals_susp_execution_via_eula.yml", "status": "test", "level": "medium", "logsource.category": "registry_add", "logsource.product": "windows"}, {"id": "9b0f8a61-91b2-464f-aceb-0527e0a45020", "title": "Potential COM Object Hijacking Via TreatAs Subkey - Registry", "file": "../sigma/rules/windows/registry/registry_add/registry_add_persistence_com_key_linking.yml", "status": "test", "level": "medium", "logsource.category": "registry_add", "logsource.product": "windows"}, {"id": "1d218616-71b0-4c40-855b-9dbe75510f7f", "title": "Potential NetWire RAT Activity - Registry", "file": "../sigma/rules/windows/registry/registry_add/registry_add_malware_netwire.yml", "status": "test", "level": "high", "logsource.category": "registry_add", "logsource.product": "windows"}, {"id": "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "title": "Potential Persistence Via New AMSI Providers - Registry", "file": "../sigma/rules/windows/registry/registry_add/registry_add_persistence_amsi_providers.yml", "status": "test", "level": "high", "logsource.category": "registry_add", "logsource.product": "windows"}, {"id": "25ffa65d-76d8-4da5-a832-3f2b0136e133", "title": "PUA - Sysinternal Tool Execution - Registry", "file": "../sigma/rules/windows/registry/registry_add/registry_add_pua_sysinternals_execution_via_eula.yml", "status": "test", "level": "low", "logsource.category": "registry_add", "logsource.product": "windows"}, {"id": "f50f3c09-557d-492d-81db-9064a8d4e211", "title": "Suspicious Execution Of Renamed Sysinternals Tools - Registry", "file": "../sigma/rules/windows/registry/registry_add/registry_add_pua_sysinternals_renamed_execution_via_eula.yml", "status": "test", "level": "high", "logsource.category": "registry_add", "logsource.product": "windows"}, {"id": "db809f10-56ce-4420-8c86-d6a7d793c79c", "title": "Potential Defense Evasion Via Raw Disk Access By Uncommon Tools", "file": "../sigma/rules/windows/raw_access_thread/raw_access_thread_susp_disk_access_using_uncommon_tools.yml", "status": "test", "level": "low", "logsource.category": "raw_access_thread", "logsource.product": "windows"}, {"id": "5ef9853e-4d0e-4a70-846f-a9ca37d876da", "title": "Potential Credential Dumping Activity Via LSASS", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_memdump.yml", "status": "experimental", "level": "medium", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "d0d2f720-d14f-448d-8242-51ff396a334e", "title": "HackTool - Generic Process Access", "file": "../sigma/rules/windows/process_access/proc_access_win_hktl_generic_access.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "a49fa4d5-11db-418c-8473-1e014a8dd462", "title": "Lsass Memory Dump via Comsvcs DLL", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_dump_comsvcs_dll.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9", "title": "Credential Dumping Activity By Python Based Tool", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_python_based_tool.yml", "status": "stable", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "9bd012ee-0dff-44d7-84a0-aa698cfd87a3", "title": "LSASS Memory Access by Tool With Dump Keyword In Name", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_dump_keyword_image.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "174afcfa-6e40-4ae9-af64-496546389294", "title": "Credential Dumping Attempt Via Svchost", "file": "../sigma/rules/windows/process_access/proc_access_win_svchost_credential_dumping.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "4be8b654-0c01-4c9d-a10c-6b28467fc651", "title": "LSASS Access From Potentially White-Listed Processes", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_whitelisted_process_names.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5", "title": "HackTool - HandleKatz Duplicating LSASS Handle", "file": "../sigma/rules/windows/process_access/proc_access_win_hktl_handlekatz_lsass_access.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "fb3722e4-1a06-46b6-b772-253e2e7db933", "title": "Function Call From Undocumented COM Interface EditionUpgradeManager", "file": "../sigma/rules/windows/process_access/proc_access_win_uac_bypass_editionupgrademanagerobj.yml", "status": "test", "level": "medium", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "472159c5-31b9-4f56-b794-b766faa8b0a7", "title": "Suspicious LSASS Access Via MalSecLogon", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_seclogon_access.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "166e9c50-8cd9-44af-815d-d1f0c0e90dde", "title": "Suspicious Svchost Process Access", "file": "../sigma/rules/windows/process_access/proc_access_win_svchost_susp_access_request.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "e5b33f7d-eb93-48b6-9851-09e1e610b6d7", "title": "Credential Dumping Attempt Via WerFault", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_werfault.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "aa35a627-33fb-4d04-a165-d33b4afca3e8", "title": "Remote LSASS Process Access Through Windows Remote Management", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_remote_access_trough_winrm.yml", "status": "stable", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "a24e5861-c6ca-4fde-a93c-ba9256feddf0", "title": "Uncommon Process Access Rights For Target Image", "file": "../sigma/rules/windows/process_access/proc_access_win_susp_all_access_uncommon_target.yml", "status": "experimental", "level": "low", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "4f6c43e2-f989-4ea5-bcd8-843b49a0317c", "title": "UAC Bypass Using WOW64 Logger DLL Hijack", "file": "../sigma/rules/windows/process_access/proc_access_win_uac_bypass_wow64_logger.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "3f3f3506-1895-401b-9cc3-e86b16e630d0", "title": "Potential Direct Syscall of NtOpenProcess", "file": "../sigma/rules/windows/process_access/proc_access_win_susp_direct_ntopenprocess_call.yml", "status": "experimental", "level": "medium", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "7bdde3bf-2a42-4c39-aa31-a92b3e17afac", "title": "HackTool - LittleCorporal Generated Maldoc Injection", "file": "../sigma/rules/windows/process_access/proc_access_win_hktl_littlecorporal_generated_maldoc.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "3b4b232a-af90-427c-a22f-30b0c0837b95", "title": "CMSTP Execution Process Access", "file": "../sigma/rules/windows/process_access/proc_access_win_cmstp_execution_by_access.yml", "status": "stable", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "a18dd26b-6450-46de-8c91-9659150cf088", "title": "Potentially Suspicious GrantedAccess Flags On LSASS", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_susp_access_flag.yml", "status": "test", "level": "medium", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "09706624-b7f6-455d-9d02-adee024cee1d", "title": "HackTool - CobaltStrike BOF Injection Pattern", "file": "../sigma/rules/windows/process_access/proc_access_win_hktl_cobaltstrike_bof_injection_pattern.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "d29ada0f-af45-4f27-8f32-f7b77c3dbc4e", "title": "HackTool - SysmonEnte Execution", "file": "../sigma/rules/windows/process_access/proc_access_win_hktl_sysmonente.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "ec8c4047-fad9-416a-8c81-0f479353d7f6", "title": "Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE", "file": "../sigma/rules/windows/image_load/image_load_dll_sdiageng_load_by_msdt.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "title": "WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load", "file": "../sigma/rules/windows/image_load/image_load_scrcons_wmi_scripteventconsumer.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "title": "PowerShell Core DLL Loaded Via Office Application", "file": "../sigma/rules/windows/image_load/image_load_office_powershell_dll_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "d13c43f0-f66b-4279-8b2c-5912077c1780", "title": "CLR DLL Loaded Via Office Applications", "file": "../sigma/rules/windows/image_load/image_load_office_dotnet_clr_dll_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "d2451be2-b582-4e15-8701-4196ac180260", "title": "Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE", "file": "../sigma/rules/windows/image_load/image_load_side_load_keyscrambler.yml", "status": "experimental", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "f40017b3-cb2e-4335-ab5d-3babf679c1de", "title": "Remote DLL Load Via Rundll32.EXE", "file": "../sigma/rules/windows/image_load/image_load_rundll32_remote_share_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "title": "Microsoft VBA For Outlook Addin Loaded Via Outlook", "file": "../sigma/rules/windows/image_load/image_load_office_outlook_outlvba_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "title": "Suspicious Volume Shadow Copy Vssapi.dll Load", "file": "../sigma/rules/windows/image_load/image_load_dll_vssapi_susp_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "title": "Potential EACore.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_eacore.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "f354eba5-623b-450f-b073-0b5b2773b6aa", "title": "Potential DCOM InternetExplorer.Application DLL Hijack - Image Load", "file": "../sigma/rules/windows/image_load/image_load_iexplore_dcom_iertutil_dll_hijack.yml", "status": "test", "level": "critical", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "6414b5cd-b19d-447e-bb5e-9f03940b5784", "title": "Potential DLL Sideloading Of DBGHELP.DLL", "file": "../sigma/rules/windows/image_load/image_load_side_load_dbghelp.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94", "title": "Suspicious WSMAN Provider Image Loads", "file": "../sigma/rules/windows/image_load/image_load_wsman_provider_image_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "bdc64095-d59a-42a2-8588-71fd9c9d9abc", "title": "Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded", "file": "../sigma/rules/windows/image_load/image_load_dll_dbghelp_dbgcore_unsigned_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "1fbc0671-5596-4e17-8682-f020a0b995dc", "title": "Potential CCleanerDU.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_ccleaner_du.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "552b6b65-df37-4d3e-a258-f2fc4771ae54", "title": "Potential Antivirus Software DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_antivirus.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "title": "Microsoft Office DLL Sideload", "file": "../sigma/rules/windows/image_load/image_load_side_load_office_dlls.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "333cdbe8-27bb-4246-bf82-b41a0dca4b70", "title": "Suspicious Volume Shadow Copy VSS_PS.dll Load", "file": "../sigma/rules/windows/image_load/image_load_dll_vss_ps_susp_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "title": "WMIC Loading Scripting Libraries", "file": "../sigma/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "4c21b805-4dd7-469f-b47d-7383a8fcb437", "title": "Potential Iviewers.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_iviewers.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "title": "Potential Mpclient.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_windows_defender.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "title": "Potential Waveedit.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_waveedit.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "title": "Potential DLL Sideloading Of MsCorSvc.DLL", "file": "../sigma/rules/windows/image_load/image_load_side_load_mscorsvc.yml", "status": "experimental", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "4508a70e-97ef-4300-b62b-ff27992990ea", "title": "DotNet CLR DLL Loaded By Scripting Applications", "file": "../sigma/rules/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "857c8db3-c89b-42fb-882b-f681c7cf4da2", "title": "Unsigned Image Loaded Into LSASS Process", "file": "../sigma/rules/windows/image_load/image_load_lsass_unsigned_image_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "title": "WMI Persistence - Command Line Event Consumer", "file": "../sigma/rules/windows/image_load/image_load_wmi_persistence_commandline_event_consumer.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "3669afd2-9891-4534-a626-e5cf03810a61", "title": "Load Of RstrtMgr.DLL By An Uncommon Process", "file": "../sigma/rules/windows/image_load/image_load_dll_rstrtmgr_uncommon_load.yml", "status": "test", "level": "low", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "title": "Potential RjvPlatform.DLL Sideloading From Default Location", "file": "../sigma/rules/windows/image_load/image_load_side_load_rjvplatform_default_location.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "title": "DLL Load By System Process From Suspicious Locations", "file": "../sigma/rules/windows/image_load/image_load_susp_dll_load_system_process.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "7417e29e-c2e7-4cf6-a2e8-767228c64837", "title": "Active Directory Kerberos DLL Loaded Via Office Application", "file": "../sigma/rules/windows/image_load/image_load_office_kerberos_dll_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "72ca7c75-bf85-45cd-aca7-255d360e423c", "title": "Potential Chrome Frame Helper DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_chrome_frame_helper.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "060d5ad4-3153-47bb-8382-43e5e29eda92", "title": "Unsigned Module Loaded by ClickOnce Application", "file": "../sigma/rules/windows/image_load/image_load_susp_clickonce_unsigned_module_loaded.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "0e0bc253-07ed-43f1-816d-e1b220fe8971", "title": "Potential RjvPlatform.DLL Sideloading From Non-Default Location", "file": "../sigma/rules/windows/image_load/image_load_side_load_rjvplatform_non_default_location.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "6e78b74f-c762-4800-82ad-f66787f10c8a", "title": "Potential Rcdll.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_rcdll.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "84b0a8f3-680b-4096-a45b-e9a89221727c", "title": "PCRE.NET Package Image Load", "file": "../sigma/rules/windows/image_load/image_load_dll_pcre_dotnet_dll_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "90ae0469-0cee-4509-b67f-e5efcef040f7", "title": "Aruba Network Service Potential DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_aruba_networks_virtual_intranet_access.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "bf9808c4-d24f-44a2-8398-b65227d406b6", "title": "Potential Libvlc.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_libvlc.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "caa02837-f659-466f-bca6-48bde2826ab4", "title": "Potential DLL Sideloading Via ClassicExplorer32.dll", "file": "../sigma/rules/windows/image_load/image_load_side_load_classicexplorer32.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "title": "PowerShell Core DLL Loaded By Non PowerShell Process", "file": "../sigma/rules/windows/image_load/image_load_dll_system_management_automation_susp_load.yml", "status": "experimental", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "title": "Potential Goopdate.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_goopdate.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "4fc0deee-0057-4998-ab31-d24e46e0aba4", "title": "Potential System DLL Sideloading From Non System Locations", "file": "../sigma/rules/windows/image_load/image_load_side_load_from_non_system_location.yml", "status": "experimental", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "e2e01011-5910-4267-9c3b-4149ed5479cf", "title": "Potential WWlib.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_wwlib.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "title": "Potential Edputil.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_edputil.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "d2605a99-2218-4894-8fd3-2afb7946514d", "title": "Potential Mfdetours.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_mfdetours.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "title": "VMGuestLib DLL Sideload", "file": "../sigma/rules/windows/image_load/image_load_side_load_vmguestlib.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "a2a3b925-7bb0-433b-b508-db9003263cc4", "title": "Active Directory Parsing DLL Loaded Via Office Application", "file": "../sigma/rules/windows/image_load/image_load_office_dsparse_dll_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "68654bf0-4412-43d5-bfe8-5eaa393cd939", "title": "Potential DLL Sideloading Via JsSchHlp", "file": "../sigma/rules/windows/image_load/image_load_side_load_jsschhlp.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "title": "Potential RoboForm.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_robform.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "title": "Potential DLL Sideloading Using Coregen.exe", "file": "../sigma/rules/windows/image_load/image_load_side_load_coregen.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "952ed57c-8f99-453d-aee0-53a49c22f95d", "title": "Potential AVKkid.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_avkkid.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "title": "DLL Sideloading Of ShellChromeAPI.DLL", "file": "../sigma/rules/windows/image_load/image_load_side_load_shell_chrome_api.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "title": "Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE", "file": "../sigma/rules/windows/image_load/image_load_side_load_gup_libcurl.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "cbb56d62-4060-40f7-9466-d8aaf3123f83", "title": "Python Image Load By Non-Python Process", "file": "../sigma/rules/windows/image_load/image_load_susp_python_image_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "75e508f7-932d-4ebc-af77-269237a84ce1", "title": "DLL Loaded From Suspicious Location Via Cmspt.EXE", "file": "../sigma/rules/windows/image_load/image_load_cmstp_load_dll_from_susp_location.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "50f852e6-af22-4c78-9ede-42ef36aa3453", "title": "Potential Azure Browser SSO Abuse", "file": "../sigma/rules/windows/image_load/image_load_dll_azure_microsoft_account_token_provider_dll_load.yml", "status": "test", "level": "low", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "title": "HackTool - SILENTTRINITY Stager DLL Load", "file": "../sigma/rules/windows/image_load/image_load_hktl_silenttrinity_stager.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "8cde342c-ba48-4b74-b615-172c330f2e93", "title": "Suspicious Renamed Comsvcs DLL Loaded By Rundll32", "file": "../sigma/rules/windows/image_load/image_load_dll_comsvcs_load_renamed_version_by_rundll32.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "ea5c131b-380d-49f9-aeb3-920694da4d4b", "title": "Suspicious Unsigned Thor Scanner Execution", "file": "../sigma/rules/windows/image_load/image_load_thor_unsigned_execution.yml", "status": "stable", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "a2edbce1-95c8-4291-8676-0d45146862b3", "title": "Potential SolidPDFCreator.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_solidpdfcreator.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "844f8eb2-610b-42c8-89a4-47596e089663", "title": "Potential ShellDispatch.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_shelldispatch.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "6360757a-d460-456c-8b13-74cf0e60cceb", "title": "Potential DLL Sideloading Via comctl32.dll", "file": "../sigma/rules/windows/image_load/image_load_side_load_comctl32.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "24b6cf51-6122-469e-861a-22974e9c1e5b", "title": "Potential SmadHook.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_smadhook.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "6b98b92b-4f00-4f62-b4fe-4d1920215771", "title": "Potential DLL Sideloading Of Non-Existent DLLs From System Folders", "file": "../sigma/rules/windows/image_load/image_load_side_load_non_existent_dlls.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "9ed5959a-c43c-4c59-84e3-d28628429456", "title": "UAC Bypass Using Iscsicpl - ImageLoad", "file": "../sigma/rules/windows/image_load/image_load_uac_bypass_iscsicpl.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "title": "Potential 7za.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_7za.yml", "status": "test", "level": "low", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "title": "System Control Panel Item Loaded From Uncommon Location", "file": "../sigma/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location.yml", "status": "experimental", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "b48492dc-c5ef-4572-8dff-32bc241c15c8", "title": "Load Of RstrtMgr.DLL By A Suspicious Process", "file": "../sigma/rules/windows/image_load/image_load_dll_rstrtmgr_suspicious_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "title": "Potential Python DLL SideLoading", "file": "../sigma/rules/windows/image_load/image_load_side_load_python.yml", "status": "experimental", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "title": "VMMap Signed Dbghelp.DLL Potential Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_vmmap_dbghelp_signed.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "b5de0c9a-6f19-43e0-af4e-55ad01f550af", "title": "Unsigned DLL Loaded by Windows Utility", "file": "../sigma/rules/windows/image_load/image_load_susp_unsigned_dll.yml", "status": "experimental", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "fef394cd-f44d-4040-9b18-95d92fe278c0", "title": "Potential DLL Sideloading Of DbgModel.DLL", "file": "../sigma/rules/windows/image_load/image_load_side_load_dbgmodel.yml", "status": "experimental", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "48bfd177-7cf2-412b-ad77-baf923489e82", "title": "Suspicious Volume Shadow Copy Vsstrace.dll Load", "file": "../sigma/rules/windows/image_load/image_load_dll_vsstrace_susp_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "2092cacb-d77b-4f98-ab0d-32b32f99a054", "title": "Potential Vivaldi_elf.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_vivaldi_elf.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "ff0f2b05-09db-4095-b96d-1b75ca24894a", "title": "DotNET Assembly DLL Loaded Via Office Application", "file": "../sigma/rules/windows/image_load/image_load_office_dotnet_assembly_dll_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "49329257-089d-46e6-af37-4afce4290685", "title": "HackTool - SharpEvtMute DLL Load", "file": "../sigma/rules/windows/image_load/image_load_hktl_sharpevtmute.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "7707a579-e0d8-4886-a853-ce47e4575aaa", "title": "Wmiprvse Wbemcomn DLL Hijack", "file": "../sigma/rules/windows/image_load/image_load_wmiprvse_wbemcomn_dll_hijack.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "ee6cea48-c5b6-4304-a332-10fc6446f484", "title": "Potential appverifUI.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_appverifui.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "9313dc13-d04c-46d8-af4a-a930cc55d93b", "title": "Potential DLL Sideloading Via VMware Xfer", "file": "../sigma/rules/windows/image_load/image_load_side_load_vmware_xfer.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "title": "VBA DLL Loaded Via Office Application", "file": "../sigma/rules/windows/image_load/image_load_office_vbadll_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "title": "Windows Spooler Service Suspicious Binary Load", "file": "../sigma/rules/windows/image_load/image_load_spoolsv_dll_load.yml", "status": "test", "level": "informational", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "title": "Potential Wazuh Security Platform DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_wazuh.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "e76c8240-d68f-4773-8880-5c6f63595aaf", "title": "Time Travel Debugging Utility Usage - Image", "file": "../sigma/rules/windows/image_load/image_load_dll_tttracer_module_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "828af599-4c53-4ed2-ba4a-a9f835c434ea", "title": "Fax Service DLL Search Order Hijack", "file": "../sigma/rules/windows/image_load/image_load_side_load_ualapi.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "title": "Third Party Software DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_third_party.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "title": "Potential DLL Sideloading Of MpSvc.DLL", "file": "../sigma/rules/windows/image_load/image_load_side_load_mpsvc.yml", "status": "experimental", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "af4c4609-5755-42fe-8075-4effb49f5d44", "title": "Microsoft Excel Add-In Loaded From Uncommon Location", "file": "../sigma/rules/windows/image_load/image_load_office_excel_xll_susp_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "9ca2bf31-0570-44d8-a543-534c47c33ed7", "title": "Potential DLL Sideloading Of DBGCORE.DLL", "file": "../sigma/rules/windows/image_load/image_load_side_load_dbgcore.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "title": "UAC Bypass With Fake DLL", "file": "../sigma/rules/windows/image_load/image_load_uac_bypass_via_dism.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "title": "CredUI.DLL Loaded By Uncommon Process", "file": "../sigma/rules/windows/image_load/image_load_dll_credui_uncommon_process_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "6ec86d9e-912e-4726-91a2-209359b999b9", "title": "Amsi.DLL Loaded Via LOLBIN Process", "file": "../sigma/rules/windows/image_load/image_load_dll_amsi_suspicious_process.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "273a8dd8-3742-4302-bcc7-7df5a80fe425", "title": "VMMap Unsigned Dbghelp.DLL Potential Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_vmmap_dbghelp_unsigned.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "90217a70-13fc-48e4-b3db-0d836c5824ac", "title": "GAC DLL Loaded Via Office Applications", "file": "../sigma/rules/windows/image_load/image_load_office_dotnet_gac_dll_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "3735d5ac-d770-4da0-99ff-156b180bc600", "title": "Potential CCleanerReactivator.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_ccleaner_reactivator.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "948a0953-f287-4806-bbcb-3b2e396df89f", "title": "Unsigned Mfdetours.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_mfdetours_unsigned.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "title": "Abusable DLL Potential Sideloading From Suspicious Location", "file": "../sigma/rules/windows/image_load/image_load_side_load_abused_dlls_susp_paths.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "73e67340-0d25-11eb-adc1-0242ac120002", "title": "Invoke-Obfuscation CLIP+ Launcher - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_clip.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "3ceb2083-a27f-449a-be33-14ec1b7cc973", "title": "Silence.EDA Detection", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_apt_silence_eda.yml", "status": "test", "level": "critical", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "195626f3-5f1b-4403-93b7-e6cfd4d6a078", "title": "Suspicious SSL Connection", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_ssl_keyword.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "ca8b77a9-d499-4095-b793-5d5f330d450e", "title": "PowerShell Credential Prompt", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_prompt_credentials.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "99c49d9c-34ea-45f7-84a7-4751ae6b2cbc", "title": "Dump Credentials from Windows Credential Manager With PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_dump_password_windows_credential_manager.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "7b836d7f-179c-4ba4-90a7-a7e60afb48e6", "title": "Execute Invoke-command on Remote Host", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_command_remote.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "bde47d4b-9987-405c-94c7-b080410e8ea7", "title": "Clearing Windows Console History", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_clearing_windows_console_history.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "88f0884b-331d-403d-a3a1-b668cf035603", "title": "AD Groups Or Users Enumeration Using PowerShell - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_ad_group_reco.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "4fdc44df-bfe9-4fcc-b041-68f5a2d3031c", "title": "Powershell LocalAccount Manipulation", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_localuser.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "ddcd88cb-7f62-4ce5-86f9-1704190feb0a", "title": "Potential In-Memory Execution Using Reflection.Assembly", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_dotnet_assembly_from_file.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "8c521530-5169-495d-a199-0a3a881ad24e", "title": "NTFS Alternate Data Stream", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_ntfs_ads_access.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "3c7d1587-3b13-439f-9941-7d14313dbdfe", "title": "Potential COM Objects Download Cradles Usage - PS Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_download_com_cradles.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "c1337eb8-921a-4b59-855b-4ba188ddcc42", "title": "Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_win32_shadowcopy_deletion.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "95afc12e-3cbb-40c3-9340-84a032e596a3", "title": "Service Registry Permissions Weakness Check", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_get_acl_service.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "1c563233-030e-4a07-af8c-ee0490a66d3a", "title": "Suspicious New-PSDrive to Admin Share", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_new_psdrive.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "fbc5e92f-3044-4e73-a5c6-1c4359b539de", "title": "PowerShell Script With File Hostname Resolving Capabilities", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_resolve_list_of_ip_from_file.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e4f93c99-396f-47c8-bb0f-201b1fa69034", "title": "Potential Data Exfiltration Via Audio File", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_audio_exfiltration.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "f5d1def8-1de0-4a0e-9794-1f6f27dd605c", "title": "PowerShell Hotfix Enumeration", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_hotfix_enum.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "78aa1347-1517-4454-9982-b338d6df8343", "title": "Powershell MsXml COM Object", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_msxml_com.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "4368354e-1797-463c-bc39-a309effbe8d7", "title": "Powershell Add Name Resolution Policy Table Rule", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_add_dnsclient_rule.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "b7ec41a4-042c-4f31-a5db-d0fcde9fa5c5", "title": "PowerShell PSAttack", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_psattack.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "5947497f-1aa4-41dd-9693-c9848d58727d", "title": "Suspicious Unblock-File", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_unblock_file.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "d4a11f63-2390-411c-9adf-d791fd152830", "title": "Windows Screen Capture with CopyFromScreen", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_capture_screenshots.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "cae80281-ef23-44c5-873b-fd48d2666f49", "title": "PowerShell Script Change Permission Via Set-Acl - PsScript", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_set_acl.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "c1dda054-d638-4c16-afc8-53e007f3fbc5", "title": "Automated Collection Command PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_automated_collection.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "a861d835-af37-4930-bcd6-5b178bfb54df", "title": "Request A Single Ticket via PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_request_kerberos_ticket.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "851fd622-b675-4d26-b803-14bc7baa517a", "title": "HackTool - WinPwn Execution - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "b29a93fb-087c-4b5b-a84d-ee3309e69d08", "title": "Manipulation of User Computer or Group Security Principals Across AD", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_directoryservices_accountmanagement.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "a0edd39f-a0c6-4c17-8141-261f958e8d8f", "title": "PowerShell Remote Session Creation", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_remote_session_creation.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "da34e323-1e65-42db-83be-a6725ac2caa3", "title": "Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_packet_capture.yml", "status": "experimental", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "6c6c6282-7671-4fe9-a0ce-a2dcebdc342b", "title": "Powershell XML Execute Command", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_xml_iex.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "846c7a87-8e14-4569-9d49-ecfd4276a01c", "title": "DSInternals Suspicious PowerShell Cmdlets - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_dsinternals_cmdlets.yml", "status": "experimental", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "1883444f-084b-419b-ac62-e0d0c5b3693f", "title": "Suspicious Connection to Remote Account", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_networkcredential.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "db885529-903f-4c5d-9864-28fe199e6370", "title": "Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_computer_discovery_get_adcomputer.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "602f5669-6927-4688-84db-0d4b7afb2150", "title": "Disable Powershell Command History", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_disable_psreadline_command_history.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "851c506b-6b7c-4ce2-8802-c703009d03c0", "title": "Winlogon Helper DLL", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_winlogon_helper_dll.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "15b7abbb-8b40-4d01-9ee2-b51994b1d474", "title": "Suspicious PowerShell Mailbox SMTP Forward Rule", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_exchange_mailbox_smpt_forwarding_rule.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "63bf8794-9917-45bc-88dd-e1b5abc0ecfd", "title": "Powershell Install a DLL in System Directory", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_copy_item_system_directory.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "1f49f2ab-26bc-48b3-96cc-dcffbc93eadf", "title": "Potential Suspicious PowerShell Keywords", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_keywords.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "779c8c12-0eb1-11eb-adc1-0242ac120002", "title": "Invoke-Obfuscation STDIN+ Launcher - Powershell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_stdin.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "afd12fed-b0ec-45c9-a13d-aa86625dac81", "title": "Create Volume Shadow Copy with Powershell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_create_volume_shadow_copy.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "488b44e7-3781-4a71-888d-c95abfacf44d", "title": "Windows Firewall Profile Disabled", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_windows_firewall_profile_disabled.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "b26647de-4feb-4283-af6b-6117661283c5", "title": "Powershell Suspicious Win32_PnPEntity", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_win32_pnpentity.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "0f017df3-8f5a-414f-ad6b-24aff1128278", "title": "Suspicious Eventlog Clear", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_clear_eventlog.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "bd5971a7-626d-46ab-8176-ed643f694f68", "title": "Extracting Information with PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_extracting.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "f62176f3-8128-4faa-bf6c-83261322e5eb", "title": "Malicious PowerShell Keywords", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_malicious_keywords.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "f772cee9-b7c2-4cb2-8f07-49870adc02e0", "title": "Malicious Nishang PowerShell Commandlets", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_nishang_malicious_commandlets.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "8c3a6607-b7dc-4f0d-a646-ef38c00b76ee", "title": "Active Directory Group Enumeration With Get-AdGroup", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_get_adgroup.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "af4c87ce-bdda-4215-b998-15220772e993", "title": "Suspicious Process Discovery With Get-Process", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_get_process.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "42821614-9264-4761-acfc-5772c3286f76", "title": "Root Certificate Installed - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_root_certificate_installed.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "2837e152-93c8-43d2-85ba-c3cd3c2ae614", "title": "Powershell Local Email Collection", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_mail_acces.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "c6438007-e081-42ce-9483-b067fbef33c3", "title": "Powershell Timestomp", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_timestomp.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "bd33d2aa-497e-4651-9893-5c5364646595", "title": "Suspicious TCP Tunnel Via PowerShell Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_proxy_scripts.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "1139d2e2-84b1-4226-b445-354492eba8ba", "title": "Usage Of Web Request Commands And Cmdlets - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_web_request_cmd_and_cmdlets.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "4a241dea-235b-4a7e-8d76-50d817b146c4", "title": "Suspicious PowerShell Mailbox Export to Share - PS", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_mailboxexport_share.yml", "status": "test", "level": "critical", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "f3a98ce4-6164-4dd4-867c-4d83de7eca51", "title": "Powershell Token Obfuscation - Powershell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_token_obfuscation.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e54f5149-6ba3-49cf-b153-070d24679126", "title": "Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_var.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "fc028194-969d-4122-8abe-0470d5b8f12f", "title": "Access to Browser Login Data", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_access_to_browser_login_data.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "a699b30e-d010-46c8-bbd1-ee2e26765fe9", "title": "Powershell Store File In Alternate Data Stream", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_store_file_in_alternate_data_stream.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e6cb92b4-b470-4eb8-8a9d-d63e8583aae0", "title": "Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_rundll.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "b5522a23-82da-44e5-9c8b-e10ed8955f88", "title": "Powershell Execute Batch Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_execute_batch_script.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "243de76f-4725-4f2e-8225-a8a69b15ad61", "title": "PowerShell Create Local User", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_create_local_user.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "36bed6b2-e9a0-4fff-beeb-413a92b86138", "title": "Active Directory Computers Enumeration With Get-AdComputer", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_get_adcomputer.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "55c925c1-7195-426b-a136-a9396800e29b", "title": "Potential Suspicious Windows Feature Enabled", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_enable_susp_windows_optional_feature.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "c5ac6a1e-9407-45f5-a0ce-ca9a0806a287", "title": "Replace Desktop Wallpaper by Powershell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_wallpaper.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "ae2bdd58-0681-48ac-be7f-58ab4e593458", "title": "Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_rem_mp.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "c2993223-6da8-4b1a-88ee-668b8bf315e9", "title": "User Discovery And Export Via Get-ADUser Cmdlet - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_user_discovery_get_aduser.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "c1344fa2-323b-4d2e-9176-84b4d4821c88", "title": "Windows Defender Exclusions Added - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_win_defender_exclusions_added.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "03409c93-a7c7-49ba-9a4c-a00badf2a153", "title": "Troubleshooting Pack Cmdlet Execution", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_follina_execution.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "05b3e303-faf0-4f4a-9b30-46cc13e69152", "title": "Potential Persistence Via PowerShell User Profile Using Add-Content", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_user_profile_tampering.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "84c174ab-d3ef-481f-9c86-a50d0b8e3edb", "title": "PowerShell Get-Process LSASS in ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_getprocess_lsass.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "afd3df04-948d-46f6-ae44-25966c44b97f", "title": "PSAsyncShell - Asynchronous TCP Reverse Shell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_psasyncshell.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "1f6399cf-2c80-4924-ace1-6fcff3393480", "title": "DirectorySearcher Powershell Exploitation", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_directorysearcher.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "26b692dc-1722-49b2-b496-a8258aa6371d", "title": "Clear PowerShell History - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_clear_powershell_history.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "df69cb1d-b891-4cd9-90c7-d617d90100ce", "title": "Suspicious FromBase64String Usage On Gzip Archive - Ps Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_frombase64string_archive.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "b7a3c9a3-09ea-4934-8864-6a32cacd98d9", "title": "Zip A Folder With PowerShell For Staging In Temp - PowerShell Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_zip_compress.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "03d83090-8cba-44a0-b02f-0b756a050306", "title": "Potential WinAPI Calls Via PowerShell Scripts", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "16b37b70-6fcf-4814-a092-c36bd3aafcbd", "title": "PowerShell ShellCode", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_shellcode_b64.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "23590215-4702-4a70-8805-8dc9e58314a2", "title": "Registry-Free Process Scope COR_PROFILER", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_cor_profiler.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "402e1e1d-ad59-47b6-bf80-1ee44985b3a7", "title": "Malicious ShellIntel PowerShell Commandlets", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_shellintel_malicious_commandlets.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "3245cd30-e015-40ff-a31d-5cadd5f377ec", "title": "HackTool - Rubeus Execution - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_hktl_rubeus.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "91109523-17f0-4248-a800-f81d9e7c081d", "title": "PowerShell WMI Win32_Product Install MSI", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_win32_product_install_msi.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "189e3b02-82b2-4b90-9662-411eb64486d4", "title": "Potential Invoke-Mimikatz PowerShell Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_potential_invoke_mimikatz.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e2812b49-bae0-4b21-b366-7c142eafcde2", "title": "Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_win32_nteventlogfile_usage.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "115fdba9-f017-42e6-84cf-d5573bf2ddf8", "title": "Disable of ETW Trace - Powershell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_etw_trace_evasion.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "8028c2c3-e25a-46e3-827f-bbb5abf181d7", "title": "WMImplant Hack Tool", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_wmimplant.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "22d80745-6f2c-46da-826b-77adaededd74", "title": "Suspicious Service DACL Modification Via Set-Service Cmdlet - PS", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_service_dacl_modification_set_service.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e17121b4-ef2a-4418-8a59-12fb1631fa9e", "title": "Delete Volume Shadow Copies via WMI with PowerShell - PS Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_win32_shadowcopy.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "904e8e61-8edf-4350-b59c-b905fc8e810c", "title": "Security Software Discovery Via Powershell Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_get_process_security_software_discovery.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "91e69562-2426-42ce-a647-711b8152ced6", "title": "AADInternals PowerShell Cmdlets Execution - PsScript", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_aadinternals_cmdlets_execution.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "99c4658d-2c5e-4d87-828d-7c066ca537c3", "title": "Disable-WindowsOptionalFeature Command PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_disable_windows_optional_feature.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "95f0643a-ed40-467c-806b-aac9542ec5ab", "title": "Suspicious Get Information for SMB Share", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_smb_share_reco.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "14c71865-6cd3-44ae-adaa-1db923fae5f2", "title": "Tamper Windows Defender - ScriptBlockLogging", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_set_mp.yml", "status": "experimental", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "b7216a7d-687e-4c8d-82b1-3080b2ad961f", "title": "Modify Group Policy Settings - ScriptBlockLogging", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_modify_group_policy_settings.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "42d36aa1-3240-4db0-8257-e0118dcdd9cd", "title": "Suspicious Hyper-V Cmdlets", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_hyper_v_condlet.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e8314f79-564d-4f79-bc13-fbc0bf2660d8", "title": "Potential PowerShell Obfuscation Using Character Join", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_alias_obfscuation.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "dddfebae-c46f-439c-af7a-fdb6bde90218", "title": "SyncAppvPublishingServer Execution to Bypass Powershell Restriction", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_syncappvpublishingserver_exe.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "0adfbc14-0ed1-11eb-adc1-0242ac120002", "title": "Invoke-Obfuscation VAR+ Launcher - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_var.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "060c3ef1-fd0a-4091-bf46-e7d625f60b73", "title": "Suspicious Get-ADReplAccount", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_get_adreplaccount.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "70ad982f-67c8-40e0-a955-b920c2fa05cb", "title": "Suspicious IO.FileStream", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_iofilestream.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "86b896ba-ffa1-4fea-83e3-ee28a4c915c7", "title": "Invoke-Obfuscation Via Stdin - Powershell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_stdin.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "96cd126d-f970-49c4-848a-da3a09f55c55", "title": "Potential PowerShell Obfuscation Using Alias Cmdlets", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_set_alias.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e0565f5d-d420-4e02-8a68-ac00d864f9cf", "title": "Automated Collection Bookmarks Using Get-ChildItem PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_get_childitem_bookmarks.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "cd185561-4760-45d6-a63e-a51325112cae", "title": "Live Memory Dump Using Powershell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_memorydump_getstoragediagnosticinfo.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "bf72941a-cba0-41ea-b18c-9aca3925690d", "title": "PowerShell ADRecon Execution", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_adrecon_execution.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "953945c5-22fe-4a92-9f8a-a9edc1e522da", "title": "Abuse of Service Permissions to Hide Services Via Set-Service - PS", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_using_set_service_to_hide_services.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "3bf1d859-3a7e-44cb-8809-a99e066d3478", "title": "PowerShell Set-Acl On Windows Folder - PsScript", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_set_acl_susp_location.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "29e1c216-6408-489d-8a06-ee9d151ef819", "title": "Suspicious Mount-DiskImage", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_mount_diskimage.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "48a45d45-8112-416b-8a67-46e03a4b2107", "title": "Remove Account From Domain Admin Group", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_remove_adgroupmember.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "ae7fbf8e-f3cb-49fd-8db4-5f3bed522c71", "title": "Suspicious PowerShell Invocations - Specific", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_invocation_specific.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "975b2262-9a49-439d-92a6-0709cccdf0b2", "title": "Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_install_unsigned_appx_packages.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "21f9162c-5f5d-4b01-89a8-b705bd7d10ab", "title": "Import PowerShell Modules From Suspicious Directories", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_import_module_susp_dirs.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "35f41cd7-c98e-469f-8a02-ec4ba0cc7a7e", "title": "PowerShell Write-EventLog Usage", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_write_eventlog.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "1b9dc62e-6e9e-42a3-8990-94d7a10007f7", "title": "Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_obfuscated_iex.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "eb2fd349-ec67-4caa-9143-d79c7fb34441", "title": "Suspicious GPO Discovery With Get-GPO", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_get_gpo.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "4c4af3cd-2115-479c-8193-6b8bfce9001c", "title": "PowerShell ICMP Exfiltration", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_icmp_exfiltration.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "9e620995-f2d8-4630-8430-4afd89f77604", "title": "Potential Active Directory Enumeration Using AD Module - PsScript", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_active_directory_module_dll_import.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "9a7afa56-4762-43eb-807d-c3dc9ffe211b", "title": "Powershell Exfiltration Over SMTP", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_send_mailmessage.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "aa7a3fce-bef5-4311-9cc1-5f04bb8c308c", "title": "Certificate Exported Via PowerShell - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_export_certificate.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "d2e3f2f6-7e09-4bf2-bc5d-90186809e7fb", "title": "PowerShell Script With File Upload Capabilities", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_script_with_upload_capabilities.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "155c7fd5-47b4-49b2-bbeb-eb4fab335429", "title": "Add Windows Capability Via PowerShell Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_add_windows_capability.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e55a5195-4724-480e-a77e-3ebe64bd3759", "title": "Invoke-Obfuscation Via Use MSHTA - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_mhsta.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "403c2cc0-7f6b-4925-9423-bfa573bed7eb", "title": "Suspicious PowerShell Download - Powershell Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_download.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "cacef8fc-9d3d-41f7-956d-455c6e881bc5", "title": "Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_remotefxvgpudisablement_abuse.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "ed965133-513f-41d9-a441-e38076a0798f", "title": "Suspicious PowerShell Invocations - Generic", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_invocation_generic.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "2f77047c-e6e9-4c11-b088-a3de399524cd", "title": "Potential Persistence Via Security Descriptors - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_ace_tampering.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "2650dd1a-eb2a-412d-ac36-83f06c4f2282", "title": "Detected Windows Software Discovery - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_software_discovery.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "603c6630-5225-49c1-8047-26c964553e0e", "title": "Enumerate Credentials from Windows Credential Manager With PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_enumerate_password_windows_credential_manager.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "34f90d3c-c297-49e9-b26d-911b05a4866c", "title": "Powershell Keylogging", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_keylogging.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "20e5497e-331c-4cd5-8d36-935f6e2a9a07", "title": "Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_compress.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "d59d7842-9a21-4bc6-ba98-64bfe0091355", "title": "Powershell DNSExfiltration", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_dnsexfiltration.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "bbb9495b-58fc-4016-b9df-9a3a1b67ca82", "title": "Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_get_addefaultdomainpasswordpolicy.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "5f9c7f1a-7c21-4c39-b2f3-8d8006e0e51f", "title": "PowerShell Web Access Installation - PsScript", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_powershell_web_access_installation.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "db92dd33-a3ad-49cf-8c2c-608c3e30ace0", "title": "Invoke-Obfuscation Via Use Clip - Powershell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_clip.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "96c982fe-3d08-4df4-bed2-eb14e02f21c8", "title": "Get-ADUser Enumeration Using UserAccountControl Flags", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_as_rep_roasting.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "dcd74b95-3f36-4ed9-9598-0490951643aa", "title": "PowerView PowerShell Cmdlets - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_powerview_malicious_commandlets.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "fa6a5a45-3ee2-4529-aa14-ee5edc9e29cb", "title": "Suspicious Get Local Groups Information - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_local_group_reco.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "313fbb0a-a341-4682-848d-6d6f8c4fab7c", "title": "Suspicious PowerShell WindowStyle Option", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_windowstyle.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "66a4d409-451b-4151-94f4-a55d559c49b0", "title": "PowerShell Deleted Mounted Share", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_mounted_share_deletion.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "d93129cd-1ee0-479f-bc03-ca6f129882e3", "title": "Powershell Detect Virtualization Environment", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_detect_vm_env.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "991a9744-f2f0-44f2-bd33-9092eba17dc3", "title": "Enable Windows Remote Management", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_enable_psremoting.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "4096a49c-7de4-4da0-a230-c66ccd56ea5a", "title": "Suspicious PowerShell Get Current User", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_get_current_user.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "fa2559c8-1197-471d-9cdd-05a0273d4522", "title": "Potential AMSI Bypass Script Using NULL Bits", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_amsi_null_bits_bypass.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "7d416556-6502-45b2-9bad-9d2f05f38997", "title": "Powershell Sensitive File Discovery", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_sensitive_file_discovery.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "09658312-bc27-4a3b-91c5-e49ab9046d1b", "title": "WMIC Unquoted Services Path Lookup - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_wmi_unquoted_service_search.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "a9723fcc-881c-424c-8709-fd61442ab3c3", "title": "Recon Information for Export with PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_recon_export.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "0718cd72-f316-4aa2-988f-838ea8533277", "title": "Suspicious Start-Process PassThru", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_start_process.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e0d6c087-2d1c-47fd-8799-3904103c5a98", "title": "AMSI Bypass Pattern Assembly GetType", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_amsi_bypass_pattern_nov22.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "61d0475c-173f-4844-86f7-f3eebae1c66b", "title": "Change PowerShell Policies to an Insecure Level - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_set_policies_to_unsecure_level.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "36fbec91-fa1b-4d5d-8df1-8d8edcb632ad", "title": "Code Executed Via Office Add-in XLL File", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_office_comobject_registerxll.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "9e07f6e7-83aa-45c6-998e-0af26efd0a85", "title": "Powershell WMI Persistence", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_wmi_persistence.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "d4488827-73af-4f8d-9244-7b7662ef046e", "title": "Change User Agents with WebRequest", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_invoke_webrequest_useragent.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "976d6e6f-a04b-4900-9713-0134a353e38b", "title": "Veeam Backup Servers Credential Dumping Script Execution", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_veeam_credential_dumping_script.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "89819aa4-bbd6-46bc-88ec-c7f7fe30efa6", "title": "Malicious PowerShell Commandlets - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "a5a30a6e-75ca-4233-8b8c-42e0f2037d3b", "title": "Invoke-Obfuscation Via Use Rundll32 - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_rundll32.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "902cedee-0398-4e3a-8183-6f3a89773a96", "title": "Suspicious Invoke-Item From Mount-DiskImage", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_run_from_mount_diskimage.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "965e2db9-eddb-4cf6-a986-7a967df651e4", "title": "Potential Keylogger Activity", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_keylogger_activity.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "162e69a7-7981-4344-84a9-0f1c9a217a52", "title": "Powershell Directory Enumeration", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_directory_enum.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "adf876b3-f1f8-4aa9-a4e4-a64106feec06", "title": "Testing Usage of Uncommonly Used Port", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_test_netconnection.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "504d63cb-0dba-4d02-8531-e72981aace2c", "title": "Suspicious X509Enrollment - Ps Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_x509enrollment.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "363eccc0-279a-4ccf-a3ab-24c2e63b11fb", "title": "Powershell Create Scheduled Task", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_cmdlet_scheduled_task.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "8bc063d5-3a3a-4f01-a140-bc15e55e8437", "title": "Suspicious GetTypeFromCLSID ShellExecute", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_gettypefromclsid.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "9ac8b09b-45de-4a07-9da1-0de8c09304a3", "title": "Invoke-Obfuscation STDIN+ Launcher - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_stdin.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "815bfc17-7fc6-4908-a55e-2f37b98cedb4", "title": "AD Groups Or Users Enumeration Using PowerShell - PoshModule", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_ad_group_reco.yml", "status": "test", "level": "low", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "4cbd4f12-2e22-43e3-882f-bff3247ffb78", "title": "PowerShell Get Clipboard", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_get_clipboard.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "2f211361-7dce-442d-b78a-c04039677378", "title": "Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_obfuscated_iex.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "aff815cc-e400-4bf0-a47a-5d8a2407d4e1", "title": "Use Get-NetTCPConnection - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_get_nettcpconnection.yml", "status": "test", "level": "low", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "de41232e-12e8-49fa-86bc-c05c7e722df9", "title": "Suspicious PowerShell Download - PoshModule", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_download.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c", "title": "Malicious PowerShell Commandlets - PoshModule", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_malicious_commandlets.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "daf7eb81-35fd-410d-9d7a-657837e602bb", "title": "Zip A Folder With PowerShell For Staging In Temp - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_zip_compress.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "9fe55ea2-4cd6-4491-8a54-dd6871651b51", "title": "HackTool - Evil-WinRm Execution - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_hktl_evil_winrm_execution.yml", "status": "experimental", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "64e8e417-c19a-475a-8d19-98ea705394cc", "title": "Alternate PowerShell Hosts - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_alternate_powershell_hosts.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "cef24b90-dddc-4ae1-a09a-8764872f69fc", "title": "Suspicious Get Local Groups Information", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_local_group_reco.yml", "status": "test", "level": "low", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "1ddc1472-8e52-4f7d-9f11-eab14fc171f5", "title": "PowerShell Decompress Commands", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_decompress_commands.yml", "status": "test", "level": "informational", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "b140afd9-474b-4072-958e-2ebb435abd68", "title": "Suspicious Get-ADDBAccount Usage", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_get_addbaccount.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "6bfb8fa7-b2e7-4f6c-8d9d-824e5d06ea9e", "title": "Invoke-Obfuscation VAR+ Launcher - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_var.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "41025fd7-0466-4650-a813-574aaacbe7f4", "title": "Malicious PowerShell Scripts - PoshModule", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_exploit_scripts.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "c72aca44-8d52-45ad-8f81-f96c4d3c755e", "title": "Invoke-Obfuscation Via Stdin - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_stdin.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "6942bd25-5970-40ab-af49-944247103358", "title": "Suspicious Get Information for SMB Share - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_smb_share_reco.yml", "status": "test", "level": "low", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "07ad2ea8-6a55-4ac6-bf3e-91b8e59676eb", "title": "Invoke-Obfuscation Via Use MSHTA - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_mhsta.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "f99276ad-d122-4989-a09a-d00904a5f9d2", "title": "Clear PowerShell History - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_clear_powershell_history.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "fe5ce7eb-dad8-467c-84a9-31ec23bd644a", "title": "SyncAppvPublishingServer Bypass Powershell Restriction - PS Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_syncappvpublishingserver_exe.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "38a7625e-b2cb-485d-b83d-aff137d859f4", "title": "Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_remotefxvgpudisablement_abuse.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "8ff28fdd-e2fa-4dfa-aeda-ef3d61c62090", "title": "Suspicious PowerShell Invocations - Specific - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_invocation_specific.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "e3818659-5016-4811-a73c-dde4679169d2", "title": "Suspicious Computer Machine Password by PowerShell", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_reset_computermachinepassword.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "88a22f69-62f9-4b8a-aa00-6b0212f2f05a", "title": "Invoke-Obfuscation Via Use Rundll32 - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_rundll32.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "8d31a8ce-46b5-4dd6-bdc3-680931f1db86", "title": "Bad Opsec Powershell Code Artifacts", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_bad_opsec_artifacts.yml", "status": "test", "level": "critical", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "ebdf49d8-b89c-46c9-8fdf-2c308406f6bd", "title": "Invoke-Obfuscation Via Use Clip - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_clip.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "f3c89218-8c3d-4ba9-9974-f1d8e6a1b4a6", "title": "Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_var.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "96b9f619-aa91-478f-bacb-c3e50f8df575", "title": "Remote PowerShell Session (PS Module)", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_remote_powershell_session.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "a136cde0-61ad-4a61-9b82-8dc490e60dd2", "title": "Invoke-Obfuscation CLIP+ Launcher - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_clip.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "74176142-4684-4d8a-8b0a-713257e7df8e", "title": "Potential Active Directory Enumeration Using AD Module - PsModule", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_active_directory_module_dll_import.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "bbb80e91-5746-4fbe-8898-122e2cafdbf4", "title": "Suspicious PowerShell Invocations - Generic - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_invocation_generic.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "7034cbbb-cc55-4dc2-8dad-36c0b942e8f1", "title": "Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_compress.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "a23791fe-8846-485a-b16b-ca691e1b03d4", "title": "Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_rundll.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "c5b20776-639a-49bf-94c7-84f912b91c15", "title": "Netcat The Powershell Version", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_powercat.yml", "status": "test", "level": "medium", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "3236fcd0-b7e3-4433-b4f8-86ad61a9af2d", "title": "Suspicious PowerShell Download", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_susp_download.yml", "status": "test", "level": "medium", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "f65e22f9-819e-4f96-9c7b-498364ae7a25", "title": "Potential RemoteFXvGPUDisablement.EXE Abuse", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_remotefxvgpudisablement_abuse.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "71ff406e-b633-4989-96ec-bc49d825a412", "title": "Zip A Folder With PowerShell For Staging In Temp - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_susp_zip_compress.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "812837bb-b17f-45e9-8bd0-0ec35d2e3bd6", "title": "Suspicious XOR Encoded PowerShell Command Line - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_xor_commandline.yml", "status": "test", "level": "medium", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "ec19ebab-72dc-40e1-9728-4c0b805d722c", "title": "Tamper Windows Defender - PSClassic", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_tamper_windows_defender_set_mp.yml", "status": "experimental", "level": "high", "logsource.category": "ps_classic_provider_start", "logsource.product": "windows"}, {"id": "30a8cb77-8eb3-4cfb-8e79-ad457c5a4592", "title": "Renamed Powershell Under Powershell Channel", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_renamed_powershell.yml", "status": "test", "level": "low", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "df9a0e0e-fedb-4d6c-8668-d765dfc92aa7", "title": "Suspicious Non PowerShell WSMAN COM Provider", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "999bff6d-dc15-44c9-9f5c-e1051bfc86e1", "title": "Nslookup PowerShell Download Cradle", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_abuse_nslookup_with_dns_records.yml", "status": "test", "level": "medium", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "c70e019b-1479-4b65-b0cc-cd0c6093a599", "title": "PowerShell Called from an Executable Version Mismatch", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_exe_calling_ps.yml", "status": "test", "level": "high", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "60167e5c-84b2-4c95-a7ac-86281f27c445", "title": "Remote PowerShell Session (PS Classic)", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_remote_powershell_session.yml", "status": "test", "level": "low", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "b366adb4-d63d-422d-8a2c-186463b5ded0", "title": "Use Get-NetTCPConnection", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_susp_get_nettcpconnection.yml", "status": "test", "level": "low", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "6331d09b-4785-4c13-980f-f96661356249", "title": "PowerShell Downgrade Attack - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_downgrade_attack.yml", "status": "test", "level": "medium", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "87df9ee1-5416-453a-8a08-e8d4a51e9ce1", "title": "Delete Volume Shadow Copies Via WMI With PowerShell", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_delete_volume_shadow_copies.yml", "status": "stable", "level": "high", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "a1d9eec5-33b2-4177-8d24-27fe754d0812", "title": "Cloudflared Tunnels Related DNS Requests", "file": "../sigma/rules/windows/dns_query/dns_query_win_cloudflared_communication.yml", "status": "experimental", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "613c03ba-0779-4a53-8a1f-47f914a4ded3", "title": "DNS Query To MEGA Hosting Website", "file": "../sigma/rules/windows/dns_query/dns_query_win_mega_nz.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "f356a9c4-effd-4608-bbf8-408afd5cd006", "title": "Suspicious Cobalt Strike DNS Beaconing - Sysmon", "file": "../sigma/rules/windows/dns_query/dns_query_win_mal_cobaltstrike.yml", "status": "test", "level": "critical", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "a21bcd7e-38ec-49ad-b69a-9ea17e69509e", "title": "DNS Server Discovery Via LDAP Query", "file": "../sigma/rules/windows/dns_query/dns_query_win_dns_server_discovery_via_ldap_query.yml", "status": "test", "level": "low", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "df68f791-ad95-447f-a271-640a0dab9cf8", "title": "DNS Query Request To OneLaunch Update Service", "file": "../sigma/rules/windows/dns_query/dns_query_win_onelaunch_update_service.yml", "status": "experimental", "level": "low", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "e043f529-8514-4205-8ab0-7f7d2927b400", "title": "DNS Query To AzureWebsites.NET By Non-Browser Process", "file": "../sigma/rules/windows/dns_query/dns_query_win_domain_azurewebsites.yml", "status": "experimental", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "title": "DNS HybridConnectionManager Service Bus", "file": "../sigma/rules/windows/dns_query/dns_query_win_hybridconnectionmgr_servicebus.yml", "status": "test", "level": "high", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "065cceea-77ec-4030-9052-fc0affea7110", "title": "DNS Query for Anonfiles.com Domain - Sysmon", "file": "../sigma/rules/windows/dns_query/dns_query_win_anonymfiles_com.yml", "status": "test", "level": "high", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "title": "TeamViewer Domain Query By Non-TeamViewer Application", "file": "../sigma/rules/windows/dns_query/dns_query_win_teamviewer_domain_query_by_uncommon_app.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "title": "Suspicious DNS Query for IP Lookup Service APIs", "file": "../sigma/rules/windows/dns_query/dns_query_win_susp_external_ip_lookup.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "title": "DNS Query To Visual Studio Code Tunnels Domain", "file": "../sigma/rules/windows/dns_query/dns_query_win_vscode_tunnel_communication.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "36e037c4-c228-4866-b6a3-48eb292b9955", "title": "DNS Query Request By Regsvr32.EXE", "file": "../sigma/rules/windows/dns_query/dns_query_win_regsvr32_dns_query.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "title": "AppX Package Installation Attempts Via AppInstaller.EXE", "file": "../sigma/rules/windows/dns_query/dns_query_win_appinstaller.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "title": "DNS Query To Devtunnels Domain", "file": "../sigma/rules/windows/dns_query/dns_query_win_devtunnels_communication.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "title": "DNS Query Tor .Onion Address - Sysmon", "file": "../sigma/rules/windows/dns_query/dns_query_win_tor_onion_domain_query.yml", "status": "test", "level": "high", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "title": "DNS Query To Remote Access Software Domain From Non-Browser App", "file": "../sigma/rules/windows/dns_query/dns_query_win_remote_access_software_domains_non_browsers.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "title": "DNS Query To Ufile.io", "file": "../sigma/rules/windows/dns_query/dns_query_win_ufile_io_query.yml", "status": "test", "level": "low", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "693a44e9-7f26-4cb6-b787-214867672d3a", "title": "Sysmon File Executable Creation Detected", "file": "../sigma/rules/windows/sysmon/sysmon_file_executable_detected.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "1f2b5353-573f-4880-8e33-7d04dcf97744", "title": "Sysmon Configuration Modification", "file": "../sigma/rules/windows/sysmon/sysmon_config_modification_status.yml", "status": "test", "level": "high", "logsource.category": "sysmon_status", "logsource.product": "windows"}, {"id": "8ac03a65-6c84-4116-acad-dc1558ff7a77", "title": "Sysmon Configuration Change", "file": "../sigma/rules/windows/sysmon/sysmon_config_modification.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "23b71bc5-953e-4971-be4c-c896cda73fc2", "title": "Sysmon Blocked Executable", "file": "../sigma/rules/windows/sysmon/sysmon_file_block_executable.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "815cd91b-7dbc-4247-841a-d7dd1392b0a8", "title": "Sysmon Configuration Error", "file": "../sigma/rules/windows/sysmon/sysmon_config_modification_error.yml", "status": "test", "level": "high", "logsource.category": "sysmon_error", "logsource.product": "windows"}, {"id": "c3e5c1b1-45e9-4632-b242-27939c170239", "title": "Sysmon Blocked File Shredding", "file": "../sigma/rules/windows/sysmon/sysmon_file_block_shredding.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "558eebe5-f2ba-4104-b339-36f7902bcc1a", "title": "File Creation Date Changed to Another Year", "file": "../sigma/rules/windows/file/file_change/file_change_win_2022_timestomping.yml", "status": "test", "level": "high", "logsource.category": "file_change", "logsource.product": "windows"}, {"id": "9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3", "title": "Unusual File Modification by dns.exe", "file": "../sigma/rules/windows/file/file_change/file_change_win_unusual_modification_by_dns_exe.yml", "status": "test", "level": "high", "logsource.category": "file_change", "logsource.product": "windows"}, {"id": "e3f673b3-65d1-4d80-9146-466f8b63fa99", "title": "Suspicious Appended Extension", "file": "../sigma/rules/windows/file/file_rename/file_rename_win_ransomware.yml", "status": "test", "level": "medium", "logsource.category": "file_rename", "logsource.product": "windows"}, {"id": "ab90dab8-c7da-4010-9193-563528cfa347", "title": "Potentially Suspicious Self Extraction Directive File Created", "file": "../sigma/rules/windows/file/file_executable_detected/file_executable_detected_win_susp_embeded_sed_file.yml", "status": "experimental", "level": "medium", "logsource.category": "file_executable_detected", "logsource.product": "windows"}, {"id": "270185ff-5f50-4d6d-a27f-24c3b8c9fef8", "title": "Tomcat WebServer Logs Deleted", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_tomcat_logs.yml", "status": "test", "level": "medium", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "5b2bbc47-dead-4ef7-8908-0cf73fcbecbf", "title": "Potential PrintNightmare Exploitation Attempt", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_cve_2021_1675_print_nightmare.yml", "status": "test", "level": "high", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0", "title": "Unusual File Deletion by Dns.exe", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_unusual_deletion_by_dns_exe.yml", "status": "test", "level": "high", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "06125661-3814-4e03-bfa2-1e4411c60ac3", "title": "Backup Files Deleted", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_backup_file.yml", "status": "test", "level": "medium", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "0a1f9d29-6465-4776-b091-7f43b26e4c89", "title": "Prefetch File Deleted", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_prefetch.yml", "status": "test", "level": "high", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "b1decb61-ed83-4339-8e95-53ea51901720", "title": "TeamViewer Log File Deleted", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_teamviewer_logs.yml", "status": "test", "level": "low", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "a55349d8-9588-4c5a-8e3b-1925fe2a4ffe", "title": "Exchange PowerShell Cmdlet History Deleted", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_exchange_powershell_logs.yml", "status": "test", "level": "high", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "63c779ba-f638-40a0-a593-ddd45e8b1ddc", "title": "EventLog EVTX File Deleted", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_event_log_files.yml", "status": "test", "level": "medium", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "ff301988-c231-4bd0-834c-ac9d73b86586", "title": "PowerShell Console History Logs Deleted", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_powershell_command_history.yml", "status": "test", "level": "medium", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "f01d1f70-cd41-42ec-9c0b-26dd9c22bf29", "title": "Process Deletion of Its Own Executable", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_own_image.yml", "status": "experimental", "level": "medium", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "3eb8c339-a765-48cc-a150-4364c04652bf", "title": "IIS WebServer Access Logs Deleted", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_iis_access_logs.yml", "status": "test", "level": "medium", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "3109530e-ab47-4cc6-a953-cac5ebcc93ae", "title": "ADS Zone.Identifier Deleted By Uncommon Application", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_zone_identifier_ads_uncommon.yml", "status": "experimental", "level": "medium", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "6ddab845-b1b8-49c2-bbf7-1a11967f64bc", "title": "File Deleted Via Sysinternals SDelete", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_sysinternals_sdelete_file_deletion.yml", "status": "test", "level": "medium", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "407aecb1-e762-4acf-8c7b-d087bcff3bb6", "title": "Credential Manager Access By Uncommon Applications", "file": "../sigma/rules/windows/file/file_access/file_access_win_susp_credential_manager_access.yml", "status": "experimental", "level": "medium", "logsource.category": "file_access", "logsource.product": "windows"}, {"id": "7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2", "title": "Access To Windows Credential History File By Uncommon Applications", "file": "../sigma/rules/windows/file/file_access/file_access_win_susp_credhist.yml", "status": "experimental", "level": "medium", "logsource.category": "file_access", "logsource.product": "windows"}, {"id": "65744385-8541-44a6-8630-ffc824d7d4cc", "title": "Microsoft Teams Sensitive File Access By Uncommon Applications", "file": "../sigma/rules/windows/file/file_access/file_access_win_teams_sensitive_files.yml", "status": "experimental", "level": "medium", "logsource.category": "file_access", "logsource.product": "windows"}, {"id": "d51694fe-484a-46ac-92d6-969e76d60d10", "title": "Access To Potentially Sensitive Sysvol Files By Uncommon Applications", "file": "../sigma/rules/windows/file/file_access/file_access_win_susp_gpo_files.yml", "status": "experimental", "level": "medium", "logsource.category": "file_access", "logsource.product": "windows"}, {"id": "46612ae6-86be-4802-bc07-39b59feb1309", "title": "Access To Windows DPAPI Master Keys By Uncommon Applications", "file": "../sigma/rules/windows/file/file_access/file_access_win_susp_dpapi_master_key_access.yml", "status": "experimental", "level": "medium", "logsource.category": "file_access", "logsource.product": "windows"}, {"id": "f41b0311-44f9-44f0-816d-dd45e39d4bc8", "title": "Access To Crypto Currency Wallets By Uncommon Applications", "file": "../sigma/rules/windows/file/file_access/file_access_win_susp_crypto_currency_wallets.yml", "status": "experimental", "level": "medium", "logsource.category": "file_access", "logsource.product": "windows"}, {"id": "a5a2d357-1ab8-4675-a967-ef9990a59391", "title": "LSASS Process Memory Dump Files", "file": "../sigma/rules/windows/file/file_event/file_event_win_lsass_default_dump_file_names.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "02773bed-83bf-469f-b7ff-e676e7d78bab", "title": "BloodHound Collection Files", "file": "../sigma/rules/windows/file/file_event/file_event_win_bloodhound_collection.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "d353dac0-1b41-46c2-820c-d7d2561fc6ed", "title": "AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_winrm_awl_bypass.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "caf02a0a-1e1c-4552-9b48-5e070bd88d11", "title": "Suspicious Creation TXT File in User Desktop", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_desktop_txt.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "68578b43-65df-4f81-9a9b-92f32711a951", "title": "UAC Bypass Using Windows Media Player - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_wmp.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "13c02350-4177-4e45-ac17-cf7ca628ff5e", "title": "Files With System DLL Name In Unsuspected Locations", "file": "../sigma/rules/windows/file/file_event/file_event_win_creation_system_dll_files.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "b8fd0e93-ff58-4cbd-8f48-1c114e342e62", "title": "Windows Binaries Write Suspicious Extensions", "file": "../sigma/rules/windows/file/file_event/file_event_win_shell_write_susp_files_extensions.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "39f1f9f2-9636-45de-98f6-a4046aa8e4b9", "title": "Potential Webshell Creation On Static Website", "file": "../sigma/rules/windows/file/file_event/file_event_win_webshell_creation_detect.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "28a452f3-786c-4fd8-b8f2-bddbe9d616d1", "title": "Creation of an WerFault.exe in Unusual Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_werfault_dll_hijacking.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "74babdd6-a758-4549-9632-26535279e654", "title": "Suspicious Executable File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_executable_creation.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "fec96f39-988b-4586-b746-b93d59fd1922", "title": "ScreenConnect Temporary Installation Artefact", "file": "../sigma/rules/windows/file/file_event/file_event_win_remote_access_tools_screenconnect_artefact.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "847def9e-924d-4e90-b7c4-5f581395a2b4", "title": "HackTool - QuarksPwDump Dump File", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_quarkspw_filedump.yml", "status": "test", "level": "critical", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "ce7066a6-508a-42d3-995b-2952c65dc2ce", "title": "Drop Binaries Into Spool Drivers Color Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_spool_drivers_color_drop.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6", "title": "Potential Homoglyph Attack Using Lookalike Characters in Filename", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_homoglyph_filename.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "54127bd4-f541-4ac3-afdb-ea073f63f692", "title": "Potential Persistence Via Notepad++ Plugins", "file": "../sigma/rules/windows/file/file_event/file_event_win_notepad_plus_plus_persistence.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "002bdb95-0cf1-46a6-9e08-d38c128a6127", "title": "WScript or CScript Dropper - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_cscript_wscript_dropper.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "c7a74c80-ba5a-486e-9974-ab9e682bc5e4", "title": "File With Uncommon Extension Created By An Office Application", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_susp_file_extension.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "34746e8c-5fb8-415a-b135-0abc167e912a", "title": "WinSxS Executable File Creation By Non-System Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_winsxs_binary_creation.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "ee63c85c-6d51-4d12-ad09-04e25877a947", "title": "New Custom Shim Database Created", "file": "../sigma/rules/windows/file/file_event/file_event_win_creation_new_shim_database.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca", "title": "Suspicious File Creation Activity From Fake Recycle.Bin Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec.yml", "status": "experimental", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "1277f594-a7d1-4f28-a2d3-73af5cbeab43", "title": "Windows Shell/Scripting Application File Write to Suspicious Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_shell_write_susp_directory.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "63e4f530-65dc-49cc-8f80-ccfa95c69d43", "title": "UAC Bypass Using EventVwr", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_eventvwr.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c", "title": "Potential Initial Access via DLL Search Order Hijacking", "file": "../sigma/rules/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "2f7979ae-f82b-45af-ac1d-2b10e93b0baa", "title": "Potential DCOM InternetExplorer.Application DLL Hijack", "file": "../sigma/rules/windows/file/file_event/file_event_win_dcom_iertutil_dll_hijack.yml", "status": "test", "level": "critical", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "059c5af9-5131-4d8d-92b2-de4ad6146712", "title": "LiveKD Driver Creation By Uncommon Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_sysinternals_livekd_driver_susp_creation.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "7fd164ba-126a-4d9c-9392-0d4f7c243df0", "title": "OneNote Attachment File Dropped In Suspicious Location", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_onenote_files_in_susp_locations.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "15904280-565c-4b73-9303-3291f964e7f9", "title": "Potential Persistence Attempt Via ErrorHandler.Cmd", "file": "../sigma/rules/windows/file/file_event/file_event_win_errorhandler_persistence.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "6902955a-01b7-432c-b32a-6f5f81d8f625", "title": "LSASS Process Dump Artefact In CrashDumps Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_lsass_shtinkering.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "3ab79e90-9fab-4cdf-a7b2-6522bc742adb", "title": "HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_krbrelay_remote_ioc.yml", "status": "experimental", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "654fcc6d-840d-4844-9b07-2c3300e54a26", "title": "Legitimate Application Dropped Archive", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_archive.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "df6ecb8b-7822-4f4b-b412-08f524b4576c", "title": "Creation Of Non-Existent System DLL", "file": "../sigma/rules/windows/file/file_event/file_event_win_create_non_existent_dlls.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "cad1fe90-2406-44dc-bd03-59d0b58fe722", "title": "HackTool - NPPSpy Hacktool Usage", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_nppspy.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "1027d292-dd87-4a1a-8701-2abe04d7783c", "title": "PSScriptPolicyTest Creation By Uncommon Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_ps_script_policy_test_creation_by_uncommon_process.yml", "status": "experimental", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "41bb431f-56d8-4691-bb56-ed34e390906f", "title": "UAC Bypass Using MSConfig Token Modification - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_msconfig_gui.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "de46c52b-0bf8-4936-a327-aace94f94ac6", "title": "Process Explorer Driver Creation By Non-Sysinternals Binary", "file": "../sigma/rules/windows/file/file_event/file_event_win_sysinternals_procexp_driver_susp_creation.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "576426ad-0131-4001-ae01-be175da0c108", "title": "PowerShell Script Dropped Via PowerShell.EXE", "file": "../sigma/rules/windows/file/file_event/file_event_win_powershell_drop_powershell.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "4e7050dd-e548-483f-b7d6-527ab4fa784d", "title": "NTDS.DIT Creation By Uncommon Parent Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_ntds_dit_uncommon_parent_process.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "3d2a2d59-929c-4b78-8c1a-145dfe9e07b1", "title": "Publisher Attachment File Dropped In Suspicious Location", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_publisher_files_in_susp_locations.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "7d604714-e071-49ff-8726-edeb95a70679", "title": "Legitimate Application Dropped Script", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_script.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "bdd8157d-8e85-4397-bb82-f06cc9c71dbb", "title": "UAC Bypass Using IEInstal - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_ieinstal.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "6b269392-9eba-40b5-acb6-55c882b20ba6", "title": "Suspicious File Drop by Exchange", "file": "../sigma/rules/windows/file/file_event/file_event_win_exchange_webshell_drop_suspicious.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "b6f91281-20aa-446a-b986-38a92813a18f", "title": "DLL Search Order Hijackig Via Additional Space in Path", "file": "../sigma/rules/windows/file/file_event/file_event_win_dll_sideloading_space_path.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "4aafb0fa-bff5-4b9d-b99e-8093e659c65f", "title": "Writing Local Admin Share", "file": "../sigma/rules/windows/file/file_event/file_event_win_writing_local_admin_share.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "3da70954-0f2c-4103-adff-b7440368f50e", "title": "Suspicious PROCEXP152.sys File Created In TMP", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "e36941d0-c0f0-443f-bc6f-cb2952eb69ea", "title": "PowerShell Module File Created", "file": "../sigma/rules/windows/file/file_event/file_event_win_powershell_module_creation.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "6e90ae7a-7cd3-473f-a035-4ebb72d961da", "title": "PCRE.NET Package Temp Files", "file": "../sigma/rules/windows/file/file_event/file_event_win_pcre_net_temp_file.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "814ddeca-3d31-4265-8e07-8cc54fb44903", "title": "LiveKD Kernel Memory Dump File Created", "file": "../sigma/rules/windows/file/file_event/file_event_win_sysinternals_livekd_default_dump_name.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "bd1212e5-78da-431e-95fa-c58e3237a8e6", "title": "Suspicious ASPX File Drop by Exchange", "file": "../sigma/rules/windows/file/file_event/file_event_win_exchange_webshell_drop.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "9e099d99-44c2-42b6-a6d8-54c3545cab29", "title": "HackTool - Mimikatz Kirbi File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_mimikatz_files.yml", "status": "test", "level": "critical", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "7280c9f3-a5af-45d0-916a-bc01cb4151c9", "title": "Suspicious MSExchangeMailboxReplication ASPX Write", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_exchange_aspx_write.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "75bf09fa-1dd7-4d18-9af9-dd9e492562eb", "title": "ADSI-Cache File Creation By Uncommon Tool", "file": "../sigma/rules/windows/file/file_event/file_event_win_adsi_cache_creation_by_uncommon_tool.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "8fbf3271-1ef6-4e94-8210-03c2317947f6", "title": "Cred Dump Tools Dropped Files", "file": "../sigma/rules/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "d102b8f5-61dc-4e68-bd83-9a3187c67377", "title": "Renamed VsCode Code Tunnel Execution - File Indicator", "file": "../sigma/rules/windows/file/file_event/file_event_win_vscode_tunnel_renamed_execution.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "81315b50-6b60-4d8f-9928-3466e1022515", "title": "Suspicious desktop.ini Action", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_desktop_ini.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "2d367498-5112-4ae5-a06a-96e7bc33a211", "title": "Suspicious Binary Writes Via AnyDesk", "file": "../sigma/rules/windows/file/file_event/file_event_win_anydesk_writing_susp_binaries.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "8e1cb247-6cf6-42fa-b440-3f27d57e9936", "title": "Potential Persistence Via Microsoft Office Add-In", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_addin_persistence.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "7047d730-036f-4f40-b9d8-1c63e36d5e62", "title": "Potential Binary Or Script Dropper Via PowerShell", "file": "../sigma/rules/windows/file/file_event/file_event_win_powershell_drop_binary_or_script.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "2aa0a6b4-a865-495b-ab51-c28249537b75", "title": "Startup Folder File Write", "file": "../sigma/rules/windows/file/file_event/file_event_win_startup_folder_file_write.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "65236ec7-ace0-4f0c-82fd-737b04fd4dcb", "title": "EVTX Created In Uncommon Location", "file": "../sigma/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations.yml", "status": "experimental", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "e4a74e34-ecde-4aab-b2fb-9112dd01aed0", "title": "Dynamic CSharp Compile Artefact", "file": "../sigma/rules/windows/file/file_event/file_event_win_csharp_compile_artefact.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "614a7e17-5643-4d89-b6fe-f9df1a79641c", "title": "Wmiprvse Wbemcomn DLL Hijack - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_wmiprvse_wbemcomn_dll_hijack.yml", "status": "test", "level": "critical", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "dca1b3e8-e043-4ec8-85d7-867f334b5724", "title": "Suspicious PFX File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_pfx_file_creation.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "0b9ad457-2554-44c1-82c2-d56a99c42377", "title": "Anydesk Temporary Artefact", "file": "../sigma/rules/windows/file/file_event/file_event_win_anydesk_artefact.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "8c31f563-f9a7-450c-bfa8-35f8f32f1f61", "title": "New Outlook Macro Created", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_outlook_macro_creation.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "9b64de98-9db3-4033-bd7a-f51430105f00", "title": "Windows Terminal Profile Settings Modification By Uncommon Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_windows_terminal_profile.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "aba15bdd-657f-422a-bab3-ac2d2a0d6f1c", "title": "Potentially Suspicious DMP/HDMP File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_dump_file_susp_creation.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "97aa2e88-555c-450d-85a6-229bcd87efb8", "title": "Suspicious Screensaver Binary File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_creation_scr_binary_file.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "304afd73-55a5-4bb9-8c21-0b1fc84ea9e4", "title": "PSEXEC Remote Execution File Artefact", "file": "../sigma/rules/windows/file/file_event/file_event_win_sysinternals_psexec_service_key.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "69ca12af-119d-44ed-b50f-a47af0ebc364", "title": "LSASS Process Memory Dump Creation Via Taskmgr.EXE", "file": "../sigma/rules/windows/file/file_event/file_event_win_taskmgr_lsass_dump.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "b1c50487-1967-4315-a026-6491686d860e", "title": "Office Macro File Creation From Suspicious Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_macro_files_from_susp_process.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "f0540f7e-2db3-4432-b9e0-3965486744bc", "title": "Legitimate Application Dropped Executable", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_exe.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "130c9e58-28ac-4f83-8574-0a4cc913b97e", "title": "Potential Winnti Dropper Activity", "file": "../sigma/rules/windows/file/file_event/file_event_win_redmimicry_winnti_filedrop.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "92fa78e7-4d39-45f1-91a3-8b23f3f1088d", "title": "Potential Startup Shortcut Persistence Via PowerShell.EXE", "file": "../sigma/rules/windows/file/file_event/file_event_win_powershell_startup_shortcuts.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "33f41cdd-35ac-4ba8-814b-c6a4244a1ad4", "title": "WMI Persistence - Script Event Consumer File Write", "file": "../sigma/rules/windows/file/file_event/file_event_win_wmi_persistence_script_event_consumer_write.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "0bcfabcb-7929-47f4-93d6-b33fb67d34d1", "title": "Adwind RAT / JRAT File Artifact", "file": "../sigma/rules/windows/file/file_event/file_event_win_mal_adwind.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "162ab1e4-6874-4564-853c-53ec3ab8be01", "title": "TeamViewer Remote Session", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_teamviewer_remote_session.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "11b1ed55-154d-4e82-8ad7-83739298f720", "title": "NTDS.DIT Creation By Uncommon Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_ntds_dit_uncommon_process.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "c61daa90-3c1e-4f18-af62-8f288b5c9aaf", "title": "Uncommon File Creation By Mysql Daemon Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_mysqld_uncommon_file_creation.yml", "status": "experimental", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "fcc6d700-68d9-4241-9a1a-06874d621b06", "title": "Suspicious File Created Via OneNote Application", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_onenote_susp_dropped_files.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "f92a6f1e-a512-4a15-9735-da09e78d7273", "title": "GatherNetworkInfo.VBS Reconnaissance Script Output", "file": "../sigma/rules/windows/file/file_event/file_event_win_lolbin_gather_network_info_script_output.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "7eff1a7f-dd45-4c20-877a-f21e342a7611", "title": "RemCom Service File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_remcom_service.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "0afecb6e-6223-4a82-99fb-bf5b981e92a5", "title": "Remote Access Tool - ScreenConnect Temporary File", "file": "../sigma/rules/windows/file/file_event/file_event_win_remote_access_tools_screenconnect_remote_file.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "f0e2b768-5220-47dd-b891-d57b96fc0ec1", "title": "CSExec Service File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_csexec_service.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "34986307-b7f4-49be-92f3-e7a4d01ac5db", "title": "Rclone Config File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_rclone_config_files.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "9711de76-5d4f-4c50-a94f-21e4e8f8384d", "title": "Installation of TeamViewer Desktop", "file": "../sigma/rules/windows/file/file_event/file_event_win_install_teamviewer_desktop.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "c3edc6a5-d9d4-48d8-930e-aab518390917", "title": "Potential Persistence Via Outlook Form", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_outlook_newform.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "d5866ddf-ce8f-4aea-b28e-d96485a20d3d", "title": "Files With System Process Name In Unsuspected Locations", "file": "../sigma/rules/windows/file/file_event/file_event_win_creation_system_file.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "259e5a6a-b8d2-4c38-86e2-26c5e651361d", "title": "PsExec Service File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_sysinternals_psexec_service.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "155dbf56-e0a4-4dd0-8905-8a98705045e8", "title": "UAC Bypass Abusing Winsat Path Parsing - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_winsat.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "7fff6773-2baa-46de-a24a-b6eec1aba2d1", "title": "UAC Bypass Using NTFS Reparse Point - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_ntfs_reparse_point.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f", "title": "UEFI Persistence Via Wpbbin - FileCreation", "file": "../sigma/rules/windows/file/file_event/file_event_win_wpbbin_persistence.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "0b8baa3f-575c-46ee-8715-d6f28cc7d33c", "title": "NTDS.DIT Created", "file": "../sigma/rules/windows/file/file_event/file_event_win_ntds_dit_creation.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "2f9356ae-bf43-41b8-b858-4496d83b2acb", "title": "ISO File Created Within Temp Folders", "file": "../sigma/rules/windows/file/file_event/file_event_win_iso_file_mount.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "a05baa88-e922-4001-bc4d-8738135f27de", "title": "Process Monitor Driver Creation By Non-Sysinternals Binary", "file": "../sigma/rules/windows/file/file_event/file_event_win_sysinternals_procmon_driver_susp_creation.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "5b40a734-99b6-4b98-a1d0-1cea51a08ab2", "title": "Suspicious Interactive PowerShell as SYSTEM", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_system_interactive_powershell.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "6e2a900a-ced9-4e4a-a9c2-13e706f9518a", "title": "HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_remote_cred_dump.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "91174a41-dc8f-401b-be89-7bfc140612a0", "title": "Office Macro File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_macro_files_created.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "8468111a-ef07-4654-903b-b863a80bbc95", "title": "VHD Image Download Via Browser", "file": "../sigma/rules/windows/file/file_event/file_event_win_vhd_download_via_browsers.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "c048f047-7e2a-4888-b302-55f509d4a91d", "title": "SCR File Write Event", "file": "../sigma/rules/windows/file/file_event/file_event_win_new_scr_file.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "52753ea4-b3a0-4365-910d-36cff487b789", "title": "Hijack Legit RDP Session to Move Laterally", "file": "../sigma/rules/windows/file/file_event/file_event_win_tsclient_filewrite_startup.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "fccfb43e-09a7-4bd2-8b37-a5a7df33386d", "title": "RDP File Creation From Suspicious Application", "file": "../sigma/rules/windows/file/file_event/file_event_win_rdp_file_susp_creation.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "5f87308a-0a5b-4623-ae15-d8fa1809bc60", "title": "Suspicious Files in Default GPO Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_default_gpo_dir_write.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b", "title": "Suspicious Get-Variable.exe Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_get_variable.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "a8f866e1-bdd4-425e-a27a-37619238d9c7", "title": "Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_hidden_dir_index_allocation.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "07a99744-56ac-40d2-97b7-2095967b0e03", "title": "Potential Privilege Escalation Attempt Via .Exe.Local Technique", "file": "../sigma/rules/windows/file/file_event/file_event_win_system32_local_folder_privilege_escalation.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "3a8da4e0-36c1-40d2-8b29-b3e890d5172a", "title": "NTDS Exfiltration Filename Patterns", "file": "../sigma/rules/windows/file/file_event/file_event_win_ntds_exfil_tools.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "0e29e3a7-1ad8-40aa-b691-9f82ecd33d66", "title": "Office Macro File Download", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_macro_files_downloaded.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "d7b50671-d1ad-4871-aa60-5aa5b331fe04", "title": "Suspicious File Creation In Uncommon AppData Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_new_files_in_uncommon_appdata_folder.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "409f8a98-4496-4aaa-818a-c931c0a8b832", "title": "Created Files by Microsoft Sync Center", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_creation_by_mobsync.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "a6976974-ea6f-4e97-818e-ea08625c52cb", "title": "Potential RipZip Attack on Startup Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_ripzip_attack.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "3a9fa2ec-30bc-4ebd-b49e-7c9cff225502", "title": "VsCode Powershell Profile Modification", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_vscode_powershell_profile.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "b4926b47-a9d7-434c-b3a0-adc3fa0bd13e", "title": "Suspicious Double Extension Files", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_double_extension.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "28208707-fe31-437f-9a7f-4b1108b94d2e", "title": "Suspicious Startup Folder Persistence", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_startup_folder_persistence.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "e15b518d-b4ce-4410-a9cd-501f23ce4a18", "title": "Suspicious Creation with Colorcpl", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_colorcpl.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "760e75d8-c3b5-409b-a9bf-6130b4c4603f", "title": "Self Extraction Directive File Created In Potentially Suspicious Location", "file": "../sigma/rules/windows/file/file_event/file_event_win_sed_file_creation.yml", "status": "experimental", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "e0b06658-7d1d-4cd3-bf15-03467507ff7c", "title": "Suspicious DotNET CLR Usage Log Artifact", "file": "../sigma/rules/windows/file/file_event/file_event_win_net_cli_artefact.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "4e87b8e2-2ee9-4b2a-a715-4727d297ece0", "title": "Potential SAM Database Dump", "file": "../sigma/rules/windows/file/file_event/file_event_win_sam_dump.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "bb09dd3e-2b78-4819-8e35-a7c1b874e449", "title": "HackTool - Inveigh Execution Artefacts", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_inveigh_artefacts.yml", "status": "test", "level": "critical", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "4c7f49ee-2638-43bb-b85b-ce676c30b260", "title": "Assembly DLL Creation Via AspNetCompiler", "file": "../sigma/rules/windows/file/file_event/file_event_win_aspnet_temp_files.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "4358e5a5-7542-4dcb-b9f3-87667371839b", "title": "ISO or Image Mount Indicator in Recent Files", "file": "../sigma/rules/windows/file/file_event/file_event_win_iso_file_recent.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "62ed5b55-f991-406a-85d9-e8e8fdf18789", "title": "UAC Bypass Using Consent and Comctl32 - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_consent_comctl32.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "e074832a-eada-4fd7-94a1-10642b130e16", "title": "HackTool - SafetyKatz Dump Indicator", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_safetykatz.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "16fe46bb-4f64-46aa-817d-ff7bec4a2352", "title": "LiveKD Driver Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_sysinternals_livekd_driver.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "8d5aca11-22b3-4f22-b7ba-90e60533e1fb", "title": "Wmiexec Default Output File", "file": "../sigma/rules/windows/file/file_event/file_event_win_wmiexec_default_filename.yml", "status": "test", "level": "critical", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "3d0ed417-3d94-4963-a562-4a92c940656a", "title": "Creation of a Diagcab", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_diagcab.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "7892ec59-c5bb-496d-8968-e5d210ca3ac4", "title": "DPAPI Backup Keys And Certificate Export Activity IOC", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_dpapi_backup_and_cert_export_ioc.yml", "status": "experimental", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "145095eb-e273-443b-83d0-f9b519b7867b", "title": "PDF File Created By RegEdit.EXE", "file": "../sigma/rules/windows/file/file_event/file_event_win_regedit_print_as_pdf.yml", "status": "experimental", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "5d756aee-ad3e-4306-ad95-cb1abec48de2", "title": "GoToAssist Temporary Installation Artefact", "file": "../sigma/rules/windows/file/file_event/file_event_win_gotoopener_artefact.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "48ea844d-19b1-4642-944e-fe39c2cc1fec", "title": "UAC Bypass Using IDiagnostic Profile - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_idiagnostic_profile.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9", "title": "Creation Exe for Service with Unquoted Path", "file": "../sigma/rules/windows/file/file_event/file_event_win_creation_unquoted_service_path.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "1908fcc1-1b92-4272-8214-0fbaf2fa5163", "title": "Malicious DLL File Dropped in the Teams or OneDrive Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_iphlpapi_dll_sideloading.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "a10a2c40-2c4d-49f8-b557-1a946bc55d9d", "title": "Uncommon File Created In Office Startup Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_uncommon_file_startup.yml", "status": "experimental", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "736ffa74-5f6f-44ca-94ef-1c0df4f51d2a", "title": "HackTool - CrackMapExec File Indicators", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_crackmapexec_indicators.yml", "status": "experimental", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "bbb7e38c-0b41-4a11-b306-d2a457b7ac2b", "title": "Suspicious File Created In PerfLogs", "file": "../sigma/rules/windows/file/file_event/file_event_win_perflogs_susp_files.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "fed85bf9-e075-4280-9159-fbe8a023d6fa", "title": "Advanced IP Scanner - File Event", "file": "../sigma/rules/windows/file/file_event/file_event_win_advanced_ip_scanner.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "0e20c89d-2264-44ae-8238-aeeaba609ece", "title": "Potential Persistence Via Microsoft Office Startup Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_startup_persistence.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "56e05d41-ce99-4ecd-912d-93f019ee0b71", "title": "Visual Studio Code Tunnel Remote File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_vscode_tunnel_remote_creation_artefacts.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "b5b78988-486d-4a80-b991-930eff3ff8bf", "title": "PowerShell Profile Modification", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_powershell_profile.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "805c55d9-31e6-4846-9878-c34c75054fe9", "title": "Octopus Scanner Malware", "file": "../sigma/rules/windows/file/file_event/file_event_win_mal_octopus_scanner.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "80e1f67a-4596-4351-98f5-a9c3efabac95", "title": "Suspicious Scheduled Task Write to System32 Tasks", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_task_write.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "e3845023-ca9a-4024-b2b2-5422156d5527", "title": "PowerShell Module File Created By Non-PowerShell Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_powershell_module_uncommon_creation.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "e8a52bbd-bced-459f-bd93-64db45ce7657", "title": "Potential Suspicious PowerShell Module File Created", "file": "../sigma/rules/windows/file/file_event/file_event_win_powershell_module_susp_creation.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "fc4f4817-0c53-4683-a4ee-b17a64bc1039", "title": "Suspicious Desktopimgdownldr Target File", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_desktopimgdownldr_file.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "6ea858a8-ba71-4a12-b2cc-5d83312404c7", "title": "HackTool - Typical HiveNightmare SAM File Export", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_hivenightmare_file_exports.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "93a19907-d4f9-4deb-9f91-aac4692776a6", "title": "UAC Bypass Using .NET Code Profiler on MMC", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "3215aa19-f060-4332-86d5-5602511f3ca8", "title": "Suspicious LNK Double Extension File Created", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_lnk_double_extension.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "117d3d3a-755c-4a61-b23e-9171146d094c", "title": "Suspicious Outlook Macro Created", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_outlook_susp_macro_creation.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "93d94efc-d7ad-4161-ad7d-1638c4f908d8", "title": "HackTool - Dumpert Process Dumper Default File", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_dumpert.yml", "status": "test", "level": "critical", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "318557a5-150c-4c8d-b70e-a9910e199857", "title": "File Creation In Suspicious Directory By Msdt.EXE", "file": "../sigma/rules/windows/file/file_event/file_event_win_msdt_susp_directories.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "c3e76af5-4ce0-4a14-9c9a-25ceb8fda182", "title": "WerFault LSASS Process Memory Dump", "file": "../sigma/rules/windows/file/file_event/file_event_win_lsass_werfault_dump.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "f331aa1f-8c53-4fc3-b083-cc159bc971cb", "title": "Malicious PowerShell Scripts - FileCreation", "file": "../sigma/rules/windows/file/file_event/file_event_win_powershell_exploit_scripts.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "602a1f13-c640-4d73-b053-be9a2fa58b96", "title": "HackTool - Powerup Write Hijack DLL", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_powerup_dllhijacking.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "0d7a9363-af70-4e7b-a3b7-1a176b7fbe84", "title": "Exports Registry Key To an Alternate Data Stream", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_regedit_export_to_ads.yml", "status": "test", "level": "high", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "19b041f6-e583-40dc-b842-d6fa8011493f", "title": "HackTool Named File Stream Created", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_hktl_generic_download.yml", "status": "experimental", "level": "high", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "b69888d4-380c-45ce-9cf9-d9ce46e67821", "title": "Hidden Executable In NTFS Alternate Data Stream", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_ads_executable.yml", "status": "test", "level": "medium", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "025bd229-fd1f-4fdb-97ab-20006e1a5368", "title": "Unusual File Download from Direct IP Address", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_susp_ip_domains.yml", "status": "test", "level": "high", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "52182dfb-afb7-41db-b4bc-5336cb29b464", "title": "Suspicious File Download From File Sharing Websites - File Stream", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_file_sharing_domains_download_susp_extension.yml", "status": "experimental", "level": "high", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "0bb4bbeb-fe52-4044-b40c-430a04577ebe", "title": "Potentially Suspicious File Download From ZIP TLD", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_zip_tld_download.yml", "status": "test", "level": "high", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "a3f5c081-e75b-43a0-9f5b-51f26fe5dba2", "title": "Potential Suspicious Winget Package Installation", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_winget_susp_package_source.yml", "status": "test", "level": "high", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "573df571-a223-43bc-846e-3f98da481eca", "title": "Creation Of a Suspicious ADS File Outside a Browser Download", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_creation_internet_file.yml", "status": "test", "level": "medium", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "ae02ed70-11aa-4a22-b397-c0d0e8f6ea99", "title": "Unusual File Download From File Sharing Websites - File Stream", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_file_sharing_domains_download_unusual_extension.yml", "status": "experimental", "level": "medium", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4", "title": "RDP Over Reverse SSH Tunnel", "file": "../sigma/rules/windows/network_connection/net_connection_win_rdp_reverse_tunnel.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "d58ba5c6-0ed7-4b9d-a433-6878379efda9", "title": "Remote Access Tool - AnyDesk Incoming Connection", "file": "../sigma/rules/windows/network_connection/net_connection_win_remote_access_tools_anydesk_incoming_connection.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "7610a4ea-c06d-495f-a2ac-0a696abcfd3b", "title": "Outbound Network Connection To Public IP Via Winlogon", "file": "../sigma/rules/windows/network_connection/net_connection_win_winlogon_net_connections.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "3ab65069-d82a-4d44-a759-466661a082d1", "title": "Communication To LocaltoNet Tunneling Service Initiated", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_localtonet_tunnel.yml", "status": "experimental", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "5c80b618-0dbb-46e6-acbb-03d90bcb6d83", "title": "Network Connection Initiated To AzureWebsites.NET By Non-Browser Process", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_azurewebsites.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "c539afac-c12a-46ed-b1bd-5a5567c9f045", "title": "Potential Remote PowerShell Session Initiated", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_remote_powershell_session.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "cdc8da7d-c303-42f8-b08c-b4ab47230263", "title": "Rundll32 Internet Connection", "file": "../sigma/rules/windows/network_connection/net_connection_win_rundll32_net_connections.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "3b5ba899-9842-4bc2-acc2-12308498bf42", "title": "Office Application Initiated Network Connection Over Uncommon Ports", "file": "../sigma/rules/windows/network_connection/net_connection_win_office_uncommon_ports.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4", "title": "Network Connection Initiated To DevTunnels Domain", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_devtunnels.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "8d7e392e-9b28-49e1-831d-5949c6281228", "title": "Network Connection Initiated By IMEWDBLD.EXE", "file": "../sigma/rules/windows/network_connection/net_connection_win_imewdbld.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "5205613d-2a63-4412-a895-3a2458b587b3", "title": "Network Connection Initiated By AddinUtil.EXE", "file": "../sigma/rules/windows/network_connection/net_connection_win_addinutil_initiated.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "9f2cc74d-78af-4eb2-bb64-9cd1d292b87b", "title": "Microsoft Sync Center Suspicious Network Connections", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_outbound_mobsync_connection.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "c3dbbc9f-ef1d-470a-a90a-d343448d5875", "title": "Suspicious Non-Browser Network Communication With Telegram API", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_telegram_api_non_browser_access.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "786cdae8-fefb-4eb2-9227-04e34060db01", "title": "Suspicious Wordpad Outbound Connections", "file": "../sigma/rules/windows/network_connection/net_connection_win_wordpad_uncommon_ports.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "b1e5da3b-ca8e-4adf-915c-9921f3d85481", "title": "RDP to HTTP or HTTPS Target Ports", "file": "../sigma/rules/windows/network_connection/net_connection_win_rdp_to_http.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97", "title": "Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_file_sharing_domains_susp_folders.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "b3ad3c0f-c949-47a1-a30e-b0491ccae876", "title": "Uncommon Connection to Active Directory Web Services", "file": "../sigma/rules/windows/network_connection/net_connection_win_adws_unusual_connection.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "edf3485d-dac4-4d50-90e4-b0e5813f7e60", "title": "Suspicious Network Connection to IP Lookup Service APIs", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_external_ip_lookup.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7", "title": "New Connection Initiated To Potential Dead Drop Resolver Domain", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_dead_drop_resolvers.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "18249279-932f-45e2-b37a-8925f2597670", "title": "Process Initiated Network Connection To Ngrok Domain", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_ngrok.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "50e54b8d-ad73-43f8-96a1-5191685b17a4", "title": "Silenttrinity Stager Msbuild Activity", "file": "../sigma/rules/windows/network_connection/net_connection_win_silenttrinity_stager_msbuild_activity.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "9e02c8ec-02b9-43e8-81eb-34a475ba7965", "title": "Network Connection Initiated To BTunnels Domains", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_btunnels.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "ed74fe75-7594-4b4b-ae38-e38e3fd2eb23", "title": "Outbound RDP Connections Over Non-Standard Tools", "file": "../sigma/rules/windows/network_connection/net_connection_win_rdp_outbound_over_non_standard_tools.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "08249dc0-a28d-4555-8ba5-9255a198e08c", "title": "Local Network Connection Initiated By Script Interpreter", "file": "../sigma/rules/windows/network_connection/net_connection_win_wscript_cscript_local_connection.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "7b434893-c57d-4f41-908d-6a17bf1ae98f", "title": "Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_initiated_uncommon_or_suspicious_locations.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "1d08ac94-400d-4469-a82f-daee9a908849", "title": "Communication To Ngrok Tunneling Service Initiated", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_ngrok_tunnel.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "7cd1dcdc-6edf-4896-86dc-d1f19ad64903", "title": "Network Connection Initiated To Cloudflared Tunnels Domains", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_cloudflared_communication.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "992a6cae-db6a-43c8-9cec-76d7195c96fc", "title": "Outbound Network Connection Initiated By Script Interpreter", "file": "../sigma/rules/windows/network_connection/net_connection_win_wscript_cscript_outbound_connection.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "4b657234-038e-4ad5-997c-4be42340bce4", "title": "Network Connection Initiated To Visual Studio Code Tunnels Domain", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_vscode_tunnel_connection.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "bef0bc5a-b9ae-425d-85c6-7b2d705980c6", "title": "Python Initiated Connection", "file": "../sigma/rules/windows/network_connection/net_connection_win_python.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "efafe0bf-4238-479e-af8f-797bd3490d2d", "title": "Outbound Network Connection Initiated By Cmstp.EXE", "file": "../sigma/rules/windows/network_connection/net_connection_win_cmstp_initiated_connection.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "7e9cf7b6-e827-11ed-a05b-15959c120003", "title": "Potentially Suspicious Network Connection To Notion API", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_notion_api_susp_communication.yml", "status": "test", "level": "low", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84", "title": "Office Application Initiated Network Connection To Non-Local IP", "file": "../sigma/rules/windows/network_connection/net_connection_win_office_outbound_non_local_ip.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "0531e43a-d77d-47c2-b89f-5fe50321c805", "title": "RegAsm.EXE Initiating Network Connection To Public IP", "file": "../sigma/rules/windows/network_connection/net_connection_win_regasm_network_activity.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "e54979bd-c5f9-4d6c-967b-a04b19ac4c74", "title": "Uncommon Outbound Kerberos Connection", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_outbound_kerberos_connection.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "fa5b1358-b040-4403-9868-15f7d9ab6329", "title": "Network Communication With Crypto Mining Pool", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_crypto_mining_pools.yml", "status": "stable", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "4b89abaa-99fe-4232-afdd-8f9aa4d20382", "title": "Potentially Suspicious Malware Callback Communication", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_malware_callback_port.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "07837ab9-60e1-481f-a74d-c31fb496a94c", "title": "Network Communication Initiated To Portmap.IO Domain", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_portmap.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "c7e91a02-d771-4a6d-a700-42587e0b1095", "title": "Network Connection Initiated By Regsvr32.EXE", "file": "../sigma/rules/windows/network_connection/net_connection_win_regsvr32_network_activity.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "c649a6c7-cd8c-4a78-9c04-000fc76df954", "title": "Potentially Suspicious Wuauclt Network Connection", "file": "../sigma/rules/windows/network_connection/net_connection_win_wuauclt_network_connection.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1", "title": "Outbound Network Connection Initiated By Microsoft Dialer", "file": "../sigma/rules/windows/network_connection/net_connection_win_dialer_initiated_connection.yml", "status": "experimental", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "e81528db-fc02-45e8-8e98-4e84aba1f10b", "title": "Network Connection Initiated Via Notepad.EXE", "file": "../sigma/rules/windows/network_connection/net_connection_win_notepad.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "0dba975d-a193-4ed1-a067-424df57570d1", "title": "Uncommon Network Connection Initiated By Certutil.EXE", "file": "../sigma/rules/windows/network_connection/net_connection_win_certutil_initiated_connection.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "9976fa64-2804-423c-8a5b-646ade840773", "title": "Suspicious Outbound SMTP Connections", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_outbound_smtp_connections.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "7e9cf7b6-e827-11ed-a05b-0242ac120003", "title": "Suspicious Non-Browser Network Communication With Google API", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_google_api_non_browser_access.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "a66bc059-c370-472c-a0d7-f8fd1bf9d583", "title": "Network Connection Initiated By Eqnedt32.EXE", "file": "../sigma/rules/windows/network_connection/net_connection_win_eqnedt.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "20384606-a124-4fec-acbb-8bd373728613", "title": "Suspicious Network Connection Binary No CommandLine", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_binary_no_cmdline.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "25eabf56-22f0-4915-a1ed-056b8dae0a68", "title": "Suspicious Dropbox API Usage", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_dropbox_api.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "6d8c3d20-a5e1-494f-8412-4571d716cf5c", "title": "Communication To Uncommon Destination Ports", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_malware_callback_ports_uncommon.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4", "title": "Network Connection Initiated To Mega.nz", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_mega_nz.yml", "status": "test", "level": "low", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "fe21810c-2a8c-478f-8dd3-5a287fb2a0e0", "title": "Suspicious Scripting in a WMI Consumer", "file": "../sigma/rules/windows/wmi_event/sysmon_wmi_susp_scripting.yml", "status": "test", "level": "high", "logsource.category": "wmi_event", "logsource.product": "windows"}, {"id": "83844185-1c5b-45bc-bcf3-b5bf3084ca5b", "title": "Suspicious Encoded Scripts in a WMI Consumer", "file": "../sigma/rules/windows/wmi_event/sysmon_wmi_susp_encoded_scripts.yml", "status": "test", "level": "high", "logsource.category": "wmi_event", "logsource.product": "windows"}, {"id": "0f06a3a5-6a09-413f-8743-e6cf35561297", "title": "WMI Event Subscription", "file": "../sigma/rules/windows/wmi_event/sysmon_wmi_event_subscription.yml", "status": "test", "level": "medium", "logsource.category": "wmi_event", "logsource.product": "windows"}, {"id": "961d0ba2-3eea-4303-a930-2cf78bbfcc5e", "title": "HackTool - Credential Dumping Tools Named Pipe Created", "file": "../sigma/rules/windows/pipe_created/pipe_created_hktl_generic_cred_dump_tools_pipes.yml", "status": "test", "level": "critical", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "493fb4ab-cdcc-4c4f-818c-0e363bd1e4bb", "title": "WMI Event Consumer Created Named Pipe", "file": "../sigma/rules/windows/pipe_created/pipe_created_scrcons_wmi_consumer_namedpipe.yml", "status": "test", "level": "medium", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "0e7163d4-9e19-4fa7-9be6-000c61aad77a", "title": "CobaltStrike Named Pipe Pattern Regex", "file": "../sigma/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_re.yml", "status": "test", "level": "critical", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "0adc67e0-a68f-4ffd-9c43-28905aad5d6a", "title": "HackTool - Koh Default Named Pipe", "file": "../sigma/rules/windows/pipe_created/pipe_created_hktl_koh_default_pipe.yml", "status": "test", "level": "critical", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "637f689e-b4a5-4a86-be0e-0100a0a33ba2", "title": "HackTool - EfsPotato Named Pipe Creation", "file": "../sigma/rules/windows/pipe_created/pipe_created_hktl_efspotato.yml", "status": "experimental", "level": "high", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "d5601f8c-b26f-4ab0-9035-69e11a8d4ad2", "title": "CobaltStrike Named Pipe", "file": "../sigma/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike.yml", "status": "test", "level": "critical", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3", "title": "ADFS Database Named Pipe Connection By Uncommon Tool", "file": "../sigma/rules/windows/pipe_created/pipe_created_adfs_namedpipe_connection_uncommon_tool.yml", "status": "test", "level": "medium", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "ac7102b4-9e1e-4802-9b4f-17c5524c015c", "title": "New PowerShell Instance Created", "file": "../sigma/rules/windows/pipe_created/pipe_created_powershell_execution_pipe.yml", "status": "test", "level": "informational", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7", "title": "CobaltStrike Named Pipe Patterns", "file": "../sigma/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_susp_pipe_patterns.yml", "status": "test", "level": "high", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "41504465-5e3a-4a5b-a5b4-2a0baadd4463", "title": "PsExec Tool Execution From Suspicious Locations - PipeName", "file": "../sigma/rules/windows/pipe_created/pipe_created_sysinternals_psexec_default_pipe_susp_location.yml", "status": "test", "level": "medium", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "4d0083b3-580b-40da-9bba-626c19fe4033", "title": "HackTool - CoercedPotato Named Pipe Creation", "file": "../sigma/rules/windows/pipe_created/pipe_created_hktl_coercedpotato.yml", "status": "test", "level": "high", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "58cb02d5-78ce-4692-b3e1-dce850aae41a", "title": "Alternate PowerShell Hosts Pipe", "file": "../sigma/rules/windows/pipe_created/pipe_created_powershell_alternate_host_pipe.yml", "status": "test", "level": "medium", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "1f7025a6-e747-4130-aac4-961eb47015f1", "title": "HackTool - DiagTrackEoP Default Named Pipe", "file": "../sigma/rules/windows/pipe_created/pipe_created_hktl_diagtrack_eop.yml", "status": "test", "level": "critical", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "d36f87ea-c403-44d2-aa79-1a0ac7c24456", "title": "PUA - RemCom Default Named Pipe", "file": "../sigma/rules/windows/pipe_created/pipe_created_pua_remcom_default_pipe.yml", "status": "test", "level": "medium", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "f6451de4-df0a-41fa-8d72-b39f54a08db5", "title": "PUA - PAExec Default Named Pipe", "file": "../sigma/rules/windows/pipe_created/pipe_created_pua_paexec_default_pipe.yml", "status": "test", "level": "medium", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "f318b911-ea88-43f4-9281-0de23ede628e", "title": "PUA - CSExec Default Named Pipe", "file": "../sigma/rules/windows/pipe_created/pipe_created_pua_csexec_default_pipe.yml", "status": "test", "level": "medium", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "fe3ac066-98bb-432a-b1e7-a5229cb39d4a", "title": "Malicious Named Pipe Created", "file": "../sigma/rules/windows/pipe_created/pipe_created_susp_malicious_namedpipes.yml", "status": "test", "level": "critical", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "67add051-9ee7-4ad3-93ba-42935615ae8d", "title": "PUA - Process Hacker Driver Load", "file": "../sigma/rules/windows/driver_load/driver_load_win_pua_process_hacker.yml", "status": "test", "level": "high", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "295c9289-acee-4503-a571-8eacaef36b28", "title": "Vulnerable HackSys Extreme Vulnerable Driver Load", "file": "../sigma/rules/windows/driver_load/driver_load_win_vuln_hevd_driver.yml", "status": "test", "level": "high", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "72cd00d6-490c-4650-86ff-1d11f491daa1", "title": "Vulnerable Driver Load By Name", "file": "../sigma/rules/windows/driver_load/driver_load_win_vuln_drivers_names.yml", "status": "test", "level": "low", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "05296024-fe8a-4baf-8f3d-9a5f5624ceb2", "title": "Malicious Driver Load", "file": "../sigma/rules/windows/driver_load/driver_load_win_mal_drivers.yml", "status": "test", "level": "high", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "1a42dfa6-6cb2-4df9-9b48-295be477e835", "title": "Vulnerable WinRing0 Driver Load", "file": "../sigma/rules/windows/driver_load/driver_load_win_vuln_winring0_driver.yml", "status": "test", "level": "high", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "10cb6535-b31d-4512-9962-513dcbc42cc1", "title": "PUA - System Informer Driver Load", "file": "../sigma/rules/windows/driver_load/driver_load_win_pua_system_informer.yml", "status": "test", "level": "medium", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8", "title": "Vulnerable Driver Load", "file": "../sigma/rules/windows/driver_load/driver_load_win_vuln_drivers.yml", "status": "test", "level": "high", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "679085d5-f427-4484-9f58-1dc30a7c426d", "title": "WinDivert Driver Load", "file": "../sigma/rules/windows/driver_load/driver_load_win_windivert.yml", "status": "test", "level": "high", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75", "title": "Driver Load From A Temporary Directory", "file": "../sigma/rules/windows/driver_load/driver_load_win_susp_temp_use.yml", "status": "test", "level": "high", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "39b64854-5497-4b57-a448-40977b8c9679", "title": "Malicious Driver Load By Name", "file": "../sigma/rules/windows/driver_load/driver_load_win_mal_drivers_names.yml", "status": "test", "level": "medium", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "06d71506-7beb-4f22-8888-e2e5e2ca7fd8", "title": "Mimikatz Use", "file": "../sigma/rules/windows/builtin/win_alert_mimikatz_keywords.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "b7bc7038-638b-4ffd-880c-292c692209ef", "title": "Certificate Request Export to Exchange Webserver", "file": "../sigma/rules/windows/builtin/msexchange/win_exchange_proxyshell_certificate_generation.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "4fe151c2-ecf9-4fae-95ae-b88ec9c2fca6", "title": "MSExchange Transport Agent Installation - Builtin", "file": "../sigma/rules/windows/builtin/msexchange/win_exchange_transportagent.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "9db37458-4df2-46a5-95ab-307e7f29e675", "title": "Exchange Set OabVirtualDirectory ExternalUrl Property", "file": "../sigma/rules/windows/builtin/msexchange/win_exchange_set_oabvirtualdirectory_externalurl.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "09570ae5-889e-43ea-aac0-0e1221fb3d95", "title": "Remove Exported Mailbox from Exchange Webserver", "file": "../sigma/rules/windows/builtin/msexchange/win_exchange_proxyshell_remove_mailbox_export.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "550d3350-bb8a-4ff3-9533-2ba533f4a1c0", "title": "ProxyLogon MSExchange OabVirtualDirectory", "file": "../sigma/rules/windows/builtin/msexchange/win_exchange_proxylogon_oabvirtualdir.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "c7d16cae-aaf3-42e5-9c1c-fb8553faa6fa", "title": "Failed MSExchange Transport Agent Installation", "file": "../sigma/rules/windows/builtin/msexchange/win_exchange_transportagent_failed.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "516376b4-05cd-4122-bae0-ad7641c38d48", "title": "Mailbox Export to Exchange Webserver", "file": "../sigma/rules/windows/builtin/msexchange/win_exchange_proxyshell_mailbox_export.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "58c0bff0-40a0-46e8-b5e8-b734b84d2017", "title": "Certificate Exported From Local Certificate Store", "file": "../sigma/rules/windows/builtin/certificate_services_client_lifecycle_system/win_certificateservicesclient_lifecycle_system_cert_exported.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "898d5fc9-fbc3-43de-93ad-38e97237c344", "title": "Suspicious AppX Package Installation Attempt", "file": "../sigma/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_susp_appx_package_installation.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "09d3b48b-be17-47f5-bf4e-94e7e75d09ce", "title": "Potential Malicious AppX Package Installation Attempts", "file": "../sigma/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_mal_appx_names.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "c977cb50-3dff-4a9f-b873-9290f56132f1", "title": "Uncommon AppX Package Locations", "file": "../sigma/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_uncommon_package_locations.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "5cdeaf3d-1489-477c-95ab-c318559fc051", "title": "Suspicious AppX Package Locations", "file": "../sigma/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_susp_package_locations.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "e021bbb5-407f-41f5-9dc9-1864c45a7a51", "title": "Deployment Of The AppX Package Was Blocked By The Policy", "file": "../sigma/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_policy_block.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "6ae53108-c3a0-4bee-8f45-c7591a2c337f", "title": "Deployment AppX Package Was Blocked By AppLocker", "file": "../sigma/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_applocker_block.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "8b48ad89-10d8-4382-a546-50588c410f0d", "title": "Suspicious Remote AppX Package Locations", "file": "../sigma/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_susp_domains.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "b55d23e5-6821-44ff-8a6e-67218891e49f", "title": "HybridConnectionManager Service Running", "file": "../sigma/rules/windows/builtin/servicebus/win_hybridconnectionmgr_svc_running.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "6d444368-6da1-43fe-b2fc-44202430480e", "title": "Failed DNS Zone Transfer", "file": "../sigma/rules/windows/builtin/dns_server/win_dns_server_failed_dns_zone_transfer.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "cbe51394-cd93-4473-b555-edf0144952d9", "title": "DNS Server Error Failed Loading the ServerLevelPluginDLL", "file": "../sigma/rules/windows/builtin/dns_server/win_dns_server_susp_server_level_plugin_dll.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "8289bf8c-4aca-4f5a-9db3-dc3d7afe5c10", "title": "Unsigned Binary Loaded From Suspicious Location", "file": "../sigma/rules/windows/builtin/security_mitigations/win_security_mitigations_unsigned_dll_from_susp_location.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "0b0ea3cc-99c8-4730-9c53-45deee2a4c86", "title": "Microsoft Defender Blocked from Loading Unsigned DLL", "file": "../sigma/rules/windows/builtin/security_mitigations/win_security_mitigations_defender_load_unsigned_dll.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "c187c075-bb3e-4c62-b4fa-beae0ffc211f", "title": "A Rule Has Been Deleted From The Windows Firewall Exception List", "file": "../sigma/rules/windows/builtin/firewall_as/win_firewall_as_delete_rule.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "04b60639-39c0-412a-9fbe-e82499c881a3", "title": "Windows Defender Firewall Has Been Reset To Its Default Configuration", "file": "../sigma/rules/windows/builtin/firewall_as/win_firewall_as_reset_config.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "cde0a575-7d3d-4a49-9817-b8004a7bf105", "title": "Uncommon New Firewall Rule Added In Windows Firewall Exception List", "file": "../sigma/rules/windows/builtin/firewall_as/win_firewall_as_add_rule.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "9e2575e7-2cb9-4da1-adc8-ed94221dca5e", "title": "New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application", "file": "../sigma/rules/windows/builtin/firewall_as/win_firewall_as_add_rule_susp_folder.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "79609c82-a488-426e-abcf-9f341a39365d", "title": "All Rules Have Been Deleted From The Windows Firewall Configuration", "file": "../sigma/rules/windows/builtin/firewall_as/win_firewall_as_delete_all_rules.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "7ec15688-fd24-4177-ba43-1a950537ee39", "title": "The Windows Defender Firewall Service Failed To Load Group Policy", "file": "../sigma/rules/windows/builtin/firewall_as/win_firewall_as_failed_load_gpo.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "eca81e8d-09e1-4d04-8614-c91f44fd0519", "title": "New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE", "file": "../sigma/rules/windows/builtin/firewall_as/win_firewall_as_add_rule_wmiprvse.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "00bb5bd5-1379-4fcf-a965-a5b6f7478064", "title": "Windows Firewall Settings Have Been Changed", "file": "../sigma/rules/windows/builtin/firewall_as/win_firewall_as_setting_change.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "71886b70-d7b4-4dbf-acce-87d2ca135262", "title": "Suspicious Rejected SMB Guest Logon From IP", "file": "../sigma/rules/windows/builtin/smbclient/security/win_smbclient_security_susp_failed_guest_logon.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "e2b5163d-7deb-4566-9af3-40afea6858c3", "title": "Certificate Private Key Acquired", "file": "../sigma/rules/windows/builtin/capi2/win_capi2_acquire_certificate_private_key.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "90f138c1-f578-4ac3-8c49-eecfd847c8b7", "title": "BITS Transfer Job Download From Direct IP", "file": "../sigma/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_ip_address.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "fe3a2d49-f255-4d10-935c-bda7391108eb", "title": "New BITS Job Created Via PowerShell", "file": "../sigma/rules/windows/builtin/bits_client/win_bits_client_new_job_via_powershell.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "f8a56cb7-a363-44ed-a82f-5926bb44cd05", "title": "BITS Transfer Job Download To Potential Suspicious Folder", "file": "../sigma/rules/windows/builtin/bits_client/win_bits_client_new_trasnfer_susp_local_folder.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "b85e5894-9b19-4d86-8c87-a2f3b81f0521", "title": "BITS Transfer Job Downloading File Potential Suspicious Extension", "file": "../sigma/rules/windows/builtin/bits_client/win_bits_client_new_transfer_saving_susp_extensions.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "1ff315dc-2a3a-4b71-8dde-873818d25d39", "title": "New BITS Job Created Via Bitsadmin", "file": "../sigma/rules/windows/builtin/bits_client/win_bits_client_new_job_via_bitsadmin.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "d635249d-86b5-4dad-a8c7-d7272b788586", "title": "BITS Transfer Job Download From File Sharing Domains", "file": "../sigma/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_file_sharing_domains.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "6d44fb93-e7d2-475c-9d3d-54c9c1e33427", "title": "BITS Transfer Job With Uncommon Or Suspicious Remote TLD", "file": "../sigma/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_uncommon_tld.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "4d7f1827-1637-4def-8d8a-fd254f9454df", "title": "Sysmon Application Crashed", "file": "../sigma/rules/windows/builtin/system/application_popup/win_system_application_sysmon_crash.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "e6f81941-b1cd-4766-87db-9fc156f658ee", "title": "KDC RC4-HMAC Downgrade CVE-2022-37966", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_rc4_downgrade.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "993c2665-e6ef-40e3-a62a-e1a97686af79", "title": "Certificate Use With No Strong Mapping", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_cert_use_no_strong_mapping.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "b1e0b3f5-b62e-41be-886a-daffde446ad4", "title": "No Suitable Encryption Key Found For Generating Kerberos Ticket", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_tgs_no_suitable_encryption_key_found.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "e9d4ab66-a532-4ef7-a502-66a9e4a34f5d", "title": "NTLMv1 Logon Between Client and Server", "file": "../sigma/rules/windows/builtin/system/lsasrv/win_system_lsasrv_ntlmv1.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "52a85084-6989-40c3-8f32-091e12e17692", "title": "Suspicious Usage of CVE_2021_34484 or CVE 2022_21919", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_user_profiles_service/win_system_susp_vuln_cve_2022_21919_or_cve_2021_34484.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "175997c5-803c-4b08-8bb0-70b099f47595", "title": "Invoke-Obfuscation COMPRESS OBFUSCATION - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_compress_services.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "f7385ee2-0e0c-11eb-adc1-0242ac120002", "title": "Invoke-Obfuscation CLIP+ Launcher - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_clip_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "c4ff1eac-84ad-44dd-a6fb-d56a92fc43a9", "title": "ProcessHacker Privilege Elevation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_pua_proceshacker.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "d26ce60c-2151-403c-9a42-49420d87b5e4", "title": "HackTool Service Registration or Execution", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_hacktools.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "843544a7-56e0-4dcc-a44f-5cc266dd97d6", "title": "Meterpreter or Cobalt Strike Getsystem Service Installation - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "b98a10af-1e1e-44a7-bab2-4cc026917648", "title": "New PDQDeploy Service - Client Side", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_pdqdeploy_runner.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "25b9c01c-350d-4b95-bed1-836d04a4f324", "title": "Moriya Rootkit - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_moriya_rootkit.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "d6b5520d-3934-48b4-928c-2aa3f92d6963", "title": "Important Windows Service Terminated With Error", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_important.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "5a105d34-05fc-401e-8553-272b45c1522d", "title": "CobaltStrike Service Installations - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_cobaltstrike_service_installs.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "641a4bfb-c017-44f7-800c-2aee0184ce9b", "title": "Invoke-Obfuscation Via Use Rundll32 - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_rundll32_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "11b52f18-aaec-4d60-9143-5dd8cc4706b9", "title": "Invoke-Obfuscation RUNDLL LAUNCHER - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_rundll_services.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "71c276aa-49cd-43d2-b920-2dcd3e6962d5", "title": "Service Installed By Unusual Client - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_sups_unusal_client.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "530a6faa-ff3d-4022-b315-50828e77eef5", "title": "Anydesk Remote Access Software Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_anydesk.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "56abae0c-6212-4b97-adc0-0b559bb950c3", "title": "Important Windows Service Terminated Unexpectedly", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_unexpectedly.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1a31b18a-f00c-4061-9900-f735b96c99fc", "title": "Remote Access Tool Services Have Been Installed - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_remote_access_software.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "70f00d10-60b2-4f34-b9a0-dc3df3fe762a", "title": "Suspicious Service Installation Script", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_susp_service_installation_script.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "26481afe-db26-4228-b264-25a29fe6efc7", "title": "Uncommon Service Installation Image Path", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_uncommon.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "5e993621-67d4-488a-b9ae-b420d08b96cb", "title": "Service Installation in Suspicious Folder", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_susp_service_installation_folder.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "de7ce410-b3fb-4e8a-b38c-3b999e2c3420", "title": "PAExec Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_paexec.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "42c575ea-e41e-41f1-b248-8093c3e82a28", "title": "PsExec Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_sysinternals_psexec.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "14bcba49-a428-42d9-b943-e2ce0f0f7ae6", "title": "Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_var_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "2d510d8d-912b-45c5-b1df-36faa3d8c3f4", "title": "NetSupport Manager Service Install", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_netsupport_manager.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "4976aa50-8f41-45c6-8b15-ab3fc10e79ed", "title": "Credential Dumping Tools Service Execution - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_mal_creddumper.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "9e36ed87-4986-482e-8e3b-5c23ffff11bf", "title": "RemCom Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_remcom.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "6c0a7755-6d31-44fa-80e1-133e57752680", "title": "Windows Defender Threat Detection Service Disabled", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_defender_disabled.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "a27e5fa9-c35e-4e3d-b7e0-1ce2af66ad12", "title": "CSExec Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_csexecsvc.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "63e3365d-4824-42d8-8b82-e56810fefa0c", "title": "Invoke-Obfuscation Via Use Clip - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_clip_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "e97d9903-53b2-41fc-8cb9-889ed4093e80", "title": "KrbRelayUp Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_krbrelayup_service_installation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "31c51af6-e7aa-4da7-84d4-8f32cc580af2", "title": "Sliver C2 Default Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_sliver.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1d61f71d-59d2-479e-9562-4ff5f4ead16b", "title": "Suspicious Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_susp.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "ee9ca27c-9bd7-4cee-9b01-6e906be7cae3", "title": "New PDQDeploy Service - Server Side", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_pdqdeploy.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "e0d1ad53-c7eb-48ec-a87a-72393cc6cedc", "title": "Mesh Agent Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_mesh_agent.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "8ca7004b-e620-4ecb-870e-86129b5b8e75", "title": "Invoke-Obfuscation VAR+ Launcher - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_var_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1b2ae822-6fe1-43ba-aa7c-d1a3b3d1d5f2", "title": "Service Installation with Suspicious Folder Pattern", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_susp_service_installation_folder_pattern.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "51aa9387-1c53-4153-91cc-d73c59ae1ca9", "title": "Invoke-Obfuscation Obfuscated IEX Invocation - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_obfuscated_iex_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "8e4cf0e5-aa5d-4dc3-beff-dc26917744a9", "title": "Tap Driver Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_tap_driver.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "91c49341-e2ef-40c0-ac45-49ec5c3fe26c", "title": "RTCore Suspicious Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_susp_rtcore64_service_install.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "7e9c7999-0f9b-4d4a-a6ed-af6d553d4af4", "title": "Invoke-Obfuscation Via Use MSHTA - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_mshta_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "4bb79b62-ef12-4861-981d-2aab43fab642", "title": "TacticalRMM Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_tacticalrmm.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "487c7524-f892-4054-b263-8a0ace63fc25", "title": "Invoke-Obfuscation Via Stdin - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_stdin_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "72862bf2-0eb1-11eb-adc1-0242ac120002", "title": "Invoke-Obfuscation STDIN+ Launcher - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_stdin_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "a2e5019d-a658-4c6a-92bf-7197b54e2cae", "title": "PowerShell Scripts Installed as Services", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_powershell_script_installed_as_service.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "85cce894-dd8b-4427-a958-5cc47a4dc9b9", "title": "Remote Utilities Host Service Install", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_remote_utilities.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "acfa2210-0d71-4eeb-b477-afab494d596c", "title": "Windows Service Terminated With Error", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_generic.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "52a85084-6989-40c3-8f32-091e12e13f09", "title": "smbexec.py Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_hack_smbexec.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "e80a0fee-1a62-4419-b31e-0d0db6e6013a", "title": "Potential CVE-2021-42287 Exploitation Attempt", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_directory_services_sam/win_system_exploit_cve_2021_42287.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "39f919f3-980b-4e6f-a975-8af7e507ef2b", "title": "Critical Hive In Suspicious Location Access Bits Cleared", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_kernel_general/win_system_susp_critical_hive_location_access_bits_cleared.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "994bfd6d-0a2e-481e-a861-934069fcf5f5", "title": "Active Directory Certificate Services Denied Certificate Enrollment Request", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_certification_authority/win_system_adcs_enrollment_request_denied.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "13cfeb75-9e33-4d04-b0f7-ab8faaa95a59", "title": "Windows Update Error", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_windows_update_client/win_system_susp_system_update_error.yml", "status": "stable", "level": "informational", "logsource.category": null, "logsource.product": "windows"}, {"id": "13fc89a9-971e-4ca6-b9dc-aa53a445bf40", "title": "DHCP Server Loaded the CallOut DLL", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "75edd3fd-7146-48e5-9848-3013d7f0282c", "title": "DHCP Server Error Failed Loading the CallOut DLL", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config_failed.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "f512acbf-e662-4903-843e-97ce4652b740", "title": "Volume Shadow Copy Mount", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_ntfs/win_system_volume_shadow_copy_mount.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "bc2e25ed-b92b-4daa-b074-b502bdd1982b", "title": "Local Privilege Escalation Indicator TabTip", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_distributed_com/win_system_lpe_indicators_tabtip.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "f14719ce-d3ab-4e25-9ce6-2899092260b0", "title": "NTFS Vulnerability Exploitation", "file": "../sigma/rules/windows/builtin/system/ntfs/win_system_ntfs_vuln_exploit.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "aaa5b30d-f418-420b-83a0-299cb6024885", "title": "Potential RDP Exploit CVE-2019-0708", "file": "../sigma/rules/windows/builtin/system/termdd/win_system_rdp_potential_cve_2019_0708.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "100ef69e-3327-481c-8e5c-6d80d9507556", "title": "Important Windows Eventlog Cleared", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_eventlog/win_system_susp_eventlog_cleared.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "a62b37e0-45d3-48d9-a517-90c1a1b0186b", "title": "Eventlog Cleared", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_eventlog/win_system_eventlog_cleared.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "a0cb7110-edf0-47a4-9177-541a4083128a", "title": "Vulnerable Netlogon Secure Channel Connection Allowed", "file": "../sigma/rules/windows/builtin/system/netlogon/win_system_vul_cve_2020_1472.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "18f37338-b9bd-4117-a039-280c81f7a596", "title": "Zerologon Exploitation Using Well-known Tools", "file": "../sigma/rules/windows/builtin/system/netlogon/win_system_possible_zerologon_exploitation_using_wellknown_tools.yml", "status": "stable", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "7ac407cc-0f48-4328-aede-de1d2e6fef41", "title": "Standard User In High Privileged Group", "file": "../sigma/rules/windows/builtin/lsa_server/win_lsa_server_normal_user_admin.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "83c161b6-ca67-4f33-8ad0-644a0737cf07", "title": "Suspicious Application Installed", "file": "../sigma/rules/windows/builtin/shell_core/win_shell_core_susp_packages_installed.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "b4c8da4a-1c12-46b0-8a2b-0a8521d03442", "title": "Restricted Software Access By SRP", "file": "../sigma/rules/windows/builtin/application/microsoft_windows_software_restriction_policies/win_software_restriction_policies_block.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "545a5da6-f103-4919-a519-e9aec1026ee4", "title": "Microsoft Malware Protection Engine Crash", "file": "../sigma/rules/windows/builtin/application/application_error/win_application_msmpeng_crash_error.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "a18e0862-127b-43ca-be12-1a542c75c7c5", "title": "Potential Credential Dumping Via WER - Application", "file": "../sigma/rules/windows/builtin/application/application_error/win_werfault_susp_lsass_credential_dump.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "48d91a3a-2363-43ba-a456-ca71ac3da5c2", "title": "Audit CVE Event", "file": "../sigma/rules/windows/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "5d19eb78-5b5b-4ef2-a9f0-4bfa94d58a13", "title": "Remote Access Tool - ScreenConnect File Transfer", "file": "../sigma/rules/windows/builtin/application/screenconnect/win_app_remote_access_tools_screenconnect_file_transfer.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "076ebe48-cc05-4d8f-9d41-89245cd93a14", "title": "Remote Access Tool - ScreenConnect Command Execution", "file": "../sigma/rules/windows/builtin/application/screenconnect/win_app_remote_access_tools_screenconnect_command_exec.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "94dc4390-6b7c-4784-8ffc-335334404650", "title": "Dump Ntds.dit To Suspicious Location", "file": "../sigma/rules/windows/builtin/application/esent/win_esent_ntdsutil_abuse_susp_location.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "e6e88853-5f20-4c4a-8d26-cd469fd8d31f", "title": "Ntdsutil Abuse", "file": "../sigma/rules/windows/builtin/application/esent/win_esent_ntdsutil_abuse.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "78bc5783-81d9-4d73-ac97-59f6db4f72a8", "title": "Relevant Anti-Virus Signature Keywords In Application Log", "file": "../sigma/rules/windows/builtin/application/Other/win_av_relevant_match.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "08200f85-2678-463e-9c32-88dce2f073d1", "title": "MSSQL Add Account To Sysadmin Role", "file": "../sigma/rules/windows/builtin/application/mssqlserver/win_mssql_add_sysadmin_account.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "b3d57a5c-c92e-4b48-9a79-5f124b7cf964", "title": "MSSQL SPProcoption Set", "file": "../sigma/rules/windows/builtin/application/mssqlserver/win_mssql_sp_procoption_set.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "d08dd86f-681e-4a00-a92c-1db218754417", "title": "MSSQL XPCmdshell Option Change", "file": "../sigma/rules/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_change.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "350dfb37-3706-4cdc-9e2e-5e24bc3a46df", "title": "MSSQL Disable Audit Settings", "file": "../sigma/rules/windows/builtin/application/mssqlserver/win_mssql_disable_audit_settings.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "7f103213-a04e-4d59-8261-213dddf22314", "title": "MSSQL XPCmdshell Suspicious Execution", "file": "../sigma/rules/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_audit_log.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "218d2855-2bba-4f61-9c85-81d0ea63ac71", "title": "MSSQL Server Failed Logon", "file": "../sigma/rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d", "title": "MSSQL Server Failed Logon From External Network", "file": "../sigma/rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon_from_external_network.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "9703792d-fd9a-456d-a672-ff92efe4806a", "title": "Backup Catalog Deleted", "file": "../sigma/rules/windows/builtin/application/microsoft_windows_backup/win_susp_backup_delete.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "87261fb2-69d0-42fe-b9de-88c6b5f65a43", "title": "Atera Agent Installation", "file": "../sigma/rules/windows/builtin/application/msiinstaller/win_software_atera_rmm_agent_install.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "570ae5ec-33dc-427c-b815-db86228ad43e", "title": "Application Uninstalled", "file": "../sigma/rules/windows/builtin/application/msiinstaller/win_builtin_remove_application.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "c7c8aa1c-5aff-408e-828b-998e3620b341", "title": "MSI Installation From Suspicious Locations", "file": "../sigma/rules/windows/builtin/application/msiinstaller/win_msi_install_from_susp_locations.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "5594e67a-7f92-4a04-b65d-1a42fd824a60", "title": "MSI Installation From Web", "file": "../sigma/rules/windows/builtin/application/msiinstaller/win_msi_install_from_web.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "6c82cf5c-090d-4d57-9188-533577631108", "title": "Microsoft Malware Protection Engine Crash - WER", "file": "../sigma/rules/windows/builtin/application/windows_error_reporting/win_application_msmpeng_crash_wer.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "9c8acf1a-cbf9-4db6-b63c-74baabe03e59", "title": "NTLM Brute Force", "file": "../sigma/rules/windows/builtin/ntlm/win_susp_ntlm_brute_force.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "ce5678bb-b9aa-4fb5-be4b-e57f686256ad", "title": "Potential Remote Desktop Connection to Non-Domain Host", "file": "../sigma/rules/windows/builtin/ntlm/win_susp_ntlm_rdp.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "98c3bcf1-56f2-49dc-9d8d-c66cf190238b", "title": "NTLM Logon", "file": "../sigma/rules/windows/builtin/ntlm/win_susp_ntlm_auth.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "31d68132-4038-47c7-8f8e-635a39a7c174", "title": "Potential Active Directory Reconnaissance/Enumeration Via LDAP", "file": "../sigma/rules/windows/builtin/ldap/win_ldap_recon.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "686c0b4b-9dd3-4847-9077-d6c1bbe36fcb", "title": "Windows Defender Virus Scanning Feature Disabled", "file": "../sigma/rules/windows/builtin/windefend/win_defender_virus_scan_disabled.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "360a1340-398a-46b6-8d06-99b905dc69d2", "title": "Windows Defender Grace Period Expired", "file": "../sigma/rules/windows/builtin/windefend/win_defender_antimalware_platform_expired.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "dd80db93-6ec2-4f4c-a017-ad40da6ffe81", "title": "Windows Defender Real-Time Protection Failure/Restart", "file": "../sigma/rules/windows/builtin/windefend/win_defender_real_time_protection_errors.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "2afe6582-e149-11ea-87d0-0242ac130003", "title": "Windows Defender Malware Detection History Deletion", "file": "../sigma/rules/windows/builtin/windefend/win_defender_history_delete.yml", "status": "test", "level": "informational", "logsource.category": null, "logsource.product": "windows"}, {"id": "b28e58e4-2a72-4fae-bdee-0fbe904db642", "title": "Windows Defender Real-time Protection Disabled", "file": "../sigma/rules/windows/builtin/windefend/win_defender_real_time_protection_disabled.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "a0a278fe-2c0e-4de2-ac3c-c68b08a9ba98", "title": "LSASS Access Detected via Attack Surface Reduction", "file": "../sigma/rules/windows/builtin/windefend/win_defender_asr_lsass_access.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "91903aba-1088-42ee-b680-d6d94fe002b0", "title": "Windows Defender Submit Sample Feature Disabled", "file": "../sigma/rules/windows/builtin/windefend/win_defender_config_change_sample_submission_consent.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "49e5bc24-8b86-49f1-b743-535f332c2856", "title": "Microsoft Defender Tamper Protection Trigger", "file": "../sigma/rules/windows/builtin/windefend/win_defender_tamper_protection_trigger.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "57b649ef-ff42-4fb0-8bf6-62da243a1708", "title": "Windows Defender Threat Detected", "file": "../sigma/rules/windows/builtin/windefend/win_defender_threat.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "97b9ce1e-c5ab-11ea-87d0-0242ac130003", "title": "PSExec and WMI Process Creations Block", "file": "../sigma/rules/windows/builtin/windefend/win_defender_asr_psexec_wmi.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "ea9bf0fa-edec-4fb8-8b78-b119f2528186", "title": "Windows Defender AMSI Trigger Detected", "file": "../sigma/rules/windows/builtin/windefend/win_defender_malware_detected_amsi_source.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "a3ab73f1-bd46-4319-8f06-4b20d0617886", "title": "Windows Defender Exploit Guard Tamper", "file": "../sigma/rules/windows/builtin/windefend/win_defender_config_change_exploit_guard_tamper.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "801bd44f-ceed-4eb6-887c-11544633c0aa", "title": "Windows Defender Configuration Changes", "file": "../sigma/rules/windows/builtin/windefend/win_defender_suspicious_features_tampering.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "bc275be9-0bec-4d77-8c8f-281a2df6710f", "title": "Windows Defender Malware And PUA Scanning Disabled", "file": "../sigma/rules/windows/builtin/windefend/win_defender_malware_and_pua_scan_disabled.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "bc92ca75-cd42-4d61-9a37-9d5aa259c88b", "title": "Win Defender Restored Quarantine File", "file": "../sigma/rules/windows/builtin/windefend/win_defender_restored_quarantine_file.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1321dc4e-a1fe-481d-a016-52c45f0c8b4f", "title": "Windows Defender Exclusions Added", "file": "../sigma/rules/windows/builtin/windefend/win_defender_config_change_exclusion_added.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "401e5d00-b944-11ea-8f9a-00163ecd60ae", "title": "File Was Not Allowed To Run", "file": "../sigma/rules/windows/builtin/applocker/win_applocker_file_was_not_allowed_to_run.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781", "title": "OpenSSH Server Listening On Socket", "file": "../sigma/rules/windows/builtin/openssh/win_sshd_openssh_server_listening_on_socket.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "9e3cb244-bdb8-4632-8c90-6079c8f4f16d", "title": "Important Scheduled Task Deleted", "file": "../sigma/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "424273ea-7cf8-43a6-b712-375f925e481f", "title": "Scheduled Task Executed From A Suspicious Location", "file": "../sigma/rules/windows/builtin/taskscheduler/win_taskscheduler_execution_from_susp_locations.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "f0767f15-0fb3-44b9-851e-e8d9a6d0005d", "title": "Scheduled Task Executed Uncommon LOLBIN", "file": "../sigma/rules/windows/builtin/taskscheduler/win_taskscheduler_lolbin_execution_via_task_scheduler.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "d29a20b2-be4b-4827-81f2-3d8a59eab5fc", "title": "Sysinternals Tools AppX Versions Execution", "file": "../sigma/rules/windows/builtin/appmodel_runtime/win_appmodel_runtime_sysinternals_tools_appx_execution.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "8e5c03fa-b7f0-11ea-b242-07e0576828d9", "title": "Denied Access To Remote Desktop", "file": "../sigma/rules/windows/builtin/security/win_security_not_allowed_rdp_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "f7644214-0eb0-4ace-9455-331ec4c09253", "title": "Kerberos Manipulation", "file": "../sigma/rules/windows/builtin/security/win_security_susp_kerberos_manipulation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "586a8d6b-6bfe-4ad9-9d78-888cd2fe50c3", "title": "Remote Service Activity via SVCCTL Named Pipe", "file": "../sigma/rules/windows/builtin/security/win_security_svcctl_remote_service.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "dcf2db1f-f091-425b-a821-c05875b8925a", "title": "Invoke-Obfuscation VAR+ Launcher - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_var_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc", "title": "Sysmon Channel Reference Deletion", "file": "../sigma/rules/windows/builtin/security/win_security_sysmon_channel_reference_deletion.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "f6de9536-0441-4b3f-a646-f4e00f300ffd", "title": "Weak Encryption Enabled and Kerberoast", "file": "../sigma/rules/windows/builtin/security/win_security_alert_enable_weak_encryption.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "571498c8-908e-40b4-910b-d2369159a3da", "title": "Password Protected ZIP File Opened (Email Attachment)", "file": "../sigma/rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_outlook.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "7a922f1b-2635-4d6c-91ef-af228b198ad3", "title": "Invoke-Obfuscation COMPRESS OBFUSCATION - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_via_compress_services_security.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "f241cf1b-3a6b-4e1a-b4f9-133c00dd95ca", "title": "Invoke-Obfuscation RUNDLL LAUNCHER - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_via_rundll_services_security.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "54f0434b-726f-48a1-b2aa-067df14516e4", "title": "Password Protected ZIP File Opened (Suspicious Filenames)", "file": "../sigma/rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_filename.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "311b6ce2-7890-4383-a8c2-663a9f6b43cd", "title": "Enabled User Right in AD to Control User Objects", "file": "../sigma/rules/windows/builtin/security/win_security_alert_active_directory_user_control.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "12ba6a38-adb3-4d6b-91ba-a7fb248e3199", "title": "Password Policy Enumerated", "file": "../sigma/rules/windows/builtin/security/win_security_password_policy_enumerated.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "dae8171c-5ec6-4396-b210-8466585b53e9", "title": "SCM Database Privileged Operation", "file": "../sigma/rules/windows/builtin/security/win_security_scm_database_privileged_operation.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "0badd08f-c6a3-4630-90d3-6875cca440be", "title": "User Logoff Event", "file": "../sigma/rules/windows/builtin/security/win_security_user_logoff.yml", "status": "test", "level": "informational", "logsource.category": null, "logsource.product": "windows"}, {"id": "1a0a2ff1-611b-4dac-8216-8a7b47c618a6", "title": "Invoke-Obfuscation Via Use Clip - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_clip_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "098d7118-55bc-4912-a836-dc6483a8d150", "title": "Access To ADMIN$ Network Share", "file": "../sigma/rules/windows/builtin/security/win_security_admin_share_access.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "80b708f3-d034-40e4-a6c8-d23b7a7db3d1", "title": "Invoke-Obfuscation Via Stdin - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_via_stdin_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "ff151c33-45fa-475d-af4f-c2f93571f4fe", "title": "Azure AD Health Monitoring Agent Registry Keys Access", "file": "../sigma/rules/windows/builtin/security/win_security_aadhealth_mon_agent_regkey_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "496a0e47-0a33-4dca-b009-9e6ca3591f39", "title": "Suspicious Kerberos RC4 Ticket Encryption", "file": "../sigma/rules/windows/builtin/security/win_security_susp_rc4_kerberos.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "45545954-4016-43c6-855e-eae8f1c369dc", "title": "Protected Storage Service Access", "file": "../sigma/rules/windows/builtin/security/win_security_protected_storage_service_access.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "6fb63b40-e02a-403e-9ffd-3bcc1d749442", "title": "Metasploit Or Impacket Service Installation Via SMB PsExec", "file": "../sigma/rules/windows/builtin/security/win_security_metasploit_or_impacket_smb_psexec_service_install.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "4c54ba8f-73d2-4d40-8890-d9cf1dca3d30", "title": "Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_via_var_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "a4c90ea1-2634-4ca0-adbb-35eae169b6fc", "title": "ETW Logging Disabled In .NET Processes - Registry", "file": "../sigma/rules/windows/builtin/security/win_security_dot_net_etw_tamper.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1d2ab8ac-1a01-423b-9c39-001510eae8e8", "title": "Azure AD Health Service Agents Registry Keys Access", "file": "../sigma/rules/windows/builtin/security/win_security_aadhealth_svc_agent_regkey_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "faa031b5-21ed-4e02-8881-2591f98d82ed", "title": "Unauthorized System Time Modification", "file": "../sigma/rules/windows/builtin/security/win_security_susp_time_modification.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "214e8f95-100a-4e04-bb31-ef6cba8ce07e", "title": "DCERPC SMB Spoolss Named Pipe", "file": "../sigma/rules/windows/builtin/security/win_security_dce_rpc_smb_spoolss_named_pipe.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "98054878-5eab-434c-85d4-72d4e5a3361b", "title": "HackTool - EDRSilencer Execution - Filter Added", "file": "../sigma/rules/windows/builtin/security/win_security_hktl_edr_silencer.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "ecbc5e16-58e0-4521-9c60-eb9a7ea4ad34", "title": "Meterpreter or Cobalt Strike Getsystem Service Installation - Security", "file": "../sigma/rules/windows/builtin/security/win_security_meterpreter_or_cobaltstrike_getsystem_service_install.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "f8748f2c-89dc-4d95-afb0-5a2dfdbad332", "title": "SAM Registry Hive Handle Request", "file": "../sigma/rules/windows/builtin/security/win_security_sam_registry_hive_handle_request.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "f63508a0-c809-4435-b3be-ed819394d612", "title": "Potential Privileged System Service Operation - SeLoadDriverPrivilege", "file": "../sigma/rules/windows/builtin/security/win_security_user_driver_loaded.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "a33f8808-2812-4373-ae95-8cfb82134978", "title": "Windows Defender Exclusion Deleted", "file": "../sigma/rules/windows/builtin/security/win_security_windows_defender_exclusions_write_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "24549159-ac1b-479c-8175-d42aea947cae", "title": "Hacktool Ruler", "file": "../sigma/rules/windows/builtin/security/win_security_alert_ruler.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "ab6bffca-beff-4baa-af11-6733f296d57a", "title": "Potential AD User Enumeration From Non-Machine Account", "file": "../sigma/rules/windows/builtin/security/win_security_ad_user_enumeration.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "f0d1feba-4344-4ca9-8121-a6c97bd6df52", "title": "Credential Dumping Tools Service Execution - Security", "file": "../sigma/rules/windows/builtin/security/win_security_mal_creddumper.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "53ad8e36-f573-46bf-97e4-15ba5bf4bb51", "title": "Password Change on Directory Service Restore Mode (DSRM) Account", "file": "../sigma/rules/windows/builtin/security/win_security_susp_dsrm_password_change.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "11d00fff-5dc3-428c-8184-801f292faec0", "title": "Service Registry Key Read Access Request", "file": "../sigma/rules/windows/builtin/security/win_security_registry_permissions_weakness_check.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "c462f537-a1e3-41a6-b5fc-b2c2cef9bf82", "title": "Suspicious PsExec Execution", "file": "../sigma/rules/windows/builtin/security/win_security_susp_psexec.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "46a68649-f218-4f86-aea1-16a759d81820", "title": "Windows Defender Exclusion List Modified", "file": "../sigma/rules/windows/builtin/security/win_security_windows_defender_exclusions_registry_modified.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "e9c8808f-4cfb-4ba9-97d4-e5f3beaa244d", "title": "Windows Defender Exclusion Registry Key - Write Access Requested", "file": "../sigma/rules/windows/builtin/security/win_security_windows_defender_exclusions_write_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "35bc7e28-ee6b-492f-ab04-da58fcf6402e", "title": "Windows Network Access Suspicious desktop.ini Action", "file": "../sigma/rules/windows/builtin/security/win_security_net_share_obj_susp_desktop_ini.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "1c480e10-7ee1-46d4-8ed2-85f9789e3ce4", "title": "Group Policy Abuse for Privilege Addition", "file": "../sigma/rules/windows/builtin/security/win_security_susp_group_policy_abuse_privilege_addition.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "c9eb55c3-b468-40ab-9089-db2862e42137", "title": "Device Installation Blocked", "file": "../sigma/rules/windows/builtin/security/win_security_device_installation_blocked.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "0c718a5e-4284-4fb9-b4d9-b9a50b3a1974", "title": "Invoke-Obfuscation STDIN+ Launcher - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_stdin_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "941e5c45-cda7-4864-8cea-bbb7458d194a", "title": "Suspicious Remote Logon with Explicit Credentials", "file": "../sigma/rules/windows/builtin/security/win_security_susp_logon_explicit_credentials.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "470ec5fa-7b4e-4071-b200-4c753100f49b", "title": "Failed Code Integrity Checks", "file": "../sigma/rules/windows/builtin/security/win_security_codeintegrity_check_failure.yml", "status": "stable", "level": "informational", "logsource.category": null, "logsource.product": "windows"}, {"id": "aa1697b7-d611-4f9a-9cb2-5125b4ccfd5c", "title": "Password Dumper Activity on LSASS", "file": "../sigma/rules/windows/builtin/security/win_security_susp_lsass_dump.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "7b687634-ab20-11ea-bb37-0242ac130002", "title": "Windows Pcap Drivers", "file": "../sigma/rules/windows/builtin/security/win_security_pcap_drivers.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "12e6d621-194f-4f59-90cc-1959e21e69f7", "title": "Register new Logon Process by Rubeus", "file": "../sigma/rules/windows/builtin/security/win_security_register_new_logon_process_by_rubeus.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "35ba1d85-724d-42a3-889f-2e2362bcaf23", "title": "AD Privileged Users or Groups Reconnaissance", "file": "../sigma/rules/windows/builtin/security/win_security_account_discovery.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "123e4e6d-b123-48f8-b261-7214938acaf0", "title": "Startup/Logon Script Added to Group Policy Object", "file": "../sigma/rules/windows/builtin/security/win_security_susp_group_policy_startup_script_added_to_gpo.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "9eb99343-d336-4020-a3cd-67f3819e68ee", "title": "Account Tampering - Suspicious Failed Logon Reasons", "file": "../sigma/rules/windows/builtin/security/win_security_susp_failed_logon_reasons.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "f6de6525-4509-495a-8a82-1f8b0ed73a00", "title": "Remote Task Creation via ATSVC Named Pipe", "file": "../sigma/rules/windows/builtin/security/win_security_atsvc_task.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "910ab938-668b-401b-b08c-b596e80fdca5", "title": "Transferring Files with Credential Data via Network Shares", "file": "../sigma/rules/windows/builtin/security/win_security_transf_files_with_cred_data_via_network_shares.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "4edf51e1-cb83-4e1a-bc39-800e396068e3", "title": "Invoke-Obfuscation CLIP+ Launcher - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_clip_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "2632954e-db1c-49cb-9936-67d1ef1d17d2", "title": "Addition of SID History to Active Directory Object", "file": "../sigma/rules/windows/builtin/security/win_security_susp_add_sid_history.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "300bac00-e041-4ee2-9c36-e262656a6ecc", "title": "Active Directory User Backdoors", "file": "../sigma/rules/windows/builtin/security/win_security_alert_ad_user_backdoors.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "9b8d9203-4e0f-4cd9-bb06-4cc4ea6d0e9a", "title": "Invoke-Obfuscation Via Use MSHTA - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_mshta_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "66b6be3d-55d0-4f47-9855-d69df21740ea", "title": "Local User Creation", "file": "../sigma/rules/windows/builtin/security/win_security_user_creation.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "8cd538a4-62d5-4e83-810b-12d41e428d6e", "title": "Processes Accessing the Microphone and Webcam", "file": "../sigma/rules/windows/builtin/security/win_security_camera_microphone_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "c265cf08-3f99-46c1-8d59-328247057d57", "title": "User Added to Local Administrator Group", "file": "../sigma/rules/windows/builtin/security/win_security_user_added_to_local_administrators.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "bfbd3291-de87-4b7c-88a2-d6a5deb28668", "title": "ADCS Certificate Template Configuration Vulnerability with Risky EKU", "file": "../sigma/rules/windows/builtin/security/win_security_adcs_certificate_template_configuration_vulnerability_eku.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "028c7842-4243-41cd-be6f-12f3cf1a26c7", "title": "AD Object WriteDAC Access", "file": "../sigma/rules/windows/builtin/security/win_security_ad_object_writedac_access.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "3a734d25-df5c-4b99-8034-af1ddb5883a4", "title": "Suspicious Scheduled Task Creation", "file": "../sigma/rules/windows/builtin/security/win_security_susp_scheduled_task_creation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "d7a95147-145f-4678-b85d-d1ff4a3bb3f6", "title": "CobaltStrike Service Installations - Security", "file": "../sigma/rules/windows/builtin/security/win_security_cobaltstrike_service_installs.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "f598ea0c-c25a-4f72-a219-50c44411c791", "title": "Possible Shadow Credentials Added", "file": "../sigma/rules/windows/builtin/security/win_security_susp_possible_shadow_credentials_added.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "6daac7fc-77d1-449a-a71a-e6b4d59a0e54", "title": "User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'", "file": "../sigma/rules/windows/builtin/security/win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "13addce7-47b2-4ca0-a98f-1de964d1d669", "title": "SCM Database Handle Failure", "file": "../sigma/rules/windows/builtin/security/win_security_scm_database_handle_failure.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "6a53d871-682d-40b6-83e0-b7c1a6c4e3a5", "title": "PetitPotam Suspicious Kerberos TGT Request", "file": "../sigma/rules/windows/builtin/security/win_security_petitpotam_susp_tgt_request.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "5bed80b6-b3e8-428e-a3ae-d3c757589e41", "title": "RDP over Reverse SSH Tunnel WFP", "file": "../sigma/rules/windows/builtin/security/win_security_rdp_reverse_tunnel.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "13acf386-b8c6-4fe0-9a6e-c4756b974698", "title": "Remote PowerShell Sessions Network Connections (WinRM)", "file": "../sigma/rules/windows/builtin/security/win_security_remote_powershell_session.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "c8b00925-926c-47e3-beea-298fd563728e", "title": "Remote Access Tool Services Have Been Installed - Security", "file": "../sigma/rules/windows/builtin/security/win_security_service_install_remote_access_software.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "d04ae2b8-ad54-4de0-bd87-4bc1da66aa59", "title": "Kerberoasting Activity - Initial Query", "file": "../sigma/rules/windows/builtin/security/win_security_kerberoasting_activity.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "7b14c76a-c602-4ae6-9717-eff868153fc0", "title": "HackTool - NoFilter Execution", "file": "../sigma/rules/windows/builtin/security/win_security_hktl_nofilter.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "39698b3f-da92-4bc6-bfb5-645a98386e45", "title": "Win Susp Computer Name Containing Samtheadmin", "file": "../sigma/rules/windows/builtin/security/win_security_susp_computer_name.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "32e19d25-4aed-4860-a55a-be99cb0bf7ed", "title": "Possible DC Shadow Attack", "file": "../sigma/rules/windows/builtin/security/win_security_possible_dc_shadow.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "d3abac66-f11c-4ed0-8acb-50cc29c97eed", "title": "NetNTLM Downgrade Attack", "file": "../sigma/rules/windows/builtin/security/win_security_net_ntlm_downgrade.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "91c945bc-2ad1-4799-a591-4d00198a1215", "title": "Suspicious Access to Sensitive File Extensions", "file": "../sigma/rules/windows/builtin/security/win_security_susp_raccess_sensitive_fext.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "17d619c1-e020-4347-957e-1d1207455c93", "title": "Active Directory Replication from Non Machine Account", "file": "../sigma/rules/windows/builtin/security/win_security_ad_replication_non_machine_account.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "2a926e6a-4b81-4011-8a96-e36cc8c04302", "title": "PowerShell Scripts Installed as Services - Security", "file": "../sigma/rules/windows/builtin/security/win_security_powershell_script_installed_as_service.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1bbf25b9-8038-4154-a50b-118f2a32be27", "title": "Suspicious Windows ANONYMOUS LOGON Local Account Created", "file": "../sigma/rules/windows/builtin/security/win_security_susp_local_anon_logon_created.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "0ee4d8a5-4e67-4faf-acfa-62a78457d1f2", "title": "HybridConnectionManager Service Installation", "file": "../sigma/rules/windows/builtin/security/win_security_hybridconnectionmgr_svc_installation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "2c99737c-585d-4431-b61a-c911d86ff32f", "title": "Powerview Add-DomainObjectAcl DCSync AD Extend Right", "file": "../sigma/rules/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "c39f0c81-7348-4965-ab27-2fde35a1b641", "title": "DCOM InternetExplorer.Application Iertutil DLL Hijack - Security", "file": "../sigma/rules/windows/builtin/security/win_security_dcom_iertutil_dll_hijack.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "4ac1f50b-3bd0-4968-902d-868b4647937e", "title": "DPAPI Domain Backup Key Extraction", "file": "../sigma/rules/windows/builtin/security/win_security_dpapi_domain_backupkey_extraction.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "411742ad-89b0-49cb-a7b0-3971b5c1e0a4", "title": "Locked Workstation", "file": "../sigma/rules/windows/builtin/security/win_security_workstation_was_locked.yml", "status": "stable", "level": "informational", "logsource.category": null, "logsource.product": "windows"}, {"id": "25cde13e-8e20-4c29-b949-4e795b76f16f", "title": "Suspicious Teams Application Related ObjectAcess Event", "file": "../sigma/rules/windows/builtin/security/win_security_teams_suspicious_objectaccess.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "69aeb277-f15f-4d2d-b32a-55e883609563", "title": "Windows Event Auditing Disabled", "file": "../sigma/rules/windows/builtin/security/win_security_disable_event_auditing.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "cfeed607-6aa4-4bbd-9627-b637deb723c8", "title": "New or Renamed User Account with '$' Character", "file": "../sigma/rules/windows/builtin/security/win_security_new_or_renamed_user_account_with_dollar_sign.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "eca91c7c-9214-47b9-b4c5-cb1d7e4f2350", "title": "Uncommon Outbound Kerberos Connection - Security", "file": "../sigma/rules/windows/builtin/security/win_security_susp_outbound_kerberos_connection.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "9c8afa4d-0022-48f0-9456-3712466f9701", "title": "Tap Driver Installation - Security", "file": "../sigma/rules/windows/builtin/security/win_security_tap_driver_installation.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "39a80702-d7ca-4a83-b776-525b1f86a36d", "title": "Secure Deletion with SDelete", "file": "../sigma/rules/windows/builtin/security/win_security_susp_sdelete.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "f69a87ea-955e-4fb4-adb2-bb9fd6685632", "title": "External Disk Drive Or USB Storage Device Was Recognized By The System", "file": "../sigma/rules/windows/builtin/security/win_security_external_device.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "9a4ff3b8-6187-4fd2-8e8b-e0eae1129495", "title": "SysKey Registry Keys Access", "file": "../sigma/rules/windows/builtin/security/win_security_syskey_registry_access.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "72124974-a68b-4366-b990-d30e0b2a190d", "title": "Metasploit SMB Authentication", "file": "../sigma/rules/windows/builtin/security/win_security_metasploit_authentication.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "d00a9a72-2c09-4459-ad03-5e0a23351e36", "title": "Suspicious LDAP-Attributes Used", "file": "../sigma/rules/windows/builtin/security/win_security_susp_ldap_dataexchange.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "32d56ea1-417f-44ff-822b-882873f5f43b", "title": "Impacket PsExec Execution", "file": "../sigma/rules/windows/builtin/security/win_security_impacket_psexec.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76", "title": "Potentially Suspicious AccessMask Requested From LSASS", "file": "../sigma/rules/windows/builtin/security/win_security_susp_lsass_dump_generic.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "20d96d95-5a20-4cf1-a483-f3bda8a7c037", "title": "Add or Remove Computer from DC", "file": "../sigma/rules/windows/builtin/security/win_security_add_remove_computer.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "f6c68d5f-e101-4b86-8c84-7d96851fd65c", "title": "T1047 Wmiprvse Wbemcomn DLL Hijack", "file": "../sigma/rules/windows/builtin/security/win_security_wmiprvse_wbemcomn_dll_hijack.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "968eef52-9cff-4454-8992-1e74b9cbad6c", "title": "Reconnaissance Activity", "file": "../sigma/rules/windows/builtin/security/win_security_susp_net_recon_activity.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "a8f29a7b-b137-4446-80a0-b804272f3da2", "title": "Persistence and Execution at Scale via GPO Scheduled Task", "file": "../sigma/rules/windows/builtin/security/win_security_gpo_scheduledtasks.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "39a94fd1-8c9a-4ff6-bf22-c058762f8014", "title": "DPAPI Domain Master Key Backup Attempt", "file": "../sigma/rules/windows/builtin/security/win_security_dpapi_domain_masterkey_backup_attempt.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "00ba9da1-b510-4f6b-b258-8d338836180f", "title": "Password Protected ZIP File Opened", "file": "../sigma/rules/windows/builtin/security/win_security_susp_opened_encrypted_zip.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "5ee3a654-372f-11ec-8d3d-0242ac130003", "title": "ADCS Certificate Template Configuration Vulnerability", "file": "../sigma/rules/windows/builtin/security/win_security_adcs_certificate_template_configuration_vulnerability.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "611eab06-a145-4dfa-a295-3ccc5c20f59a", "title": "Mimikatz DC Sync", "file": "../sigma/rules/windows/builtin/security/win_security_dcsync.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "cd0f7229-d16f-42de-8fe3-fba365fbcb3a", "title": "Invoke-Obfuscation Via Use Rundll32 - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_rundll32_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "7595ba94-cf3b-4471-aa03-4f6baa9e5fad", "title": "Important Scheduled Task Deleted/Disabled", "file": "../sigma/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "962fe167-e48d-4fd6-9974-11e5b9a5d6d1", "title": "LSASS Access From Non System Account", "file": "../sigma/rules/windows/builtin/security/win_security_lsass_access_non_system_account.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "c4e92a97-a9ff-4392-9d2d-7a4c642768ca", "title": "Service Installed By Unusual Client - Security", "file": "../sigma/rules/windows/builtin/security/win_security_service_installation_by_unusal_client.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "52d8b0c6-53d6-439a-9e41-52ad442ad9ad", "title": "First Time Seen Remote Named Pipe", "file": "../sigma/rules/windows/builtin/security/win_security_lm_namedpipe.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "614cf376-6651-47c4-9dcc-6b9527f749f4", "title": "Suspicious Scheduled Task Update", "file": "../sigma/rules/windows/builtin/security/win_security_susp_scheduled_task_update.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "0255a820-e564-4e40-af2b-6ac61160335c", "title": "A New Trust Was Created To A Domain", "file": "../sigma/rules/windows/builtin/security/win_security_susp_add_domain_trust.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "b210394c-ba12-4f89-9117-44a2464b9511", "title": "SMB Create Remote File Admin Share", "file": "../sigma/rules/windows/builtin/security/win_security_smb_file_creation_admin_shares.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "e9faba72-4974-4ab2-a4c5-46e25ad59e9b", "title": "VSSAudit Security Event Source Registration", "file": "../sigma/rules/windows/builtin/security/win_security_vssaudit_secevent_source_registration.yml", "status": "test", "level": "informational", "logsource.category": null, "logsource.product": "windows"}, {"id": "ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1", "title": "Important Windows Event Auditing Disabled", "file": "../sigma/rules/windows/builtin/security/win_security_disable_event_auditing_critical.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1de68c67-af5c-4097-9c85-fe5578e09e67", "title": "WCE wceaux.dll Access", "file": "../sigma/rules/windows/builtin/security/win_security_mal_wceaux_dll.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "fd0f5778-d3cb-4c9a-9695-66759d04702a", "title": "Invoke-Obfuscation Obfuscated IEX Invocation - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_obfuscated_iex_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "f033f3f3-fd24-4995-97d8-a3bb17550a88", "title": "WMI Persistence - Security", "file": "../sigma/rules/windows/builtin/security/win_security_wmi_persistence.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "7b449a5e-1db5-4dd0-a2dc-4e3a67282538", "title": "Hidden Local User Creation", "file": "../sigma/rules/windows/builtin/security/win_security_hidden_user_creation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "d99b79d2-0a6f-4f46-ad8b-260b6e17f982", "title": "Security Eventlog Cleared", "file": "../sigma/rules/windows/builtin/security/win_security_audit_log_cleared.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "5a44727c-3b85-4713-8c44-4401d5499629", "title": "Replay Attack Detected", "file": "../sigma/rules/windows/builtin/security/win_security_replay_attack_detected.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "252902e3-5830-4cf6-bf21-c22083dfd5cf", "title": "Possible Impacket SecretDump Remote Activity", "file": "../sigma/rules/windows/builtin/security/win_security_impacket_secretdump.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1ce8c8a3-2723-48ed-8246-906ac91061a6", "title": "Possible PetitPotam Coerce Authentication Attempt", "file": "../sigma/rules/windows/builtin/security/win_security_petitpotam_network_share.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "0248a7bc-8a9a-4cd8-a57e-3ae8e073a073", "title": "ISO Image Mounted", "file": "../sigma/rules/windows/builtin/security/win_security_iso_mount.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "f88e112a-21aa-44bd-9b01-6ee2a2bbbed1", "title": "Failed Logon From Public IP", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_susp_failed_logon_source.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "8eef149c-bd26-49f2-9e5a-9b00e3af499b", "title": "Pass the Hash Activity 2", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_pass_the_hash_2.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "02c39d30-02b5-45d2-b435-8aebfe5a8629", "title": "A Member Was Removed From a Security-Enabled Global Group", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_member_removed_security_enabled_global_group.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "def8b624-e08f-4ae1-8612-1ba21190da6b", "title": "Outgoing Logon with New Credentials", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_susp_logon_newcredentials.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "0f63e1ef-1eb9-4226-9d54-8927ca08520a", "title": "Admin User Remote Logon", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_admin_rdp_login.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "192a0330-c20b-4356-90b6-7b7049ae0b87", "title": "Successful Overpass the Hash Attempt", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_overpass_the_hash.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "259a9cdf-c4dd-4fa2-b243-2269e5ab18a2", "title": "External Remote RDP Logon from Public IP", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_successful_external_remote_rdp_login.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "8400629e-79a9-4737-b387-5db940ab2367", "title": "Scanner PoC for CVE-2019-0708 RDP RCE Vuln", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_rdp_bluekeep_poc_scanner.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "16f5d8ca-44bd-47c8-acbe-6fc95a16c12f", "title": "RottenPotato Like Attack Pattern", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_susp_rottenpotato.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "51e33403-2a37-4d66-a574-1fda1782cc31", "title": "RDP Login from Localhost", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_rdp_localhost_login.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "c43c26be-2e87-46c7-8661-284588c5a53e", "title": "A Member Was Added to a Security-Enabled Global Group", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_member_added_security_enabled_global_group.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "b237c54b-0f15-4612-a819-44b735e0de27", "title": "A Security-Enabled Global Group Was Deleted", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_security_enabled_global_group_deleted.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "02f7c9c1-1ae8-4c6a-8add-04693807f92f", "title": "Potential Access Token Abuse", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_access_token_abuse.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "749c9f5e-b353-4b90-a9c1-05243357ca4b", "title": "Potential Privilege Escalation via Local Kerberos Relay over LDAP", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_susp_privesc_kerberos_relay_over_ldap.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "2111118f-7e46-4fc8-974a-59fd8ec95196", "title": "DiagTrackEoP Default Login Username", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_diagtrack_eop_default_login_username.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "78d5cab4-557e-454f-9fb9-a222bd0d5edc", "title": "External Remote SMB Logon from Public IP", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "5af54681-df95-4c26-854f-2565e13cfab0", "title": "Successful Account Login Via WMI", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_susp_wmi_login.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "bacf58c6-e199-4040-a94f-95dea0f1e45a", "title": "Windows Filtering Platform Blocked Connection From EDR Agent Binary", "file": "../sigma/rules/windows/builtin/security/object_access/win_security_wfp_endpoint_agent_blocked.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "dd857d3e-0c6e-457b-9b48-e82ae7f86bd7", "title": "New Module Module Added To IIS Server", "file": "../sigma/rules/windows/builtin/iis-configuration/win_iis_module_added.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f", "title": "Previously Installed IIS Module Was Removed", "file": "../sigma/rules/windows/builtin/iis-configuration/win_iis_module_removed.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "e8ebd53a-30c2-45bd-81bb-74befba07bdb", "title": "HTTP Logging Disabled On IIS Server", "file": "../sigma/rules/windows/builtin/iis-configuration/win_iis_logging_http_disabled.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "a5b40a90-baf5-4bf7-a6f7-373494881d22", "title": "ETW Logging/Processing Option Disabled On IIS Server", "file": "../sigma/rules/windows/builtin/iis-configuration/win_iis_logging_etw_disabled.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "64d51a51-32a6-49f0-9f3d-17e34d640272", "title": "Ngrok Usage with Remote Desktop Service", "file": "../sigma/rules/windows/builtin/terminalservices/win_terminalservices_rdp_ngrok.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1a4bd6e3-4c6e-405d-a9a3-53a116e341d4", "title": "USB Device Plugged", "file": "../sigma/rules/windows/builtin/driverframeworks/win_usb_device_plugged.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "0b7889b4-5577-4521-a60a-3376ee7f9f7b", "title": "WMI Persistence", "file": "../sigma/rules/windows/builtin/wmi/win_wmi_persistence.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "b5aa7d60-c17e-4538-97de-09029d6cd76b", "title": "Suspicious Digital Signature Of AppX Package", "file": "../sigma/rules/windows/builtin/appxpackaging_om/win_appxpackaging_om_sups_appx_signature.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "50cb47b8-2c33-4b23-a2e9-4600657d9746", "title": "Loading Diagcab Package From Remote Path", "file": "../sigma/rules/windows/builtin/diagnosis/scripted/win_diagnosis_scripted_load_remote_diagcab.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "0d18728b-f5bf-4381-9dcf-915539fff6c2", "title": "Suspicious Cobalt Strike DNS Beaconing - DNS Client", "file": "../sigma/rules/windows/builtin/dns_client/win_dns_client__mal_cobaltstrike.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "66474410-b883-415f-9f8d-75345a0a66a6", "title": "DNS Query To MEGA Hosting Website - DNS Client", "file": "../sigma/rules/windows/builtin/dns_client/win_dns_client_mega_nz.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "29f171d7-aa47-42c7-9c7b-3c87938164d9", "title": "DNS Query for Anonfiles.com Domain - DNS Client", "file": "../sigma/rules/windows/builtin/dns_client/win_dns_client_anonymfiles_com.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "8b69fd42-9dad-4674-abef-7fdef43ef92a", "title": "DNS Query To Put.io - DNS Client", "file": "../sigma/rules/windows/builtin/dns_client/win_dns_client_put_io.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "090ffaad-c01a-4879-850c-6d57da98452d", "title": "DNS Query To Ufile.io - DNS Client", "file": "../sigma/rules/windows/builtin/dns_client/win_dns_client_ufile_io.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "8384bd26-bde6-4da9-8e5d-4174a7a47ca2", "title": "Query Tor Onion Address - DNS Client", "file": "../sigma/rules/windows/builtin/dns_client/win_dns_client_tor_onion.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "6f156c48-3894-4952-baf0-16193e9067d2", "title": "CodeIntegrity - Blocked Image Load With Revoked Certificate", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_image_blocked.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "881b7725-47cc-4055-8000-425823344c59", "title": "CodeIntegrity - Revoked Image Loaded", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_image_loaded.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "e4be5675-4a53-426a-8c81-a8bb2387e947", "title": "CodeIntegrity - Blocked Image/Driver Load For Policy Violation", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_enforced_policy_block.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "9b72b82d-f1c5-4632-b589-187159bc6ec1", "title": "CodeIntegrity - Blocked Driver Load With Revoked Certificate", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_blocked.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "320fccbf-5e32-4101-82b8-2679c5f007c6", "title": "CodeIntegrity - Revoked Kernel Driver Loaded", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_loaded.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "2f8cd7a0-9d5a-4f62-9f8b-2c951aa0dd1f", "title": "CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_whql_failure.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "c92c24e7-f595-493f-9c98-53d5142f5c18", "title": "CodeIntegrity - Unsigned Image Loaded", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_unsigned_image_loaded.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "f8931561-97f5-4c46-907f-0a4a592e47a7", "title": "CodeIntegrity - Unmet Signing Level Requirements By File Under Validation", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_attempted_dll_load.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "5daf11c3-022b-4969-adb9-365e6c078c7c", "title": "CodeIntegrity - Disallowed File For Protected Processes Has Been Blocked", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_blocked_protected_process_file.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "951f8d29-f2f6-48a7-859f-0673ff105e6f", "title": "CodeIntegrity - Unsigned Kernel Module Loaded", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_unsigned_driver_loaded.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "c4b890e5-8d8c-4496-8c66-c805753817cd", "title": "Potential Process Hollowing Activity", "file": "../sigma/rules/windows/process_tampering/proc_tampering_susp_process_hollowing.yml", "status": "test", "level": "medium", "logsource.category": "process_tampering", "logsource.product": "windows"}, {"id": "2e4e488a-6164-4811-9ea1-f960c7359c40", "title": "HackTool - CACTUSTORCH Remote Thread Creation", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_hktl_cactustorch.yml", "status": "test", "level": "high", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "66d31e5f-52d6-40a4-9615-002d3789a119", "title": "Remote Thread Creation By Uncommon Source Image", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_source_image.yml", "status": "experimental", "level": "medium", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "02d1d718-dd13-41af-989d-ea85c7fab93f", "title": "Rare Remote Thread Creation By Uncommon Source Image", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_susp_relevant_source_image.yml", "status": "experimental", "level": "high", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "99b97608-3e21-4bfe-8217-2a127c396a0e", "title": "Remote Thread Creation Via PowerShell In Uncommon Target", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_powershell_susp_targets.yml", "status": "test", "level": "medium", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "c15e99a3-c474-48ab-b9a7-84549a7a9d16", "title": "Remote Thread Creation Ttdinject.exe Proxy", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_ttdinjec.yml", "status": "test", "level": "high", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "a1a144b7-5c9b-4853-a559-2172be8d4a03", "title": "Remote Thread Creation In Uncommon Target Image", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_target_image.yml", "status": "experimental", "level": "medium", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "c0aac16a-b1e7-4330-bab0-3c27bb4987c7", "title": "Remote Thread Creation In Mstsc.Exe From Suspicious Location", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_mstsc_susp_location.yml", "status": "experimental", "level": "high", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f", "title": "Remote Thread Created In Shell Application", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_susp_target_shell_application.yml", "status": "experimental", "level": "medium", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "fb656378-f909-47c1-8747-278bf09f4f4f", "title": "Potential Credential Dumping Attempt Via PowerShell Remote Thread", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_powershell_lsass.yml", "status": "test", "level": "high", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "77564cc2-7382-438b-a7f6-395c2ae53b9a", "title": "Remote Thread Created In KeePass.EXE", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_keepass.yml", "status": "test", "level": "high", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "6309645e-122d-4c5b-bb2b-22e4f9c2fa42", "title": "HackTool - Potential CobaltStrike Process Injection", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_hktl_cobaltstrike.yml", "status": "test", "level": "high", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "f239b326-2f41-4d6b-9dfa-c846a60ef505", "title": "Password Dumper Remote Thread in LSASS", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_susp_password_dumper_lsass.yml", "status": "stable", "level": "high", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "caa06de8-fdef-4c91-826a-7f9e163eef4b", "title": "RunDLL32 Spawning Explorer", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_spawn_explorer.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "title": "Suspicious VBoxDrvInst.exe Parameters", "file": "../sigma/rules/windows/process_creation/proc_creation_win_virtualbox_vboxdrvinst_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "754ed792-634f-40ae-b3bc-e0448d33f695", "title": "Suspicious PowerShell Parent Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_susp_parent_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2158f96f-43c2-43cb-952a-ab4580f32382", "title": "Screen Capture Activity Via Psr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_psr_capture_screenshots.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "title": "Service Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_service.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d797268e-28a9-49a7-b9a8-2f5039011c5c", "title": "Bypass UAC via WSReset.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "title": "Suspicious Serv-U Process Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_servu_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f426547a-e0f7-441a-b63e-854ac5bdf54d", "title": "Perl Inline Command Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_perl_inline_command_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "title": "UAC Bypass Using Windows Media Player - Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_wmp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "title": "Audio Capture via PowerShell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_audio_capture.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6d3a3952-6530-44a3-8554-cf17c116c615", "title": "Potentially Suspicious JWT Token Search Via CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_jwt_token_search.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "title": "New Virtual Smart Card Created Via TpmVscMgr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_tpmvscmgr_add_virtual_smartcard.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4c0aaedc-154c-4427-ada0-d80ef9c9deb6", "title": "Process Access via TrolleyExpress Exclusion", "file": "../sigma/rules/windows/process_creation/proc_creation_win_citrix_trolleyexpress_procdump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "title": "Suspicious Download from Office Domain", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_download_office_domain.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a4824fca-976f-4964-b334-0621379e84c4", "title": "Potential File Overwrite Via Sysinternals SDelete", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_sdelete.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "title": "File Download And Execution Via IEExec.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ieexec_download.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "92a974db-ab84-457f-9ec0-55db83d7a825", "title": "Potential AMSI Bypass Using NULL Bits", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_amsi_null_bits_bypass.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f9578658-9e71-4711-b634-3f9b50cd3c06", "title": "Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_3.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "title": "Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_2.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "title": "Uncommon Link.EXE Parent Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_link_uncommon_parent_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "title": "XBAP Execution From Uncommon Locations Via PresentationHost.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_presentationhost_uncommon_location_exec.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "title": "UAC Bypass via Windows Firewall Snap-In Hijack", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_hijacking_firwall_snap_in.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f5240972-3938-4e56-8e4b-e33893176c1f", "title": "Suspicious Query of MachineGUID", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_machineguid.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fff9d2b7-e11c-4a69-93d3-40ef66189767", "title": "Suspicious Copy From or To System Directory", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_copy_system_dir.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cc9d3712-6310-4320-b2df-7cb408274d53", "title": "Rebuild Performance Counter Values Via Lodctr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lodctr_performance_counter_tampering.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "title": "Renamed PsExec Service Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_psexec_service.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "title": "HackTool - SharpChisel Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharp_chisel.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "327ff235-94eb-4f06-b9de-aaee571324be", "title": "Regsvr32 Execution From Highly Suspicious Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_susp_exec_path_2.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "42a993dd-bb3e-48c8-b372-4d6684c4106c", "title": "HackTool - CrackMapExec Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "title": "New User Created Via Net.EXE With Never Expire Option", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_user_add_never_expire.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "36210e0d-5b19-485d-a087-c096088885f0", "title": "Suspicious PowerShell Parameter Substring", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1723e720-616d-4ddc-ab02-f7e3685a4713", "title": "Rundll32 Spawned Via Explorer.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_parent_explorer.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "90fb5e62-ca1f-4e22-b42e-cc521874c938", "title": "Suspicious Shells Spawn by Java Utility Keytool", "file": "../sigma/rules/windows/process_creation/proc_creation_win_java_keytool_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "title": "Ruby Inline Command Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ruby_inline_command_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "57c4bf16-227f-4394-8ec7-1b745ee061c3", "title": "Firewall Disabled via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_fw_disable.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "title": "Suspicious Where Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_where_browser_data_recon.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0ea52357-cd59-4340-9981-c46c7e900428", "title": "Potentially Suspicious Rundll32.EXE Execution of UDL File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_udl_exec.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7aa7009a-28b9-4344-8c1f-159489a390df", "title": "HackTool - Windows Credential Editor (WCE) Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_wce.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "title": "MMC Spawning Windows Shell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9719a8aa-401c-41af-8108-ced7ec9cd75c", "title": "Windows Defender Definition Files Removed", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mpcmdrun_remove_windows_defender_definition.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "title": "Powershell Inline Execution From A File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_exec_data_file.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "title": "Time Travel Debugging Utility Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_tttracer_mod_load.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "title": "HackTool - Impersonate Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_impersonate.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "title": "Suspicious Splwow64 Without Params", "file": "../sigma/rules/windows/process_creation/proc_creation_win_splwow64_cli_anomaly.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "title": "Potential Script Proxy Execution Via CL_Mutexverifiers.ps1", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_cl_mutexverifiers.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "title": "Process Creation Using Sysnative Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_sysnative.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "title": "Suspicious Scheduled Task Creation Involving Temp Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_creation_temp_folder.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "145322e4-0fd3-486b-81ca-9addc75736d8", "title": "Use of UltraVNC Remote Access Software", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ultravnc.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "587254ee-a24b-4335-b3cd-065c0f1f4baa", "title": "Remote File Download Via Findstr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_download.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "98b53e78-ebaf-46f8-be06-421aafd176d9", "title": "HackTool - winPEAS Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_winpeas.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "title": "WMI Backdoor Exchange Transport Agent", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmi_backdoor_exchange_transport_agent.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b5746143-59d6-4603-8d06-acbd60e166ee", "title": "Uncommon Child Process Of AddinUtil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c09dad97-1c78-4f71-b127-7edb2b8e491a", "title": "Execution of Suspicious File Type Extension", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_non_exe_image.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "551d9c1f-816c-445b-a7a6-7a3864720d60", "title": "Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_excel_dcom_lateral_movement.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e31033fc-33f0-4020-9a16-faf9b31cbf08", "title": "PUA - Netcat Suspicious Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_netcat.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "title": "HackTool - UACMe Akagi Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_uacme.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "title": "Csc.EXE Execution Form Potentially Suspicious Parent", "file": "../sigma/rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "title": "Renamed ProcDump Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_procdump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "title": "Msiexec Quiet Installation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msiexec_install_quiet.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8e3c7994-131e-4ba5-b6ea-804d49113a26", "title": "Uncommon Child Process Spawned By Odbcconf.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_odbcconf_uncommon_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "title": "Remote CHM File Download/Execution Via HH.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hh_chm_remote_download_or_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e32d4572-9826-4738-b651-95fa63747e8a", "title": "Base64 Encoded PowerShell Command Detected", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_frombase64string.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "043c4b8b-3a54-4780-9682-081cb6b8185c", "title": "Suspicious IIS Module Registration", "file": "../sigma/rules/windows/process_creation/proc_creation_win_iis_susp_module_registration.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "title": "Potential Arbitrary Command Execution Via FTP.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ftp_arbitrary_command_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c363385c-f75d-4753-a108-c1a8e28bdbda", "title": "Potential Manage-bde.wsf Abuse To Proxy Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_manage_bde.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5cb299fc-5fb1-4d07-b989-0644c68b6043", "title": "Suspicious File Download From IP Via Curl.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_susp_extensions.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "title": "Exports Registry Key To a File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regedit_export_keys.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "811f459f-9231-45d4-959a-0266c6311987", "title": "Suspicious Child Process Of BgInfo.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bginfo_suspicious_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "title": "Uncommon Child Process Of Appvlp.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_appvlp_uncommon_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7d6d30b8-5b91-4b90-a891-46cccaf29598", "title": "Program Executed Using Proxy/Local Command Via SSH.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ssh_proxy_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "title": "Suspicious Workstation Locking via Rundll32", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_user32_dll.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "title": "Suspicious Parent Double Extension File Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_double_extension_parent.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "title": "File Decoded From Base64/Hex Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_decode.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "title": "Query Usage To Exfil Data", "file": "../sigma/rules/windows/process_creation/proc_creation_win_query_session_exfil.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "title": "Potential WinAPI Calls Via CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_inline_win_api_access.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "087790e3-3287-436c-bccf-cbd0184a7db1", "title": "Potential CommandLine Path Traversal Via Cmd.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_path_traversal.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "title": "HackTool - Bloodhound/Sharphound Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_bloodhound_sharphound.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6812a10b-60ea-420c-832f-dfcc33b646ba", "title": "Potential PowerShell Execution Via DLL", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_powershell_execution_via_dll.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "84b14121-9d14-416e-800b-f3b829c5a14d", "title": "Suspicious CustomShellHost Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_customshellhost.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "32e280f1-8ad4-46ef-9e80-910657611fbc", "title": "Potential Homoglyph Attack Using Lookalike Characters", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_homoglyph_cyrillic_lookalikes.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1444443e-6757-43e4-9ea4-c8fc705f79a2", "title": "Boot Configuration Tampering Via Bcdedit.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bcdedit_boot_conf_tamper.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "title": "Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bcdedit_susp_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "title": "7Zip Compressing Dump Files", "file": "../sigma/rules/windows/process_creation/proc_creation_win_7zip_exfil_dmp_files.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9cfc00b6-bfb7-49ce-9781-ef78503154bb", "title": "Wlrmdr.EXE Uncommon Argument Or Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wlrmdr_uncommon_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "title": "Winrar Compressing Dump Files", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winrar_exfil_dmp_files.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3f5491e2-8db8-496b-9e95-1029fce852d4", "title": "Driver/DLL Installation Via Odbcconf.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_odbcconf_driver_install.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "title": "Suspicious Execution From Outlook Temporary Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_outlook_execution_from_temp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "02030f2f-6199-49ec-b258-ea71b07e03dc", "title": "Malicious PowerShell Commandlets - ProcessCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_malicious_cmdlets.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "74403157-20f5-415d-89a7-c505779585cf", "title": "ConvertTo-SecureString Cmdlet Usage Via CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_cmdline_convertto_securestring.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "52ff7941-8211-46f9-84f8-9903efb7077d", "title": "HackTool - PPID Spoofing SelectMyParent Tool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_selectmyparent.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "title": "LSA PPL Protection Disabled Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_lsa_ppl_protection_disabled.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4d7cda18-1b12-4e52-b45c-d28653210df8", "title": "Sysmon Driver Unloaded Via Fltmc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_fltmc_unload_driver_sysmon.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "title": "Mavinject Inject DLL Into Running Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "title": "Service Registry Key Deleted Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_delete_services.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c9783e20-4793-4164-ba96-d9ee483992c4", "title": "Logged-On User Password Change Via Ksetup.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ksetup_password_change_user.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "title": "File Encryption Using Gpg4win", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gpg4win_encryption.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "title": "Potential RDP Tunneling Via Plink", "file": "../sigma/rules/windows/process_creation/proc_creation_win_plink_susp_tunneling.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "94771a71-ba41-4b6e-a757-b531372eaab6", "title": "File Download From Browser Process Via Inline URL", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_inline_file_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2f869d59-7f6a-4931-992c-cce556ff2d53", "title": "Potential Adplus.EXE Abuse", "file": "../sigma/rules/windows/process_creation/proc_creation_win_adplus_memory_dump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "title": "Suspicious AddinUtil.EXE CommandLine Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_addinutil_suspicious_cmdline.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "title": "Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dotnet_arbitrary_dll_csproj_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "title": "Suspicious Rundll32 Invoking Inline VBScript", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_inline_vbs.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "title": "File Download Via Bitsadmin To An Uncommon Target Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bitsadmin_download_uncommon_targetfolder.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "title": "Potential Download/Upload Activity Using Type Command", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_type_arbitrary_file_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1775e15e-b61b-4d14-a1a3-80981298085a", "title": "Rundll32 Execution Without CommandLine Parameters", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_no_params.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "title": "HackTool - Impacket Tools Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_impacket_tools.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "42b1a5b8-353f-4f10-b256-39de4467faff", "title": "Harvesting Of Wifi Credentials Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_wifi_credential_harvesting.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "title": "New Root Certificate Installed Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_certificate_installation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9292293b-8496-4715-9db6-37028dcda4b3", "title": "Replace.exe Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_replace.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b1876533-4ed5-4a83-90f3-b8645840a413", "title": "HackTool - SafetyKatz Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_safetykatz.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "52788a70-f1da-40dd-8fbd-73b5865d6568", "title": "JScript Compiler Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_jsc_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "349d891d-fef0-4fe4-bc53-eee623a15969", "title": "Use Short Name Path in Command Line", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_cli.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "title": "Suspicious File Encoded To Base64 Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "title": "Sysprep on AppData Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysprep_appdata.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6f3e2987-db24-4c78-a860-b4f4095a7095", "title": "Files Added To An Archive Using Rar.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rar_compress_data.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1ec65a5f-9473-4f12-97da-622044d6df21", "title": "Powershell Defender Disable Scan Feature", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_defender_disable_feature.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d042284c-a296-4988-9be5-f424fadcc28c", "title": "Suspicious Execution of InstallUtil Without Log", "file": "../sigma/rules/windows/process_creation/proc_creation_win_instalutil_no_log_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "title": "Mshtml.DLL RunHTMLApplication Suspicious Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_mshtml_runhtmlapplication.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "title": "Suspicious Driver Install by pnputil.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_susp_driver_installed_by_pnputil.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1327381e-6ab0-4f38-b583-4c1b8346a56b", "title": "Potential Command Line Path Traversal Evasion Attempt", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_commandline_path_traversal_evasion.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "title": "HackTool - Stracciatella Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_stracciatella_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9ef27c24-4903-4192-881a-3adde7ff92a5", "title": "Renamed Remote Utilities RAT (RURAT) Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_rurat.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "title": "Shell Process Spawned by Java.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_java_susp_child_process_2.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "title": "HackTool - SysmonEOP Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sysmoneop.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9ec9fb1b-e059-4489-9642-f270c207923d", "title": "Hiding User Account Via SpecialAccounts Registry Key - CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_special_accounts_hide_user.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "058f4380-962d-40a5-afce-50207d36d7e2", "title": "HackTool - CrackMapExec Execution Patterns", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution_patterns.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fe63010f-8823-4864-a96b-a7b4a0f7b929", "title": "LSASS Process Reconnaissance Via Findstr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_lsass.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "title": "Webshell Hacking Activity Patterns", "file": "../sigma/rules/windows/process_creation/proc_creation_win_webshell_hacking.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "title": "Malicious Base64 Encoded PowerShell Keywords in Command Lines", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_hidden_flag.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "title": "Suspicious Process Masquerading As SvcHost.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "title": "Potentially Suspicious Regsvr32 HTTP IP Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_http_ip_pattern.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "758ff488-18d5-4cbe-8ec4-02b6285a434f", "title": "Remote Access Tool - NetSupport Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_netsupport.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c86133ad-4725-4bd0-8170-210788e0a7ba", "title": "Net WebClient Casing Anomalies", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_webclient_casing.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d08a2711-ee8b-4323-bdec-b7d85e892b31", "title": "PUA - CsExec Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_csexec.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f5d19838-41b5-476c-98d8-ba8af4929ee2", "title": "LOL-Binary Copied From System Directory", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_copy_system_dir_lolbin.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "title": "Remote Access Tool - Team Viewer Session Started On Windows Host", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_teamviewer_incoming_connection.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "82880171-b475-4201-b811-e9c826cd5eaa", "title": "Exports Critical Registry Keys To a File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regedit_export_critical_keys.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "023c654f-8f16-44d9-bb2b-00ff36a62af9", "title": "Python Function Execution Security Warning Disabled In Excel", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_office_disable_python_security_warnings.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d557dc06-62e8-4468-a8e8-7984124908ce", "title": "HackTool - WinPwn Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_winpwn.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "title": "CobaltStrike Load by Rundll32", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_load_by_rundll32.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "title": "Persistence Via Sticky Key Backdoor", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_sticky_keys_replace.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "title": "Use of VisualUiaVerifyNative.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_visualuiaverifynative.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a642964e-bead-4bed-8910-1bb4d63e3b4d", "title": "HackTool - Mimikatz Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_mimikatz_command_line.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "title": "HackTool - CreateMiniDump Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_createminidump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e4a6b256-3e47-40fc-89d2-7a477edd6915", "title": "System File Execution Location Anomaly", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "title": "Suspicious File Downloaded From Direct IP Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "title": "HackTool - SharpLDAPmonitor Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharp_ldap_monitor.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "title": "PrintBrm ZIP Creation of Extraction", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_printbrm.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "46123129-1024-423e-9fae-43af4a0fa9a5", "title": "File Download Via Windows Defender MpCmpRun.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mpcmdrun_download_arbitrary_file.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9fff585c-c33e-4a86-b3cd-39312079a65f", "title": "Taskmgr as LOCAL_SYSTEM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_taskmgr_localsystem.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "title": "Procdump Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_procdump.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fa00b701-44c6-4679-994d-5a18afa8a707", "title": "PUA - AdvancedRun Suspicious Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "title": "Suspicious WebDav Client Execution Via Rundll32.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_webdav_client_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "313d6012-51a0-4d93-8dfc-de8553239e25", "title": "Install New Package Via Winget Local Manifest", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "title": "Group Membership Reconnaissance Via Whoami.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_whoami_groups_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "title": "XSL Script Execution Via WMIC.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8d63dadf-b91b-4187-87b6-34a1114577ea", "title": "Potential SquiblyTwo Technique Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "title": "Potential Commandline Obfuscation Using Escape Characters", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_escape_char.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b36d01a3-ddaf-4804-be18-18a6247adfcd", "title": "Add Windows Capability Via PowerShell Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_add_windows_capability.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aaf46cdc-934e-4284-b329-34aa701e3771", "title": "Uncommon Child Process Of BgInfo.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bginfo_uncommon_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "575dce0c-8139-4e30-9295-1ee75969f7fe", "title": "Potential Reconnaissance Activity Via GatherNetworkInfo.VBS", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "title": "All Backups Deleted Via Wbadmin.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wbadmin_delete_all_backups.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "title": "PUA - Nmap/Zenmap Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_nmap_zenmap.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a1473adb-5338-4a20-b4c3-126763e2d3d3", "title": "Suspicious Advpack Call Via Rundll32.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_advpack_obfuscated_ordinal_call.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "title": "Renamed NirCmd.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_nircmd.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "title": "HackTool - TruffleSnout Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_trufflesnout.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "241e802a-b65e-484f-88cd-c2dc10f9206d", "title": "Read Contents From Stdin Via Cmd.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_stdin_redirect.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fd877b94-9bb5-4191-bb25-d79cbd93c167", "title": "Dumping of Sensitive Hives Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_dumping_sensitive_hives.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d047726b-c71c-4048-a99b-2e2f50dc107d", "title": "Kavremover Dropped Binary LOLBIN Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_kavremover_uncommon_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "40b95d31-1afc-469e-8d34-9a3a667d058e", "title": "Suspicious Csi.exe Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_csi_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "title": "UAC Bypass via ICMLuaUtil", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_icmluautil.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e6c54d94-498c-4562-a37c-b469d8e9a275", "title": "Suspicious PowerShell Download and Execute Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_susp_download_patterns.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "64760eef-87f7-4ed3-93fd-655668ea9420", "title": "Use of Scriptrunner.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_scriptrunner.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "title": "Suspicious Msiexec Quiet Install From Remote Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msiexec_install_remote.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "da2738f2-fadb-4394-afa7-0a0674885afa", "title": "Sdclt Child Processes", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sdclt_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6938366d-8954-4ddc-baff-c830b3ba8fcd", "title": "HackTool - Certipy Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_certipy.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "88872991-7445-4a22-90b2-a3adadb0e827", "title": "Stop Windows Service Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_stop_service.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f576a613-2392-4067-9d1a-9345fb58d8d1", "title": "Automated Collection Command Prompt", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_automated_collection.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "431a1fdb-4799-4f3b-91c3-a683b003fc49", "title": "New Kernel Driver Via SC.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_new_kernel_driver.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "title": "HackTool - Hashcat Password Cracker Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_hashcat.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4931188c-178e-4ee7-a348-39e8a7a56821", "title": "Filter Driver Unloaded Via Fltmc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_fltmc_unload_driver.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "85ff530b-261d-48c6-a441-facaa2e81e48", "title": "New Service Creation Using Sc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_create_service.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "title": "WMI Persistence - Script Event Consumer", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmi_persistence_script_event_consumer.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "title": "Suspicious Use of CSharp Interactive Console", "file": "../sigma/rules/windows/process_creation/proc_creation_win_csi_use_of_csharp_console.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8cbc9475-8d05-4e27-9c32-df960716c701", "title": "Potentially Suspicious Desktop Background Change Using Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_desktop_background_change.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "378a05d8-963c-46c9-bcce-13c7657eac99", "title": "Potentially Suspicious Electron Application CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_electron_execution_proxy.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e8d34729-86a4-4140-adfd-0a29c2106307", "title": "HackTool - CoercedPotato Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_coercedpotato.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "title": "ETW Trace Evasion Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "title": "Potential RDP Tunneling Via SSH", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ssh_rdp_tunneling.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e568650b-5dcd-4658-8f34-ded0b1e13992", "title": "Potential Product Class Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_product_class.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f208d6d8-d83a-4c2c-960d-877c37da84e5", "title": "Process Launched Without Image Name", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_no_image_name.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "514e4c3a-c77d-4cde-a00f-046425e2301e", "title": "Abuse of Service Permissions to Hide Services Via Set-Service", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_hide_services_via_set_service.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "title": "Suspicious Diantz Alternate Data Stream Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "01aeb693-138d-49d2-9403-c4f52d7d3d62", "title": "RDP Connection Allowed Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_fw_allow_rdp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "title": "New Firewall Rule Added Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_fw_add_rule.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "83865853-59aa-449e-9600-74b9d89a6d6e", "title": "Audio Capture via SoundRecorder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_soundrecorder_audio_capture.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "title": "Disabled IE Security Features", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_disable_ie_features.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "title": "Raccine Uninstall", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_disable_raccine.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "title": "File Download Via InstallUtil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_installutil_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0ba1da6d-b6ce-4366-828c-18826c9de23e", "title": "Potential Defense Evasion Via Rename Of Highly Relevant Binaries", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "title": "Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_4.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b53317a0-8acf-4fd1-8de8-a5401e776b96", "title": "Application Removed Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_uninstall_application.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "title": "Suspicious Scheduled Task Name As GUID", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_guid_task_name.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "title": "Suspicious Group And Account Reconnaissance Activity Using Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_groups_and_accounts_recon.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "10344bb3-7f65-46c2-b915-2d00d47be5b0", "title": "IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_ie_security_zone_protocol_defaults_downgrade.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "title": "PUA - Mouse Lock Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_mouselock_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "185d7418-f250-42d0-b72e-0c8b70661e93", "title": "Suspicious Diantz Download and Compress Into a CAB File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_diantz_remote_cab.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "379fa130-190e-4c3f-b7bc-6c8e834485f3", "title": "File Deletion Via Del", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_del_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "title": "Suspicious File Download From File Sharing Domain Via Curl.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e83e8899-c9b2-483b-b355-5decc942b959", "title": "Interesting Service Enumeration Via Sc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_query_interesting_services.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "title": "LOLBIN Execution From Abnormal Drive", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_lolbin_exec_from_non_c_drive.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6385697e-9f1b-40bd-8817-f4a91f40508e", "title": "PowerShell Base64 Encoded Invoke Keyword", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_invoke.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "title": "UAC Bypass Using MSConfig Token Modification - Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_msconfig_gui.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3c05e90d-7eba-4324-9972-5d7f711a60a8", "title": "UAC Bypass Tools Using ComputerDefaults", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_computerdefaults.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "24357373-078f-44ed-9ac4-6d334a668a11", "title": "Direct Autorun Keys Modification", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_direct_asep_registry_keys_modification.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "15619216-e993-4721-b590-4c520615a67d", "title": "Potential Meterpreter/CobaltStrike Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_meterpreter_getsystem.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d2eb17db-1d39-41dc-b57f-301f6512fa75", "title": "Potentially Suspicious Command Targeting Teams Sensitive Files", "file": "../sigma/rules/windows/process_creation/proc_creation_win_teams_suspicious_command_line_cred_access.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5a6e1e16-07de-48d8-8aae-faa766c05e88", "title": "Potential Cookies Session Hijacking", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_cookie_hijacking.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9fbf5927-5261-4284-a71d-f681029ea574", "title": "Compress Data and Lock With Password for Exfiltration With 7-ZIP", "file": "../sigma/rules/windows/process_creation/proc_creation_win_7zip_password_compression.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5a3164f2-b373-4152-93cf-090b13c12d27", "title": "Potentially Suspicious Child Process Of VsCode", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vscode_child_processes_anomalies.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "title": "File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cbec226f-63d9-4eca-9f52-dfb6652f24df", "title": "Suspicious Process Parents", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_parents.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5b768e71-86f2-4879-b448-81061cbae951", "title": "Suspicious Manipulation Of Default Accounts Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_user_default_accounts_manipulation.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ca621ba5-54ab-4035-9942-d378e6fcde3c", "title": "HackTool - HandleKatz LSASS Dumper Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_handlekatz.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "98767d61-b2e8-4d71-b661-e36783ee24c1", "title": "Gzip Archive Decode Via PowerShell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_decode_gzip.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a85ffc3a-e8fd-4040-93bf-78aff284d801", "title": "Use Of The SFTP.EXE Binary As A LOLBIN", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_sftp.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "88f46b67-14d4-4f45-ac2c-d66984f22191", "title": "Renamed Microsoft Teams Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_msteams.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "83809e84-4475-4b69-bc3e-4aad8568612f", "title": "MSExchange Transport Agent Installation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_msexchange_transport_agent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ce72ef99-22f1-43d4-8695-419dcb5d9330", "title": "Suspicious Windows Service Tampering", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_service_tamper.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "add64136-62e5-48ea-807e-88638d02df1e", "title": "Fsutil Suspicious Invocation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_fsutil_usage.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "04936b66-3915-43ad-a8e5-809eadfd1141", "title": "Insensitive Subfolder Search Via Findstr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "title": "Remote Access Tool - GoToAssist Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_gotoopener.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "847d5ff3-8a31-4737-a970-aeae8fe21765", "title": "Potential Tampering With Security Products Via WMIC", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_uninstall_security_products.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2fdefcb3-dbda-401e-ae23-f0db027628bc", "title": "Sticky Key Like Backdoor Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_sticky_key_like_backdoor_execution.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c49c5062-0966-4170-9efd-9968c913a6cf", "title": "Stop Windows Service Via PowerShell Stop-Service", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_stop_service.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "title": "Delete Important Scheduled Task", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_delete.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "title": "Renamed ZOHO Dctask64 Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_dctask64.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "title": "HackTool - SharpLdapWhoami Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharpldapwhoami.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "title": "Local File Read Using Curl.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_local_file_read.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "850d55f9-6eeb-4492-ad69-a72338f65ba4", "title": "C# IL Code Compilation Via Ilasm.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ilasm_il_code_compilation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d87bd452-6da1-456e-8155-7dc988157b7d", "title": "Suspicious Usage Of ShellExec_RunDLL", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_susp_shellexec_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5bb68627-3198-40ca-b458-49f973db8752", "title": "Rundll32 Execution Without Parameters", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_without_parameters.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "title": "Execution of Powershell Script in Public Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_public_folder.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "title": "Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_fw_allow_program_in_susp_location.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "caf201a9-c2ce-4a26-9c3a-2b9525413711", "title": "Potentially Suspicious Call To Win32_NTEventlogFile Class", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_nteventlogfile_usage.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4e762605-34a8-406d-b72e-c1a089313320", "title": "Potential Fake Instance Of Hxtsr.EXE Executed", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hxtsr_masquerading.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d3c3861d-c504-4c77-ba55-224ba82d0118", "title": "New Network Trace Capture Started Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_packet_capture.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2ddef153-167b-4e89-86b6-757a9e65dcac", "title": "File Download Via Bitsadmin To A Suspicious Target Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "title": "Cloudflared Tunnel Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cloudflared_tunnel_run.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "54773c5f-f1cc-4703-9126-2f797d96a69d", "title": "PUA - Advanced Port Scanner Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "title": "Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8a582fe2-0882-4b89-a82a-da6b2dc32937", "title": "Suspicious WmiPrvSE Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmiprvse_susp_child_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "title": "Use NTFS Short Name in Command Line", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_cli.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "title": "HackTool - Covenant PowerShell Launcher", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_covenant.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f35c5d71-b489-4e22-a115-f003df287317", "title": "Potential CobaltStrike Process Patterns", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_process_patterns.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fbd7c32d-db2a-4418-b92c-566eb8911133", "title": "SyncAppvPublishingServer Execute Arbitrary PowerShell Code", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_execute_psh.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "87a476dc-0079-4583-a985-dee7a20a03de", "title": "Enumeration for 3rd Party Creds From CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_enumeration_for_credentials_cli.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "title": "Potentially Suspicious DLL Registered Via Odbcconf.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr_susp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "title": "Suspicious Modification Of Scheduled Tasks", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_change.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "38879043-7e1e-47a9-8d46-6bec88e201df", "title": "Potential Persistence Attempt Via Existing Service Tampering", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_service_tamper_for_persistence.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "title": "Certificate Exported Via PowerShell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_export_certificate.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f9999590-1f94-4a34-a91e-951e47bedefd", "title": "Suspicious Provlaunch.EXE Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_provlaunch_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "title": "Regsvr32 DLL Execution With Suspicious File Extension", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_susp_extensions.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "title": "Potential PowerShell Obfuscation Via Reversed Commands", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_cmdline_reversed_strings.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "title": "Suspicious RASdial Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rasdial_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "title": "Uncommon FileSystem Load Attempt By Format.com", "file": "../sigma/rules/windows/process_creation/proc_creation_win_format_uncommon_filesystem_load.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "title": "HackTool - KrbRelay Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_krbrelay.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4eddc365-79b4-43ff-a9d7-99422dc34b93", "title": "Use of Remote.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_remote.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "title": "Deletion of Volume Shadow Copies via WMI with PowerShell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_shadowcopy_deletion.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "220457c1-1c9f-4c2e-afe6-9598926222c1", "title": "Delete All Scheduled Tasks", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_delete_all.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bf361876-6620-407a-812f-bfe11e51e924", "title": "Compressed File Extraction Via Tar.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_tar_extraction.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "title": "Curl Download And Execute Combination", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_curl_download_exec_combo.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c79da740-5030-45ec-a2e0-479e824a562c", "title": "System Disk And Volume Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_volume.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d7662ff6-9e97-4596-a61d-9839e32dee8d", "title": "Add SafeBoot Keys Via Reg Utility", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_add_safeboot.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a197e378-d31b-41c0-9635-cfdf1c1bb423", "title": "HackTool - WinRM Access Via Evil-WinRM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_evil_winrm.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "737e618a-a410-49b5-bec3-9e55ff7fbc15", "title": "Suspicious Calculator Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_calc_uncommon_exec.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "title": "Scripting/CommandLine Process Spawned Regsvr32", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_susp_parent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "30edb182-aa75-42c0-b0a9-e998bb29067c", "title": "Potential AMSI Bypass Via .NET Reflection", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_amsi_init_failed_bypass.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ff23ffbc-3378-435e-992f-0624dcf93ab4", "title": "HackTool - PurpleSharp Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_purplesharp_indicators.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "eb1c4225-1c23-4241-8dd4-051389fde4ce", "title": "Suspicious DumpMinitool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dumpminitool_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "title": "Xwizard.EXE Execution From Non-Default Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_xwizard_execution_non_default_location.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "title": "Dumping Process via Sqldumper.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_susp_sqldumper_activity.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e312efd0-35a1-407f-8439-b8d434b438a6", "title": "Potential PowerShell Obfuscation Via WCHAR", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_obfuscation_via_utf8.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "title": "Unusual Parent Process For Cmd.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_unusual_parent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d679950c-abb7-43a6-80fb-2a480c4fc450", "title": "PDQ Deploy Remote Adminstartion Tool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pdqdeploy_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ba42babc-0666-4393-a4f7-ceaf5a69191e", "title": "Uncommon Child Processes Of SndVol.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sndvol_susp_child_processes.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c27515df-97a9-4162-8a60-dc0eeb51b775", "title": "Suspicious Microsoft OneNote Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_onenote_susp_child_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "title": "Potential Password Spraying Attempt Using Dsacls.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dsacls_password_spray.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "title": "Suspicious Use of PsLogList", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_psloglist.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0f6da907-5854-4be6-859a-e9958747b0aa", "title": "Potential DLL Injection Via AccCheckConsole", "file": "../sigma/rules/windows/process_creation/proc_creation_win_acccheckconsole_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "title": "New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dnscmd_install_new_server_level_plugin_dll.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5edc2273-c26f-406c-83f3-f4d948e740dd", "title": "Indirect Inline Command Execution Via Bash.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bash_command_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "95eadcb2-92e4-4ed1-9031-92547773a6db", "title": "Suspicious PowerShell Invocation From Script Engines", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_script_engine_parent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "title": "OpenWith.exe Executes Specified Binary", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_openwith.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "title": "PowerShell Download Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_download_patterns.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0f0450f3-8b47-441e-a31b-15a91dc243e2", "title": "Potential DLL File Download Via PowerShell Invoke-WebRequest", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_download_dll.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "title": "Suspicious Download Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "817f252c-5143-4dae-b418-48c3e9f63728", "title": "Windows Recall Feature Enabled Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_enable_windows_recall.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "title": "HackTool - Rubeus Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_rubeus.yml", "status": "stable", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "title": "Arbitrary File Download Via MSOHTMED.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msohtmed_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "title": "PUA - WebBrowserPassView Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_webbrowserpassview.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "07e3cb2c-0608-410d-be4b-1511cb1a0448", "title": "Tamper Windows Defender Remove-MpPreference", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_remove_mppreference.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "138d3531-8793-4f50-a2cd-f291b2863d78", "title": "Suspicious Service Path Modification", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_service_path_modification.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "title": "DSInternals Suspicious PowerShell Cmdlets", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_dsinternals_cmdlets.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ddeff553-5233-4ae9-bbab-d64d2bd634be", "title": "Data Copied To Clipboard Via Clip.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_clip_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "03552375-cc2c-4883-bbe4-7958d5a980be", "title": "HackTool - SILENTTRINITY Stager Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_silenttrinity_stager.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e212d415-0e93-435f-9e1a-f29005bb4723", "title": "Suspicious Remote Child Process From Outlook", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes_remote.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "55f0a3a1-846e-40eb-8273-677371b8d912", "title": "Outlook EnableUnsafeClientMailRules Setting Enabled", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "title": "Disable Windows IIS HTTP Logging", "file": "../sigma/rules/windows/process_creation/proc_creation_win_iis_appcmd_http_logging.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "title": "UAC Bypass Using NTFS Reparse Point - Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_ntfs_reparse_point.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "title": "Changing Existing Service ImagePath Value Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_service_imagepath_change.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "title": "Ping Hex IP", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ping_hex_ip.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "87911521-7098-470b-a459-9a57fc80bdfd", "title": "Sysmon Configuration Update", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_sysmon_config_update.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "title": "Change Default File Association Via Assoc", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_assoc_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e7888eb1-13b0-4616-bd99-4bc0c2b054b9", "title": "Dllhost.EXE Execution Anomaly", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dllhost_no_cli_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6ba5a05f-b095-4f0a-8654-b825f4f16334", "title": "Potential MSTSC Shadowing Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mstsc_rdp_hijack_shadowing.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "title": "Unmount Share Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_share_unmount.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "title": "Renamed Jusched.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_jusched.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "title": "Always Install Elevated Windows Installer", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_always_install_elevated_windows_installer.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "title": "Suspicious Response File Execution Via Odbcconf.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_odbcconf_response_file_susp.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7cce6fc8-a07f-4d84-a53e-96e1879843c9", "title": "Potential Binary Impersonating Sysinternals Tools", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_tools_masquerading.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "45d3a03d-f441-458c-8883-df101a3bb146", "title": "Launch-VsDevShell.PS1 Proxy Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_launch_vsdevshell.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "871b9555-69ca-4993-99d3-35a59f9f3599", "title": "Suspicious UltraVNC Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ultravnc_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f2c64357-b1d2-41b7-849f-34d2682c0fad", "title": "Suspicious Command Patterns In Scheduled Task Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_susp_pattern.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "title": "PUA - Adidnsdump Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_python_adidnsdump.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "12fbff88-16b5-4b42-9754-cd001a789fb3", "title": "CodePage Modification Via MODE.COM To Russian Language", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mode_codepage_russian.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "title": "WebDav Client Execution Via Rundll32.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_webdav_client_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0403d67d-6227-4ea8-8145-4e72db7da120", "title": "UtilityFunctions.ps1 Proxy Dll", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_utilityfunctions.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "title": "Execute From Alternate Data Streams", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bd1c6866-65fc-44b2-be51-5588fcff82b9", "title": "Renamed Msdt.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_msdt.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "title": "Potential SPN Enumeration Via Setspn.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_setspn_spn_enumeration.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1114e048-b69c-4f41-bc20-657245ae6e3f", "title": "User Discovery And Export Via Get-ADUser Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_user_discovery_get_aduser.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "title": "Suspicious Obfuscated PowerShell Code", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_encoded_obfusc.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "title": "Suspicious File Characteristics Due to Missing Fields", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_file_characteristics.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "title": "Suspicious SYSTEM User Process Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "27aec9c9-dbb0-4939-8422-1742242471d0", "title": "Invoke-Obfuscation VAR+ Launcher", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_var.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "727454c0-d851-48b0-8b89-385611ab0704", "title": "Lolbin Unregmp2.exe Use As Proxy", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_unregmp2.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "title": "Potential Recon Activity Via Nltest.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_nltest_recon.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d20ee2f4-822c-4827-9e15-41500b1fff10", "title": "Potential Amazon SSM Agent Hijacking", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ssm_agent_abuse.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "title": "Allow Service Access Using Security Descriptor Tampering Via Sc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_sdset_allow_service_changes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "title": "Potential Arbitrary File Download Using Office Application", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_arbitrary_cli_download.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "efec536f-72e8-4656-8960-5e85d091345b", "title": "Set Suspicious Files as System Files Using Attrib.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_attrib_system_susp_paths.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6f4191bb-912b-48a8-9ce7-682769541e6d", "title": "Suspicious Msiexec Execute Arbitrary DLL", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msiexec_execute_dll.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "title": "Potentially Suspicious Child Process Of DiskShadow.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_diskshadow_child_process_susp.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "517490a7-115a-48c6-8862-1a481504d5a8", "title": "Potential Shim Database Persistence via Sdbinst.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sdbinst_shim_persistence.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "title": "Use of VSIISExeLauncher.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_vsiisexelauncher.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "49d9671b-0a0a-4c09-8280-d215bfd30662", "title": "Application Terminated Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_terminate_application.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "05f3c945-dcc8-4393-9f3d-af65077a8f86", "title": "Suspicious SYSVOL Domain Group Policy Access", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_sysvol_access.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3037d961-21e9-4732-b27a-637bcc7bf539", "title": "Suspicious High IntegrityLevel Conhost Legacy Option", "file": "../sigma/rules/windows/process_creation/proc_creation_win_conhost_legacy_option.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "title": "Invoke-Obfuscation COMPRESS OBFUSCATION", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_compress.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "title": "PUA - Radmin Viewer Utility Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_radmin.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "title": "CreateDump Process Dump", "file": "../sigma/rules/windows/process_creation/proc_creation_win_createdump_lolbin_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "title": "Potential Regsvr32 Commandline Flag Anomaly", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_flags_anomaly.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "554601fb-9b71-4bcc-abf4-21a611be4fde", "title": "Suspicious Recursive Takeown", "file": "../sigma/rules/windows/process_creation/proc_creation_win_takeown_recursive_own.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "title": "Portable Gpg.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gpg4win_portable_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7b10f171-7f04-47c7-9fa2-5be43c76e535", "title": "Visual Basic Command Line Compiler Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_visual_basic_compiler.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "45239e6a-b035-4aaf-b339-8ad379fcb67e", "title": "Process Proxy Execution Via Squirrel.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_squirrel_proxy_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "24e3e58a-646b-4b50-adef-02ef935b9fc8", "title": "Hacktool Execution - Imphash", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_execution_via_imphashes.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "title": "Potential Privilege Escalation via Service Permissions Weakness", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_privilege_escalation_via_service_key.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "40f9af16-589d-4984-b78d-8c2aec023197", "title": "Potential UAC Bypass Via Sdclt.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_sdclt.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7679d464-4f74-45e2-9e01-ac66c5eb041a", "title": "HackTool - SecurityXploded Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_secutyxploded.yml", "status": "stable", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "title": "Renamed Whoami Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_whoami.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7be5fb68-f9ef-476d-8b51-0256ebece19e", "title": "Suspicious Execution of Hostname", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hostname_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6e22722b-dfb1-4508-a911-49ac840b40f8", "title": "Suspicious Mstsc.EXE Execution With Local RDP File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mstsc_run_local_rdp_file_susp_location.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9ccba514-7cb6-4c5c-b377-700758f2f120", "title": "Suspicious Child Process of AspNetCompiler", "file": "../sigma/rules/windows/process_creation/proc_creation_win_aspnet_compiler_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "title": "Renamed Plink Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_plink.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7a74da6b-ea76-47db-92cc-874ad90df734", "title": "Suspicious MSDT Parent Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msdt_susp_parent.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b37998de-a70b-4f33-b219-ec36bf433dc0", "title": "PUA - PingCastle Execution From Potentially Suspicious Parent", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_pingcastle_script_parent.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f11f2808-adb4-46c0-802a-8660db50fa99", "title": "ImagingDevices Unusual Parent/Child Processes", "file": "../sigma/rules/windows/process_creation/proc_creation_win_imagingdevices_unusual_parents.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "43e32da2-fdd0-4156-90de-50dfd62636f9", "title": "Dism Remove Online Package", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dism_remove.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "title": "Change Default File Association To Executable Via Assoc", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_assoc_tamper_exe_file_association.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a20def93-0709-4eae-9bd2-31206e21e6b2", "title": "DriverQuery.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_driverquery_usage.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "title": "Suspicious Process Execution From Fake Recycle.Bin Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_recycle_bin_fake_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "title": "Computer System Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_computersystem.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6004abd0-afa4-4557-ba90-49d172e0a299", "title": "Execute Pcwrun.EXE To Leverage Follina", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_pcwrun_follina.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "title": "Node Process Executions", "file": "../sigma/rules/windows/process_creation/proc_creation_win_node_adobe_creative_cloud_abuse.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "970823b7-273b-460a-8afc-3a6811998529", "title": "Uncommon One Time Only Scheduled Task At 00:00", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_one_time_only_midnight_task.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "title": "Compress Data and Lock With Password for Exfiltration With WINZIP", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winzip_password_compression.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "15b75071-74cc-47e0-b4c6-b43744a62a2b", "title": "Suspicious Process Start Locations", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_run_locations.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "title": "Suspicious Eventlog Clearing or Configuration Change Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_eventlog_clear.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "title": "AddinUtil.EXE Execution From Uncommon Directory", "file": "../sigma/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_dir_exec.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "title": "WMIC Remote Command Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_remote_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4cbef972-f347-4170-b62a-8253f6168e6d", "title": "UAC Bypass Using IDiagnostic Profile", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_idiagnostic_profile.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "title": "Copying Sensitive Files with Credential Data", "file": "../sigma/rules/windows/process_creation/proc_creation_win_esentutl_sensitive_file_copy.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f99abdf0-6283-4e71-bd2b-b5c048a94743", "title": "Potentially Suspicious Office Document Executed From Trusted Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_exec_from_trusted_locations.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "48a61b29-389f-4032-b317-b30de6b95314", "title": "Suspicious Plink Port Forwarding", "file": "../sigma/rules/windows/process_creation/proc_creation_win_plink_port_forwarding.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0a13e132-651d-11eb-ae93-0242ac130002", "title": "Audit Policy Tampering Via Auditpol", "file": "../sigma/rules/windows/process_creation/proc_creation_win_auditpol_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "title": "Potentially Suspicious EventLog Recon Activity Using Log Query Utilities", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_eventlog_content_recon.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e9f55347-2928-4c06-88e5-1a7f8169942e", "title": "Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_var.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "title": "Potentially Suspicious Child Process Of ClickOnce Application", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dfsvc_suspicious_child_processes.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6a69f62d-ce75-4b57-8dce-6351eb55b362", "title": "Esentutl Steals Browser Information", "file": "../sigma/rules/windows/process_creation/proc_creation_win_esentutl_webcache.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8b0e12da-d3c3-49db-bb4f-256703f380e5", "title": "PUA - Chisel Tunneling Tool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_chisel.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7dc2dedd-7603-461a-bc13-15803d132355", "title": "Uncommon Child Process Of Conhost.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "title": "Suspicious Certreq Command to Download", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_susp_certreq_download.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "98a96a5a-64a0-4c42-92c5-489da3866cb0", "title": "DNS Exfiltration and Tunneling Tools Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dns_exfiltration_tools_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "47e4bab7-c626-47dc-967b-255608c9a920", "title": "Permission Misconfiguration Reconnaissance Via Findstr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_recon_everyone.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "title": "Potential Windows Defender Tampering Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_namespace_defender.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "40b19fa6-d835-400c-b301-41f3a2baacaf", "title": "VolumeShadowCopy Symlink Creation Via Mklink", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_mklink_shadow_copies_access_symlink.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "71158e3f-df67-472b-930e-7d287acaa3e1", "title": "Execution Of Non-Existing File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_image_missing.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f44800ac-38ec-471f-936e-3fa7d9c53100", "title": "PUA - CleanWipe Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_cleanwipe.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "title": "Suspicious Spool Service Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_spoolsv_susp_child_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "title": "Visual Studio Code Tunnel Shell Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vscode_tunnel_remote_shell_.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "24c8392b-aa3c-46b7-a545-43f71657fe98", "title": "Suspicious Schtasks Schedule Types", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_schedule_type.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "88f680b8-070e-402c-ae11-d2914f2257f1", "title": "PowerShell Base64 Encoded IEX Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_iex.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "15434e33-5027-4914-88d5-3d4145ec25a9", "title": "Potential Product Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_product.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b98d0db6-511d-45de-ad02-e82a98729620", "title": "Remotely Hosted HTA File Executed Via Mshta.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mshta_http.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "title": "Remote PowerShell Session Host Process (WinRM)", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winrm_remote_powershell_session_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0bbc6369-43e3-453d-9944-cae58821c173", "title": "Execution via WorkFolders.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_workfolders.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "title": "Potential Defense Evasion Via Binary Rename", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_binary.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "title": "Suspicious Electron Application Child Processes", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_electron_app_children.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b7966f4a-b333-455b-8370-8ca53c229762", "title": "Dropping Of Password Filter DLL", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_credential_access_via_password_filter.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "43fa5350-db63-4b8f-9a01-789a427074e1", "title": "Potential Obfuscated Ordinal Call Via Rundll32", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_obfuscated_ordinal_call.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "title": "Audit Policy Tampering Via NT Resource Kit Auditpol", "file": "../sigma/rules/windows/process_creation/proc_creation_win_auditpol_nt_resource_kit_usage.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ec290c06-9b6b-4338-8b6b-095c0f284f10", "title": "Suspicious Execution of Shutdown to Log Out", "file": "../sigma/rules/windows/process_creation/proc_creation_win_shutdown_logoff.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "title": "Enumeration for Credentials in Registry", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_enumeration_for_credentials_in_registry.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "title": "Process Memory Dump Via Dotnet-Dump", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dotnetdump_memory_dump.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "title": "Assembly Loading Via CL_LoadAssembly.ps1", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_cl_loadassembly.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "title": "Suspicious Schtasks Execution AppData Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_appdata_local_system.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0b0cd537-fc77-4e6e-a973-e53495c1083d", "title": "Renamed Office Binary Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_office_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "title": "PUA - DefenderCheck Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_defendercheck.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fca949cc-79ca-446e-8064-01aa7e52ece5", "title": "HackTool - PCHunter Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d4498716-1d52-438f-8084-4a603157d131", "title": "Password Provided In Command Line Of Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_use_password_plaintext.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b222df08-0e07-11eb-adc1-0242ac120002", "title": "Invoke-Obfuscation CLIP+ Launcher", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_clip.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e1693bc8-7168-4eab-8718-cdcaa68a1738", "title": "Suspicious WMIC Execution Via Office Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_susp_execution_via_office_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "title": "Potential Mftrace.EXE Abuse", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mftrace_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d3b70aad-097e-409c-9df2-450f80dc476b", "title": "PUA - DIT Snapshot Viewer", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_ditsnap.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "title": "Suspicious Reg Add Open Command", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_open_command.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "312d0384-401c-4b8b-abdf-685ffba9a332", "title": "Email Exifiltration Via Powershell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_email_exfil.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cc368ed0-2411-45dc-a222-510ace303cb2", "title": "Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regasm_regsvcs_uncommon_location_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "42333b2c-b425-441c-b70e-99404a17170f", "title": "HackTool - Sliver C2 Implant Activity Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sliver_c2_execution_pattern.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0e4164da-94bc-450d-a7be-a4b176179f1f", "title": "Firewall Configuration Discovery Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_fw_rules_discovery.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "title": "HackTool - XORDump Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_xordump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "title": "HackTool - RedMimicry Winnti Playbook Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_redmimicry_winnti_playbook.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ebef4391-1a81-4761-a40a-1db446c0e625", "title": "New ActiveScriptEventConsumer Created Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f26307d8-14cd-47e3-a26b-4b4769f24af6", "title": "HackTool - CrackMapExec Process Patterns", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_patterns.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "03cc0c25-389f-4bf8-b48d-11878079f1ca", "title": "Suspicious MSHTA Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mshta_susp_child_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8834e2f7-6b4b-4f09-8906-d2276470ee23", "title": "PsExec/PAExec Escalation to LOCAL SYSTEM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_psexec_paexec_escalate_system.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7090adee-82e2-4269-bd59-80691e7c6338", "title": "Console CodePage Lookup Via CHCP", "file": "../sigma/rules/windows/process_creation/proc_creation_win_chcp_codepage_lookup.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c74c0390-3e20-41fd-a69a-128f0275a5ea", "title": "Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wusa_cab_files_extraction_from_susp_paths.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b6457d63-d2a2-4e29-859d-4e7affc153d1", "title": "Potential Discovery Activity Via Dnscmd.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dnscmd_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "title": "File And SubFolder Enumeration Via Dir Command", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_dir_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5f6a601c-2ecb-498b-9c33-660362323afa", "title": "Root Certificate Installed From Susp Locations", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_import_cert_susp_locations.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aa8e035d-7be4-48d3-a944-102aec04400d", "title": "Suspicious Extrac32 Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_extrac32.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b243b280-65fe-48df-ba07-6ddea7646427", "title": "Discovery of a System Time", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_time_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "236d8e89-ed95-4789-a982-36f4643738ba", "title": "Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence_susp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "277a4393-446c-449a-b0ed-7fdc7795244c", "title": "Renamed FTP.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_ftp.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4fe074b4-b833-4081-8f24-7dcfeca72b42", "title": "Security Tools Keyword Lookup Via Findstr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "853e74f9-9392-4935-ad3b-2e8c040dae86", "title": "UAC Bypass Using DismHost", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_dismhost.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "68bcd73b-37ef-49cb-95fc-edc809730be6", "title": "Potential Unquoted Service Path Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_unquoted_service_search.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "86588b36-c6d3-465f-9cee-8f9093e07798", "title": "Scheduled Task Executing Payload from Registry", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_reg_loader.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "502b42de-4306-40b4-9596-6f590c81f073", "title": "Local Accounts Discovery", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_local_system_owner_account_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0a99eb3e-1617-41bd-b095-13dc767f3def", "title": "HackTool - Jlaive In-Memory Assembly Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_jlaive_batch_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "title": "HTML Help HH.EXE Suspicious Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "07f8bdc2-c9b3-472a-9817-5a670b872f53", "title": "Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmdkey_recon.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "title": "HackTool - SharpImpersonation Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharp_impersonation.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "28ac00d6-22d9-4a3c-927f-bbd770104573", "title": "RestrictedAdminMode Registry Value Tampering - ProcCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_lsa_disable_restricted_admin.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "452bce90-6fb0-43cc-97a5-affc283139b3", "title": "Suspicious Windows Defender Registry Key Tampering Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_windows_defender_tamper.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "title": "Potentially Suspicious Execution From Parent Process In Public Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_execution_from_public_folder_as_parent.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "title": "PowerShell Set-Acl On Windows Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_set_acl_susp_location.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ce7cf472-6fcc-490a-9481-3786840b5d9b", "title": "InfDefaultInstall.exe .inf Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_infdefaultinstall_execute_sct_scripts.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c6fb44c6-71f5-49e6-9462-1425d328aee3", "title": "Powershell Base64 Encoded MpPreference Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_mppreference.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9c0295ce-d60d-40bd-bd74-84673b7592b1", "title": "Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load_obfusc.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0a4f6091-223b-41f6-8743-f322ec84930b", "title": "Suspicious GUP Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gup_suspicious_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "98c5aeef-32d5-492f-b174-64a691896d25", "title": "Service Security Descriptor Tampering Via Sc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_sdset_modification.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6fe4aa1e-0531-4510-8be2-782154b73b48", "title": "File Recovery From Backup Via Wbadmin.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wbadmin_restore_file.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "title": "Suspicious AgentExecutor PowerShell Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_agentexecutor_susp_usage.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "title": "Windows Hotfix Updates Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_hotfix.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d78b5d61-187d-44b6-bf02-93486a80de5a", "title": "HackTool - DInjector PowerShell Cradle Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_dinjector.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e9b61244-893f-427c-b287-3e708f321c6b", "title": "Potential Privilege Escalation Using Symlink Between Osk and Cmd", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "70bc5215-526f-4477-963c-a47a5c9ebd12", "title": "Potential Active Directory Enumeration Using AD Module - ProcCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_active_directory_module_dll_import.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b6e04788-29e1-4557-bb14-77f761848ab8", "title": "Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_download_susp_file_sharing_domains.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "title": "Shadow Copies Creation Using Operating Systems Utilities", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_creation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0685b176-c816-4837-8e7b-1216f346636b", "title": "HackTool - Quarks PwDump Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_quarks_pwdump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e84d89c4-f544-41ca-a6af-4b92fd38b023", "title": "Arbitrary File Download Via MSEDGE_PROXY.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msedge_proxy_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "title": "Potentially Suspicious Windows App Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_appx_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "title": "Potential Network Sniffing Activity Using Network Tools", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_network_sniffing.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "023394c4-29d5-46ab-92b8-6a534c6f447b", "title": "Suspicious HWP Sub Processes", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hwp_exploits.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "title": "New Service Creation Using PowerShell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_create_service.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ebea773c-a8f1-42ad-a856-00cb221966e8", "title": "DLL Sideloading by VMware Xfer Utility", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dll_sideload_vmware_xfer.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0b7163dc-7eee-4960-af17-c0cd517f92da", "title": "Service Started/Stopped Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_service_manipulation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "98dedfdd-8333-49d4-9f23-d7018cccae53", "title": "Enable LM Hash Storage - ProcCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_nolmhash.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "title": "Potential Data Exfiltration Activity Via CommandLine Tools", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_data_exfiltration_via_cli.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "title": "HackTool - SharpView Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharpview.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f24bcaea-0cd1-11eb-adc1-0242ac120002", "title": "Uncommon Assistive Technology Applications Execution Via AtBroker.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_atbroker_uncommon_ats_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ccb5742c-c248-4982-8c5c-5571b9275ad3", "title": "Recon Command Output Piped To Findstr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_recon_pipe_output.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "title": "MSHTA Suspicious Execution 01", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mshta_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4abc0ec4-db5a-412f-9632-26659cddf145", "title": "UEFI Persistence Via Wpbbin - ProcessCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wpbbin_potential_persistence.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "title": "Import LDAP Data Interchange Format File Via Ldifde.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ldifde_file_load.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "title": "Suspicious Download From File-Sharing Website Via Bitsadmin", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bitsadmin_download_file_sharing_domains.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5cddf373-ef00-4112-ad72-960ac29bac34", "title": "HackTool - Koadic Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_koadic.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "37db85d1-b089-490a-a59a-c7b6f984f480", "title": "Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_sysmon_discovery_via_default_altitude.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "title": "File Download Via Bitsadmin", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "title": "Potential Browser Data Stealing", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_copy_browser_data.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f1edd233-30b5-4823-9e6a-c4171b24d316", "title": "Rundll32 Registered COM Objects", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_registered_com_objects.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e92a4287-e072-4a40-9739-370c106bb750", "title": "HackTool - SOAPHound Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_soaphound_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "title": "Disabled Volume Snapshots", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_volsnap_disable.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "title": "Potentially Suspicious ASP.NET Compilation Via AspNetCompiler", "file": "../sigma/rules/windows/process_creation/proc_creation_win_aspnet_compiler_susp_paths.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8bc64091-6875-4881-aaf9-7bd25b5dda08", "title": "Suspicious Process Patterns NTDS.DIT Exfil", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_ntds.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "56c217c3-2de2-479b-990f-5c109ba8458f", "title": "HackTool - Default PowerSploit/Empire Scheduled Task Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_powersploit_empire_default_schtasks.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "eee00933-a761-4cd0-be70-c42fe91731e7", "title": "Arbitrary File Download Via GfxDownloadWrapper.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gfxdownloadwrapper_arbitrary_file_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bab049ca-7471-4828-9024-38279a4c04da", "title": "Detect Virtualbox Driver Installation OR Starting Of VMs", "file": "../sigma/rules/windows/process_creation/proc_creation_win_virtualbox_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c3a99af4-35a9-4668-879e-c09aeb4f2bdf", "title": "Rundll32 Execution With Uncommon DLL Extension", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_uncommon_dll_extension.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d7654f02-e04b-4934-9838-65c46f187ebc", "title": "PUA- IOX Tunneling Tool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_iox.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2a072a96-a086-49fa-bcb5-15cc5a619093", "title": "Start Windows Service Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_start_service.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "883faa95-175a-4e22-8181-e5761aeb373c", "title": "Suspicious Service Binary Directory", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_service_dir.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "title": "Change PowerShell Policies to an Insecure Level", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_set_policies_to_unsecure_level.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "title": "MMC20 Lateral Movement", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mmc_mmc20_lateral_movement.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "63d1ccc0-2a43-4f4b-9289-361b308991ff", "title": "Wab/Wabmig Unusual Parent Or Child Processes", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wab_unusual_parents.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4f154fb6-27d1-4813-a759-78b93e0b9c48", "title": "Operator Bloopers Cobalt Strike Modules", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_bloopers_modules.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "title": "Suspicious Execution Location Of Wermgr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wermgr_susp_exec_location.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "title": "HackTool - Empire PowerShell Launch Parameters", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_empire_powershell_launch.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "title": "Potential Binary Proxy Execution Via Cdb.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cdb_arbitrary_command_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "26488ad0-f9fd-4536-876f-52fea846a2e4", "title": "HackTool - SharPersist Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharpersist.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "title": "Python Spawning Pretty TTY on Windows", "file": "../sigma/rules/windows/process_creation/proc_creation_win_python_pty_spawn.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "33be4333-2c6b-44f4-ae28-102cdbde0a31", "title": "Suspicious Msbuild Execution By Uncommon Parent Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msbuild_susp_parent_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e37db05d-d1f9-49c8-b464-cee1a4b11638", "title": "PUA - Rclone Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_rclone_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "395907ee-96e5-4666-af2e-2ca91688e151", "title": "Wab Execution From Non Default Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wab_execution_from_non_default_location.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "title": "Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_download_file_sharing_domains.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b0ce780f-10bd-496d-9067-066d23dc3aa5", "title": "HackTool - SharpWSUS/WSUSpendu Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharpwsus_wsuspendu_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "title": "Suspicious Driver/DLL Installation Via Odbcconf.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_odbcconf_driver_install_susp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "title": "Loaded Module Enumeration Via Tasklist.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_tasklist_module_enumeration.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "title": "PUA - Wsudo Suspicious Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_wsudo_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "title": "Suspicious ZipExec Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_zipexec.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "79b06761-465f-4f88-9ef2-150e24d3d737", "title": "Potential SysInternals ProcDump Evasion", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_procdump_evasion.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "title": "HackTool - SharpDPAPI Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharp_dpapi_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c615d676-f655-46b9-b913-78729021e5d7", "title": "Data Export From MSSQL Table Via BCP.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bcp_export_data.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b19146a3-25d4-41b4-928b-1e2a92641b1b", "title": "Remote Access Tool - ScreenConnect Server Web Shell Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_webshell.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "title": "HackTool - GMER Rootkit Detector and Remover Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_gmer.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "title": "Potential Data Stealing Via Chromium Headless Debugging", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_debugging.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e6474a1b-5390-49cd-ab41-8d88655f7394", "title": "Renamed Mavinject.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_mavinject.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "692f0bec-83ba-4d04-af7e-e884a96059b6", "title": "Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmiprvse_spawns_powershell.yml", "status": "stable", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "93671f99-04eb-4ab4-a161-70d446a84003", "title": "Capture Credentials with Rpcping.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rpcping_credential_capture.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0d5675be-bc88-4172-86d3-1e96a4476536", "title": "Potential Tampering With RDP Related Registry Keys Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_rdp_keys_tamper.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "title": "PsExec Service Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_psexesvc.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4281cb20-2994-4580-aa63-c8b86d019934", "title": "Hiding Files with Attrib.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_attrib_hiding_files.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "title": "Malicious PE Execution by Microsoft Visual Studio Debugger", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_use_of_vsjitdebugger_bin.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "title": "Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "title": "Potentially Suspicious Execution Of PDQDeployRunner", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pdqdeploy_runner_susp_children.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "title": "Unusual Child Process of dns.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dns_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a34f79a3-8e5f-4cc3-b765-de00695452c2", "title": "HackTool - PowerTool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_powertool.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "title": "Chopper Webshell Process Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_webshell_chopper.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5589ab4f-a767-433c-961d-c91f3f704db1", "title": "Potential SMB Relay Attack Tool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_relay_attacks_tools.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "title": "UAC Bypass Using ChangePK and SLUI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_changepk_slui.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e8a95b5e-c891-46e2-b33a-93937d3abc31", "title": "Suspicious HH.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hh_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c86500e9-a645-4680-98d7-f882c70c1ea3", "title": "AADInternals PowerShell Cmdlets Execution - ProccessCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_aadinternals_cmdlets_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "58f50261-c53b-4c88-bd12-1d71f12eda4c", "title": "Windows Credential Manager Access via VaultCmd", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vaultcmd_list_creds.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "34ebb878-1b15-4895-b352-ca2eeb99b274", "title": "Suspicious Execution of Shutdown", "file": "../sigma/rules/windows/process_creation/proc_creation_win_shutdown_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7a02e22e-b885-4404-b38b-1ddc7e65258a", "title": "Suspicious Schtasks Schedule Type With High Privileges", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_schedule_type_system.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "title": "Hardware Model Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_csproduct.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "24de4f3b-804c-4165-b442-5a06a2302c7e", "title": "Arbitrary Shell Command Execution Via Settingcontent-Ms", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_arbitrary_shell_execution_via_settingcontent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "731231b9-0b5d-4219-94dd-abb6959aa7ea", "title": "Suspicious Rundll32 Activity Invoking Sys File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_sys.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "title": "Mstsc.EXE Execution With Local RDP File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mstsc_run_local_rdp_file.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "title": "Obfuscated PowerShell OneLiner Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_download_cradle_obfuscated.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "title": "Potential LethalHTA Technique Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mshta_lethalhta_technique.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d7bcd677-645d-4691-a8d4-7a5602b780d1", "title": "Potential PowerShell Command Line Obfuscation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_cmdline_special_characters.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "title": "Abusing Print Executable", "file": "../sigma/rules/windows/process_creation/proc_creation_win_print_remote_file_copy.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "title": "PktMon.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pktmon_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "title": "Phishing Pattern ISO in Archive", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_archiver_iso_phishing.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "title": "Invoke-Obfuscation Via Use Clip", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_clip.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6e897651-f157-4d8f-aaeb-df8151488385", "title": "PowerShell Web Download", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_download_cradles.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "title": "Privilege Escalation via Named Pipe Impersonation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_priv_escalation_via_named_pipe.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9847f263-4a81-424f-970c-875dab15b79b", "title": "Suspicious TSCON Start as SYSTEM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_tscon_localsystem.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "title": "User Added to Remote Desktop Users Group", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_add_user_remote_desktop_group.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "title": "Obfuscated IP Download Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "title": "New User Created Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_user_add.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "title": "HackTool - Inveigh Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_inveigh.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4b046706-5789-4673-b111-66f25fe99534", "title": "Deleted Data Overwritten Via Cipher.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "73bba97f-a82d-42ce-b315-9182e76c57b1", "title": "Imports Registry Key From a File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regedit_import_keys.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "646bc99f-6682-4b47-a73a-17b1b64c9d34", "title": "Execute Files with Msdeploy.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_msdeploy.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6c96fc76-0eb1-11eb-adc1-0242ac120002", "title": "Invoke-Obfuscation STDIN+ Launcher", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_stdin.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7050bba1-1aed-454e-8f73-3f46f09ce56a", "title": "Cloudflared Tunnel Connections Cleanup", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cloudflared_tunnel_cleanup.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9d5a1274-922a-49d0-87f3-8c653483b909", "title": "Uncommon System Information Discovery Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_system_info_uncommon.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "744a188b-0415-4792-896f-11ddb0588dbc", "title": "Potential Process Injection Via Msra.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msra_process_injection.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "title": "Conhost Spawned By Uncommon Parent Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_conhost_uncommon_parent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "faa48cae-6b25-4f00-a094-08947fef582f", "title": "Rar Usage with Password and Compression Level", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rar_compression_with_password.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "70ad0861-d1fe-491c-a45f-fa48148a300d", "title": "File Download via CertOC.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certoc_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a16980c2-0c56-4de0-9a79-17971979efdd", "title": "Cmd.EXE Missing Space Characters Execution Anomaly", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_no_space_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "title": "Mstsc.EXE Execution From Uncommon Parent", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mstsc_run_local_rpd_file_susp_parent.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "954f0af7-62dd-418f-b3df-a84bc2c7a774", "title": "New Remote Desktop Connection Initiated Via Mstsc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mstsc_remote_connection.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a7ee1722-c3c5-aeff-3212-c777e4733217", "title": "Disable Windows Defender AV Security Monitoring", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_disable_defender_av_security_monitoring.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1dde5376-a648-492e-9e54-4241dd9b0c7f", "title": "Diskshadow Script Mode - Uncommon Script Extension Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_ext.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "title": "Suspicious SysAidServer Child", "file": "../sigma/rules/windows/process_creation/proc_creation_win_java_sysaidserver_susp_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "10c14723-61c7-4c75-92ca-9af245723ad2", "title": "HackTool - Potential Impacket Lateral Movement Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_impacket_lateral_movement.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "title": "Potential PowerShell Execution Policy Tampering - ProcCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_set_unsecure_powershell_policy.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "title": "Import PowerShell Modules From Suspicious Directories - ProcCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_import_module_susp_dirs.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "title": "Suspicious Double Extension File Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_double_extension.yml", "status": "stable", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "41421f44-58f9-455d-838a-c398859841d4", "title": "ETW Logging Tamper In .NET Processes Via CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_etw_modification_cmdline.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ae9b0bd7-8888-4606-b444-0ed7410cb728", "title": "Writing Of Malicious Files To The Fonts Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_hiding_malware_in_fonts_folder.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8de1cbe8-d6f5-496d-8237-5f44a721c7a0", "title": "Whoami.EXE Execution Anomaly", "file": "../sigma/rules/windows/process_creation/proc_creation_win_whoami_parent_anomaly.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "title": "NtdllPipe Like Activity Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_ntdllpipe_redirect.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "43103702-5886-11ed-9b6a-0242ac120002", "title": "Suspicious Vsls-Agent Command With AgentExtensionPath Load", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vslsagent_agentextensionpath_load.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "16905e21-66ee-42fe-b256-1318ada2d770", "title": "Start of NT Virtual DOS Machine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_16bit_application.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7530cd3d-7671-43e3-b209-976966f6ea48", "title": "Renamed CURL.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_curl.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "title": "Renamed BOINC Client Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_boinc.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a7c3d773-caef-227e-a7e7-c2f13c622329", "title": "Bad Opsec Defaults Sacrificial Processes With Improper Arguments", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_bad_opsec_sacrificial_processes.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "214641c2-c579-4ecb-8427-0cf19df6842e", "title": "Remote File Download Via Desktopimgdownldr Utility", "file": "../sigma/rules/windows/process_creation/proc_creation_win_desktopimgdownldr_remote_file_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "title": "AgentExecutor PowerShell Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_agentexecutor_potential_abuse.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "07aa184a-870d-413d-893a-157f317f6f58", "title": "Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "title": "Use of TTDInject.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_ttdinject.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "title": "Malicious Windows Script Components File Execution by TAEF Detection", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_use_of_te_bin.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f548a603-c9f2-4c89-b511-b089f7e94549", "title": "Potential Persistence Via Microsoft Compatibility Appraiser", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_persistence_windows_telemetry.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "93199800-b52a-4dec-b762-75212c196542", "title": "PUA - RunXCmd Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_runxcmd.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "526be59f-a573-4eea-b5f7-f0973207634d", "title": "New Process Created Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_process_creation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6345b048-8441-43a7-9bed-541133633d7a", "title": "ManageEngine Endpoint Central Dctask64.EXE Potential Abuse", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dctask64_arbitrary_command_and_dll_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "title": "SQL Client Tools PowerShell Session Detection", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mssql_sqltoolsps_susp_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "25676e10-2121-446e-80a4-71ff8506af47", "title": "Exchange PowerShell Snap-Ins Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_snapins_hafnium.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "title": "Forfiles Command Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_forfiles_proxy_execution_.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ac1c92b4-ac81-405a-9978-4604d78cc47e", "title": "Potential Binary Proxy Execution Via VSDiagnostics.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vsdiagnostics_execution_proxy.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "title": "Potential Arbitrary Code Execution Via Node.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_node_abuse.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bdeb2cff-af74-4094-8426-724dc937f20a", "title": "PowerShell Script Change Permission Via Set-Acl", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_set_acl.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "41f407b5-3096-44ea-a74f-96d04fbc41be", "title": "Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_revoked_cert.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "title": "Renamed MegaSync Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_megasync.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a383dec4-deec-4e6e-913b-ed9249670848", "title": "Potential Signing Bypass Via Windows Developer Features", "file": "../sigma/rules/windows/process_creation/proc_creation_win_systemsettingsadminflows_turn_on_dev_features.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "title": "HackTool - SharpEvtMute Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharpevtmute.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "title": "Sysinternals PsSuspend Suspicious Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_pssuspend_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ac20ae82-8758-4f38-958e-b44a3140ca88", "title": "Invoke-Obfuscation Via Use MSHTA", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "54786ddc-5b8a-11ed-9b6a-0242ac120002", "title": "Suspicious Ping/Del Command Combination", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_ping_del_combined_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "41ca393d-538c-408a-ac27-cf1e038be80c", "title": "Directory Removal Via Rmdir", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_rmdir_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "title": "Potentially Suspicious CMD Shell Output Redirect", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_redirection_susp_folder.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cd71385d-fd9b-4691-9b98-2b1f7e508714", "title": "Lolbin Runexehelper Use As Proxy", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_runexehelper.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c625d754-6a3d-4f65-9c9a-536aea960d37", "title": "Permission Check Via Accesschk.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_accesschk_check_permissions.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c8a180d6-47a3-4345-a609-53f9c3d834fc", "title": "Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_get_localgroup_member_recon.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "title": "CMSTP UAC Bypass via COM Object Access", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp_com_object_access.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "044ba588-dff4-4918-9808-3f95e8160606", "title": "Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_copy_dmp_from_share.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1af57a4b-460a-4738-9034-db68b880c665", "title": "PowerShell SAM Copy", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_sam_access.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "title": "Run PowerShell Script from ADS", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_run_script_from_ads.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1dd05363-104e-4b4a-b963-196a534b03a1", "title": "Potential Suspicious Mofcomp Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mofcomp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "title": "Non-privileged Usage of Reg or Powershell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_non_priv_reg_or_ps.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "title": "Potential Renamed Rundll32 Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_rundll32_dllregisterserver.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "title": "Suspicious Service DACL Modification Via Set-Service Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_service_dacl_modification_set_service.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "84b1ecf9-6eff-4004-bafb-bae5c0e251b2", "title": "Potentially Suspicious GoogleUpdate Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_googleupdate_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "204b17ae-4007-471b-917b-b917b315c5db", "title": "Greedy File Deletion Using Del", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_del_greedy_deletion.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "title": "PUA - PingCastle Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_pingcastle.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "50d66fb0-03f8-4da0-8add-84e77d12a020", "title": "Suspicious RunAs-Like Flag Combination", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_privilege_escalation_cli_patterns.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "title": "Tasks Folder Evasion", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_task_folder_evasion.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c2b86e67-b880-4eec-b045-50bc98ef4844", "title": "HackTool - LaZagne Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_lazagne.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "title": "SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "title": "PowerShell Get-Process LSASS", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_getprocess_lsass.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "title": "Suspicious Child Process Of Wermgr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wermgr_susp_child_process.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5722dff1-4bdd-4949-86ab-fbaf707e767a", "title": "PUA - System Informer Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_system_informer.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "title": "Potential Powershell ReverseShell Connection", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_reverse_shell_connection.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "eb2d07d4-49cb-4523-801a-da002df36602", "title": "HackTool - EDRSilencer Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_edrsilencer.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e593cf51-88db-4ee1-b920-37e89012a3c9", "title": "Potentially Suspicious Rundll32 Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "90d6bd71-dffb-4989-8d86-a827fedd6624", "title": "Visual Studio Code Tunnel Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vscode_tunnel_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "89a9a0e0-f61a-42e5-8957-b1479565a658", "title": "UAC Bypass WSReset", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset_integrity_level.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8202070f-edeb-4d31-a010-a26c72ac5600", "title": "Suspicious Process By Web Server Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_webshell_susp_process_spawned_from_webserver.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "title": "Security Privileges Enumeration Via Whoami.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_whoami_priv_discovery.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3268b746-88d8-4cd3-bffc-30077d02c787", "title": "HackTool - Empire PowerShell UAC Bypass", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_empire_powershell_uac_bypass.yml", "status": "stable", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "811e0002-b13b-4a15-9d00-a613fce66e42", "title": "PUA - Process Hacker Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_process_hacker.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "18988e1b-9087-4f8a-82fe-0414dce49878", "title": "Execute Code with Pester.bat as Parent", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_pester.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "title": "Suspicious Powercfg Execution To Change Lock Screen Timeout", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powercfg_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f53714ec-5077-420e-ad20-907ff9bb2958", "title": "Forfiles.EXE Child Process Masquerading", "file": "../sigma/rules/windows/process_creation/proc_creation_win_forfiles_child_process_masquerading.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f117933c-980c-4f78-b384-e3d838111165", "title": "Windows Share Mount Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_use_mount_share.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "title": "Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_zip_compress.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a29c1813-ab1f-4dde-b489-330b952e91ae", "title": "Suspicious Network Command", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_network_command.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "title": "Tor Client/Browser Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_tor_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b655a06a-31c0-477a-95c2-3726b83d649d", "title": "Suspicious Userinit Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_userinit_child.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "21d856f9-9281-4ded-9377-51a1a6e2a432", "title": "Potential Persistence Via Logon Scripts - CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_logon_script.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b66474aa-bd92-4333-a16c-298155b120df", "title": "Potential Persistence Via Powershell Search Order Hijacking - Task", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_powershell_persistence.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b2309017-4235-44fe-b5af-b15363011957", "title": "Uncommon Child Process Of Defaultpack.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_defaultpack_uncommon_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "title": "Renamed AutoHotkey.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_autohotkey.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "title": "Devtoolslauncher.exe Executes Specified Binary", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_devtoolslauncher.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "62510e69-616b-4078-b371-847da438cc03", "title": "Share And Session Enumeration Using Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_view_share_and_sessions_enum.yml", "status": "stable", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "title": "Copy From Or To Admin Share Or Sysvol Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_copy_lateral_movement.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "title": "Unsigned AppX Installation Attempt Using Add-AppxPackage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_install_unsigned_appx_packages.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a743ceba-c771-4d75-97eb-8a90f7f4844c", "title": "UAC Bypass Using PkgMgr and DISM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_pkgmgr_dism.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "title": "Browser Execution In Headless Mode", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_exec.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "title": "Nslookup PowerShell Download Cradle - ProcessCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_nslookup_poweshell_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "title": "Insecure Transfer Via Curl.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_insecure_connection.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "285b85b1-a555-4095-8652-a8a4106af63f", "title": "Suspicious Rundll32 Setupapi.dll Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_setupapi_installhinfsection.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "84f52741-8834-4a8c-a413-2eb2269aa6c8", "title": "DllUnregisterServer Function Call Via Msiexec.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msiexec_dll.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "762f2482-ff21-4970-8939-0aa317a886bb", "title": "HackTool - Certify Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_certify.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "title": "Suspicious Encoded PowerShell Command Line", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "title": "Renamed BrowserCore.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_browsercore.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "be344333-921d-4c4d-8bb8-e584cf584780", "title": "Potentially Suspicious Event Viewer Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_eventvwr_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "title": "Indirect Command Execution By Program Compatibility Wizard", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_pcwrun.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "title": "Potential COM Objects Download Cradles Usage - Process Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_download_com_cradles.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fb843269-508c-4b76-8b8d-88679db22ce7", "title": "Suspicious Execution of Powershell with Base64", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_encode.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "title": "Script Event Consumer Spawning Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_scrcons_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "de587dce-915e-4218-aac4-835ca6af6f70", "title": "Potential Persistence Attempt Via Run Keys Using Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_add_run_key.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c7942406-33dd-4377-a564-0f62db0593a3", "title": "Suspicious CodePage Switch Via CHCP", "file": "../sigma/rules/windows/process_creation/proc_creation_win_chcp_codepage_switch.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ab9e3b40-0c85-4ba1-aede-455d226fd124", "title": "Suspicious Redirection to Local Admin Share", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_redirect_local_admin_share.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ef61af62-bc74-4f58-b49b-626448227652", "title": "Suspicious Active Directory Database Snapshot Via ADExplorer", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_adexplorer_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a20391f8-76fb-437b-abc0-dba2df1952c6", "title": "Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pressanykey_lolbin_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "899133d5-4d7c-4a7f-94ee-27355c879d90", "title": "Python Inline Command Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "24c77512-782b-448a-8950-eddb0785fc71", "title": "SQLite Chromium Profile Data DB Access", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sqlite_chromium_profile_data.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1ac8666b-046f-4201-8aba-1951aaec03a3", "title": "Command Line Execution with Suspicious URL and AppData Strings", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_http_appdata.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1c67a717-32ba-409b-a45d-0fb704a73a81", "title": "System Network Connections Discovery Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_use_network_connections_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "title": "SafeBoot Registry Key Deleted Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_delete_safeboot.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "title": "Remote Code Execute via Winrm.vbs", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winrm_execution_via_scripting_api_winrm_vbs.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "eca49c87-8a75-4f13-9c73-a5a29e845f03", "title": "Suspicious Runscripthelper.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_runscripthelper.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "435e10e4-992a-4281-96f3-38b11106adde", "title": "Computer Discovery And Export Via Get-ADComputer Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_computer_discovery_get_adcomputer.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b3512211-c67e-4707-bedc-66efc7848863", "title": "Potential PowerShell Downgrade Attack", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_downgrade_attack.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c15a46a0-07d4-4c87-b4b6-89207835a83b", "title": "Add Potential Suspicious New Download Source To Winget", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winget_add_susp_custom_source.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "title": "Kernel Memory Dump Via LiveKD", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_livekd_kernel_memory_dump.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "title": "PowerShell DownloadFile", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_susp_ps_downloadfile.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "title": "Suspicious Kernel Dump Using Dtrace", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dtrace_kernel_dump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1f0f6176-6482-4027-b151-00071af39d7e", "title": "Arbitrary File Download Via ConfigSecurityPolicy.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_configsecuritypolicy_download_file.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "title": "Compressed File Creation Via Tar.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_tar_compression.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "title": "Potentially Suspicious WebDAV LNK Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_webdav_lnk_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "title": "Potential Provlaunch.EXE Binary Proxy Execution Abuse", "file": "../sigma/rules/windows/process_creation/proc_creation_win_provlaunch_potential_abuse.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9257c05b-4a4a-48e5-a670-b7b073cf401b", "title": "Binary Proxy Execution Via Dotnet-Trace.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dotnet_trace_lolbin_execution.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "title": "Add New Download Source To Winget", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winget_add_custom_source.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "title": "Write Protect For Storage Disabled", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_write_protect_for_storage_disabled.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "title": "File Encoded To Base64 Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_encode.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "99793437-3e16-439b-be0f-078782cf953d", "title": "Tap Installer Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_tapinstall_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "title": "Suspicious File Download From IP Via Wget.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wget_download_direct_ip.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "title": "Potential Credential Dumping Attempt Using New NetworkProvider - CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_new_network_provider.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "title": "Wusa.EXE Executed By Parent Process Located In Suspicious Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wusa_susp_parent_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ac175779-025a-4f12-98b0-acdaeb77ea85", "title": "PowerShell Script Run in AppData", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_susp_ps_appdata.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "title": "Fsutil Drive Enumeration", "file": "../sigma/rules/windows/process_creation/proc_creation_win_fsutil_drive_enumeration.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "90d50722-0483-4065-8e35-57efaadd354d", "title": "Arbitrary MSI Download Via Devinit.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_devinit_lolbin_usage.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "180c7c5c-d64b-4a63-86e9-68910451bc8b", "title": "Potential File Download Via MS-AppInstaller Protocol Handler", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_ms_appinstaller_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d55b793d-f847-4eea-b59a-5ab09908ac90", "title": "Suspicious Child Process Of Veeam Dabatase", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mssql_veaam_susp_child_processes.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aef9d1f1-7396-4e92-a927-4567c7a495c1", "title": "Suspicious Git Clone", "file": "../sigma/rules/windows/process_creation/proc_creation_win_git_susp_clone.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ed825c86-c009-4014-b413-b76003e33d35", "title": "Windows Binary Executed From WSL", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wsl_windows_binaries_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6c6d9280-e6d0-4b9d-80ac-254701b64916", "title": "Potential NTLM Coercion Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_ntlm_coercion.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "title": "Suspicious Control Panel DLL Load", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_susp_control_dll_load.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9212f354-7775-4e28-9c9f-8f0a4544e664", "title": "Active Directory Database Snapshot Via ADExplorer", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_adexplorer_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b697e69c-746f-4a86-9f59-7bfff8eab881", "title": "UAC Bypass Using Disk Cleanup", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_cleanmgr.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "title": "Suspicious Invoke-WebRequest Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_invoke_webrequest_download.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ffa6861c-4461-4f59-8a41-578c39f3f23e", "title": "LSASS Dump Keyword In CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_lsass_dmp_cli_keywords.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a0459f02-ac51-4c09-b511-b8c9203fc429", "title": "Potential Process Execution Proxy Via CL_Invocation.ps1", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_cl_invocation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "title": "PsExec Service Child Process Execution as LOCAL SYSTEM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_psexesvc_as_system.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "title": "HackTool - Htran/NATBypass Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_htran_or_natbypass.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "title": "Registry Modification Via Regini.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regini_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "534f2ef7-e8a2-4433-816d-c91bccde289b", "title": "Explorer NOUACCHECK Flag", "file": "../sigma/rules/windows/process_creation/proc_creation_win_explorer_nouaccheck.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "title": "New Port Forwarding Rule Added Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_port_forwarding.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "590a5f4c-6c8c-4f10-8307-89afe9453a9d", "title": "Suspicious Child Process Created as System", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_child_process_as_system_.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "84232095-ecca-4015-b0d7-7726507ee793", "title": "Suspicious DLL Loaded via CertOC.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certoc_load_dll_susp_locations.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "38646daa-e78f-4ace-9de0-55547b2d30da", "title": "PUA - Seatbelt Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_seatbelt.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4e2ed651-1906-4a59-a78a-18220fca1b22", "title": "PUA - NirCmd Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_nircmd.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "96036718-71cc-4027-a538-d1587e0006a7", "title": "Windows Processes Suspicious Parent Directory", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_proc_wrong_parent.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d21374ff-f574-44a7-9998-4a8c8bf33d7d", "title": "WmiPrvSE Spawned A Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmiprvse_spawning_process.yml", "status": "stable", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "60f16a96-db70-42eb-8f76-16763e333590", "title": "New Capture Session Launched Via DXCap.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dxcap_arbitrary_binary_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5afee48e-67dd-4e03-a783-f74259dcf998", "title": "Potential LSASS Process Dump Via Procdump", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_procdump_lsass.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "title": "Suspicious Processes Spawned by Java.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_java_susp_child_process.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "771d1eb5-9587-4568-95fb-9ec44153a012", "title": "PUA - NSudo Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_nsudo.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "title": "Uninstall Sysinternals Sysmon", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_sysmon_uninstall.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "title": "PowerShell Web Access Feature Enabled Via DISM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dism_enable_powershell_web_access_feature.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e28a5a99-da44-436d-b7a0-2afc20a5f413", "title": "Whoami Utility Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_whoami_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "title": "Potential Memory Dumping Activity Via LiveKD", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_livekd_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "title": "HackTool - F-Secure C3 Load by Rundll32", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_c3_rundll32_pattern.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "68d37776-61db-42f5-bf54-27e87072d17e", "title": "PUA - NPS Tunneling Tool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_nps.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c4e49831-1496-40cf-8ce1-b53f942b02f9", "title": "Renamed PAExec Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_paexec.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "title": "Fsutil Behavior Set SymlinkEvaluation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_fsutil_symlinkevaluation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "title": "Base64 MZ Header In CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_inline_base64_mz_header.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "title": "Suspicious Rundll32 Execution With Image Extension", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_susp_execution_with_image_extension.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2c32b543-1058-4808-91c6-5b31b8bed6c5", "title": "PUA - Crassus Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_crassus.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "title": "Schtasks From Suspicious Folders", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_folder_combos.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d2b749ee-4225-417e-b20e-a8d2193cbb84", "title": "PUA - AdvancedRun Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_advancedrun.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1193d960-2369-499f-a158-7b50a31df682", "title": "Potential Suspicious Browser Launch From Document Reader Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_browser_launch_from_document_reader_process.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6b65c28e-11f3-46cb-902a-68f2cafaf474", "title": "Odbcconf.EXE Suspicious DLL Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_odbcconf_exec_susp_locations.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "242301bc-f92f-4476-8718-78004a6efd9f", "title": "DLL Loaded via CertOC.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certoc_load_dll.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "title": "Diskshadow Script Mode - Execution From Potential Suspicious Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_location.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "title": "Monitoring For Persistence Via BITS", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "52d097e2-063e-4c9c-8fbb-855c8948d135", "title": "Suspicious Windows Update Agent Empty Cmdline", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wuauclt_no_cli_flags_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "title": "Process Memory Dump via RdrLeakDiag.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "647c7b9e-d784-4fda-b9a0-45c565a7b729", "title": "Operator Bloopers Cobalt Strike Commands", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_bloopers_cmd.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "title": "Suspicious Mshta.EXE Execution Patterns", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mshta_susp_pattern.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "title": "Potential Encoded PowerShell Patterns In CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_encoding_patterns.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bb76d96b-821c-47cf-944b-7ce377864492", "title": "Suspicious NTLM Authentication on the Printer Spooler Service", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_ntlmrelay.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "title": "Detection of PowerShell Execution via Sqlps.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mssql_sqlps_susp_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1816994b-42e1-4fb1-afd2-134d88184f71", "title": "PowerShell Base64 Encoded WMI Classes", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_wmi_classes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "12827a56-61a4-476a-a9cb-f3068f191073", "title": "HackTool - KrbRelayUp Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_krbrelayup.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "32b96012-7892-429e-b26c-ac2bf46066ff", "title": "Shell32 DLL Execution in Suspicious Directory", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_shell32_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "title": "Potential Mpclient.DLL Sideloading Via Defender Binaries", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mpcmdrun_dll_sideload_defender.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f4bbd493-b796-416e-bbf2-121235348529", "title": "Non Interactive PowerShell Process Spawned", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_non_interactive_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "title": "PUA - Advanced IP Scanner Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "title": "Persistence Via TypedPaths - CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_typed_paths_persistence.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d06be4b9-8045-428b-a567-740a26d9db25", "title": "Verclsid.exe Runs COM Object", "file": "../sigma/rules/windows/process_creation/proc_creation_win_verclsid_runs_com.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "title": "Remote Access Tool - AnyDesk Silent Installation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_silent_install.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "title": "Suspicious FromBase64String Usage On Gzip Archive - Process Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_frombase64string_archive.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7a01183d-71a2-46ad-ad5c-acd989ac1793", "title": "UAC Bypass Abusing Winsat Path Parsing - Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_winsat.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "65c3ca2c-525f-4ced-968e-246a713d164f", "title": "Visual Studio NodejsTools PressAnyKey Renamed Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_pressanykey.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "347906f3-e207-4d18-ae5b-a9403d6bcdef", "title": "Netsh Allow Group Policy on Microsoft Defender Firewall", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_fw_enable_group_rule.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a29808fd-ef50-49ff-9c7a-59a9b040b404", "title": "HackTool - Pypykatz Credentials Dumping Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_pypykatz.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e66779cc-383e-4224-a3a4-267eeb585c40", "title": "Bypass UAC via CMSTP", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "85c312b7-f44d-4a51-a024-d671c40b49fc", "title": "Service StartupType Change Via Sc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_disable_service.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6da2c9f5-7c53-401b-aacb-92c040ce1215", "title": "Use of W32tm as Timer", "file": "../sigma/rules/windows/process_creation/proc_creation_win_w32tm.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6bd75993-9888-4f91-9404-e1e4e4e34b77", "title": "HackTool - LocalPotato Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_localpotato.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "title": "Potential MsiExec Masquerading", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msiexec_masquerading.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ff992eac-6449-4c60-8c1d-91c9722a1d48", "title": "New Root Certificate Installed Via CertMgr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certmgr_certificate_installation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "title": "Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_1.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "208748f7-881d-47ac-a29c-07ea84bf691d", "title": "Suspicious Outlook Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "89ca78fd-b37c-4310-b3d3-81a023f83936", "title": "Schtasks Creation Or Modification With SYSTEM Privileges", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_system.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a2910908-e86f-4687-aeba-76a5f996e652", "title": "DLL Execution Via Register-cimprovider.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_cimprovider_dll_load.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "title": "Php Inline Command Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_php_inline_command_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9c14c9fa-1a63-4a64-8e57-d19280559490", "title": "Invoke-Obfuscation Via Stdin", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_stdin.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "221b251a-357a-49a9-920a-271802777cc0", "title": "Process Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "50919691-7302-437f-8e10-1fe088afa145", "title": "Regsvr32 DLL Execution With Uncommon Extension", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_uncommon_extension.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "title": "Windows Internet Hosted WebDav Share Mount Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_use_mount_internet_share.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "title": "File Download From IP Based URL Via CertOC.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certoc_download_direct_ip.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f14e169e-9978-4c69-acb3-1cff8200bc36", "title": "Suspicious GrpConv Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_susp_grpconv.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "title": "Copy From VolumeShadowCopy Via Cmd.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_shadowcopy_access.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "title": "Potential ReflectDebugger Content Execution Via WerFault.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_werfault_reflect_debugger_exec.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1c8774a0-44d4-4db0-91f8-e792359c70bd", "title": "REGISTER_APP.VBS Proxy Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_register_app.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "title": "Run PowerShell Script from Redirected Input Stream", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_run_script_from_input_stream.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9fc3072c-dc8f-4bf7-b231-18950000fadd", "title": "Potential Recon Activity Using DriverQuery.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_driverquery_recon.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "title": "Potentially Suspicious Ping/Copy Command Combination", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_ping_copy_combined_execution.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ada4b0c4-758b-46ac-9033-9004613a150d", "title": "Modify Group Policy Settings", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_modify_group_policy_settings.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "584bca0f-3608-4402-80fd-4075ff6072e3", "title": "Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_unicode_img.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9a132afa-654e-11eb-ae93-0242ac130002", "title": "PUA - AdFind Suspicious Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "title": "Suspicious Process Created Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_susp_process_creation.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a70dcb37-3bee-453a-99df-d0c683151be6", "title": "Firewall Rule Update Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_fw_set_rule.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "85b0b087-eddf-4a2b-b033-d771fa2b9775", "title": "PowerShell Download and Execution Cradles", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_download_iex.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2267fe65-0681-42ad-9a6d-46553d3f3480", "title": "WSL Child Process Anomaly", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wsl_child_processes_anomalies.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "28c8f68b-098d-45af-8d43-8089f3e35403", "title": "Potential Register_App.Vbs LOLScript Abuse", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolscript_register_app.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cd8c163e-a19b-402e-bdd5-419ff5859f12", "title": "HackTool - ADCSPwn Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_adcspwn.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "title": "Sensitive File Access Via Volume Shadow Copy Backup", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_sensitive_file_access_shadowcopy.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "title": "Control Panel Items", "file": "../sigma/rules/windows/process_creation/proc_creation_win_control_panel_item.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2c28c248-7f50-417a-9186-a85b223010ee", "title": "Wscript Shell Run In CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mshta_inline_vbscript.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "84972c80-251c-4c3a-9079-4f00aad93938", "title": "Sensitive File Recovery From Backup Via Wbadmin.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wbadmin_restore_sensitive_files.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "224f140f-3553-4cd1-af78-13d81bf9f7cc", "title": "Potential RDP Session Hijacking Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_tscon_rdp_session_hijacking.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "434c08ba-8406-4d15-8b24-782cb071a691", "title": "PowerShell Execution With Potential Decryption Capabilities", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_decrypt_pattern.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bed2a484-9348-4143-8a8a-b801c979301c", "title": "Webshell Detection With Command Line Keywords", "file": "../sigma/rules/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a0d7e4d2-bede-4141-8896-bc6e237e977c", "title": "Suspicious File Download From File Sharing Domain Via Wget.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wget_download_susp_file_sharing_domains.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "title": "Dynamic .NET Compilation Via Csc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_csc_susp_dynamic_compilation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1c526788-0abe-4713-862f-b520da5e5316", "title": "Chromium Browser Headless Execution To Mockbin Like Site", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_chromium_mockbin_abuse.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "title": "RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_remotefxvgpudisablement_abuse.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "title": "Disable Important Scheduled Task", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_disable.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9f107a84-532c-41af-b005-8d12a607639f", "title": "Potentially Suspicious Cabinet File Expansion", "file": "../sigma/rules/windows/process_creation/proc_creation_win_expand_cabinet_files.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3", "title": "Potential Credential Dumping Via WER", "file": "../sigma/rules/windows/process_creation/proc_creation_win_werfault_lsass_shtinkering.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "455b9d50-15a1-4b99-853f-8d37655a4c1b", "title": "PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dee0a7a3-f200-4112-a99b-952196d81e42", "title": "DumpMinitool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dumpminitool_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "title": "Remote Access Tool - Anydesk Execution From Suspicious Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_susp_exec.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "79ce34ca-af29-4d0e-b832-fc1b377020db", "title": "Whoami.EXE Execution From Privileged Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_whoami_execution_from_high_priv_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2afafd61-6aae-4df4-baed-139fa1f4c345", "title": "Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ntdsutil_usage.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b52e84a3-029e-4529-b09b-71d19dd27e94", "title": "Remote Access Tool - AnyDesk Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "title": "CMSTP Execution Process Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmstp_execution_by_creation.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f0507c0f-a3a2-40f5-acc6-7f543c334993", "title": "Suspicious File Execution From Internet Hosted WebDav Share", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_net_use_and_exec_combo.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "970007b7-ce32-49d0-a4a4-fbef016950bd", "title": "Potential Configuration And Service Reconnaissance Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_query_registry.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "title": "Potential Provisioning Registry Key Abuse For Binary Proxy Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_provlaunch_provisioning_command.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f4264e47-f522-4c38-a420-04525d5b880f", "title": "Renamed AutoIt Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_autoit.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b2ddd389-f676-4ac4-845a-e00781a48e5f", "title": "Using SettingSyncHost.exe as LOLBin", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_settingsynchost.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "title": "Uncommon Child Process Of Setres.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_setres_uncommon_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4a6713f6-3331-11ed-a261-0242ac120002", "title": "Taskkill Symantec Endpoint Protection", "file": "../sigma/rules/windows/process_creation/proc_creation_win_taskkill_sep.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "title": "Windows Kernel Debugger Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_kd_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "title": "Renamed AdFind Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_adfind.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5cc2cda8-f261-4d88-a2de-e9e193c86716", "title": "Suspicious Processes Spawned by WinRM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winrm_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2d22a514-e024-4428-9dba-41505bd63a5b", "title": "Indirect Command Execution From Script File Via Bash.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bash_file_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "title": "Ie4uinit Lolbin Use From Invalid Path", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_ie4uinit.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "01c42d3c-242d-4655-85b2-34f1739632f7", "title": "Potentially Over Permissive Permissions Granted Using Dsacls.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dsacls_abuse_permissions.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "title": "Suspicious Scheduled Task Creation via Masqueraded XML File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_schedule_via_masqueraded_xml_file.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "77946e79-97f1-45a2-84b4-f37b5c0d8682", "title": "Suspicious Registry Modification From ADS Via Regini.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regini_ads.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "27ba3207-dd30-4812-abbf-5d20c57d474e", "title": "Suspicious Chromium Browser Instance Executed With Custom Extension", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "title": "Pubprn.vbs Proxy Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_pubprn.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "title": "HackTool - SharpMove Tool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharpmove.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1228c958-e64e-4e71-92ad-7d429f4138ba", "title": "Script Interpreter Execution From Suspicious Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_script_exec_from_env_folder.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "title": "BitLockerTogo.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bitlockertogo_execution.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "title": "Suspicious WindowsTerminal Child Processes", "file": "../sigma/rules/windows/process_creation/proc_creation_win_windows_terminal_susp_children.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b1377339-fda6-477a-b455-ac0923f9ec2c", "title": "Remote Access Tool - AnyDesk Piped Password Via CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_piped_password_via_cli.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "44143844-0631-49ab-97a0-96387d6b2d7c", "title": "File Download Using Notepad++ GUP Utility", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gup_download.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "title": "PUA - Potential PE Metadata Tamper Using Rcedit", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "title": "Potential Crypto Mining Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_crypto_mining_monero.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "85de1f22-d189-44e4-8239-dc276b45379b", "title": "Curl Web Request With Potential Custom User-Agent", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_custom_user_agent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "92626ddd-662c-49e3-ac59-f6535f12d189", "title": "Scheduled Task Creation Via Schtasks.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_creation.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "title": "Hidden Powershell in Link File Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_embed_exe_lnk.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "title": "Potential Suspicious Windows Feature Enabled - ProcCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_enable_susp_windows_optional_feature.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "title": "Chromium Browser Instance Executed With Custom Extension", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_chromium_load_extension.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e56d3073-83ff-4021-90fe-c658e0709e72", "title": "Gpresult Display Group Policy Information", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gpresult_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "deb9b646-a508-44ee-b7c9-d8965921c6b6", "title": "Powershell Token Obfuscation - Process Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_token_obfuscation.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "title": "Suspicious Extrac32 Alternate Data Stream Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cea2b7ea-792b-405f-95a1-b903ea06458f", "title": "Suspicious Child Process Of Manage Engine ServiceDesk", "file": "../sigma/rules/windows/process_creation/proc_creation_win_java_manageengine_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "title": "Suspicious Binary In User Directory Spawned From Office Application", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_spawn_exe_from_users_directory.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "title": "Remote Access Tool - ScreenConnect Installation Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_installation_cli_param.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "730fc21b-eaff-474b-ad23-90fd265d4988", "title": "Psexec Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_psexec_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "title": "HackTool - Wmiexec Default Powershell Command", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_wmiexec_default_powershell.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "title": "HackTool - RemoteKrbRelay Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_krbrelay_remote.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "title": "Rundll32 InstallScreenSaver Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_installscreensaver.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "48917adc-a28e-4f5d-b729-11e75da8941f", "title": "Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_defender_exclusion.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "title": "Suspicious Scan Loop Network", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_network_scan_loop.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0900463c-b33b-49a8-be1d-552a3b553dae", "title": "Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_hidden_dir_index_allocation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "82a6714f-4899-4f16-9c1e-9a333544d4c3", "title": "File In Suspicious Location Encoded To Base64 Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "title": "Add Insecure Download Source To Winget", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winget_add_insecure_custom_source.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1e59c230-6670-45bf-83b0-98903780607e", "title": "Gpscript Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_gpscript.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "title": "HackTool - CrackMapExec PowerShell Obfuscation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_powershell_obfuscation.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5687f942-867b-4578-ade7-1e341c46e99a", "title": "VMToolsd Suspicious Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vmware_vmtoolsd_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "258fc8ce-8352-443a-9120-8a11e4857fa5", "title": "Potential Arbitrary Command Execution Using Msdt.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msdt_arbitrary_command_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "title": "Renamed CreateDump Utility Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_createdump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "title": "HH.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hh_chm_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "title": "File Download Using ProtocolHandler.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_protocolhandler_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4ae81040-fc1c-4249-bfa3-938d260214d9", "title": "Use Icacls to Hide File to Everyone", "file": "../sigma/rules/windows/process_creation/proc_creation_win_icacls_deny.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aa2efee7-34dd-446e-8a37-40790a66efd7", "title": "Recon Information for Export with Command Prompt", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_recon.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "title": "New Generic Credentials Added Via Cmdkey.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmdkey_adding_generic_creds.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "title": "Suspicious RDP Redirect Using TSCON", "file": "../sigma/rules/windows/process_creation/proc_creation_win_tscon_rdp_redirect.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "title": "File Encryption/Decryption Via Gpg4win From Suspicious Locations", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gpg4win_susp_location.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ae215552-081e-44c7-805f-be16f975c8a2", "title": "Suspicious Debugger Registration Cmdline", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_install_reg_debugger_backdoor.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "30bf1789-379d-4fdc-900f-55cd0a90a801", "title": "Visual Studio Code Tunnel Service Installation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vscode_tunnel_service_install.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "title": "COM Object Execution via Xwizard.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_xwizard_runwizard_com_object_exec.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "198effb6-6c98-4d0c-9ea3-451fa143c45c", "title": "Run Once Task Execution as Configured in Registry", "file": "../sigma/rules/windows/process_creation/proc_creation_win_runonce_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4f7a6757-ff79-46db-9687-66501a02d9ec", "title": "Active Directory Structure Export Via Ldifde.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ldifde_export.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e01fa958-6893-41d4-ae03-182477c5e77d", "title": "Remote Access Tool - RURAT Execution From Unusual Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_rurat_non_default_location.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "129966c9-de17-4334-a123-8b58172e664d", "title": "Potential Windows Defender AV Bypass Via Dump64.EXE Rename", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dump64_defender_av_bypass_rename.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "696bfb54-227e-4602-ac5b-30d9d2053312", "title": "Veeam Backup Database Suspicious Query", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sqlcmd_veeam_db_recon.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d85873ef-a0f8-4c48-a53a-6b621f11729d", "title": "Remote Access Tool - LogMeIn Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_logmein.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "title": "RDP Port Forwarding Rule Added Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_port_forwarding_3389.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7df1713a-1a5b-4a4b-a071-dc83b144a101", "title": "Esentutl Gather Credentials", "file": "../sigma/rules/windows/process_creation/proc_creation_win_esentutl_params.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a96970af-f126-420d-90e1-d37bf25e50e1", "title": "Use Short Name Path in Image", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_image.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "title": "Renamed Cloudflared.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_cloudflared.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "title": "Potential Execution of Sysinternals Tools", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_eula_accepted.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "814c95cc-8192-4378-a70a-f1aafd877af1", "title": "Use of OpenConsole", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_openconsole.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "title": "File With Suspicious Extension Downloaded Via Bitsadmin", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "99c840f2-2012-46fd-9141-c761987550ef", "title": "Suspicious Download From Direct IP Via Bitsadmin", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "02b18447-ea83-4b1b-8805-714a8a34546a", "title": "Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_offlinescannershell_mpclient_sideloading.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "title": "File Download with Headless Browser", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "de16d92c-c446-4d53-8938-10aeef41c8b6", "title": "Computer Password Change Via Ksetup.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ksetup_password_change_computer.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "056c7317-9a09-4bd4-9067-d051312752ea", "title": "Powershell Executed From Headless ConHost Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "60fc936d-2eb0-4543-8a13-911c750a1dfc", "title": "Interactive AT Job", "file": "../sigma/rules/windows/process_creation/proc_creation_win_at_interactive_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "title": "Suspicious Curl.EXE Download", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_susp_download.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "title": "Reg Add Suspicious Paths", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_susp_paths.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "114de787-4eb2-48cc-abdb-c0b449f93ea4", "title": "Suspicious X509Enrollment - Process Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_x509enrollment.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "207b0396-3689-42d9-8399-4222658efc99", "title": "Potential Privilege Escalation To LOCAL SYSTEM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_susp_psexec_paexec_flags.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "title": "Execute Code with Pester.bat", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_pester_1.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9248c7e1-2bf3-4661-a22c-600a8040b446", "title": "Potential Rundll32 Execution With DLL Stored In ADS", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_ads_stored_dll_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "146aace8-9bd6-42ba-be7a-0070d8027b76", "title": "Potentially Suspicious Child Process Of WinRAR.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winrar_susp_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3d7679bd-0c00-440c-97b0-3f204273e6c7", "title": "New Process Created Via Taskmgr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_taskmgr_susp_child_process.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ea011323-7045-460b-b2d7-0f7442ea6b38", "title": "Potential PsExec Remote Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_psexec_remote_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "title": "Suspicious Regsvr32 Execution From Remote Share", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_remote_share.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e290b10b-1023-4452-a4a9-eb31a9013b3a", "title": "LOLBAS Data Exfiltration by DataSvcUtil.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_data_exfiltration_by_using_datasvcutil.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ca5583e9-8f80-46ac-ab91-7f314d13b984", "title": "Potentially Suspicious Child Process of KeyScrambler.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_keyscrambler_susp_child_process.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "80fc36aa-945e-4181-89f2-2f907ab6775d", "title": "UAC Bypass Using IEInstal - Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_ieinstal.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cd3d1298-eb3b-476c-ac67-12847de55813", "title": "DLL Execution via Rasautou.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_rasautou_dll_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0afbd410-de03-4078-8491-f132303cb67d", "title": "Renamed NetSupport RAT Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_netsupport_rat.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "867356ee-9352-41c9-a8f2-1be690d78216", "title": "Potentially Suspicious Regsvr32 HTTP/FTP Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_network_pattern.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "67f113fa-e23d-4271-befa-30113b3e08b1", "title": "Suspicious JavaScript Execution Via Mshta.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mshta_javascript.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "title": "Arbitrary File Download Via MSPUB.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mspub_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "title": "Use of Wfc.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_wfc.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "title": "Insecure Proxy/DOH Transfer Via Curl.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_insecure_porxy_or_doh.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "62b20d44-1546-4e61-afce-8e175eb9473c", "title": "Service StartupType Change Via PowerShell Set-Service", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_set_service_disabled.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "title": "Suspicious Execution of Systeminfo", "file": "../sigma/rules/windows/process_creation/proc_creation_win_systeminfo_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "title": "User Added to Local Administrators Group", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_add_user_local_admin_group.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "37e8d358-6408-4853-82f4-98333fca7014", "title": "Remote Access Tool - NetSupport Execution From Unusual Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_netsupport_susp_exec.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "title": "Explorer Process Tree Break", "file": "../sigma/rules/windows/process_creation/proc_creation_win_explorer_break_process_tree.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "title": "Active Directory Structure Export Via Csvde.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_csvde_export.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b6676963-0353-4f88-90f5-36c20d443c6a", "title": "Cscript/Wscript Potentially Suspicious Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wscript_cscript_susp_child_processes.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "99cf1e02-00fb-4c0d-8375-563f978dfd37", "title": "Deny Service Access Using Security Descriptor Tampering Via Sc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_sdset_deny_service_access.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "903076ff-f442-475a-b667-4f246bcc203b", "title": "Nltest.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_nltest_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a77c1610-fc73-4019-8e29-0f51efc04a51", "title": "Potential Dosfuscation Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_dosfuscation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "title": "PowerShell Base64 Encoded FromBase64String Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_frombase64string.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "title": "Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_iexpress_susp_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cea72823-df4d-4567-950c-0b579eaf0846", "title": "Potential Dropper Script Execution Via WScript/CScript", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wscript_cscript_dropper.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "74a2b202-73e0-4693-9a3a-9d36146d0775", "title": "Remote Access Tool - MeshAgent Command Execution via MeshCentral", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_meshagent_exec.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5fc297ae-25b6-488a-8f25-cc12ac29b744", "title": "Potentially Suspicious Usage Of Qemu", "file": "../sigma/rules/windows/process_creation/proc_creation_win_qemu_suspicious_execution.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "12f6b752-042d-483e-bf9c-915a6d06ad75", "title": "Windows Firewall Disabled via PowerShell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_disable_firewall.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "title": "Code Execution via Pcwutl.dll", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_pcwutl.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c1d867fe-8d95-4487-aab4-e53f2d339f90", "title": "Renamed Sysinternals Sdelete Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_sdelete.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e13f668e-7f95-443d-98d2-1816a7648a7b", "title": "Detected Windows Software Discovery", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_software_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "863218bd-c7d0-4c52-80cd-0a96c09f54af", "title": "Arbitrary File Download Via IMEWDBLD.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_imewbdld_download.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "title": "Sensitive File Dump Via Wbadmin.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wbadmin_dump_sensitive_files.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9c8c7000-3065-44a8-a555-79bcba5d9955", "title": "Execute MSDT Via Answer File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_msdt_answer_file.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "title": "Cloudflared Portable Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cloudflared_portable_execution.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ee5e119b-1f75-4b34-add8-3be976961e39", "title": "Conhost.exe CommandLine Path Traversal", "file": "../sigma/rules/windows/process_creation/proc_creation_win_conhost_path_traversal.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "33339be3-148b-4e16-af56-ad16ec6c7e7b", "title": "Findstr Launching .lnk File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_lnk.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "title": "Potentially Suspicious Child Process Of Regsvr32", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "01d2e2a1-5f09-44f7-9fc1-24faa7479b6d", "title": "Uncommon Svchost Parent Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_svchost_uncommon_parent_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d937b75f-a665-4480-88a5-2f20e9f9b22a", "title": "Possible Privilege Escalation via Weak Service Permissions", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_change_sevice_image_path_by_non_admin.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "title": "PUA - Ngrok Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_ngrok.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "646ea171-dded-4578-8a4d-65e9822892e3", "title": "Process Memory Dump Via Comsvcs.DLL", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_process_dump_via_comsvcs.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ca387a8e-1c84-4da3-9993-028b45342d30", "title": "PUA - SoftPerfect Netscan Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_netscan.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "84b1706c-932a-44c4-ae28-892b28a25b94", "title": "OneNote.EXE Execution of Malicious Embedded Scripts", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_onenote_embedded_script_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "title": "Arbitrary File Download Via Squirrel.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_squirrel_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "title": "Always Install Elevated MSI Spawned Cmd And Powershell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_elavated_msi_spawned_shell.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1012f107-b8f1-4271-af30-5aed2de89b39", "title": "Terminal Service Process Spawn", "file": "../sigma/rules/windows/process_creation/proc_creation_win_svchost_termserv_proc_spawn.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "074e0ded-6ced-4ebd-8b4d-53f55908119d", "title": "AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winrm_awl_bypass.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "title": "Firewall Rule Deleted Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_fw_delete_rule.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "title": "Whoami.EXE Execution With Output Option", "file": "../sigma/rules/windows/process_creation/proc_creation_win_whoami_output.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "title": "Certificate Exported Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_export_pfx.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1ca6bd18-0ba0-44ca-851c-92ed89a61085", "title": "UAC Bypass Using Consent and Comctl32 - Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_consent_comctl32.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "af491bca-e752-4b44-9c86-df5680533dbc", "title": "Finger.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_finger_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "title": "Suspicious Desktopimgdownldr Command", "file": "../sigma/rules/windows/process_creation/proc_creation_win_desktopimgdownldr_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "title": "Use NTFS Short Name in Image", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_image.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f0f7be61-9cf5-43be-9836-99d6ef448a18", "title": "Uninstall Crowdstrike Falcon Sensor", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uninstall_crowdstrike_falcon.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b1f73849-6329-4069-bc8f-78a604bb8b23", "title": "Remote Access Tool - ScreenConnect Remote Command Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "title": "Suspicious PowerShell Encoded Command Patterns", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd_patterns.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "title": "HackTool - SharpUp PrivEsc Tool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharpup.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "title": "User Added To Highly Privileged Group", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_add_user_privileged_group.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "title": "Potential ShellDispatch.DLL Functionality Abuse", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_shelldispatch_potential_abuse.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "title": "Stop Windows Service Via Sc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_stop_service.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "title": "Potential Credential Dumping Via LSASS Process Clone", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lsass_process_clone.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "title": "Use of Pcalua For Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_pcalua.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3a6586ad-127a-4d3b-a677-1e6eacdf8fde", "title": "Windows Shell/Scripting Processes Spawning Suspicious Programs", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_shell_spawn_susp_program.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "title": "Usage Of Web Request Commands And Cmdlets", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_web_request_cmd_and_cmdlets.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f38a82d2-fba3-4781-b549-525efbec8506", "title": "PUA - 3Proxy Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_3proxy_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "title": "Msxsl.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msxsl_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4833155a-4053-4c9c-a997-777fcea0baa7", "title": "SQLite Firefox Profile Data DB Access", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sqlite_firefox_gecko_profile_data.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0b80ade5-6997-4b1d-99a1-71701778ea61", "title": "Imports Registry Key From an ADS", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "81ebd28b-9607-4478-bf06-974ed9d53ed7", "title": "Potential Application Whitelisting Bypass via Dnx.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dnx_execute_csharp_code.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dc4576d4-7467-424f-9eee-fd2b02855fe0", "title": "Suspicious Cabinet File Execution Via Msdt.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msdt_susp_cab_options.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "title": "Weak or Abused Passwords In CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_weak_or_abused_passwords.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e9142d84-fbe0-401d-ac50-3e519fb00c89", "title": "WhoAmI as Parameter", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_whoami_as_param.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b4dc61f5-6cce-468e-a608-b48b469feaa2", "title": "DirLister Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dirlister_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e6313acd-208c-44fc-a0ff-db85d572e90e", "title": "Network Reconnaissance Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_nslookup_domain_discovery.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f3d39c45-de1a-4486-a687-ab126124f744", "title": "Sdiagnhost Calling Suspicious Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sdiagnhost_susp_child.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "97dbf6e2-e436-44d8-abee-4261b24d3e41", "title": "Microsoft IIS Connection Strings Decryption", "file": "../sigma/rules/windows/process_creation/proc_creation_win_iis_connection_strings_decryption.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "729ce0ea-5d8f-4769-9762-e35de441586d", "title": "MpiExec Lolbin", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_mpiexec.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0fc35fc3-efe6-4898-8a37-0b233339524f", "title": "Suspicious ScreenSave Change by Reg.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_screensaver.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c947b146-0abc-4c87-9c64-b17e9d7274a2", "title": "Shadow Copies Deletion Using Operating Systems Utilities", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "91a2c315-9ee6-4052-a853-6f6a8238f90d", "title": "Findstr GPP Passwords", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_gpp_passwords.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9525dc73-0327-438c-8c04-13c0e037e9da", "title": "Regsvr32 Execution From Potential Suspicious Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_susp_exec_path_1.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a4694263-59a8-4608-a3a0-6f8d3a51664c", "title": "Suspicious Key Manager Access", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_keymgr.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f37aba28-a9e6-4045-882c-d5004043b337", "title": "Potential Arbitrary File Download Via Cmdl32.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmdl32_arbitrary_file_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5e95028c-5229-4214-afae-d653d573d0ec", "title": "Security Service Disabled Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_disable_sec_services.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "88656cec-6c3b-487c-82c0-f73ebb805503", "title": "Remote Access Tool - UltraViewer Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_ultraviewer.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "title": "New DLL Registered Via Odbcconf.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "title": "Suspicious IIS URL GlobalRules Rewrite Via AppCmd", "file": "../sigma/rules/windows/process_creation/proc_creation_win_iis_appcmd_susp_rewrite_rule.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "title": "Suspicious Child Process Of SQL Server", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mssql_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "title": "Suspicious Program Names", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_progname.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f7375e28-5c14-432f-b8d1-1db26c832df3", "title": "Potential Arbitrary DLL Load Using Winword", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_winword_dll_load.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0e0255bf-2548-47b8-9582-c0955c9283f5", "title": "Suspicious Reg Add BitLocker", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_bitlocker.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "title": "Cscript/Wscript Uncommon Script Extension Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wscript_cscript_uncommon_extension_exec.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "57bff678-25d1-4d6c-8211-8ca106d12053", "title": "Remote Access Tool - ScreenConnect Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d65aee4d-2292-4cea-b832-83accd6cfa43", "title": "Arbitrary Binary Execution Using GUP Utility", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gup_arbitrary_binary_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "title": "Scheduled Task Executing Encoded Payload from Registry", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_reg_loader_encoded.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "889719ef-dd62-43df-86c3-768fb08dc7c0", "title": "Suspicious PowerShell Mailbox Export to Share", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_mailboxexport_share.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "037dcd71-33a8-4392-bb01-293c94663e5a", "title": "File Decryption Using Gpg4win", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gpg4win_decryption.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "18ee686c-38a3-4f65-9f44-48a077141f42", "title": "Uncommon Extension Shim Database Installation Via Sdbinst.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sdbinst_susp_extension.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "af77cf95-c469-471c-b6a0-946c685c4798", "title": "Proxy Execution Via Wuauclt.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wuauclt_dll_loading.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "title": "Uncommon AddinUtil.EXE CommandLine Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "title": "Renamed Gpg.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_gpg4win.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4bf943c6-5146-4273-98dd-e958fd1e3abf", "title": "Invoke-Obfuscation Obfuscated IEX Invocation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7f741dcf-fc22-4759-87b4-9ae8376676a2", "title": "Bypass UAC via Fodhelper.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_fodhelper.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8a3038e8-9c9d-46f8-b184-66234a160f6f", "title": "Potential Remote Desktop Tunneling", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_remote_desktop_tunneling.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7d4aaec2-08ed-4430-8b96-28420e030e04", "title": "Uncommon Sigverif.EXE Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sigverif_uncommon_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "75d0a94e-6252-448d-a7be-d953dff527bb", "title": "Remote XSL Execution Via Msxsl.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msxsl_remote_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "327f48c1-a6db-4eb8-875a-f6981f1b0183", "title": "Port Forwarding Activity Via SSH.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ssh_port_forward.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5f03babb-12db-4eec-8c82-7b4cb5580868", "title": "Response File Execution Via Odbcconf.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_odbcconf_response_file.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "title": "Windows Backup Deleted Via Wbadmin.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wbadmin_delete_backups.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "title": "MsiExec Web Install", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msiexec_web_install.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cd1f961e-0b96-436b-b7c6-38da4583ec00", "title": "Suspicious Windows Trace ETW Session Tamper Via Logman.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_logman_disable_eventlog.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7b4f794b-590a-4ad4-ba18-7964a2832205", "title": "Renamed Vmnat.exe Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_vmnat.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "438025f9-5856-4663-83f7-52f878a70a50", "title": "Suspicious Microsoft Office Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_susp_child_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "title": "IIS Native-Code Module Command Line Installation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_iis_appcmd_susp_module_install.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "213d6a77-3d55-4ce8-ba74-fcfef741974e", "title": "Private Keys Reconnaissance Via CommandLine Tools", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_private_keys_recon.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aaafa146-074c-11eb-adc1-0242ac120002", "title": "HackTool - Hydra Password Bruteforce Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_hydra.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2433a154-bb3d-42e4-86c3-a26bdac91c45", "title": "Renamed PingCastle Binary Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_pingcastle.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "178e615d-e666-498b-9630-9ed363038101", "title": "Elevated System Shell Spawned From Uncommon Parent Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_elevated_system_shell_uncommon_parent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "title": "Remote Access Tool - Simple Help Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_simple_help.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4f647cfa-b598-4e12-ad69-c68dd16caef8", "title": "DumpStack.log Defender Evasion", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_dumpstack_log_evasion.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "16c37b52-b141-42a5-a3ea-bbe098444397", "title": "Suspect Svchost Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_svchost_execution_with_no_cli_flags.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "title": "Execution via stordiag.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_stordiag_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cd764533-2e07-40d6-a718-cfeec7f2da7f", "title": "Renamed SysInternals DebugView Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_debugview.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "17769c90-230e-488b-a463-e05c08e9d48f", "title": "Powershell Defender Exclusion", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_defender_exclusion.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "222129f7-f4dc-4568-b0d2-22440a9639ba", "title": "Cloudflared Quick Tunnel Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cloudflared_quicktunnel_execution.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2704ab9e-afe2-4854-a3b1-0c0706d03578", "title": "HackTool - Dumpert Process Dumper Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_dumpert.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "afe52666-401e-4a02-b4ff-5d128990b8cb", "title": "Suspicious Greedy Compression Using Rar.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rar_susp_greedy_compression.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4ede543c-e098-43d9-a28f-dd784a13132f", "title": "Winrar Execution in Non-Standard Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winrar_uncommon_folder_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e173ad47-4388-4012-ae62-bd13f71c18a8", "title": "Potential DLL Sideloading Via DeviceEnroller.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_deviceenroller_dll_sideloading.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "48bbc537-b652-4b4e-bd1d-281172df448f", "title": "Sysinternals PsSuspend Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_pssuspend_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1edff897-9146-48d2-9066-52e8d8f80a2f", "title": "Suspicious Invoke-WebRequest Execution With DirectIP", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_invoke_webrequest_direct_ip.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c248c896-e412-4279-8c15-1c558067b6fa", "title": "Enumerate All Information With Whoami.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_whoami_all_execution.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "title": "Arbitrary File Download Via PresentationHost.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_presentationhost_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "title": "Microsoft IIS Service Account Password Dumped", "file": "../sigma/rules/windows/process_creation/proc_creation_win_iis_appcmd_service_account_password_dumped.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "title": "Potential Defense Evasion Via Right-to-Left Override", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_right_to_left_override.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2cf29f11-e356-4f61-98c0-1bdb9393d6da", "title": "Renamed Visual Studio Code Tunnel Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vscode_tunnel_renamed_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d522eca2-2973-4391-a3e0-ef0374321dae", "title": "Abused Debug Privilege by Arbitrary Parent Processes", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_abusing_debug_privilege.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "62e0298b-e994-4189-bc87-bc699aa62d97", "title": "Potential Suspicious Registry File Imported Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_import_from_suspicious_paths.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "title": "PowerShell Base64 Encoded Reflective Assembly Load", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "title": "Suspicious New Service Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_service_creation.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "title": "Java Running with Remote Debugging", "file": "../sigma/rules/windows/process_creation/proc_creation_win_java_remote_debugging.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a537cfc3-4297-4789-92b5-345bfd845ad0", "title": "Service DACL Abuse To Hide Services Via Sc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_sdset_hide_sevices.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "74a12f18-505c-4114-8d0b-8448dd5485c6", "title": "PUA - Nimgrab Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_nimgrab.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bb780e0c-16cf-4383-8383-1e5471db6cf9", "title": "Suspicious XOR Encoded PowerShell Command", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_xor_commandline.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4a2a2c3e-209f-4d01-b513-4155a540b469", "title": "Suspicious MsiExec Embedding Parent", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msiexec_embedding.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "32410e29-5f94-4568-b6a3-d91a8adad863", "title": "PUA - Fast Reverse Proxy (FRP) Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_frp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f64e5c19-879c-4bae-b471-6d84c8339677", "title": "Webshell Tool Reconnaissance Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_webshell_tool_recon.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "title": "Process Execution From A Potentially Suspicious Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_execution_path.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "title": "File Download From IP URL Via Curl.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_exec.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "536e2947-3729-478c-9903-745aaffe60d2", "title": "Suspicious PowerShell Invocations - Specific - ProcessCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_invocation_specific.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "40aa399c-7b02-4715-8e5f-73572b493f33", "title": "Suspicious File Download From IP Via Wget.EXE - Paths", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wget_download_susp_locations.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "883835a7-df45-43e4-bf1d-4268768afda4", "title": "Regedit as Trusted Installer", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regedit_trustedinstaller.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "title": "UAC Bypass Using Event Viewer RecentViews", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_eventvwr_recentviews.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "title": "AspNetCompiler Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_aspnet_compiler_exectuion.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "title": "Sysinternals PsService Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_psservice.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b57ba453-b384-4ab9-9f40-1038086b4e53", "title": "VeeamBackup Database Credentials Dump Via Sqlcmd.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sqlcmd_veeam_dump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "title": "Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regasm_regsvcs_uncommon_extension_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "148431ce-4b70-403d-8525-fcc2993f29ea", "title": "Potential DLL Injection Or Execution Using Tracker.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_tracker.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3bad990e-4848-4a78-9530-b427d854aac0", "title": "Domain Trust Discovery Via Dsquery", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "title": "PowerShell Get-Clipboard Cmdlet Via CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_get_clipboard.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "title": "DeviceCredentialDeployment Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_device_credential_deployment.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "09576804-7a05-458e-a817-eb718ca91f54", "title": "Suspicious PowerShell IEX Execution Patterns", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_iex_patterns.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "title": "Potential Suspicious Activity Using SeCEdit", "file": "../sigma/rules/windows/process_creation/proc_creation_win_secedit_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b0524451-19af-4efa-a46f-562a977f792e", "title": "ShimCache Flush", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_susp_shimcache_flush.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b96b2031-7c17-4473-afe7-a30ce714db29", "title": "Use of FSharp Interpreters", "file": "../sigma/rules/windows/process_creation/proc_creation_win_fsi_fsharp_code_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "37c1333a-a0db-48be-b64b-7393b2386e3b", "title": "Hacktool Execution - PE Metadata", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_execution_via_pe_metadata.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "81325ce1-be01-4250-944f-b4789644556f", "title": "Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_env_folder.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3abd6094-7027-475f-9630-8ab9be7b9725", "title": "Windows Admin Share Mount Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_use_mount_admin_share.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d9047477-0359-48c9-b8c7-792cedcdc9c4", "title": "PUA - NirCmd Execution As LOCAL SYSTEM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_nircmd_as_system.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0a98a10c-685d-4ab0-bddc-b6bdd1d48458", "title": "Uncommon Userinit Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_userinit_uncommon_child_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "56d19cb4-6414-4769-9644-1ed35ffbb148", "title": "Obfuscated IP Via CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_via_cli.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "title": "Suspicious Script Execution From Temp Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_script_exec_from_temp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "title": "TrustedPath UAC Bypass Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_trustedpath.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "title": "Browser Started with Remote Debugging", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_remote_debugging.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5cdb711b-5740-4fb2-ba88-f7945027afac", "title": "Rundll32 UNC Path Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_unc_path.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "164eda96-11b2-430b-85ff-6a265c15bf32", "title": "Local Groups Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_group.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a58353df-af43-4753-bad0-cd83ef35eef5", "title": "Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ntdsutil_susp_usage.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "56321594-9087-49d9-bf10-524fe8479452", "title": "Potential Persistence Via Netsh Helper DLL", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_helper_dll_persistence.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "df3fcaea-2715-4214-99c5-0056ea59eb35", "title": "Credentials In Files - Linux", "file": "../sigma/rules/linux/auditd/lnx_auditd_find_cred_in_files.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "eae8ce9f-bde9-47a6-8e79-f20d18419910", "title": "Suspicious History File Operations - Linux", "file": "../sigma/rules/linux/auditd/lnx_auditd_susp_histfile_operations.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "edd595d7-7895-4fa7-acb3-85a18a8772ca", "title": "Steganography Unzip Hidden Information From Picture File", "file": "../sigma/rules/linux/auditd/lnx_auditd_unzip_hidden_zip_files_steganography.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "1f358e2e-cb63-43c3-b575-dfb072a6814f", "title": "System and Hardware Information Discovery", "file": "../sigma/rules/linux/auditd/lnx_auditd_system_info_discovery2.yml", "status": "stable", "level": "informational", "logsource.category": null, "logsource.product": "linux"}, {"id": "a5b977d6-8a81-4475-91b9-49dbfcd941f7", "title": "Remove Immutable File Attribute - Auditd", "file": "../sigma/rules/linux/auditd/lnx_auditd_chattr_immutable_removal.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "f200dc3f-b219-425d-a17e-c38467364816", "title": "Clipboard Collection of Image Data with Xclip Tool", "file": "../sigma/rules/linux/auditd/lnx_auditd_clipboard_image_collection.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "4b3cb710-5e83-4715-8c45-8b2b5b3e5751", "title": "Modification of ld.so.preload", "file": "../sigma/rules/linux/auditd/lnx_auditd_ld_so_preload_mod.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "3761e026-f259-44e6-8826-719ed8079408", "title": "Linux Network Service Scanning - Auditd", "file": "../sigma/rules/linux/auditd/lnx_auditd_network_service_scanning.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "49aae26c-450e-448b-911d-b3c13d178dfc", "title": "Linux Keylogging with Pam.d", "file": "../sigma/rules/linux/auditd/lnx_auditd_keylogging_with_pam_d.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "c0d3734d-330f-4a03-aae2-65dacc6a8222", "title": "Webshell Remote Command Execution", "file": "../sigma/rules/linux/auditd/lnx_auditd_web_rce.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "linux"}, {"id": "4cb57c2f-1f29-41f8-893d-8bed8e1c1d2f", "title": "System Shutdown/Reboot - Linux", "file": "../sigma/rules/linux/auditd/lnx_auditd_system_shutdown_reboot.yml", "status": "test", "level": "informational", "logsource.category": null, "logsource.product": "linux"}, {"id": "45810b50-7edc-42ca-813b-bdac02fb946b", "title": "Steganography Hide Zip Information in Picture File", "file": "../sigma/rules/linux/auditd/lnx_auditd_hidden_zip_files_steganography.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "70b4156e-50fc-4523-aa50-c9dddf1993fc", "title": "Bpfdoor TCP Ports Redirect", "file": "../sigma/rules/linux/auditd/lnx_auditd_bpfdoor_port_redirect.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "9d4548fa-bba0-4e88-bd66-5d5bf516cda0", "title": "Masquerading as Linux Crond Process", "file": "../sigma/rules/linux/auditd/lnx_auditd_masquerading_crond.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "ca94a6db-8106-4737-9ed2-3e3bb826af0a", "title": "Password Policy Discovery", "file": "../sigma/rules/linux/auditd/lnx_auditd_password_policy_discovery.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "106d7cbd-80ff-4985-b682-a7043e5acb72", "title": "Loading of Kernel Module via Insmod", "file": "../sigma/rules/linux/auditd/lnx_auditd_load_module_insmod.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed", "title": "Possible Coin Miner CPU Priority Param", "file": "../sigma/rules/linux/auditd/lnx_auditd_coinminer.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "linux"}, {"id": "a5a827d9-1bbe-4952-9293-c59d897eb41b", "title": "Steganography Extract Files with Steghide", "file": "../sigma/rules/linux/auditd/lnx_auditd_steghide_extract_steganography.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "c52a914f-3d8b-4b2a-bb75-b3991e75f8ba", "title": "Binary Padding - Linux", "file": "../sigma/rules/linux/auditd/lnx_auditd_binary_padding.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "f7158a64-6204-4d6d-868a-6e6378b467e0", "title": "Suspicious C2 Activities", "file": "../sigma/rules/linux/auditd/lnx_auditd_susp_c2_commands.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "214e7e6c-f21b-47ff-bb6f-551b2d143fcf", "title": "Clipboard Collection with Xclip Tool - Auditd", "file": "../sigma/rules/linux/auditd/lnx_auditd_clipboard_collection.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "e2f17c5d-b02a-442b-9052-6eb89c9fec9c", "title": "Screen Capture with Xwd", "file": "../sigma/rules/linux/auditd/lnx_auditd_screencaputre_xwd.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "a7af2487-9c2f-42e4-9bb9-ff961f0561d5", "title": "Audio Capture", "file": "../sigma/rules/linux/auditd/lnx_auditd_audio_capture.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "2dad0cba-c62a-4a4f-949f-5f6ecd619769", "title": "Split A File Into Pieces - Linux", "file": "../sigma/rules/linux/auditd/lnx_auditd_split_file_into_pieces.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "9a0d8ca0-2385-4020-b6c6-cb6153ca56f3", "title": "System Owner or User Discovery", "file": "../sigma/rules/linux/auditd/lnx_auditd_user_discovery.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "f4d3748a-65d1-4806-bd23-e25728081d01", "title": "Network Sniffing - Linux", "file": "../sigma/rules/linux/auditd/lnx_auditd_network_sniffing.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "53059bc0-1472-438b-956a-7508a94a91f0", "title": "Disable System Firewall", "file": "../sigma/rules/linux/auditd/lnx_auditd_disable_system_firewall.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "1bac86ba-41aa-4f62-9d6b-405eac99b485", "title": "Systemd Service Creation", "file": "../sigma/rules/linux/auditd/lnx_auditd_systemd_service_creation.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "d08722cd-3d09-449a-80b4-83ea2d9d4616", "title": "Hidden Files and Directories", "file": "../sigma/rules/linux/auditd/lnx_auditd_hidden_files_directories.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "f34047d9-20d3-4e8b-8672-0a35cc50dc71", "title": "System Information Discovery - Auditd", "file": "../sigma/rules/linux/auditd/lnx_auditd_system_info_discovery.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "977ef627-4539-4875-adf4-ed8f780c4922", "title": "Auditing Configuration Changes on Linux Host", "file": "../sigma/rules/linux/auditd/lnx_auditd_auditing_config_change.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "323ff3f5-0013-4847-bbd4-250b5edb62cc", "title": "Modify System Firewall", "file": "../sigma/rules/linux/auditd/lnx_auditd_modify_system_firewall.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "74c01ace-0152-4094-8ae2-6fd776dd43e5", "title": "File or Folder Permissions Change", "file": "../sigma/rules/linux/auditd/lnx_auditd_file_or_folder_permissions.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "cb39d16b-b3b6-4a7a-8222-1cf24b686ffc", "title": "Data Exfiltration with Wget", "file": "../sigma/rules/linux/auditd/lnx_auditd_data_exfil_wget.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "a94cdd87-6c54-4678-a6cc-2814ffe5a13d", "title": "Unix Shell Configuration Modification", "file": "../sigma/rules/linux/auditd/lnx_auditd_unix_shell_configuration_modification.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "759d0d51-bc99-4b5e-9add-8f5b2c8e7512", "title": "Creation Of An User Account", "file": "../sigma/rules/linux/auditd/lnx_auditd_create_account.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "1543ae20-cbdf-4ec1-8d12-7664d667a825", "title": "Suspicious Commands Linux", "file": "../sigma/rules/linux/auditd/lnx_auditd_susp_cmds.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "a3b5e3e9-1b49-4119-8b8e-0344a01f21ee", "title": "Data Compressed", "file": "../sigma/rules/linux/auditd/lnx_auditd_data_compressed.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "b3cec4e7-6901-4b0d-a02d-8ab2d8eb818b", "title": "File Time Attribute Change - Linux", "file": "../sigma/rules/linux/auditd/lnx_auditd_change_file_time_attr.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "37222991-11e9-4b6d-8bdf-60fbe48f753e", "title": "Overwriting the File with Dev Zero or Null", "file": "../sigma/rules/linux/auditd/lnx_auditd_dd_delete_file.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "fe10751f-1995-40a5-aaa2-c97ccb4123fe", "title": "Linux Capabilities Discovery", "file": "../sigma/rules/linux/auditd/lnx_auditd_capabilities_discovery.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "dbe4b9c5-c254-4258-9688-d6af0b7967fd", "title": "Screen Capture with Import Tool", "file": "../sigma/rules/linux/auditd/lnx_auditd_screencapture_import.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "9e1bef8d-0fff-46f6-8465-9aa54e128c1e", "title": "Use Of Hidden Paths Or Files", "file": "../sigma/rules/linux/auditd/lnx_auditd_hidden_binary_execution.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "808146b2-9332-4d78-9416-d7e47012d83d", "title": "BPFDoor Abnormal Process ID or Lock File Accessed", "file": "../sigma/rules/linux/auditd/lnx_auditd_bpfdoor_file_accessed.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "c830f15d-6f6e-430f-8074-6f73d6807841", "title": "Logging Configuration Changes on Linux Host", "file": "../sigma/rules/linux/auditd/lnx_auditd_logging_config_change.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "ce446a9e-30b9-4483-8e38-d2c9ad0a2280", "title": "Steganography Hide Files with Steghide", "file": "../sigma/rules/linux/auditd/lnx_auditd_steghide_embed_steganography.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "2625cc59-0634-40d0-821e-cb67382a3dd7", "title": "Systemd Service Reload or Start", "file": "../sigma/rules/linux/auditd/lnx_auditd_pers_systemd_reload.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc", "title": "Program Executions in Suspicious Folders", "file": "../sigma/rules/linux/auditd/lnx_auditd_susp_exe_folders.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871", "title": "Linux Reverse Shell Indicator", "file": "../sigma/rules/linux/network_connection/net_connection_lnx_back_connect_shell_dev.yml", "status": "test", "level": "critical", "logsource.category": "network_connection", "logsource.product": "linux"}, {"id": "dbfc7c98-04ab-4ab7-aa94-c74d22aa7376", "title": "Potentially Suspicious Malware Callback Communication - Linux", "file": "../sigma/rules/linux/network_connection/net_connection_lnx_susp_malware_callback_port.yml", "status": "experimental", "level": "high", "logsource.category": "network_connection", "logsource.product": "linux"}, {"id": "c4568f5d-131f-4e78-83d4-45b2da0ec4f1", "title": "Communication To LocaltoNet Tunneling Service Initiated - Linux", "file": "../sigma/rules/linux/network_connection/net_connection_lnx_domain_localtonet_tunnel.yml", "status": "experimental", "level": "high", "logsource.category": "network_connection", "logsource.product": "linux"}, {"id": "a46c93b7-55ed-4d27-a41b-c259456c4746", "title": "Linux Crypto Mining Pool Connections", "file": "../sigma/rules/linux/network_connection/net_connection_lnx_crypto_mining_indicators.yml", "status": "stable", "level": "high", "logsource.category": "network_connection", "logsource.product": "linux"}, {"id": "19bf6fdb-7721-4f3d-867f-53467f6a5db6", "title": "Communication To Ngrok Tunneling Service - Linux", "file": "../sigma/rules/linux/network_connection/net_connection_lnx_ngrok_tunnel.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "linux"}, {"id": "2aa1440c-9ae9-4d92-84a7-a9e5f5e31695", "title": "Suspicious Activity in Shell Commands", "file": "../sigma/rules/linux/builtin/lnx_shell_susp_commands.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "f64b6e9a-5d9d-48a5-8289-e1dd2b3876e1", "title": "Suspicious Log Entries", "file": "../sigma/rules/linux/builtin/lnx_shell_susp_log_entries.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "8ec2c8b4-557a-4121-b87c-5dfb3a602fae", "title": "JexBoss Command Sequence", "file": "../sigma/rules/linux/builtin/lnx_susp_jexboss.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "fdc88d25-96fb-4b7c-9633-c0e417fdbd4e", "title": "Linux Command History Tampering", "file": "../sigma/rules/linux/builtin/lnx_shell_clear_cmd_history.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "738d9bcf-6999-4fdb-b4ac-3033037db8ab", "title": "Suspicious Reverse Shell Command Line", "file": "../sigma/rules/linux/builtin/lnx_shell_susp_rev_shells.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781", "title": "Buffer Overflow Attempts", "file": "../sigma/rules/linux/builtin/lnx_buffer_overflows.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "0ac15ec3-d24f-4246-aa2a-3077bb1cf90e", "title": "Privileged User Has Been Created", "file": "../sigma/rules/linux/builtin/lnx_privileged_user_creation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "c67fc22a-0be5-4b4f-aad5-2b32c4b69523", "title": "Symlink Etc Passwd", "file": "../sigma/rules/linux/builtin/lnx_symlink_etc_passwd.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "e09eb557-96d2-4de9-ba2d-30f712a5afd3", "title": "Commands to Clear or Remove the Syslog - Builtin", "file": "../sigma/rules/linux/builtin/lnx_clear_syslog.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "7a14080d-a048-4de8-ae58-604ce58a795b", "title": "Remote File Copy", "file": "../sigma/rules/linux/builtin/lnx_file_copy.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "7ba05b43-adad-4c02-b5e9-c8c35cdf9fa8", "title": "Nimbuspwn Exploitation", "file": "../sigma/rules/linux/builtin/lnx_nimbuspwn_privilege_escalation_exploit.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "879c3015-c88b-4782-93d7-07adf92dbcb7", "title": "Space After Filename", "file": "../sigma/rules/linux/builtin/lnx_space_after_filename_.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "6cc5fceb-9a71-4c23-aeeb-963abe0b279c", "title": "Suspicious Use of /dev/tcp", "file": "../sigma/rules/linux/builtin/lnx_susp_dev_tcp.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "41e5c73d-9983-4b69-bd03-e13b67e9623c", "title": "Equation Group Indicators", "file": "../sigma/rules/linux/builtin/lnx_apt_equationgroup_lnx.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "7e3c4651-c347-40c4-b1d4-d48590fdf684", "title": "Code Injection by ld.so Preload", "file": "../sigma/rules/linux/builtin/lnx_ldso_preload_injection.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "c67e0c98-4d39-46ee-8f6b-437ebf6b950e", "title": "Shellshock Expression", "file": "../sigma/rules/linux/builtin/lnx_shellshock.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "0fadd880-6af3-4610-b1e5-008dc3a11b8a", "title": "Potential Suspicious BPF Activity - Linux", "file": "../sigma/rules/linux/builtin/lnx_potential_susp_ebpf_activity.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "7fcc54cb-f27d-4684-84b7-436af096f858", "title": "Sudo Privilege Escalation CVE-2019-14287 - Builtin", "file": "../sigma/rules/linux/builtin/sudo/lnx_sudo_cve_2019_14287_user.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "linux"}, {"id": "49f5dfc1-f92e-4d34-96fa-feba3f6acf36", "title": "Disabling Security Tools - Builtin", "file": "../sigma/rules/linux/builtin/syslog/lnx_syslog_security_tools_disabling_syslog.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "c8e35e96-19ce-4f16-aeb6-fd5588dc5365", "title": "Suspicious Named Error", "file": "../sigma/rules/linux/builtin/syslog/lnx_syslog_susp_named.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "af202fd3-7bff-4212-a25a-fb34606cfcbe", "title": "Modifying Crontab", "file": "../sigma/rules/linux/builtin/cron/lnx_cron_crontab_file_modification.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "377f33a1-4b36-4ee1-acee-1dbe4b43cfbe", "title": "Suspicious VSFTPD Error Messages", "file": "../sigma/rules/linux/builtin/vsftpd/lnx_vsftpd_susp_error_messages.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "4c9d903d-4939-4094-ade0-3cb748f4d7da", "title": "SSHD Error Message CVE-2018-15473", "file": "../sigma/rules/linux/builtin/sshd/lnx_sshd_ssh_cve_2018_15473.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "e76b413a-83d0-4b94-8e4c-85db4a5b8bdc", "title": "Suspicious OpenSSH Daemon Error", "file": "../sigma/rules/linux/builtin/sshd/lnx_sshd_susp_ssh.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "0506a799-698b-43b4-85a1-ac4c84c720e9", "title": "PwnKit Local Privilege Escalation", "file": "../sigma/rules/linux/builtin/auth/lnx_auth_pwnkit_local_privilege_escalation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "1edd77db-0669-4fef-9598-165bda82826d", "title": "Guacamole Two Users Sharing Session Anomaly", "file": "../sigma/rules/linux/builtin/guacamole/lnx_guacamole_susp_guacamole.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "36aa86ca-fd9d-4456-814e-d3b1b8e1e0bb", "title": "Relevant ClamAV Message", "file": "../sigma/rules/linux/builtin/clamav/lnx_clamav_relevant_message.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "35a05c60-9012-49b6-a11f-6bab741c9f74", "title": "Wget Creating Files in Tmp Directory", "file": "../sigma/rules/linux/file_event/file_event_lnx_wget_download_file_in_tmp_dir.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "linux"}, {"id": "ddb26b76-4447-4807-871f-1b035b2bfa5d", "title": "Persistence Via Sudoers Files", "file": "../sigma/rules/linux/file_event/file_event_lnx_persistence_sudoers_files.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "linux"}, {"id": "13f08f54-e705-4498-91fd-cce9d9cee9f1", "title": "Potentially Suspicious Shell Script Creation in Profile Folder", "file": "../sigma/rules/linux/file_event/file_event_lnx_susp_shell_script_under_profile_directory.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "linux"}, {"id": "6c4e2f43-d94d-4ead-b64d-97e53fa2bd05", "title": "Persistence Via Cron Files", "file": "../sigma/rules/linux/file_event/file_event_lnx_persistence_cron_files.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "linux"}, {"id": "00eee2a5-fdb0-4746-a21d-e43fbdea5681", "title": "Linux Doas Conf File Creation", "file": "../sigma/rules/linux/file_event/file_event_lnx_doas_conf_creation.yml", "status": "stable", "level": "medium", "logsource.category": "file_event", "logsource.product": "linux"}, {"id": "c0239255-822c-4630-b7f1-35362bcb8f44", "title": "Triple Cross eBPF Rootkit Default LockFile", "file": "../sigma/rules/linux/file_event/file_event_lnx_triple_cross_rootkit_lock_file.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "linux"}, {"id": "1a2ea919-d11d-4d1e-8535-06cda13be20f", "title": "Triple Cross eBPF Rootkit Default Persistence", "file": "../sigma/rules/linux/file_event/file_event_lnx_triple_cross_rootkit_persistence.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "linux"}, {"id": "e34cfa0c-0a50-4210-9cb3-5632d08eb041", "title": "Potential GobRAT File Discovery Via Grep", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_malware_gobrat_grep_payload_discovery.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "2d2f44ff-4611-4778-a8fc-323a0e9850cc", "title": "Inline Python Execution - Spawn Shell Via OS System Library", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_python_shell_os_system.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "30aed7b6-d2c1-4eaf-9382-b6bc43e50c57", "title": "File Deletion", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_file_deletion.yml", "status": "stable", "level": "informational", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "8c1a5675-cb85-452f-a298-b01b22a51856", "title": "Suspicious Invocation of Shell via AWK - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_awk_shell_spawn.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "30bcce26-51c5-49f2-99c8-7b59e3af36c7", "title": "Execution Of Script Located In Potentially Suspicious Directory", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_shell_script_exec_from_susp_location.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "676381a6-15ca-4d73-a9c8-6a22e970b90d", "title": "Local Groups Discovery - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_local_groups.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "e4ffe466-6ff8-48d4-94bd-e32d1a6061e2", "title": "Nohup Execution", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_nohup.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "ba592c6d-6888-43c3-b8c6-689b8fe47337", "title": "Linux Base64 Encoded Pipe to Shell", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_base64_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "7f734ed0-4f47-46c0-837f-6ee62505abd9", "title": "Potential Netcat Reverse Shell Execution", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_netcat_reverse_shell.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "38eb1dbb-011f-40b1-a126-cf03a0210563", "title": "ESXi Syslog Configuration Change Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_syslog_config_change.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "b8bdac18-c06e-4016-ac30-221553e74f59", "title": "Potential Ruby Reverse Shell", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_ruby_reverse_shell.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "e7bd1cfa-b446-4c88-8afb-403bcd79e3fa", "title": "System Network Discovery - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_system_network_discovery.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "1182f3b3-e716-4efa-99ab-d2685d04360f", "title": "History File Deletion", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_history_delete.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "c2e234de-03a3-41e1-b39a-1e56dc17ba67", "title": "Remove Scheduled Cron Task/Job", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_crontab_removal.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "e3a8a052-111f-4606-9aee-f28ebeb76776", "title": "Disabling Security Tools", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_security_tools_disabling.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "f74107df-b6c6-4e80-bf00-4170b658162b", "title": "Sudo Privilege Escalation CVE-2019-14287", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_sudo_cve_2019_14287.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf", "title": "Potential Discovery Activity Using Find - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_find_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "47b3bbd4-1bf7-48cc-84ab-995362aaa75a", "title": "Shell Execution via Git - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_git_shell_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "21541900-27a9-4454-9c4c-3f0a4240344a", "title": "OMIGOD SCX RunAsProvider ExecuteShellCommand", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "c8a5f584-cdc8-42cc-8cce-0398e4265de3", "title": "Apache Spark Shell Command Injection - ProcessCreation", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_cve_2022_33891_spark_shell_command_injection.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "de25eeb8-3655-4643-ac3a-b662d3f26b6b", "title": "Disable Or Stop Services", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_services_stop_and_disable.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "6104e693-a7d6-4891-86cb-49a258523559", "title": "Bash Interactive Shell", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_bash_interactive_shell.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "067d8238-7127-451c-a9ec-fa78045b618b", "title": "Linux Doas Tool Execution", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_doas_execution.yml", "status": "stable", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "ec52985a-d024-41e3-8ff6-14169039a0b3", "title": "Mount Execution With Hidepid Parameter", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_mount_hidepid.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "f41dada5-3f56-4232-8503-3fb7f9cf2d60", "title": "ESXi Storage Information Discovery Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_storage_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "bed978f8-7f3a-432b-82c5-9286a9b3031a", "title": "Shell Invocation via Env Command - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_env_shell_invocation.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "cfec9d29-64ec-4a0f-9ffe-0fdb856d5446", "title": "Suspicious Git Clone - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_git_clone.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "84c9e83c-599a-458a-a0cb-0ecce44e807a", "title": "Ufw Force Stop Using Ufw-Init", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_disable_ufw.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "f9b3edc5-3322-4fc7-8aa3-245d646cc4b7", "title": "Potential Linux Amazon SSM Agent Hijacking", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_ssm_agent_abuse.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "880973f3-9708-491c-a77b-2a35a1921158", "title": "Linux Shell Pipe to Shell", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_pipe_shell.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "0cf7a157-8879-41a2-8f55-388dd23746b7", "title": "Linux Recon Indicators", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_recon_indicators.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "97de11cd-4b67-4abf-9a8b-1020e670aa9e", "title": "Pnscan Binary Data Transmission Activity", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_pnscan_binary_cli_pattern.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "093d68c7-762a-42f4-9f46-95e79142571a", "title": "Shell Execution via Nice - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_nice_shell_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "7fb14105-530e-4e2e-8cfb-99f7d8700b66", "title": "Atlassian Confluence CVE-2022-26134", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_cve_2022_26134_atlassian_confluence.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "c4042d54-110d-45dd-a0e1-05c47822c937", "title": "Python Spawning Pretty TTY", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_python_pty_spawn.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "c9d8b7fd-78e4-44fe-88f6-599135d46d60", "title": "Security Software Discovery - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_security_software_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "cf610c15-ed71-46e1-bdf8-2bd1a99de6c4", "title": "Download File To Potentially Suspicious Directory Via Wget", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_wget_download_suspicious_directory.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "11063ec2-de63-4153-935e-b1a8b9e616f1", "title": "Linux Remote System Discovery", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_remote_system_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "9691f58d-92c1-4416-8bf3-2edd753ec9cf", "title": "ESXi Admin Permission Assigned To Account Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_permission_change_admin.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "457df417-8b9d-4912-85f3-9dbda39c3645", "title": "Suspicious Nohup Execution", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_nohup_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "34979410-e4b5-4e5d-8cfb-389fdff05c12", "title": "Remove Immutable File Attribute", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_chattr_immutable_removal.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "43e26eb5-cd58-48d1-8ce9-a273f5d298d8", "title": "Potential Container Discovery Via Inodes Listing", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_inod_listing.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "22236d75-d5a0-4287-bf06-c93b1770860f", "title": "Triple Cross eBPF Rootkit Install Commands", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_install.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "a015e032-146d-4717-8944-7a1884122111", "title": "Linux HackTool Execution", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_hktl_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "b86d356d-6093-443d-971c-9b07db583c68", "title": "Suspicious Curl Change User Agents - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_curl_useragent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "db1ac3be-f606-4e3a-89e0-9607cbe6b98a", "title": "Capsh Shell Invocation - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_capsh_shell_invocation.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "d27ab432-2199-483f-a297-03633c05bae6", "title": "OS Architecture Discovery Via Grep", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_grep_os_arch_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "8a46f16c-8c4c-82d1-b121-0fdd3ba70a84", "title": "Group Has Been Deleted Via Groupdel", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_groupdel.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "6eea1bf6-f8d2-488a-a742-e6ef6c1b67db", "title": "OMIGOD SCX RunAsProvider ExecuteScript", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executescript.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "ec127035-a636-4b9a-8555-0efd4e59f316", "title": "Clipboard Collection with Xclip Tool", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_clipboard_collection.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "403ed92c-b7ec-4edd-9947-5b535ee12d46", "title": "Crontab Enumeration", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_crontab_enumeration.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "32e62bc7-3de0-4bb1-90af-532978fe42c0", "title": "Potential Python Reverse Shell", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_python_reverse_shell.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "64c41342-6b27-523b-5d3f-c265f3efcdb3", "title": "Terminate Linux Process Via Kill", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_kill_process.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "fa4aaed5-4fe0-498d-bbc0-08e3346387ba", "title": "Copy Passwd Or Shadow From TMP Path", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_cp_passwd_or_shadow_tmp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "259df6bc-003f-4306-9f54-4ff1a08fa38e", "title": "Potential Perl Reverse Shell Execution", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_perl_reverse_shell.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "6adfbf8f-52be-4444-9bac-81b539624146", "title": "Shell Execution via Find - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_find_shell_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "3e102cd9-a70d-4a7a-9508-403963092f31", "title": "Linux Network Service Scanning Tools Execution", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_network_utilities_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "9069ea3c-b213-4c52-be13-86506a227ab1", "title": "Linux Crypto Mining Indicators", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_crypto_mining.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "c6714a24-d7d5-4283-a36b-3ffd091d5f7e", "title": "Potential PHP Reverse Shell", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_php_reverse_shell.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "86157017-c2b1-4d4a-8c33-93b8e67e4af4", "title": "Potential Suspicious Change To Sensitive/Critical Files", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_sensitive_file_access.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d", "title": "Remote Access Tool - Team Viewer Session Started On Linux Host", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "b45e3d6f-42c6-47d8-a478-df6bd6cf534c", "title": "Local System Accounts Discovery - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_local_account.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "72f4ab3f-787d-495d-a55d-68c2ff46cf4c", "title": "Connection Proxy", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_proxy_connection.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "fe2f9663-41cb-47e2-b954-8a228f3b9dff", "title": "Linux Base64 Encoded Shebang In CLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_base64_shebang_cli.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "11701de9-d5a5-44aa-8238-84252f131895", "title": "Docker Container Discovery Via Dockerenv Listing", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_dockerenv_recon.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "700fb7e8-2981-401c-8430-be58e189e741", "title": "Suspicious Package Installed - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_install_suspicioua_packages.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "746c86fb-ccda-4816-8997-01386263acc4", "title": "Container Residence Discovery Via Proc Virtual FS", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_container_residence_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "7692f583-bd30-4008-8615-75dab3f08a99", "title": "Enable BPF Kprobes Tracing", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_bpf_kprob_tracing_enabled.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "78a80655-a51e-4669-bc6b-e9d206a462ee", "title": "Install Root Certificate", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_install_root_certificate.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "2992ac4d-31e9-4325-99f2-b18a73221bb2", "title": "ESXi VM Kill Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "ea3ecad2-db86-4a89-ad0b-132a10d2db55", "title": "Interactive Bash Suspicious Children", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_interactive_bash.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "4cad6c64-d6df-42d6-8dae-eb78defdc415", "title": "Potential Linux Process Code Injection Via DD Utility", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_dd_process_injection.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "42df45e7-e6e9-43b5-8f26-bec5b39cc239", "title": "System Information Discovery", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_system_info_discovery.yml", "status": "stable", "level": "informational", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "4c519226-f0cd-4471-bd2f-6fbb2bb68a79", "title": "System Network Connections Discovery - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_system_network_connections_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "80915f59-9b56-4616-9de0-fd0dea6c12fe", "title": "Clear Linux Logs", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_clear_logs.yml", "status": "stable", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "4e25af4b-246d-44ea-8563-e42aacab006b", "title": "Potential Xterm Reverse Shell", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_xterm_reverse_shell.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "6a50f16c-3b7b-42d1-b081-0fdd3ba70a73", "title": "User Added To Root/Sudoers Group Using Usermod", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_usermod_susp_group.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "e80273e1-9faf-40bc-bd85-dbaff104c4e9", "title": "ESXi System Information Discovery Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_system_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "d2d642d7-b393-43fe-bae4-e81ed5915c4b", "title": "Scheduled Task/Job At", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_at_command.yml", "status": "stable", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "f8341cb2-ee25-43fa-a975-d8a5a9714b39", "title": "BPFtrace Unsafe Option Usage", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_bpftrace_unsafe_option_usage.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "9d779ce8-5256-4b13-8b6f-b91c602b43f4", "title": "Named Pipe Created Via Mkfifo", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "4b09c71e-4269-4111-9cdd-107d8867f0cc", "title": "Shell Execution via Flock - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_flock_shell_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "5f1573a7-363b-4114-9208-ad7a61de46eb", "title": "ESXi VM List Discovery Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "bb382fd5-b454-47ea-a264-1828e4c766d6", "title": "Shell Invocation via Apt - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_apt_shell_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "6419afd1-3742-47a5-a7e6-b50386cd15f8", "title": "Chmod Suspicious Directory", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_chmod_directories.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "d8d97d51-122d-4cdd-9e2f-01b4b4933530", "title": "Capabilities Discovery - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_capa_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "e2326866-609f-4015-aea9-7ec634e8aa04", "title": "Shell Execution via Rsync - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_rsync_shell_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "c21c4eaa-ba2e-419a-92b2-8371703cbe21", "title": "Setuid and Setgid", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_setgid_setuid.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "0f79c4d2-4e1f-4683-9c36-b5469a665e06", "title": "Cat Sudoers", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_cat_sudoers.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "4e2f5868-08d4-413d-899f-dc2f1508627b", "title": "Process Discovery", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_process_discovery.yml", "status": "stable", "level": "informational", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "818f7b24-0fba-4c49-a073-8b755573b9c7", "title": "Linux Webshell Indicators", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_webshell_detection.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "d54c2f06-aca9-4e2b-81c9-5317858f4b79", "title": "ESXi VSAN Information Discovery Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "3fcc9b35-39e4-44c0-a2ad-9e82b6902b31", "title": "Commands to Clear or Remove the Syslog", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_clear_syslog.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "d292e0af-9a18-420c-9525-ec0ac3936892", "title": "Suspicious Java Children Processes", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_java_children.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "00b90cc1-17ec-402c-96ad-3a8117d7a582", "title": "Suspicious Curl File Upload - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_curl_fileupload.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "6b14bac8-3e3a-4324-8109-42f0546a347f", "title": "Scheduled Cron Task/Job - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_schedule_task_job_cron.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "e2072cab-8c9a-459b-b63c-40ae79e27031", "title": "Decode Base64 Encoded Text", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_base64_decode.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "0326c3c8-7803-4a0f-8c5c-368f747f7c3e", "title": "Triple Cross eBPF Rootkit Execve Hijack", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_execve_hijack.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "312b42b1-bded-4441-8b58-163a3af58775", "title": "Potentially Suspicious Execution From Tmp Folder", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_execution_tmp_folder.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "95d61234-7f56-465c-6f2d-b562c6fedbc4", "title": "Linux Package Uninstall", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_remove_package.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "33e814e0-1f00-4e43-9c34-31fb7ae2b174", "title": "ESXi Network Configuration Discovery Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_network_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db", "title": "ESXi Account Creation Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_user_account_creation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "8737b7f6-8df3-4bb7-b1da-06019b99b687", "title": "Shell Invocation Via Ssh - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_ssh_shell_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "ea34fb97-e2c4-4afb-810f-785e4459b194", "title": "Curl Usage on Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_curl_usage.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72", "title": "File and Directory Discovery - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_file_and_directory_discovery.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "9b5de532-a757-4d70-946c-1f3e44f48b4d", "title": "Shell Execution GCC - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_gcc_shell_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "2fade0b6-7423-4835-9d4f-335b39b83867", "title": "Shell Execution Of Process Located In Tmp Directory", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "31545105-3444-4584-bebf-c466353230d2", "title": "Touch Suspicious Service File", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_touch_susp.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "d7821ff1-4527-4e33-9f84-d0d57fa2fb66", "title": "Print History File Contents", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_history_recon.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "08f26069-6f80-474b-8d1f-d971c6fedea0", "title": "User Has Been Deleted Via Userdel", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_userdel.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "2953194b-e33c-4859-b9e8-05948c167447", "title": "DD File Overwrite", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_dd_file_overwrite.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "7ab8f73a-fcff-428b-84aa-6a5ff7877dea", "title": "Vim GTFOBin Abuse - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_vim_shell_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "3be619f4-d9ec-4ea8-a173-18fdd01996ab", "title": "Flush Iptables Ufw Chain", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_iptables_flush_ufw.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "999c3b12-0a8c-40b6-8e13-dd7d62b75c7a", "title": "Potentially Suspicious Named Pipe Created Via Mkfifo", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}], "status": {"uberAgent (develop)": ["dfe8b941-4e54-4242-b674-6b613d521962", "23c43900-e732-45a4-8354-63e4a6c187ce", "47d65ac0-c06f-4ba2-a2e3-d263139d0f51", "65d506d3-fcfe-4071-b4b2-bcefe721bbbb", "5d0fdb62-f225-42fb-8402-3dfe64da468a", "b743623c-2776-40e0-87b1-682b975d0ca5", "089dbdf6-b960-4bcc-90e3-ffc3480c20f6", "2d5e7a8b-f484-4a24-945d-7f0efd52eab0", "58800443-f9fc-4d55-ae0c-98a3966dfb97", "5de06a6f-673a-4fc0-8d48-bcfe3837b033", "1cf98dc2-fcb0-47c9-8aea-654c9284d1ae", "7ed2c9f7-c59d-4c82-a7e2-f859aa676099", "b120b587-a4c2-4b94-875d-99c9807d6955", "7c3b43d8-d794-47d2-800a-d277715aa460", "9a7a0393-2144-4626-9bf1-7c2f5a7321db", "2316929c-01aa-438c-970f-099145ab1ee6", "6d8a7cf1-8085-423b-b87d-7e880faabbdf", "2c95fa8a-8b8d-4787-afce-7117ceb8e3da", "95361ce5-c891-4b0a-87ca-e24607884a96", "1bc2e6c5-0885-472b-bed6-be5ea8eace55", "acf61bd8-d814-4272-81f0-a7a269aa69aa", "ddf36b67-e872-4507-ab2e-46bda21b842c", "bf241472-f014-4f01-a869-96f99330ca8c", "e0cfaecd-602d-41af-988d-f6ccebb2af26", "69483748-1525-4a6c-95ca-90dc8d431b68", "508a9374-ad52-4789-b568-fc358def2c65", "b9d9b652-d8ed-4697-89a2-a1186ee680ac", "f1408a58-0e94-4165-b80a-da9f96cf6fc3", "13db8d2e-7723-4c2c-93c1-a4d36994f7ef", "be2e3a5c-9cc7-4d02-842a-68e9cb26ec49", "84bae5d4-b518-4ae0-b331-6d4afd34d00f", "652c098d-dc11-4ba6-8566-c20e89042f2b", "0877ed01-da46-4c49-8476-d49cdd80dfa7", "234dc5df-40b5-49d1-bf53-0d44ce778eca", "10227522-8429-47e6-a301-f2b2d014e7ad", "719c22d7-c11a-4f2c-93a6-2cfdd5412f68", "a753a6af-3126-426d-8bd0-26ebbcb92254", "0ed75b9c-c73b-424d-9e7d-496cd565fbe0", "51719bf5-e4fd-4e44-8ba8-b830e7ac0731", "85de3a19-b675-4a51-bfc6-b11a5186c971", "7794fa3c-edea-4cff-bec7-267dd4770fd7", "4809c683-059b-4935-879d-36835986f8cf", "6ff08e55-ea53-4f27-94a1-eff92e6d9d5c", "53821412-17b0-4147-ade0-14faae67d54b", "6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4", "40b1fbe2-18ea-4ee7-be47-0294285811de", "b22a5b36-2431-493a-8be1-0bae56c28ef3", "ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e", "f5141b6d-9f42-41c6-a7bf-2a780678b29b", "89bb1f97-c7b9-40e8-b52b-7d6afbd67276", "adc9bcc4-c39c-4f6b-a711-1884017bf043", "60f1ce20-484e-41bd-85f4-ac4afec2c541", "0250638a-2b28-4541-86fc-ea4c558fa0c6", "09a910bf-f71f-4737-9c40-88880ba5913d", "821bcf4d-46c7-4b87-bc57-9509d3ba7c11", "9acf45ed-3a26-4062-bf08-56857613eb52", "ff39f1a6-84ac-476f-a1af-37fcdf53d7c0", "3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe", "88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0", "3603f18a-ec15-43a1-9af2-d196c8a7fec6", "f459ccb4-9805-41ea-b5b2-55e279e2424a", "452df256-da78-427a-866f-49fa04417d74", "7f2bb9d5-6395-4de5-969c-70c11fbe6b12", "53b1b378-9b06-4992-b972-dde6e423d2b4", "f68c4a4f-19ef-4817-952c-50dce331f4b0", "b6e2a2e3-2d30-43b1-a4ea-071e36595690", "d7329412-13bd-44ba-a072-3387f804a106", "47e0852a-cf81-4494-a8e6-31864f8c86ed", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "295a59c1-7b79-4b47-a930-df12c15fc9c2", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "5aad0995-46ab-41bd-a9ff-724f41114971", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "4d431012-2ab5-4db7-a84e-b29809da2172", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "b3503044-60ce-4bf4-bbcb-e3db98788823", "a6b33c02-8305-488f-8585-03cb2a7763f2", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "f663a6d9-9d1b-49b8-b2b1-0637914d199a", "55e29995-75e7-451a-bef0-6225e2f13597", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "b6d235fc-1d38-4b12-adbe-325f06728f37", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "6ea3bf32-9680-422d-9f50-e90716b12a66", "baca5663-583c-45f9-b5dc-ea96a22ce542", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "62120148-6b7a-42be-8b91-271c04e281a3", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "277efb8f-60be-4f10-b4d3-037802f37167", "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "41d1058a-aea7-4952-9293-29eaaf516465", "96f697b0-b499-4e5d-9908-a67bec11cdb6", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "acd74772-5f88-45c7-956b-6a7b36c294d2", "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "92772523-d9c1-4c93-9547-b0ca500baba3", "790317c0-0a36-4a6a-a105-6e576bf99a14", "707e097c-e20f-4f67-8807-1f72ff4500d6", "396ae3eb-4174-4b9b-880e-dc0364d78a19", "e61e8a88-59a9-451c-874e-70fcc9740d67", "48437c39-9e5f-47fb-af95-3d663c3f2919", "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "509e84b9-a71a-40e0-834f-05470369bd1e", "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "7d9263bd-dc47-4a58-bc92-5474abab390c", "c5f6a85d-b647-40f7-bbad-c10b66bab038", "8ffc5407-52e3-478f-9596-0a7371eafe13", "bf344fea-d947-4ef4-9192-34d008315d3a", "5a93eb65-dffa-4543-b761-94aa60098fb6", "7c81fec3-1c1d-43b0-996a-46753041b1b6", "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "e3fdf743-f05b-4051-990a-b66919be1743", "6b6976a3-b0e6-4723-ac24-ae38a737af41", "f7997770-92c3-4ec9-b112-774c4ef96f96", "966315ef-c5e1-4767-ba25-fce9c8de3660", "e7b18879-676e-4a0e-ae18-27039185a8e7", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "8023f872-3f1d-4301-a384-801889917ab4", "44a22d59-b175-4f13-8c16-cbaef5b581ff", "fe20dda1-6f37-4379-bbe0-a98d400cae90", "b7916c2a-fa2f-4795-9477-32b731f70f11", "0cf2e1c6-8d10-4273-8059-738778f981ad", "b86852fb-4c77-48f9-8519-eb1b2c308b59", "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "dc5c24af-6995-49b2-86eb-a9ff62199e82", "92b0b372-a939-44ed-a11b-5136cf680e27", "1c3121ed-041b-4d97-a075-07f54f20fb4a", "cd277474-5c52-4423-a52b-ac2d7969902f", "9df5f547-c86a-433e-b533-f2794357e242", "46490193-1b22-4c29-bdd6-5bf63907216f", "fa277e82-9b78-42dd-b05c-05555c7b6015", "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "91239011-fe3c-4b54-9f24-15c86bb65913", "2f78da12-f7c7-430b-8b19-a28f269b77a3", "18f2065c-d36c-464a-a748-bcf909acb2e3", "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "7f2954d2-99c2-4d42-a065-ca36740f187b", "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "83314318-052a-4c90-a1ad-660ece38d276", "07743f65-7ec9-404a-a519-913db7118a8d", "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "555155a2-03bf-4fe7-af74-d176b3fdbe16", "df4dc653-1029-47ba-8231-3c44238cc0ae", "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "1547e27c-3974-43e2-a7d7-7f484fb928ec", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "fad91067-08c5-4d1a-8d8c-d96a21b37814", "a982fc9c-6333-4ffb-a51d-addb04e8b529", "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "90f342e1-1aaa-4e43-b092-39fda57ed11e", "02ee49e2-e294-4d0f-9278-f5b3212fc588", "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "0eb46774-f1ab-4a74-8238-1155855f2263", "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "c90362e0-2df3-4e61-94fe-b37615814cb1", "974515da-6cc5-4c95-ae65-f97f9150ec7f", "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "c420410f-c2d8-4010-856b-dffe21866437", "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "f37b4bce-49d0-4087-9f5b-58bffda77316", "9827ae57-3802-418f-994b-d5ecf5cd974b", "93d298a1-d28f-47f1-a468-d971e7796679", "46dd5308-4572-4d12-aa43-8938f0184d4f", "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "f742bde7-9528-42e5-bd82-84f51a8387d2", "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "8d85cf08-bf97-4260-ba49-986a2a65129c", "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "2ff692c2-4594-41ec-8fcb-46587de769e0", "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "b23818c7-e575-4d13-8012-332075ec0a2b", "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "160d2780-31f7-4922-8b3a-efce30e63e96", "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "ab567429-1dfb-4674-b6d2-979fd2f9d125", "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "cbf93e5d-ca6c-4722-8bea-e9119007c248", "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "275641a5-a492-45e2-a817-7c81e9d9d3e9", "961e33d1-4f86-4fcf-80ab-930a708b2f82", "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "ad89044a-8f49-4673-9a55-cbd88a1b374f", "086ae989-9ca6-4fe7-895a-759c5544f247", "5de03871-5d46-4539-a82d-3aa992a69a83", "28036918-04d3-423d-91c0-55ecf99fb892", "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "046218bd-e0d8-4113-a3c3-895a12b2b298", "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "a80f662f-022f-4429-9b8c-b1a41aaa6688", "612e47e9-8a59-43a6-b404-f48683f45bd6", "833ef470-fa01-4631-a79b-6f291c9ac498", "9d8f9bb8-01af-4e15-a3a2-349071530530", "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "5df86130-4e95-4a54-90f7-26541b40aec2", "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "f10ed525-97fe-4fed-be7c-2feecca941b1", "5f9db380-ea57-4d1e-beab-8a2d33397e93", "487bb375-12ef-41f6-baae-c6a1572b4dd1", "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "8218c875-90b9-42e2-b60d-0b0069816d10", "53330955-dc52-487f-a3a2-da24dcff99b5", "f2485272-a156-4773-82d7-1d178bc4905b", "724ea201-6514-4f38-9739-e5973c34f49a", "6c304b02-06e6-402d-8be4-d5833cdf8198", "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "4916a35e-bfc4-47d0-8e25-a003d7067061", "73a883d0-0348-4be4-a8d8-51031c2564f8", "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "d223b46b-5621-4037-88fe-fda32eead684", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "480421f9-417f-4d3b-9552-fd2728443ec8", "60936b49-fca0-4f32-993d-7415edcf9a5d", "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "6597be7b-ac61-4ac8-bef4-d3ec88174853", "5b872a46-3b90-45c1-8419-f675db8053aa", "092af964-4233-4373-b4ba-d86ea2890288", "b64a026b-8deb-4c1d-92fd-98893209dff1", "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "34aa0252-6039-40ff-951f-939fd6ce47d8", "63647769-326d-4dde-a419-b925cc0caf42", "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "9d15044a-7cfe-4d23-8085-6ebc11df7685", "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "976dd1f2-a484-45ec-aa1d-0e87e882262b", "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "439957a7-ad86-4a8f-9705-a28131c6821b", "5a5152f1-463f-436b-b2f5-8eceb3964b42", "e0813366-0407-449a-9869-a2db1119dc41", "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "bf9e1387-b040-4393-9851-1598f8ecfae9", "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "9c226817-8dc9-46c2-a58d-66655aafd7dc", "7021255e-5db3-4946-a8b9-0ba7a4644a69", "36803969-5421-41ec-b92f-8500f79c23b0", "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "42205c73-75c8-4a63-9db1-e3782e06fda0", "41f6531d-af6e-4c6e-918f-b946f2b85a36", "e2482f8d-3443-4237-b906-cc145d87a076", "8b9606c9-28be-4a38-b146-0e313cc232c1", "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "4f281b83-0200-4b34-bf35-d24687ea57c2", "243380fa-11eb-4141-af92-e14925e77c1b", "baecf8fb-edbf-429f-9ade-31fc3f22b970", "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "0d7ceeef-3539-4392-8953-3dc664912714", "fc014922-5def-4da9-a0fc-28c973f41bfb", "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7", "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "9ace0707-b560-49b8-b6ca-5148b42f39fb", "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "9b0f8a61-91b2-464f-aceb-0527e0a45020", "1d218616-71b0-4c40-855b-9dbe75510f7f", "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "25ffa65d-76d8-4da5-a832-3f2b0136e133", "f50f3c09-557d-492d-81db-9064a8d4e211", "ec8c4047-fad9-416a-8c81-0f479353d7f6", "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "d13c43f0-f66b-4279-8b2c-5912077c1780", "d2451be2-b582-4e15-8701-4196ac180260", "f40017b3-cb2e-4335-ab5d-3babf679c1de", "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "f354eba5-623b-450f-b073-0b5b2773b6aa", "6414b5cd-b19d-447e-bb5e-9f03940b5784", "ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94", "bdc64095-d59a-42a2-8588-71fd9c9d9abc", "1fbc0671-5596-4e17-8682-f020a0b995dc", "552b6b65-df37-4d3e-a258-f2fc4771ae54", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "333cdbe8-27bb-4246-bf82-b41a0dca4b70", "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "4c21b805-4dd7-469f-b47d-7383a8fcb437", "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "4508a70e-97ef-4300-b62b-ff27992990ea", "857c8db3-c89b-42fb-882b-f681c7cf4da2", "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "3669afd2-9891-4534-a626-e5cf03810a61", "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "7417e29e-c2e7-4cf6-a2e8-767228c64837", "72ca7c75-bf85-45cd-aca7-255d360e423c", "060d5ad4-3153-47bb-8382-43e5e29eda92", "0e0bc253-07ed-43f1-816d-e1b220fe8971", "6e78b74f-c762-4800-82ad-f66787f10c8a", "84b0a8f3-680b-4096-a45b-e9a89221727c", "90ae0469-0cee-4509-b67f-e5efcef040f7", "bf9808c4-d24f-44a2-8398-b65227d406b6", "caa02837-f659-466f-bca6-48bde2826ab4", "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "4fc0deee-0057-4998-ab31-d24e46e0aba4", "e2e01011-5910-4267-9c3b-4149ed5479cf", "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "d2605a99-2218-4894-8fd3-2afb7946514d", "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "a2a3b925-7bb0-433b-b508-db9003263cc4", "68654bf0-4412-43d5-bfe8-5eaa393cd939", "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "952ed57c-8f99-453d-aee0-53a49c22f95d", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "75e508f7-932d-4ebc-af77-269237a84ce1", "50f852e6-af22-4c78-9ede-42ef36aa3453", "8cde342c-ba48-4b74-b615-172c330f2e93", "ea5c131b-380d-49f9-aeb3-920694da4d4b", "a2edbce1-95c8-4291-8676-0d45146862b3", "844f8eb2-610b-42c8-89a4-47596e089663", "6360757a-d460-456c-8b13-74cf0e60cceb", "24b6cf51-6122-469e-861a-22974e9c1e5b", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "9ed5959a-c43c-4c59-84e3-d28628429456", "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "b5de0c9a-6f19-43e0-af4e-55ad01f550af", "fef394cd-f44d-4040-9b18-95d92fe278c0", "48bfd177-7cf2-412b-ad77-baf923489e82", "2092cacb-d77b-4f98-ab0d-32b32f99a054", "ff0f2b05-09db-4095-b96d-1b75ca24894a", "49329257-089d-46e6-af37-4afce4290685", "7707a579-e0d8-4886-a853-ce47e4575aaa", "ee6cea48-c5b6-4304-a332-10fc6446f484", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "e76c8240-d68f-4773-8880-5c6f63595aaf", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "af4c4609-5755-42fe-8075-4effb49f5d44", "9ca2bf31-0570-44d8-a543-534c47c33ed7", "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "6ec86d9e-912e-4726-91a2-209359b999b9", "273a8dd8-3742-4302-bcc7-7df5a80fe425", "90217a70-13fc-48e4-b3db-0d836c5824ac", "3735d5ac-d770-4da0-99ff-156b180bc600", "948a0953-f287-4806-bbcb-3b2e396df89f", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "a1d9eec5-33b2-4177-8d24-27fe754d0812", "613c03ba-0779-4a53-8a1f-47f914a4ded3", "f356a9c4-effd-4608-bbf8-408afd5cd006", "a21bcd7e-38ec-49ad-b69a-9ea17e69509e", "df68f791-ad95-447f-a271-640a0dab9cf8", "e043f529-8514-4205-8ab0-7f7d2927b400", "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "065cceea-77ec-4030-9052-fc0affea7110", "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "36e037c4-c228-4866-b6a3-48eb292b9955", "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3", "e3f673b3-65d1-4d80-9146-466f8b63fa99", "270185ff-5f50-4d6d-a27f-24c3b8c9fef8", "5b2bbc47-dead-4ef7-8908-0cf73fcbecbf", "8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0", "06125661-3814-4e03-bfa2-1e4411c60ac3", "0a1f9d29-6465-4776-b091-7f43b26e4c89", "b1decb61-ed83-4339-8e95-53ea51901720", "a55349d8-9588-4c5a-8e3b-1925fe2a4ffe", "63c779ba-f638-40a0-a593-ddd45e8b1ddc", "ff301988-c231-4bd0-834c-ac9d73b86586", "3eb8c339-a765-48cc-a150-4364c04652bf", "3109530e-ab47-4cc6-a953-cac5ebcc93ae", "6ddab845-b1b8-49c2-bbf7-1a11967f64bc", "407aecb1-e762-4acf-8c7b-d087bcff3bb6", "7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2", "65744385-8541-44a6-8630-ffc824d7d4cc", "d51694fe-484a-46ac-92d6-969e76d60d10", "46612ae6-86be-4802-bc07-39b59feb1309", "f41b0311-44f9-44f0-816d-dd45e39d4bc8", "a5a2d357-1ab8-4675-a967-ef9990a59391", "02773bed-83bf-469f-b7ff-e676e7d78bab", "d353dac0-1b41-46c2-820c-d7d2561fc6ed", "caf02a0a-1e1c-4552-9b48-5e070bd88d11", "68578b43-65df-4f81-9a9b-92f32711a951", "13c02350-4177-4e45-ac17-cf7ca628ff5e", "b8fd0e93-ff58-4cbd-8f48-1c114e342e62", "39f1f9f2-9636-45de-98f6-a4046aa8e4b9", "28a452f3-786c-4fd8-b8f2-bddbe9d616d1", "74babdd6-a758-4549-9632-26535279e654", "fec96f39-988b-4586-b746-b93d59fd1922", "847def9e-924d-4e90-b7c4-5f581395a2b4", "ce7066a6-508a-42d3-995b-2952c65dc2ce", "4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6", "54127bd4-f541-4ac3-afdb-ea073f63f692", "002bdb95-0cf1-46a6-9e08-d38c128a6127", "c7a74c80-ba5a-486e-9974-ab9e682bc5e4", "34746e8c-5fb8-415a-b135-0abc167e912a", "ee63c85c-6d51-4d12-ad09-04e25877a947", "cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca", "1277f594-a7d1-4f28-a2d3-73af5cbeab43", "63e4f530-65dc-49cc-8f80-ccfa95c69d43", "dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c", "2f7979ae-f82b-45af-ac1d-2b10e93b0baa", "059c5af9-5131-4d8d-92b2-de4ad6146712", "7fd164ba-126a-4d9c-9392-0d4f7c243df0", "15904280-565c-4b73-9303-3291f964e7f9", "6902955a-01b7-432c-b32a-6f5f81d8f625", "3ab79e90-9fab-4cdf-a7b2-6522bc742adb", "654fcc6d-840d-4844-9b07-2c3300e54a26", "df6ecb8b-7822-4f4b-b412-08f524b4576c", "cad1fe90-2406-44dc-bd03-59d0b58fe722", "1027d292-dd87-4a1a-8701-2abe04d7783c", "41bb431f-56d8-4691-bb56-ed34e390906f", "de46c52b-0bf8-4936-a327-aace94f94ac6", "576426ad-0131-4001-ae01-be175da0c108", "4e7050dd-e548-483f-b7d6-527ab4fa784d", "3d2a2d59-929c-4b78-8c1a-145dfe9e07b1", "7d604714-e071-49ff-8726-edeb95a70679", "bdd8157d-8e85-4397-bb82-f06cc9c71dbb", "6b269392-9eba-40b5-acb6-55c882b20ba6", "b6f91281-20aa-446a-b986-38a92813a18f", "4aafb0fa-bff5-4b9d-b99e-8093e659c65f", "3da70954-0f2c-4103-adff-b7440368f50e", "e36941d0-c0f0-443f-bc6f-cb2952eb69ea", "6e90ae7a-7cd3-473f-a035-4ebb72d961da", "814ddeca-3d31-4265-8e07-8cc54fb44903", "bd1212e5-78da-431e-95fa-c58e3237a8e6", "9e099d99-44c2-42b6-a6d8-54c3545cab29", "7280c9f3-a5af-45d0-916a-bc01cb4151c9", "75bf09fa-1dd7-4d18-9af9-dd9e492562eb", "8fbf3271-1ef6-4e94-8210-03c2317947f6", "d102b8f5-61dc-4e68-bd83-9a3187c67377", "81315b50-6b60-4d8f-9928-3466e1022515", "2d367498-5112-4ae5-a06a-96e7bc33a211", "8e1cb247-6cf6-42fa-b440-3f27d57e9936", "7047d730-036f-4f40-b9d8-1c63e36d5e62", "2aa0a6b4-a865-495b-ab51-c28249537b75", "65236ec7-ace0-4f0c-82fd-737b04fd4dcb", "e4a74e34-ecde-4aab-b2fb-9112dd01aed0", "614a7e17-5643-4d89-b6fe-f9df1a79641c", "dca1b3e8-e043-4ec8-85d7-867f334b5724", "0b9ad457-2554-44c1-82c2-d56a99c42377", "8c31f563-f9a7-450c-bfa8-35f8f32f1f61", "9b64de98-9db3-4033-bd7a-f51430105f00", "aba15bdd-657f-422a-bab3-ac2d2a0d6f1c", "97aa2e88-555c-450d-85a6-229bcd87efb8", "304afd73-55a5-4bb9-8c21-0b1fc84ea9e4", "69ca12af-119d-44ed-b50f-a47af0ebc364", "b1c50487-1967-4315-a026-6491686d860e", "f0540f7e-2db3-4432-b9e0-3965486744bc", "130c9e58-28ac-4f83-8574-0a4cc913b97e", "92fa78e7-4d39-45f1-91a3-8b23f3f1088d", "33f41cdd-35ac-4ba8-814b-c6a4244a1ad4", "0bcfabcb-7929-47f4-93d6-b33fb67d34d1", "162ab1e4-6874-4564-853c-53ec3ab8be01", "11b1ed55-154d-4e82-8ad7-83739298f720", "c61daa90-3c1e-4f18-af62-8f288b5c9aaf", "fcc6d700-68d9-4241-9a1a-06874d621b06", "f92a6f1e-a512-4a15-9735-da09e78d7273", "7eff1a7f-dd45-4c20-877a-f21e342a7611", "0afecb6e-6223-4a82-99fb-bf5b981e92a5", "f0e2b768-5220-47dd-b891-d57b96fc0ec1", "34986307-b7f4-49be-92f3-e7a4d01ac5db", "9711de76-5d4f-4c50-a94f-21e4e8f8384d", "c3edc6a5-d9d4-48d8-930e-aab518390917", "d5866ddf-ce8f-4aea-b28e-d96485a20d3d", "259e5a6a-b8d2-4c38-86e2-26c5e651361d", "155dbf56-e0a4-4dd0-8905-8a98705045e8", "7fff6773-2baa-46de-a24a-b6eec1aba2d1", "e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f", "0b8baa3f-575c-46ee-8715-d6f28cc7d33c", "2f9356ae-bf43-41b8-b858-4496d83b2acb", "a05baa88-e922-4001-bc4d-8738135f27de", "5b40a734-99b6-4b98-a1d0-1cea51a08ab2", "6e2a900a-ced9-4e4a-a9c2-13e706f9518a", "91174a41-dc8f-401b-be89-7bfc140612a0", "8468111a-ef07-4654-903b-b863a80bbc95", "c048f047-7e2a-4888-b302-55f509d4a91d", "52753ea4-b3a0-4365-910d-36cff487b789", "fccfb43e-09a7-4bd2-8b37-a5a7df33386d", "5f87308a-0a5b-4623-ae15-d8fa1809bc60", "0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b", "a8f866e1-bdd4-425e-a27a-37619238d9c7", "07a99744-56ac-40d2-97b7-2095967b0e03", "3a8da4e0-36c1-40d2-8b29-b3e890d5172a", "0e29e3a7-1ad8-40aa-b691-9f82ecd33d66", "d7b50671-d1ad-4871-aa60-5aa5b331fe04", "409f8a98-4496-4aaa-818a-c931c0a8b832", "a6976974-ea6f-4e97-818e-ea08625c52cb", "3a9fa2ec-30bc-4ebd-b49e-7c9cff225502", "b4926b47-a9d7-434c-b3a0-adc3fa0bd13e", "28208707-fe31-437f-9a7f-4b1108b94d2e", "e15b518d-b4ce-4410-a9cd-501f23ce4a18", "760e75d8-c3b5-409b-a9bf-6130b4c4603f", "e0b06658-7d1d-4cd3-bf15-03467507ff7c", "4e87b8e2-2ee9-4b2a-a715-4727d297ece0", "bb09dd3e-2b78-4819-8e35-a7c1b874e449", "4c7f49ee-2638-43bb-b85b-ce676c30b260", "4358e5a5-7542-4dcb-b9f3-87667371839b", "62ed5b55-f991-406a-85d9-e8e8fdf18789", "e074832a-eada-4fd7-94a1-10642b130e16", "16fe46bb-4f64-46aa-817d-ff7bec4a2352", "8d5aca11-22b3-4f22-b7ba-90e60533e1fb", "3d0ed417-3d94-4963-a562-4a92c940656a", "7892ec59-c5bb-496d-8968-e5d210ca3ac4", "145095eb-e273-443b-83d0-f9b519b7867b", "5d756aee-ad3e-4306-ad95-cb1abec48de2", "48ea844d-19b1-4642-944e-fe39c2cc1fec", "8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9", "1908fcc1-1b92-4272-8214-0fbaf2fa5163", "a10a2c40-2c4d-49f8-b557-1a946bc55d9d", "736ffa74-5f6f-44ca-94ef-1c0df4f51d2a", "bbb7e38c-0b41-4a11-b306-d2a457b7ac2b", "fed85bf9-e075-4280-9159-fbe8a023d6fa", "0e20c89d-2264-44ae-8238-aeeaba609ece", "56e05d41-ce99-4ecd-912d-93f019ee0b71", "b5b78988-486d-4a80-b991-930eff3ff8bf", "805c55d9-31e6-4846-9878-c34c75054fe9", "80e1f67a-4596-4351-98f5-a9c3efabac95", "e3845023-ca9a-4024-b2b2-5422156d5527", "e8a52bbd-bced-459f-bd93-64db45ce7657", "fc4f4817-0c53-4683-a4ee-b17a64bc1039", "6ea858a8-ba71-4a12-b2cc-5d83312404c7", "93a19907-d4f9-4deb-9f91-aac4692776a6", "3215aa19-f060-4332-86d5-5602511f3ca8", "117d3d3a-755c-4a61-b23e-9171146d094c", "93d94efc-d7ad-4161-ad7d-1638c4f908d8", "318557a5-150c-4c8d-b70e-a9910e199857", "c3e76af5-4ce0-4a14-9c9a-25ceb8fda182", "f331aa1f-8c53-4fc3-b083-cc159bc971cb", "602a1f13-c640-4d73-b053-be9a2fa58b96", "9f2cc74d-78af-4eb2-bb64-9cd1d292b87b", "c3dbbc9f-ef1d-470a-a90a-d343448d5875", "edf3485d-dac4-4d50-90e4-b0e5813f7e60", "1d08ac94-400d-4469-a82f-daee9a908849", "7e9cf7b6-e827-11ed-a05b-15959c120003", "fa5b1358-b040-4403-9868-15f7d9ab6329", "c649a6c7-cd8c-4a78-9c04-000fc76df954", "e81528db-fc02-45e8-8e98-4e84aba1f10b", "7e9cf7b6-e827-11ed-a05b-0242ac120003", "a66bc059-c370-472c-a0d7-f8fd1bf9d583", "67add051-9ee7-4ad3-93ba-42935615ae8d", "295c9289-acee-4503-a571-8eacaef36b28", "72cd00d6-490c-4650-86ff-1d11f491daa1", "05296024-fe8a-4baf-8f3d-9a5f5624ceb2", "1a42dfa6-6cb2-4df9-9b48-295be477e835", "10cb6535-b31d-4512-9962-513dcbc42cc1", "7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8", "679085d5-f427-4484-9f58-1dc30a7c426d", "2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75", "39b64854-5497-4b57-a448-40977b8c9679", "a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f", "77564cc2-7382-438b-a7f6-395c2ae53b9a", "f239b326-2f41-4d6b-9dfa-c846a60ef505", "caa06de8-fdef-4c91-826a-7f9e163eef4b", "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "2158f96f-43c2-43cb-952a-ab4580f32382", "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "d797268e-28a9-49a7-b9a8-2f5039011c5c", "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "f426547a-e0f7-441a-b63e-854ac5bdf54d", "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "6d3a3952-6530-44a3-8554-cf17c116c615", "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "4c0aaedc-154c-4427-ada0-d80ef9c9deb6", "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "a4824fca-976f-4964-b334-0621379e84c4", "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "92a974db-ab84-457f-9ec0-55db83d7a825", "f9578658-9e71-4711-b634-3f9b50cd3c06", "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "f5240972-3938-4e56-8e4b-e33893176c1f", "fff9d2b7-e11c-4a69-93d3-40ef66189767", "cc9d3712-6310-4320-b2df-7cb408274d53", "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "327ff235-94eb-4f06-b9de-aaee571324be", "42a993dd-bb3e-48c8-b372-4d6684c4106c", "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "36210e0d-5b19-485d-a087-c096088885f0", "1723e720-616d-4ddc-ab02-f7e3685a4713", "90fb5e62-ca1f-4e22-b42e-cc521874c938", "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "57c4bf16-227f-4394-8ec7-1b745ee061c3", "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "0ea52357-cd59-4340-9981-c46c7e900428", "7aa7009a-28b9-4344-8c1f-159489a390df", "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "9719a8aa-401c-41af-8108-ced7ec9cd75c", "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "587254ee-a24b-4335-b3cd-065c0f1f4baa", "98b53e78-ebaf-46f8-be06-421aafd176d9", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "b5746143-59d6-4603-8d06-acbd60e166ee", "c09dad97-1c78-4f71-b127-7edb2b8e491a", "551d9c1f-816c-445b-a7a6-7a3864720d60", "e31033fc-33f0-4020-9a16-faf9b31cbf08", "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "8e3c7994-131e-4ba5-b6ea-804d49113a26", "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "e32d4572-9826-4738-b651-95fa63747e8a", "043c4b8b-3a54-4780-9682-081cb6b8185c", "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "c363385c-f75d-4753-a108-c1a8e28bdbda", "5cb299fc-5fb1-4d07-b989-0644c68b6043", "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "811f459f-9231-45d4-959a-0266c6311987", "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "7d6d30b8-5b91-4b90-a891-46cccaf29598", "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "087790e3-3287-436c-bccf-cbd0184a7db1", "6812a10b-60ea-420c-832f-dfcc33b646ba", "84b14121-9d14-416e-800b-f3b829c5a14d", "32e280f1-8ad4-46ef-9e80-910657611fbc", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "9cfc00b6-bfb7-49ce-9781-ef78503154bb", "3f5491e2-8db8-496b-9e95-1029fce852d4", "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "02030f2f-6199-49ec-b258-ea71b07e03dc", "74403157-20f5-415d-89a7-c505779585cf", "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "4d7cda18-1b12-4e52-b45c-d28653210df8", "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "c9783e20-4793-4164-ba96-d9ee483992c4", "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "94771a71-ba41-4b6e-a757-b531372eaab6", "2f869d59-7f6a-4931-992c-cce556ff2d53", "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "1775e15e-b61b-4d14-a1a3-80981298085a", "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "42b1a5b8-353f-4f10-b256-39de4467faff", "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "9292293b-8496-4715-9db6-37028dcda4b3", "52788a70-f1da-40dd-8fbd-73b5865d6568", "349d891d-fef0-4fe4-bc53-eee623a15969", "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "6f3e2987-db24-4c78-a860-b4f4095a7095", "1ec65a5f-9473-4f12-97da-622044d6df21", "d042284c-a296-4988-9be5-f424fadcc28c", "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "1327381e-6ab0-4f38-b583-4c1b8346a56b", "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "9ec9fb1b-e059-4489-9642-f270c207923d", "058f4380-962d-40a5-afce-50207d36d7e2", "fe63010f-8823-4864-a96b-a7b4a0f7b929", "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "c86133ad-4725-4bd0-8170-210788e0a7ba", "f5d19838-41b5-476c-98d8-ba8af4929ee2", "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "82880171-b475-4201-b811-e9c826cd5eaa", "023c654f-8f16-44d9-bb2b-00ff36a62af9", "d557dc06-62e8-4468-a8e8-7984124908ce", "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "a642964e-bead-4bed-8910-1bb4d63e3b4d", "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "e4a6b256-3e47-40fc-89d2-7a477edd6915", "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "9fff585c-c33e-4a86-b3cd-39312079a65f", "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "fa00b701-44c6-4679-994d-5a18afa8a707", "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "313d6012-51a0-4d93-8dfc-de8553239e25", "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "8d63dadf-b91b-4187-87b6-34a1114577ea", "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "b36d01a3-ddaf-4804-be18-18a6247adfcd", "aaf46cdc-934e-4284-b329-34aa701e3771", "575dce0c-8139-4e30-9295-1ee75969f7fe", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "a1473adb-5338-4a20-b4c3-126763e2d3d3", "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "241e802a-b65e-484f-88cd-c2dc10f9206d", "fd877b94-9bb5-4191-bb25-d79cbd93c167", "d047726b-c71c-4048-a99b-2e2f50dc107d", "40b95d31-1afc-469e-8d34-9a3a667d058e", "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "e6c54d94-498c-4562-a37c-b469d8e9a275", "64760eef-87f7-4ed3-93fd-655668ea9420", "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "da2738f2-fadb-4394-afa7-0a0674885afa", "88872991-7445-4a22-90b2-a3adadb0e827", "f576a613-2392-4067-9d1a-9345fb58d8d1", "431a1fdb-4799-4f3b-91c3-a683b003fc49", "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "4931188c-178e-4ee7-a348-39e8a7a56821", "85ff530b-261d-48c6-a441-facaa2e81e48", "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "8cbc9475-8d05-4e27-9c32-df960716c701", "378a05d8-963c-46c9-bcce-13c7657eac99", "e8d34729-86a4-4140-adfd-0a29c2106307", "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "e568650b-5dcd-4658-8f34-ded0b1e13992", "f208d6d8-d83a-4c2c-960d-877c37da84e5", "514e4c3a-c77d-4cde-a00f-046425e2301e", "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "01aeb693-138d-49d2-9403-c4f52d7d3d62", "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "83865853-59aa-449e-9600-74b9d89a6d6e", "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "b53317a0-8acf-4fd1-8de8-a5401e776b96", "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "10344bb3-7f65-46c2-b915-2d00d47be5b0", "185d7418-f250-42d0-b72e-0c8b70661e93", "379fa130-190e-4c3f-b7bc-6c8e834485f3", "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "e83e8899-c9b2-483b-b355-5decc942b959", "6385697e-9f1b-40bd-8817-f4a91f40508e", "24357373-078f-44ed-9ac4-6d334a668a11", "15619216-e993-4721-b590-4c520615a67d", "d2eb17db-1d39-41dc-b57f-301f6512fa75", "5a6e1e16-07de-48d8-8aae-faa766c05e88", "5a3164f2-b373-4152-93cf-090b13c12d27", "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "cbec226f-63d9-4eca-9f52-dfb6652f24df", "5b768e71-86f2-4879-b448-81061cbae951", "ca621ba5-54ab-4035-9942-d378e6fcde3c", "98767d61-b2e8-4d71-b661-e36783ee24c1", "a85ffc3a-e8fd-4040-93bf-78aff284d801", "88f46b67-14d4-4f45-ac2c-d66984f22191", "83809e84-4475-4b69-bc3e-4aad8568612f", "ce72ef99-22f1-43d4-8695-419dcb5d9330", "add64136-62e5-48ea-807e-88638d02df1e", "04936b66-3915-43ad-a8e5-809eadfd1141", "847d5ff3-8a31-4737-a970-aeae8fe21765", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "c49c5062-0966-4170-9efd-9968c913a6cf", "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "850d55f9-6eeb-4492-ad69-a72338f65ba4", "d87bd452-6da1-456e-8155-7dc988157b7d", "5bb68627-3198-40ca-b458-49f973db8752", "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "caf201a9-c2ce-4a26-9c3a-2b9525413711", "4e762605-34a8-406d-b72e-c1a089313320", "d3c3861d-c504-4c77-ba55-224ba82d0118", "2ddef153-167b-4e89-86b6-757a9e65dcac", "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "8a582fe2-0882-4b89-a82a-da6b2dc32937", "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "f35c5d71-b489-4e22-a115-f003df287317", "fbd7c32d-db2a-4418-b92c-566eb8911133", "87a476dc-0079-4583-a985-dee7a20a03de", "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "38879043-7e1e-47a9-8d46-6bec88e201df", "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "f9999590-1f94-4a34-a91e-951e47bedefd", "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "4eddc365-79b4-43ff-a9d7-99422dc34b93", "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "220457c1-1c9f-4c2e-afe6-9598926222c1", "bf361876-6620-407a-812f-bfe11e51e924", "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "c79da740-5030-45ec-a2e0-479e824a562c", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "a197e378-d31b-41c0-9635-cfdf1c1bb423", "737e618a-a410-49b5-bec3-9e55ff7fbc15", "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "30edb182-aa75-42c0-b0a9-e998bb29067c", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "eb1c4225-1c23-4241-8dd4-051389fde4ce", "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "e312efd0-35a1-407f-8439-b8d434b438a6", "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "ba42babc-0666-4393-a4f7-ceaf5a69191e", "c27515df-97a9-4162-8a60-dc0eeb51b775", "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "0f6da907-5854-4be6-859a-e9958747b0aa", "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "5edc2273-c26f-406c-83f3-f4d948e740dd", "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "0f0450f3-8b47-441e-a31b-15a91dc243e2", "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "817f252c-5143-4dae-b418-48c3e9f63728", "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "07e3cb2c-0608-410d-be4b-1511cb1a0448", "138d3531-8793-4f50-a2cd-f291b2863d78", "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "ddeff553-5233-4ae9-bbab-d64d2bd634be", "e212d415-0e93-435f-9e1a-f29005bb4723", "55f0a3a1-846e-40eb-8273-677371b8d912", "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "e7888eb1-13b0-4616-bd99-4bc0c2b054b9", "6ba5a05f-b095-4f0a-8654-b825f4f16334", "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "7cce6fc8-a07f-4d84-a53e-96e1879843c9", "45d3a03d-f441-458c-8883-df101a3bb146", "871b9555-69ca-4993-99d3-35a59f9f3599", "f2c64357-b1d2-41b7-849f-34d2682c0fad", "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "12fbff88-16b5-4b42-9754-cd001a789fb3", "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "0403d67d-6227-4ea8-8145-4e72db7da120", "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "bd1c6866-65fc-44b2-be51-5588fcff82b9", "1114e048-b69c-4f41-bc20-657245ae6e3f", "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "27aec9c9-dbb0-4939-8422-1742242471d0", "727454c0-d851-48b0-8b89-385611ab0704", "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "d20ee2f4-822c-4827-9e15-41500b1fff10", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "efec536f-72e8-4656-8960-5e85d091345b", "6f4191bb-912b-48a8-9ce7-682769541e6d", "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "517490a7-115a-48c6-8862-1a481504d5a8", "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "49d9671b-0a0a-4c09-8280-d215bfd30662", "05f3c945-dcc8-4393-9f3d-af65077a8f86", "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "554601fb-9b71-4bcc-abf4-21a611be4fde", "7b10f171-7f04-47c7-9fa2-5be43c76e535", "45239e6a-b035-4aaf-b339-8ad379fcb67e", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "7be5fb68-f9ef-476d-8b51-0256ebece19e", "6e22722b-dfb1-4508-a911-49ac840b40f8", "9ccba514-7cb6-4c5c-b377-700758f2f120", "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "7a74da6b-ea76-47db-92cc-874ad90df734", "f11f2808-adb4-46c0-802a-8660db50fa99", "43e32da2-fdd0-4156-90de-50dfd62636f9", "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "a20def93-0709-4eae-9bd2-31206e21e6b2", "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "6004abd0-afa4-4557-ba90-49d172e0a299", "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "970823b7-273b-460a-8afc-3a6811998529", "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "15b75071-74cc-47e0-b4c6-b43744a62a2b", "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "f99abdf0-6283-4e71-bd2b-b5c048a94743", "0a13e132-651d-11eb-ae93-0242ac130002", "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "e9f55347-2928-4c06-88e5-1a7f8169942e", "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "6a69f62d-ce75-4b57-8dce-6351eb55b362", "8b0e12da-d3c3-49db-bb4f-256703f380e5", "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "98a96a5a-64a0-4c42-92c5-489da3866cb0", "47e4bab7-c626-47dc-967b-255608c9a920", "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "40b19fa6-d835-400c-b301-41f3a2baacaf", "71158e3f-df67-472b-930e-7d287acaa3e1", "f44800ac-38ec-471f-936e-3fa7d9c53100", "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "24c8392b-aa3c-46b7-a545-43f71657fe98", "88f680b8-070e-402c-ae11-d2914f2257f1", "15434e33-5027-4914-88d5-3d4145ec25a9", "b98d0db6-511d-45de-ad02-e82a98729620", "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "0bbc6369-43e3-453d-9944-cae58821c173", "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "b7966f4a-b333-455b-8370-8ca53c229762", "43fa5350-db63-4b8f-9a01-789a427074e1", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "ec290c06-9b6b-4338-8b6b-095c0f284f10", "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "d4498716-1d52-438f-8084-4a603157d131", "b222df08-0e07-11eb-adc1-0242ac120002", "e1693bc8-7168-4eab-8718-cdcaa68a1738", "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "d3b70aad-097e-409c-9df2-450f80dc476b", "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "312d0384-401c-4b8b-abdf-685ffba9a332", "cc368ed0-2411-45dc-a222-510ace303cb2", "42333b2c-b425-441c-b70e-99404a17170f", "0e4164da-94bc-450d-a7be-a4b176179f1f", "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "ebef4391-1a81-4761-a40a-1db446c0e625", "f26307d8-14cd-47e3-a26b-4b4769f24af6", "03cc0c25-389f-4bf8-b48d-11878079f1ca", "8834e2f7-6b4b-4f09-8906-d2276470ee23", "7090adee-82e2-4269-bd59-80691e7c6338", "c74c0390-3e20-41fd-a69a-128f0275a5ea", "b6457d63-d2a2-4e29-859d-4e7affc153d1", "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "5f6a601c-2ecb-498b-9c33-660362323afa", "aa8e035d-7be4-48d3-a944-102aec04400d", "b243b280-65fe-48df-ba07-6ddea7646427", "236d8e89-ed95-4789-a982-36f4643738ba", "277a4393-446c-449a-b0ed-7fdc7795244c", "4fe074b4-b833-4081-8f24-7dcfeca72b42", "68bcd73b-37ef-49cb-95fc-edc809730be6", "86588b36-c6d3-465f-9cee-8f9093e07798", "502b42de-4306-40b4-9596-6f590c81f073", "0a99eb3e-1617-41bd-b095-13dc767f3def", "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "07f8bdc2-c9b3-472a-9817-5a670b872f53", "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "28ac00d6-22d9-4a3c-927f-bbd770104573", "452bce90-6fb0-43cc-97a5-affc283139b3", "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "ce7cf472-6fcc-490a-9481-3786840b5d9b", "c6fb44c6-71f5-49e6-9462-1425d328aee3", "9c0295ce-d60d-40bd-bd74-84673b7592b1", "0a4f6091-223b-41f6-8743-f322ec84930b", "98c5aeef-32d5-492f-b174-64a691896d25", "6fe4aa1e-0531-4510-8be2-782154b73b48", "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "d78b5d61-187d-44b6-bf02-93486a80de5a", "e9b61244-893f-427c-b287-3e708f321c6b", "70bc5215-526f-4477-963c-a47a5c9ebd12", "b6e04788-29e1-4557-bb14-77f761848ab8", "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "0685b176-c816-4837-8e7b-1216f346636b", "e84d89c4-f544-41ca-a6af-4b92fd38b023", "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "023394c4-29d5-46ab-92b8-6a534c6f447b", "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "ebea773c-a8f1-42ad-a856-00cb221966e8", "0b7163dc-7eee-4960-af17-c0cd517f92da", "98dedfdd-8333-49d4-9f23-d7018cccae53", "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "f24bcaea-0cd1-11eb-adc1-0242ac120002", "ccb5742c-c248-4982-8c5c-5571b9275ad3", "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "4abc0ec4-db5a-412f-9632-26659cddf145", "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "5cddf373-ef00-4112-ad72-960ac29bac34", "37db85d1-b089-490a-a59a-c7b6f984f480", "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "f1edd233-30b5-4823-9e6a-c4171b24d316", "e92a4287-e072-4a40-9739-370c106bb750", "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "8bc64091-6875-4881-aaf9-7bd25b5dda08", "56c217c3-2de2-479b-990f-5c109ba8458f", "eee00933-a761-4cd0-be70-c42fe91731e7", "bab049ca-7471-4828-9024-38279a4c04da", "c3a99af4-35a9-4668-879e-c09aeb4f2bdf", "d7654f02-e04b-4934-9838-65c46f187ebc", "2a072a96-a086-49fa-bcb5-15cc5a619093", "883faa95-175a-4e22-8181-e5761aeb373c", "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "63d1ccc0-2a43-4f4b-9289-361b308991ff", "4f154fb6-27d1-4813-a759-78b93e0b9c48", "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "33be4333-2c6b-44f4-ae28-102cdbde0a31", "395907ee-96e5-4666-af2e-2ca91688e151", "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "b0ce780f-10bd-496d-9067-066d23dc3aa5", "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "79b06761-465f-4f88-9ef2-150e24d3d737", "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "c615d676-f655-46b9-b913-78729021e5d7", "b19146a3-25d4-41b4-928b-1e2a92641b1b", "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "e6474a1b-5390-49cd-ab41-8d88655f7394", "692f0bec-83ba-4d04-af7e-e884a96059b6", "93671f99-04eb-4ab4-a161-70d446a84003", "0d5675be-bc88-4172-86d3-1e96a4476536", "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "4281cb20-2994-4580-aa63-c8b86d019934", "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "a34f79a3-8e5f-4cc3-b765-de00695452c2", "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "5589ab4f-a767-433c-961d-c91f3f704db1", "e8a95b5e-c891-46e2-b33a-93937d3abc31", "c86500e9-a645-4680-98d7-f882c70c1ea3", "58f50261-c53b-4c88-bd12-1d71f12eda4c", "34ebb878-1b15-4895-b352-ca2eeb99b274", "7a02e22e-b885-4404-b38b-1ddc7e65258a", "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "24de4f3b-804c-4165-b442-5a06a2302c7e", "731231b9-0b5d-4219-94dd-abb6959aa7ea", "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "d7bcd677-645d-4691-a8d4-7a5602b780d1", "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "6e897651-f157-4d8f-aaeb-df8151488385", "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "9847f263-4a81-424f-970c-875dab15b79b", "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "4b046706-5789-4673-b111-66f25fe99534", "73bba97f-a82d-42ce-b315-9182e76c57b1", "646bc99f-6682-4b47-a73a-17b1b64c9d34", "6c96fc76-0eb1-11eb-adc1-0242ac120002", "7050bba1-1aed-454e-8f73-3f46f09ce56a", "744a188b-0415-4792-896f-11ddb0588dbc", "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "faa48cae-6b25-4f00-a094-08947fef582f", "70ad0861-d1fe-491c-a45f-fa48148a300d", "a16980c2-0c56-4de0-9a79-17971979efdd", "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "954f0af7-62dd-418f-b3df-a84bc2c7a774", "a7ee1722-c3c5-aeff-3212-c777e4733217", "1dde5376-a648-492e-9e54-4241dd9b0c7f", "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "10c14723-61c7-4c75-92ca-9af245723ad2", "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "41421f44-58f9-455d-838a-c398859841d4", "ae9b0bd7-8888-4606-b444-0ed7410cb728", "8de1cbe8-d6f5-496d-8237-5f44a721c7a0", "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "43103702-5886-11ed-9b6a-0242ac120002", "16905e21-66ee-42fe-b256-1318ada2d770", "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "a7c3d773-caef-227e-a7e7-c2f13c622329", "214641c2-c579-4ecb-8427-0cf19df6842e", "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "07aa184a-870d-413d-893a-157f317f6f58", "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "f548a603-c9f2-4c89-b511-b089f7e94549", "93199800-b52a-4dec-b762-75212c196542", "526be59f-a573-4eea-b5f7-f0973207634d", "6345b048-8441-43a7-9bed-541133633d7a", "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "25676e10-2121-446e-80a4-71ff8506af47", "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "ac1c92b4-ac81-405a-9978-4604d78cc47e", "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "bdeb2cff-af74-4094-8426-724dc937f20a", "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "a383dec4-deec-4e6e-913b-ed9249670848", "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "ac20ae82-8758-4f38-958e-b44a3140ca88", "54786ddc-5b8a-11ed-9b6a-0242ac120002", "41ca393d-538c-408a-ac27-cf1e038be80c", "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "cd71385d-fd9b-4691-9b98-2b1f7e508714", "c8a180d6-47a3-4345-a609-53f9c3d834fc", "044ba588-dff4-4918-9808-3f95e8160606", "1af57a4b-460a-4738-9034-db68b880c665", "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "1dd05363-104e-4b4a-b963-196a534b03a1", "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "84b1ecf9-6eff-4004-bafb-bae5c0e251b2", "204b17ae-4007-471b-917b-b917b315c5db", "50d66fb0-03f8-4da0-8add-84e77d12a020", "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "c2b86e67-b880-4eec-b045-50bc98ef4844", "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "e593cf51-88db-4ee1-b920-37e89012a3c9", "90d6bd71-dffb-4989-8d86-a827fedd6624", "8202070f-edeb-4d31-a010-a26c72ac5600", "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "3268b746-88d8-4cd3-bffc-30077d02c787", "18988e1b-9087-4f8a-82fe-0414dce49878", "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "f53714ec-5077-420e-ad20-907ff9bb2958", "f117933c-980c-4f78-b384-e3d838111165", "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "a29c1813-ab1f-4dde-b489-330b952e91ae", "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "b655a06a-31c0-477a-95c2-3726b83d649d", "21d856f9-9281-4ded-9377-51a1a6e2a432", "b66474aa-bd92-4333-a16c-298155b120df", "b2309017-4235-44fe-b5af-b15363011957", "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "62510e69-616b-4078-b371-847da438cc03", "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "285b85b1-a555-4095-8652-a8a4106af63f", "84f52741-8834-4a8c-a413-2eb2269aa6c8", "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "be344333-921d-4c4d-8bb8-e584cf584780", "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "fb843269-508c-4b76-8b8d-88679db22ce7", "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "de587dce-915e-4218-aac4-835ca6af6f70", "c7942406-33dd-4377-a564-0f62db0593a3", "ab9e3b40-0c85-4ba1-aede-455d226fd124", "ef61af62-bc74-4f58-b49b-626448227652", "a20391f8-76fb-437b-abc0-dba2df1952c6", "899133d5-4d7c-4a7f-94ee-27355c879d90", "1ac8666b-046f-4201-8aba-1951aaec03a3", "1c67a717-32ba-409b-a45d-0fb704a73a81", "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "eca49c87-8a75-4f13-9c73-a5a29e845f03", "435e10e4-992a-4281-96f3-38b11106adde", "b3512211-c67e-4707-bedc-66efc7848863", "c15a46a0-07d4-4c87-b4b6-89207835a83b", "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "1f0f6176-6482-4027-b151-00071af39d7e", "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "9257c05b-4a4a-48e5-a670-b7b073cf401b", "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "99793437-3e16-439b-be0f-078782cf953d", "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "ac175779-025a-4f12-98b0-acdaeb77ea85", "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "90d50722-0483-4065-8e35-57efaadd354d", "180c7c5c-d64b-4a63-86e9-68910451bc8b", "d55b793d-f847-4eea-b59a-5ab09908ac90", "aef9d1f1-7396-4e92-a927-4567c7a495c1", "6c6d9280-e6d0-4b9d-80ac-254701b64916", "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "9212f354-7775-4e28-9c9f-8f0a4544e664", "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "ffa6861c-4461-4f59-8a41-578c39f3f23e", "a0459f02-ac51-4c09-b511-b8c9203fc429", "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "534f2ef7-e8a2-4433-816d-c91bccde289b", "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "84232095-ecca-4015-b0d7-7726507ee793", "4e2ed651-1906-4a59-a78a-18220fca1b22", "96036718-71cc-4027-a538-d1587e0006a7", "60f16a96-db70-42eb-8f76-16763e333590", "5afee48e-67dd-4e03-a783-f74259dcf998", "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "771d1eb5-9587-4568-95fb-9ec44153a012", "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "e28a5a99-da44-436d-b7a0-2afc20a5f413", "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "68d37776-61db-42f5-bf54-27e87072d17e", "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "d2b749ee-4225-417e-b20e-a8d2193cbb84", "1193d960-2369-499f-a158-7b50a31df682", "6b65c28e-11f3-46cb-902a-68f2cafaf474", "242301bc-f92f-4476-8718-78004a6efd9f", "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "52d097e2-063e-4c9c-8fbb-855c8948d135", "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "647c7b9e-d784-4fda-b9a0-45c565a7b729", "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "bb76d96b-821c-47cf-944b-7ce377864492", "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "1816994b-42e1-4fb1-afd2-134d88184f71", "12827a56-61a4-476a-a9cb-f3068f191073", "32b96012-7892-429e-b26c-ac2bf46066ff", "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "f4bbd493-b796-416e-bbf2-121235348529", "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "d06be4b9-8045-428b-a567-740a26d9db25", "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "65c3ca2c-525f-4ced-968e-246a713d164f", "347906f3-e207-4d18-ae5b-a9403d6bcdef", "a29808fd-ef50-49ff-9c7a-59a9b040b404", "e66779cc-383e-4224-a3a4-267eeb585c40", "85c312b7-f44d-4a51-a024-d671c40b49fc", "6da2c9f5-7c53-401b-aacb-92c040ce1215", "6bd75993-9888-4f91-9404-e1e4e4e34b77", "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "ff992eac-6449-4c60-8c1d-91c9722a1d48", "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "208748f7-881d-47ac-a29c-07ea84bf691d", "89ca78fd-b37c-4310-b3d3-81a023f83936", "a2910908-e86f-4687-aeba-76a5f996e652", "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "9c14c9fa-1a63-4a64-8e57-d19280559490", "221b251a-357a-49a9-920a-271802777cc0", "50919691-7302-437f-8e10-1fe088afa145", "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "f14e169e-9978-4c69-acb3-1cff8200bc36", "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "1c8774a0-44d4-4db0-91f8-e792359c70bd", "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "9fc3072c-dc8f-4bf7-b231-18950000fadd", "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "ada4b0c4-758b-46ac-9033-9004613a150d", "584bca0f-3608-4402-80fd-4075ff6072e3", "9a132afa-654e-11eb-ae93-0242ac130002", "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "a70dcb37-3bee-453a-99df-d0c683151be6", "85b0b087-eddf-4a2b-b033-d771fa2b9775", "2267fe65-0681-42ad-9a6d-46553d3f3480", "28c8f68b-098d-45af-8d43-8089f3e35403", "cd8c163e-a19b-402e-bdd5-419ff5859f12", "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "2c28c248-7f50-417a-9186-a85b223010ee", "84972c80-251c-4c3a-9079-4f00aad93938", "434c08ba-8406-4d15-8b24-782cb071a691", "bed2a484-9348-4143-8a8a-b801c979301c", "a0d7e4d2-bede-4141-8896-bc6e237e977c", "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "1c526788-0abe-4713-862f-b520da5e5316", "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "9f107a84-532c-41af-b005-8d12a607639f", "455b9d50-15a1-4b99-853f-8d37655a4c1b", "dee0a7a3-f200-4112-a99b-952196d81e42", "79ce34ca-af29-4d0e-b832-fc1b377020db", "2afafd61-6aae-4df4-baed-139fa1f4c345", "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "f0507c0f-a3a2-40f5-acc6-7f543c334993", "970007b7-ce32-49d0-a4a4-fbef016950bd", "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "f4264e47-f522-4c38-a420-04525d5b880f", "b2ddd389-f676-4ac4-845a-e00781a48e5f", "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "4a6713f6-3331-11ed-a261-0242ac120002", "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "5cc2cda8-f261-4d88-a2de-e9e193c86716", "2d22a514-e024-4428-9dba-41505bd63a5b", "01c42d3c-242d-4655-85b2-34f1739632f7", "77946e79-97f1-45a2-84b4-f37b5c0d8682", "27ba3207-dd30-4812-abbf-5d20c57d474e", "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "1228c958-e64e-4e71-92ad-7d429f4138ba", "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "b1377339-fda6-477a-b455-ac0923f9ec2c", "44143844-0631-49ab-97a0-96387d6b2d7c", "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "85de1f22-d189-44e4-8239-dc276b45379b", "92626ddd-662c-49e3-ac59-f6535f12d189", "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "e56d3073-83ff-4021-90fe-c658e0709e72", "deb9b646-a508-44ee-b7c9-d8965921c6b6", "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "cea2b7ea-792b-405f-95a1-b903ea06458f", "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "730fc21b-eaff-474b-ad23-90fd265d4988", "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "48917adc-a28e-4f5d-b729-11e75da8941f", "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "0900463c-b33b-49a8-be1d-552a3b553dae", "82a6714f-4899-4f16-9c1e-9a333544d4c3", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "1e59c230-6670-45bf-83b0-98903780607e", "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "5687f942-867b-4578-ade7-1e341c46e99a", "258fc8ce-8352-443a-9120-8a11e4857fa5", "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "4ae81040-fc1c-4249-bfa3-938d260214d9", "aa2efee7-34dd-446e-8a37-40790a66efd7", "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "ae215552-081e-44c7-805f-be16f975c8a2", "30bf1789-379d-4fdc-900f-55cd0a90a801", "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "4f7a6757-ff79-46db-9687-66501a02d9ec", "129966c9-de17-4334-a123-8b58172e664d", "696bfb54-227e-4602-ac5b-30d9d2053312", "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "7df1713a-1a5b-4a4b-a071-dc83b144a101", "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "814c95cc-8192-4378-a70a-f1aafd877af1", "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "99c840f2-2012-46fd-9141-c761987550ef", "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "de16d92c-c446-4d53-8938-10aeef41c8b6", "056c7317-9a09-4bd4-9067-d051312752ea", "60fc936d-2eb0-4543-8a13-911c750a1dfc", "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "114de787-4eb2-48cc-abdb-c0b449f93ea4", "207b0396-3689-42d9-8399-4222658efc99", "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "9248c7e1-2bf3-4661-a22c-600a8040b446", "146aace8-9bd6-42ba-be7a-0070d8027b76", "3d7679bd-0c00-440c-97b0-3f204273e6c7", "ea011323-7045-460b-b2d7-0f7442ea6b38", "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "e290b10b-1023-4452-a4a9-eb31a9013b3a", "ca5583e9-8f80-46ac-ab91-7f314d13b984", "cd3d1298-eb3b-476c-ac67-12847de55813", "867356ee-9352-41c9-a8f2-1be690d78216", "67f113fa-e23d-4271-befa-30113b3e08b1", "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "62b20d44-1546-4e61-afce-8e175eb9473c", "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "b6676963-0353-4f88-90f5-36c20d443c6a", "99cf1e02-00fb-4c0d-8375-563f978dfd37", "903076ff-f442-475a-b667-4f246bcc203b", "a77c1610-fc73-4019-8e29-0f51efc04a51", "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "cea72823-df4d-4567-950c-0b579eaf0846", "74a2b202-73e0-4693-9a3a-9d36146d0775", "5fc297ae-25b6-488a-8f25-cc12ac29b744", "12f6b752-042d-483e-bf9c-915a6d06ad75", "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "c1d867fe-8d95-4487-aab4-e53f2d339f90", "e13f668e-7f95-443d-98d2-1816a7648a7b", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "9c8c7000-3065-44a8-a555-79bcba5d9955", "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "ee5e119b-1f75-4b34-add8-3be976961e39", "33339be3-148b-4e16-af56-ad16ec6c7e7b", "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "01d2e2a1-5f09-44f7-9fc1-24faa7479b6d", "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "646ea171-dded-4578-8a4d-65e9822892e3", "84b1706c-932a-44c4-ae28-892b28a25b94", "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "1012f107-b8f1-4271-af30-5aed2de89b39", "074e0ded-6ced-4ebd-8b4d-53f55908119d", "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "af491bca-e752-4b44-9c86-df5680533dbc", "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "f0f7be61-9cf5-43be-9836-99d6ef448a18", "b1f73849-6329-4069-bc8f-78a604bb8b23", "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "0b80ade5-6997-4b1d-99a1-71701778ea61", "81ebd28b-9607-4478-bf06-974ed9d53ed7", "dc4576d4-7467-424f-9eee-fd2b02855fe0", "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "e9142d84-fbe0-401d-ac50-3e519fb00c89", "b4dc61f5-6cce-468e-a608-b48b469feaa2", "e6313acd-208c-44fc-a0ff-db85d572e90e", "f3d39c45-de1a-4486-a687-ab126124f744", "97dbf6e2-e436-44d8-abee-4261b24d3e41", "729ce0ea-5d8f-4769-9762-e35de441586d", "0fc35fc3-efe6-4898-8a37-0b233339524f", "c947b146-0abc-4c87-9c64-b17e9d7274a2", "91a2c315-9ee6-4052-a853-6f6a8238f90d", "9525dc73-0327-438c-8c04-13c0e037e9da", "a4694263-59a8-4608-a3a0-6f8d3a51664c", "f37aba28-a9e6-4045-882c-d5004043b337", "5e95028c-5229-4214-afae-d653d573d0ec", "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "f7375e28-5c14-432f-b8d1-1db26c832df3", "0e0255bf-2548-47b8-9582-c0955c9283f5", "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "d65aee4d-2292-4cea-b832-83accd6cfa43", "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "889719ef-dd62-43df-86c3-768fb08dc7c0", "18ee686c-38a3-4f65-9f44-48a077141f42", "af77cf95-c469-471c-b6a0-946c685c4798", "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "4bf943c6-5146-4273-98dd-e958fd1e3abf", "7f741dcf-fc22-4759-87b4-9ae8376676a2", "8a3038e8-9c9d-46f8-b184-66234a160f6f", "7d4aaec2-08ed-4430-8b96-28420e030e04", "75d0a94e-6252-448d-a7be-d953dff527bb", "327f48c1-a6db-4eb8-875a-f6981f1b0183", "5f03babb-12db-4eec-8c82-7b4cb5580868", "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "cd1f961e-0b96-436b-b7c6-38da4583ec00", "7b4f794b-590a-4ad4-ba18-7964a2832205", "438025f9-5856-4663-83f7-52f878a70a50", "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "213d6a77-3d55-4ce8-ba74-fcfef741974e", "aaafa146-074c-11eb-adc1-0242ac120002", "2433a154-bb3d-42e4-86c3-a26bdac91c45", "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "4f647cfa-b598-4e12-ad69-c68dd16caef8", "16c37b52-b141-42a5-a3ea-bbe098444397", "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "17769c90-230e-488b-a463-e05c08e9d48f", "222129f7-f4dc-4568-b0d2-22440a9639ba", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "e173ad47-4388-4012-ae62-bd13f71c18a8", "48bbc537-b652-4b4e-bd1d-281172df448f", "1edff897-9146-48d2-9066-52e8d8f80a2f", "c248c896-e412-4279-8c15-1c558067b6fa", "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "2cf29f11-e356-4f61-98c0-1bdb9393d6da", "d522eca2-2973-4391-a3e0-ef0374321dae", "62e0298b-e994-4189-bc87-bc699aa62d97", "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "a537cfc3-4297-4789-92b5-345bfd845ad0", "74a12f18-505c-4114-8d0b-8448dd5485c6", "4a2a2c3e-209f-4d01-b513-4155a540b469", "32410e29-5f94-4568-b6a3-d91a8adad863", "f64e5c19-879c-4bae-b471-6d84c8339677", "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "536e2947-3729-478c-9903-745aaffe60d2", "40aa399c-7b02-4715-8e5f-73572b493f33", "883835a7-df45-43e4-bf1d-4268768afda4", "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "b57ba453-b384-4ab9-9f40-1038086b4e53", "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "3bad990e-4848-4a78-9530-b427d854aac0", "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "09576804-7a05-458e-a817-eb718ca91f54", "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "b0524451-19af-4efa-a46f-562a977f792e", "b96b2031-7c17-4473-afe7-a30ce714db29", "37c1333a-a0db-48be-b64b-7393b2386e3b", "81325ce1-be01-4250-944f-b4789644556f", "3abd6094-7027-475f-9630-8ab9be7b9725", "d9047477-0359-48c9-b8c7-792cedcdc9c4", "0a98a10c-685d-4ab0-bddc-b6bdd1d48458", "56d19cb4-6414-4769-9644-1ed35ffbb148", "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "5cdb711b-5740-4fb2-ba88-f7945027afac", "164eda96-11b2-430b-85ff-6a265c15bf32", "a58353df-af43-4753-bad0-cd83ef35eef5", "56321594-9087-49d9-bf10-524fe8479452"], "uberAgent 7.3": ["dfe8b941-4e54-4242-b674-6b613d521962", "23c43900-e732-45a4-8354-63e4a6c187ce", "47d65ac0-c06f-4ba2-a2e3-d263139d0f51", "65d506d3-fcfe-4071-b4b2-bcefe721bbbb", "5d0fdb62-f225-42fb-8402-3dfe64da468a", "b743623c-2776-40e0-87b1-682b975d0ca5", "089dbdf6-b960-4bcc-90e3-ffc3480c20f6", "2d5e7a8b-f484-4a24-945d-7f0efd52eab0", "58800443-f9fc-4d55-ae0c-98a3966dfb97", "5de06a6f-673a-4fc0-8d48-bcfe3837b033", "1cf98dc2-fcb0-47c9-8aea-654c9284d1ae", "7ed2c9f7-c59d-4c82-a7e2-f859aa676099", "b120b587-a4c2-4b94-875d-99c9807d6955", "7c3b43d8-d794-47d2-800a-d277715aa460", "9a7a0393-2144-4626-9bf1-7c2f5a7321db", "2316929c-01aa-438c-970f-099145ab1ee6", "6d8a7cf1-8085-423b-b87d-7e880faabbdf", "2c95fa8a-8b8d-4787-afce-7117ceb8e3da", "95361ce5-c891-4b0a-87ca-e24607884a96", "1bc2e6c5-0885-472b-bed6-be5ea8eace55", "acf61bd8-d814-4272-81f0-a7a269aa69aa", "ddf36b67-e872-4507-ab2e-46bda21b842c", "bf241472-f014-4f01-a869-96f99330ca8c", "e0cfaecd-602d-41af-988d-f6ccebb2af26", "69483748-1525-4a6c-95ca-90dc8d431b68", "508a9374-ad52-4789-b568-fc358def2c65", "b9d9b652-d8ed-4697-89a2-a1186ee680ac", "f1408a58-0e94-4165-b80a-da9f96cf6fc3", "13db8d2e-7723-4c2c-93c1-a4d36994f7ef", "be2e3a5c-9cc7-4d02-842a-68e9cb26ec49", "84bae5d4-b518-4ae0-b331-6d4afd34d00f", "652c098d-dc11-4ba6-8566-c20e89042f2b", "0877ed01-da46-4c49-8476-d49cdd80dfa7", "234dc5df-40b5-49d1-bf53-0d44ce778eca", "10227522-8429-47e6-a301-f2b2d014e7ad", "719c22d7-c11a-4f2c-93a6-2cfdd5412f68", "a753a6af-3126-426d-8bd0-26ebbcb92254", "0ed75b9c-c73b-424d-9e7d-496cd565fbe0", "51719bf5-e4fd-4e44-8ba8-b830e7ac0731", "85de3a19-b675-4a51-bfc6-b11a5186c971", "7794fa3c-edea-4cff-bec7-267dd4770fd7", "4809c683-059b-4935-879d-36835986f8cf", "6ff08e55-ea53-4f27-94a1-eff92e6d9d5c", "53821412-17b0-4147-ade0-14faae67d54b", "6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4", "40b1fbe2-18ea-4ee7-be47-0294285811de", "b22a5b36-2431-493a-8be1-0bae56c28ef3", "ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e", "f5141b6d-9f42-41c6-a7bf-2a780678b29b", "89bb1f97-c7b9-40e8-b52b-7d6afbd67276", "adc9bcc4-c39c-4f6b-a711-1884017bf043", "60f1ce20-484e-41bd-85f4-ac4afec2c541", "0250638a-2b28-4541-86fc-ea4c558fa0c6", "09a910bf-f71f-4737-9c40-88880ba5913d", "821bcf4d-46c7-4b87-bc57-9509d3ba7c11", "9acf45ed-3a26-4062-bf08-56857613eb52", "ff39f1a6-84ac-476f-a1af-37fcdf53d7c0", "3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe", "88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0", "3603f18a-ec15-43a1-9af2-d196c8a7fec6", "f459ccb4-9805-41ea-b5b2-55e279e2424a", "452df256-da78-427a-866f-49fa04417d74", "7f2bb9d5-6395-4de5-969c-70c11fbe6b12", "53b1b378-9b06-4992-b972-dde6e423d2b4", "f68c4a4f-19ef-4817-952c-50dce331f4b0", "b6e2a2e3-2d30-43b1-a4ea-071e36595690", "d7329412-13bd-44ba-a072-3387f804a106", "47e0852a-cf81-4494-a8e6-31864f8c86ed", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "295a59c1-7b79-4b47-a930-df12c15fc9c2", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "5aad0995-46ab-41bd-a9ff-724f41114971", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "4d431012-2ab5-4db7-a84e-b29809da2172", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "b3503044-60ce-4bf4-bbcb-e3db98788823", "a6b33c02-8305-488f-8585-03cb2a7763f2", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "f663a6d9-9d1b-49b8-b2b1-0637914d199a", "55e29995-75e7-451a-bef0-6225e2f13597", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "b6d235fc-1d38-4b12-adbe-325f06728f37", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "6ea3bf32-9680-422d-9f50-e90716b12a66", "baca5663-583c-45f9-b5dc-ea96a22ce542", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "62120148-6b7a-42be-8b91-271c04e281a3", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "277efb8f-60be-4f10-b4d3-037802f37167", "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "41d1058a-aea7-4952-9293-29eaaf516465", "96f697b0-b499-4e5d-9908-a67bec11cdb6", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "acd74772-5f88-45c7-956b-6a7b36c294d2", "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "92772523-d9c1-4c93-9547-b0ca500baba3", "790317c0-0a36-4a6a-a105-6e576bf99a14", "707e097c-e20f-4f67-8807-1f72ff4500d6", "396ae3eb-4174-4b9b-880e-dc0364d78a19", "e61e8a88-59a9-451c-874e-70fcc9740d67", "48437c39-9e5f-47fb-af95-3d663c3f2919", "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "509e84b9-a71a-40e0-834f-05470369bd1e", "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "7d9263bd-dc47-4a58-bc92-5474abab390c", "c5f6a85d-b647-40f7-bbad-c10b66bab038", "8ffc5407-52e3-478f-9596-0a7371eafe13", "bf344fea-d947-4ef4-9192-34d008315d3a", "5a93eb65-dffa-4543-b761-94aa60098fb6", "7c81fec3-1c1d-43b0-996a-46753041b1b6", "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "e3fdf743-f05b-4051-990a-b66919be1743", "6b6976a3-b0e6-4723-ac24-ae38a737af41", "f7997770-92c3-4ec9-b112-774c4ef96f96", "966315ef-c5e1-4767-ba25-fce9c8de3660", "e7b18879-676e-4a0e-ae18-27039185a8e7", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "8023f872-3f1d-4301-a384-801889917ab4", "44a22d59-b175-4f13-8c16-cbaef5b581ff", "fe20dda1-6f37-4379-bbe0-a98d400cae90", "b7916c2a-fa2f-4795-9477-32b731f70f11", "0cf2e1c6-8d10-4273-8059-738778f981ad", "b86852fb-4c77-48f9-8519-eb1b2c308b59", "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "dc5c24af-6995-49b2-86eb-a9ff62199e82", "92b0b372-a939-44ed-a11b-5136cf680e27", "1c3121ed-041b-4d97-a075-07f54f20fb4a", "cd277474-5c52-4423-a52b-ac2d7969902f", "9df5f547-c86a-433e-b533-f2794357e242", "46490193-1b22-4c29-bdd6-5bf63907216f", "fa277e82-9b78-42dd-b05c-05555c7b6015", "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "91239011-fe3c-4b54-9f24-15c86bb65913", "2f78da12-f7c7-430b-8b19-a28f269b77a3", "18f2065c-d36c-464a-a748-bcf909acb2e3", "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "7f2954d2-99c2-4d42-a065-ca36740f187b", "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "83314318-052a-4c90-a1ad-660ece38d276", "07743f65-7ec9-404a-a519-913db7118a8d", "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "555155a2-03bf-4fe7-af74-d176b3fdbe16", "df4dc653-1029-47ba-8231-3c44238cc0ae", "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "1547e27c-3974-43e2-a7d7-7f484fb928ec", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "fad91067-08c5-4d1a-8d8c-d96a21b37814", "a982fc9c-6333-4ffb-a51d-addb04e8b529", "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "90f342e1-1aaa-4e43-b092-39fda57ed11e", "02ee49e2-e294-4d0f-9278-f5b3212fc588", "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "0eb46774-f1ab-4a74-8238-1155855f2263", "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "c90362e0-2df3-4e61-94fe-b37615814cb1", "974515da-6cc5-4c95-ae65-f97f9150ec7f", "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "c420410f-c2d8-4010-856b-dffe21866437", "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "f37b4bce-49d0-4087-9f5b-58bffda77316", "9827ae57-3802-418f-994b-d5ecf5cd974b", "93d298a1-d28f-47f1-a468-d971e7796679", "46dd5308-4572-4d12-aa43-8938f0184d4f", "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "f742bde7-9528-42e5-bd82-84f51a8387d2", "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "8d85cf08-bf97-4260-ba49-986a2a65129c", "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "2ff692c2-4594-41ec-8fcb-46587de769e0", "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "b23818c7-e575-4d13-8012-332075ec0a2b", "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "160d2780-31f7-4922-8b3a-efce30e63e96", "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "ab567429-1dfb-4674-b6d2-979fd2f9d125", "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "cbf93e5d-ca6c-4722-8bea-e9119007c248", "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "275641a5-a492-45e2-a817-7c81e9d9d3e9", "961e33d1-4f86-4fcf-80ab-930a708b2f82", "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "ad89044a-8f49-4673-9a55-cbd88a1b374f", "086ae989-9ca6-4fe7-895a-759c5544f247", "5de03871-5d46-4539-a82d-3aa992a69a83", "28036918-04d3-423d-91c0-55ecf99fb892", "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "046218bd-e0d8-4113-a3c3-895a12b2b298", "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "a80f662f-022f-4429-9b8c-b1a41aaa6688", "612e47e9-8a59-43a6-b404-f48683f45bd6", "833ef470-fa01-4631-a79b-6f291c9ac498", "9d8f9bb8-01af-4e15-a3a2-349071530530", "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "5df86130-4e95-4a54-90f7-26541b40aec2", "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "f10ed525-97fe-4fed-be7c-2feecca941b1", "5f9db380-ea57-4d1e-beab-8a2d33397e93", "487bb375-12ef-41f6-baae-c6a1572b4dd1", "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "8218c875-90b9-42e2-b60d-0b0069816d10", "53330955-dc52-487f-a3a2-da24dcff99b5", "f2485272-a156-4773-82d7-1d178bc4905b", "724ea201-6514-4f38-9739-e5973c34f49a", "6c304b02-06e6-402d-8be4-d5833cdf8198", "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "4916a35e-bfc4-47d0-8e25-a003d7067061", "73a883d0-0348-4be4-a8d8-51031c2564f8", "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "d223b46b-5621-4037-88fe-fda32eead684", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "480421f9-417f-4d3b-9552-fd2728443ec8", "60936b49-fca0-4f32-993d-7415edcf9a5d", "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "6597be7b-ac61-4ac8-bef4-d3ec88174853", "5b872a46-3b90-45c1-8419-f675db8053aa", "092af964-4233-4373-b4ba-d86ea2890288", "b64a026b-8deb-4c1d-92fd-98893209dff1", "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "34aa0252-6039-40ff-951f-939fd6ce47d8", "63647769-326d-4dde-a419-b925cc0caf42", "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "9d15044a-7cfe-4d23-8085-6ebc11df7685", "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "976dd1f2-a484-45ec-aa1d-0e87e882262b", "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "439957a7-ad86-4a8f-9705-a28131c6821b", "5a5152f1-463f-436b-b2f5-8eceb3964b42", "e0813366-0407-449a-9869-a2db1119dc41", "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "bf9e1387-b040-4393-9851-1598f8ecfae9", "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "9c226817-8dc9-46c2-a58d-66655aafd7dc", "7021255e-5db3-4946-a8b9-0ba7a4644a69", "36803969-5421-41ec-b92f-8500f79c23b0", "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "42205c73-75c8-4a63-9db1-e3782e06fda0", "41f6531d-af6e-4c6e-918f-b946f2b85a36", "e2482f8d-3443-4237-b906-cc145d87a076", "8b9606c9-28be-4a38-b146-0e313cc232c1", "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "4f281b83-0200-4b34-bf35-d24687ea57c2", "243380fa-11eb-4141-af92-e14925e77c1b", "baecf8fb-edbf-429f-9ade-31fc3f22b970", "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "0d7ceeef-3539-4392-8953-3dc664912714", "fc014922-5def-4da9-a0fc-28c973f41bfb", "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7", "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "9ace0707-b560-49b8-b6ca-5148b42f39fb", "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "9b0f8a61-91b2-464f-aceb-0527e0a45020", "1d218616-71b0-4c40-855b-9dbe75510f7f", "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "25ffa65d-76d8-4da5-a832-3f2b0136e133", "f50f3c09-557d-492d-81db-9064a8d4e211", "ec8c4047-fad9-416a-8c81-0f479353d7f6", "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "d13c43f0-f66b-4279-8b2c-5912077c1780", "d2451be2-b582-4e15-8701-4196ac180260", "f40017b3-cb2e-4335-ab5d-3babf679c1de", "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "f354eba5-623b-450f-b073-0b5b2773b6aa", "6414b5cd-b19d-447e-bb5e-9f03940b5784", "ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94", "bdc64095-d59a-42a2-8588-71fd9c9d9abc", "1fbc0671-5596-4e17-8682-f020a0b995dc", "552b6b65-df37-4d3e-a258-f2fc4771ae54", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "333cdbe8-27bb-4246-bf82-b41a0dca4b70", "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "4c21b805-4dd7-469f-b47d-7383a8fcb437", "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "4508a70e-97ef-4300-b62b-ff27992990ea", "857c8db3-c89b-42fb-882b-f681c7cf4da2", "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "3669afd2-9891-4534-a626-e5cf03810a61", "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "7417e29e-c2e7-4cf6-a2e8-767228c64837", "72ca7c75-bf85-45cd-aca7-255d360e423c", "060d5ad4-3153-47bb-8382-43e5e29eda92", "0e0bc253-07ed-43f1-816d-e1b220fe8971", "6e78b74f-c762-4800-82ad-f66787f10c8a", "84b0a8f3-680b-4096-a45b-e9a89221727c", "90ae0469-0cee-4509-b67f-e5efcef040f7", "bf9808c4-d24f-44a2-8398-b65227d406b6", "caa02837-f659-466f-bca6-48bde2826ab4", "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "4fc0deee-0057-4998-ab31-d24e46e0aba4", "e2e01011-5910-4267-9c3b-4149ed5479cf", "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "d2605a99-2218-4894-8fd3-2afb7946514d", "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "a2a3b925-7bb0-433b-b508-db9003263cc4", "68654bf0-4412-43d5-bfe8-5eaa393cd939", "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "952ed57c-8f99-453d-aee0-53a49c22f95d", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "75e508f7-932d-4ebc-af77-269237a84ce1", "50f852e6-af22-4c78-9ede-42ef36aa3453", "8cde342c-ba48-4b74-b615-172c330f2e93", "ea5c131b-380d-49f9-aeb3-920694da4d4b", "a2edbce1-95c8-4291-8676-0d45146862b3", "844f8eb2-610b-42c8-89a4-47596e089663", "6360757a-d460-456c-8b13-74cf0e60cceb", "24b6cf51-6122-469e-861a-22974e9c1e5b", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "9ed5959a-c43c-4c59-84e3-d28628429456", "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "b5de0c9a-6f19-43e0-af4e-55ad01f550af", "fef394cd-f44d-4040-9b18-95d92fe278c0", "48bfd177-7cf2-412b-ad77-baf923489e82", "2092cacb-d77b-4f98-ab0d-32b32f99a054", "ff0f2b05-09db-4095-b96d-1b75ca24894a", "49329257-089d-46e6-af37-4afce4290685", "7707a579-e0d8-4886-a853-ce47e4575aaa", "ee6cea48-c5b6-4304-a332-10fc6446f484", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "e76c8240-d68f-4773-8880-5c6f63595aaf", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "af4c4609-5755-42fe-8075-4effb49f5d44", "9ca2bf31-0570-44d8-a543-534c47c33ed7", "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "6ec86d9e-912e-4726-91a2-209359b999b9", "273a8dd8-3742-4302-bcc7-7df5a80fe425", "90217a70-13fc-48e4-b3db-0d836c5824ac", "3735d5ac-d770-4da0-99ff-156b180bc600", "948a0953-f287-4806-bbcb-3b2e396df89f", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "a1d9eec5-33b2-4177-8d24-27fe754d0812", "613c03ba-0779-4a53-8a1f-47f914a4ded3", "f356a9c4-effd-4608-bbf8-408afd5cd006", "a21bcd7e-38ec-49ad-b69a-9ea17e69509e", "df68f791-ad95-447f-a271-640a0dab9cf8", "e043f529-8514-4205-8ab0-7f7d2927b400", "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "065cceea-77ec-4030-9052-fc0affea7110", "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "36e037c4-c228-4866-b6a3-48eb292b9955", "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3", "e3f673b3-65d1-4d80-9146-466f8b63fa99", "270185ff-5f50-4d6d-a27f-24c3b8c9fef8", "5b2bbc47-dead-4ef7-8908-0cf73fcbecbf", "8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0", "06125661-3814-4e03-bfa2-1e4411c60ac3", "0a1f9d29-6465-4776-b091-7f43b26e4c89", "b1decb61-ed83-4339-8e95-53ea51901720", "a55349d8-9588-4c5a-8e3b-1925fe2a4ffe", "63c779ba-f638-40a0-a593-ddd45e8b1ddc", "ff301988-c231-4bd0-834c-ac9d73b86586", "3eb8c339-a765-48cc-a150-4364c04652bf", "3109530e-ab47-4cc6-a953-cac5ebcc93ae", "6ddab845-b1b8-49c2-bbf7-1a11967f64bc", "407aecb1-e762-4acf-8c7b-d087bcff3bb6", "7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2", "65744385-8541-44a6-8630-ffc824d7d4cc", "d51694fe-484a-46ac-92d6-969e76d60d10", "46612ae6-86be-4802-bc07-39b59feb1309", "f41b0311-44f9-44f0-816d-dd45e39d4bc8", "a5a2d357-1ab8-4675-a967-ef9990a59391", "02773bed-83bf-469f-b7ff-e676e7d78bab", "d353dac0-1b41-46c2-820c-d7d2561fc6ed", "caf02a0a-1e1c-4552-9b48-5e070bd88d11", "68578b43-65df-4f81-9a9b-92f32711a951", "13c02350-4177-4e45-ac17-cf7ca628ff5e", "b8fd0e93-ff58-4cbd-8f48-1c114e342e62", "39f1f9f2-9636-45de-98f6-a4046aa8e4b9", "28a452f3-786c-4fd8-b8f2-bddbe9d616d1", "74babdd6-a758-4549-9632-26535279e654", "fec96f39-988b-4586-b746-b93d59fd1922", "847def9e-924d-4e90-b7c4-5f581395a2b4", "ce7066a6-508a-42d3-995b-2952c65dc2ce", "4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6", "54127bd4-f541-4ac3-afdb-ea073f63f692", "002bdb95-0cf1-46a6-9e08-d38c128a6127", "c7a74c80-ba5a-486e-9974-ab9e682bc5e4", "34746e8c-5fb8-415a-b135-0abc167e912a", "ee63c85c-6d51-4d12-ad09-04e25877a947", "cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca", "1277f594-a7d1-4f28-a2d3-73af5cbeab43", "63e4f530-65dc-49cc-8f80-ccfa95c69d43", "dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c", "2f7979ae-f82b-45af-ac1d-2b10e93b0baa", "059c5af9-5131-4d8d-92b2-de4ad6146712", "7fd164ba-126a-4d9c-9392-0d4f7c243df0", "15904280-565c-4b73-9303-3291f964e7f9", "6902955a-01b7-432c-b32a-6f5f81d8f625", "3ab79e90-9fab-4cdf-a7b2-6522bc742adb", "654fcc6d-840d-4844-9b07-2c3300e54a26", "df6ecb8b-7822-4f4b-b412-08f524b4576c", "cad1fe90-2406-44dc-bd03-59d0b58fe722", "1027d292-dd87-4a1a-8701-2abe04d7783c", "41bb431f-56d8-4691-bb56-ed34e390906f", "de46c52b-0bf8-4936-a327-aace94f94ac6", "576426ad-0131-4001-ae01-be175da0c108", "4e7050dd-e548-483f-b7d6-527ab4fa784d", "3d2a2d59-929c-4b78-8c1a-145dfe9e07b1", "7d604714-e071-49ff-8726-edeb95a70679", "bdd8157d-8e85-4397-bb82-f06cc9c71dbb", "6b269392-9eba-40b5-acb6-55c882b20ba6", "b6f91281-20aa-446a-b986-38a92813a18f", "4aafb0fa-bff5-4b9d-b99e-8093e659c65f", "3da70954-0f2c-4103-adff-b7440368f50e", "e36941d0-c0f0-443f-bc6f-cb2952eb69ea", "6e90ae7a-7cd3-473f-a035-4ebb72d961da", "814ddeca-3d31-4265-8e07-8cc54fb44903", "bd1212e5-78da-431e-95fa-c58e3237a8e6", "9e099d99-44c2-42b6-a6d8-54c3545cab29", "7280c9f3-a5af-45d0-916a-bc01cb4151c9", "75bf09fa-1dd7-4d18-9af9-dd9e492562eb", "8fbf3271-1ef6-4e94-8210-03c2317947f6", "d102b8f5-61dc-4e68-bd83-9a3187c67377", "81315b50-6b60-4d8f-9928-3466e1022515", "2d367498-5112-4ae5-a06a-96e7bc33a211", "8e1cb247-6cf6-42fa-b440-3f27d57e9936", "7047d730-036f-4f40-b9d8-1c63e36d5e62", "2aa0a6b4-a865-495b-ab51-c28249537b75", "65236ec7-ace0-4f0c-82fd-737b04fd4dcb", "e4a74e34-ecde-4aab-b2fb-9112dd01aed0", "614a7e17-5643-4d89-b6fe-f9df1a79641c", "dca1b3e8-e043-4ec8-85d7-867f334b5724", "0b9ad457-2554-44c1-82c2-d56a99c42377", "8c31f563-f9a7-450c-bfa8-35f8f32f1f61", "9b64de98-9db3-4033-bd7a-f51430105f00", "aba15bdd-657f-422a-bab3-ac2d2a0d6f1c", "97aa2e88-555c-450d-85a6-229bcd87efb8", "304afd73-55a5-4bb9-8c21-0b1fc84ea9e4", "69ca12af-119d-44ed-b50f-a47af0ebc364", "b1c50487-1967-4315-a026-6491686d860e", "f0540f7e-2db3-4432-b9e0-3965486744bc", "130c9e58-28ac-4f83-8574-0a4cc913b97e", "92fa78e7-4d39-45f1-91a3-8b23f3f1088d", "33f41cdd-35ac-4ba8-814b-c6a4244a1ad4", "0bcfabcb-7929-47f4-93d6-b33fb67d34d1", "162ab1e4-6874-4564-853c-53ec3ab8be01", "11b1ed55-154d-4e82-8ad7-83739298f720", "c61daa90-3c1e-4f18-af62-8f288b5c9aaf", "fcc6d700-68d9-4241-9a1a-06874d621b06", "f92a6f1e-a512-4a15-9735-da09e78d7273", "7eff1a7f-dd45-4c20-877a-f21e342a7611", "0afecb6e-6223-4a82-99fb-bf5b981e92a5", "f0e2b768-5220-47dd-b891-d57b96fc0ec1", "34986307-b7f4-49be-92f3-e7a4d01ac5db", "9711de76-5d4f-4c50-a94f-21e4e8f8384d", "c3edc6a5-d9d4-48d8-930e-aab518390917", "d5866ddf-ce8f-4aea-b28e-d96485a20d3d", "259e5a6a-b8d2-4c38-86e2-26c5e651361d", "155dbf56-e0a4-4dd0-8905-8a98705045e8", "7fff6773-2baa-46de-a24a-b6eec1aba2d1", "e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f", "0b8baa3f-575c-46ee-8715-d6f28cc7d33c", "2f9356ae-bf43-41b8-b858-4496d83b2acb", "a05baa88-e922-4001-bc4d-8738135f27de", "5b40a734-99b6-4b98-a1d0-1cea51a08ab2", "6e2a900a-ced9-4e4a-a9c2-13e706f9518a", "91174a41-dc8f-401b-be89-7bfc140612a0", "8468111a-ef07-4654-903b-b863a80bbc95", "c048f047-7e2a-4888-b302-55f509d4a91d", "52753ea4-b3a0-4365-910d-36cff487b789", "fccfb43e-09a7-4bd2-8b37-a5a7df33386d", "5f87308a-0a5b-4623-ae15-d8fa1809bc60", "0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b", "a8f866e1-bdd4-425e-a27a-37619238d9c7", "07a99744-56ac-40d2-97b7-2095967b0e03", "3a8da4e0-36c1-40d2-8b29-b3e890d5172a", "0e29e3a7-1ad8-40aa-b691-9f82ecd33d66", "d7b50671-d1ad-4871-aa60-5aa5b331fe04", "409f8a98-4496-4aaa-818a-c931c0a8b832", "a6976974-ea6f-4e97-818e-ea08625c52cb", "3a9fa2ec-30bc-4ebd-b49e-7c9cff225502", "b4926b47-a9d7-434c-b3a0-adc3fa0bd13e", "28208707-fe31-437f-9a7f-4b1108b94d2e", "e15b518d-b4ce-4410-a9cd-501f23ce4a18", "760e75d8-c3b5-409b-a9bf-6130b4c4603f", "e0b06658-7d1d-4cd3-bf15-03467507ff7c", "4e87b8e2-2ee9-4b2a-a715-4727d297ece0", "bb09dd3e-2b78-4819-8e35-a7c1b874e449", "4c7f49ee-2638-43bb-b85b-ce676c30b260", "4358e5a5-7542-4dcb-b9f3-87667371839b", "62ed5b55-f991-406a-85d9-e8e8fdf18789", "e074832a-eada-4fd7-94a1-10642b130e16", "16fe46bb-4f64-46aa-817d-ff7bec4a2352", "8d5aca11-22b3-4f22-b7ba-90e60533e1fb", "3d0ed417-3d94-4963-a562-4a92c940656a", "7892ec59-c5bb-496d-8968-e5d210ca3ac4", "145095eb-e273-443b-83d0-f9b519b7867b", "5d756aee-ad3e-4306-ad95-cb1abec48de2", "48ea844d-19b1-4642-944e-fe39c2cc1fec", "8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9", "1908fcc1-1b92-4272-8214-0fbaf2fa5163", "a10a2c40-2c4d-49f8-b557-1a946bc55d9d", "736ffa74-5f6f-44ca-94ef-1c0df4f51d2a", "bbb7e38c-0b41-4a11-b306-d2a457b7ac2b", "fed85bf9-e075-4280-9159-fbe8a023d6fa", "0e20c89d-2264-44ae-8238-aeeaba609ece", "56e05d41-ce99-4ecd-912d-93f019ee0b71", "b5b78988-486d-4a80-b991-930eff3ff8bf", "805c55d9-31e6-4846-9878-c34c75054fe9", "80e1f67a-4596-4351-98f5-a9c3efabac95", "e3845023-ca9a-4024-b2b2-5422156d5527", "e8a52bbd-bced-459f-bd93-64db45ce7657", "fc4f4817-0c53-4683-a4ee-b17a64bc1039", "6ea858a8-ba71-4a12-b2cc-5d83312404c7", "93a19907-d4f9-4deb-9f91-aac4692776a6", "3215aa19-f060-4332-86d5-5602511f3ca8", "117d3d3a-755c-4a61-b23e-9171146d094c", "93d94efc-d7ad-4161-ad7d-1638c4f908d8", "318557a5-150c-4c8d-b70e-a9910e199857", "c3e76af5-4ce0-4a14-9c9a-25ceb8fda182", "f331aa1f-8c53-4fc3-b083-cc159bc971cb", "602a1f13-c640-4d73-b053-be9a2fa58b96", "9f2cc74d-78af-4eb2-bb64-9cd1d292b87b", "c3dbbc9f-ef1d-470a-a90a-d343448d5875", "edf3485d-dac4-4d50-90e4-b0e5813f7e60", "1d08ac94-400d-4469-a82f-daee9a908849", "7e9cf7b6-e827-11ed-a05b-15959c120003", "fa5b1358-b040-4403-9868-15f7d9ab6329", "c649a6c7-cd8c-4a78-9c04-000fc76df954", "e81528db-fc02-45e8-8e98-4e84aba1f10b", "7e9cf7b6-e827-11ed-a05b-0242ac120003", "a66bc059-c370-472c-a0d7-f8fd1bf9d583", "67add051-9ee7-4ad3-93ba-42935615ae8d", "295c9289-acee-4503-a571-8eacaef36b28", "72cd00d6-490c-4650-86ff-1d11f491daa1", "05296024-fe8a-4baf-8f3d-9a5f5624ceb2", "1a42dfa6-6cb2-4df9-9b48-295be477e835", "10cb6535-b31d-4512-9962-513dcbc42cc1", "7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8", "679085d5-f427-4484-9f58-1dc30a7c426d", "2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75", "39b64854-5497-4b57-a448-40977b8c9679", "a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f", "77564cc2-7382-438b-a7f6-395c2ae53b9a", "f239b326-2f41-4d6b-9dfa-c846a60ef505", "caa06de8-fdef-4c91-826a-7f9e163eef4b", "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "2158f96f-43c2-43cb-952a-ab4580f32382", "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "d797268e-28a9-49a7-b9a8-2f5039011c5c", "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "f426547a-e0f7-441a-b63e-854ac5bdf54d", "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "6d3a3952-6530-44a3-8554-cf17c116c615", "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "4c0aaedc-154c-4427-ada0-d80ef9c9deb6", "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "a4824fca-976f-4964-b334-0621379e84c4", "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "92a974db-ab84-457f-9ec0-55db83d7a825", "f9578658-9e71-4711-b634-3f9b50cd3c06", "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "f5240972-3938-4e56-8e4b-e33893176c1f", "fff9d2b7-e11c-4a69-93d3-40ef66189767", "cc9d3712-6310-4320-b2df-7cb408274d53", "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "327ff235-94eb-4f06-b9de-aaee571324be", "42a993dd-bb3e-48c8-b372-4d6684c4106c", "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "36210e0d-5b19-485d-a087-c096088885f0", "1723e720-616d-4ddc-ab02-f7e3685a4713", "90fb5e62-ca1f-4e22-b42e-cc521874c938", "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "57c4bf16-227f-4394-8ec7-1b745ee061c3", "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "0ea52357-cd59-4340-9981-c46c7e900428", "7aa7009a-28b9-4344-8c1f-159489a390df", "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "9719a8aa-401c-41af-8108-ced7ec9cd75c", "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "587254ee-a24b-4335-b3cd-065c0f1f4baa", "98b53e78-ebaf-46f8-be06-421aafd176d9", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "b5746143-59d6-4603-8d06-acbd60e166ee", "c09dad97-1c78-4f71-b127-7edb2b8e491a", "551d9c1f-816c-445b-a7a6-7a3864720d60", "e31033fc-33f0-4020-9a16-faf9b31cbf08", "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "8e3c7994-131e-4ba5-b6ea-804d49113a26", "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "e32d4572-9826-4738-b651-95fa63747e8a", "043c4b8b-3a54-4780-9682-081cb6b8185c", "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "c363385c-f75d-4753-a108-c1a8e28bdbda", "5cb299fc-5fb1-4d07-b989-0644c68b6043", "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "811f459f-9231-45d4-959a-0266c6311987", "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "7d6d30b8-5b91-4b90-a891-46cccaf29598", "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "087790e3-3287-436c-bccf-cbd0184a7db1", "6812a10b-60ea-420c-832f-dfcc33b646ba", "84b14121-9d14-416e-800b-f3b829c5a14d", "32e280f1-8ad4-46ef-9e80-910657611fbc", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "9cfc00b6-bfb7-49ce-9781-ef78503154bb", "3f5491e2-8db8-496b-9e95-1029fce852d4", "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "02030f2f-6199-49ec-b258-ea71b07e03dc", "74403157-20f5-415d-89a7-c505779585cf", "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "4d7cda18-1b12-4e52-b45c-d28653210df8", "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "c9783e20-4793-4164-ba96-d9ee483992c4", "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "94771a71-ba41-4b6e-a757-b531372eaab6", "2f869d59-7f6a-4931-992c-cce556ff2d53", "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "1775e15e-b61b-4d14-a1a3-80981298085a", "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "42b1a5b8-353f-4f10-b256-39de4467faff", "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "9292293b-8496-4715-9db6-37028dcda4b3", "52788a70-f1da-40dd-8fbd-73b5865d6568", "349d891d-fef0-4fe4-bc53-eee623a15969", "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "6f3e2987-db24-4c78-a860-b4f4095a7095", "1ec65a5f-9473-4f12-97da-622044d6df21", "d042284c-a296-4988-9be5-f424fadcc28c", "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "1327381e-6ab0-4f38-b583-4c1b8346a56b", "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "9ec9fb1b-e059-4489-9642-f270c207923d", "058f4380-962d-40a5-afce-50207d36d7e2", "fe63010f-8823-4864-a96b-a7b4a0f7b929", "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "c86133ad-4725-4bd0-8170-210788e0a7ba", "f5d19838-41b5-476c-98d8-ba8af4929ee2", "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "82880171-b475-4201-b811-e9c826cd5eaa", "023c654f-8f16-44d9-bb2b-00ff36a62af9", "d557dc06-62e8-4468-a8e8-7984124908ce", "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "a642964e-bead-4bed-8910-1bb4d63e3b4d", "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "e4a6b256-3e47-40fc-89d2-7a477edd6915", "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "9fff585c-c33e-4a86-b3cd-39312079a65f", "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "fa00b701-44c6-4679-994d-5a18afa8a707", "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "313d6012-51a0-4d93-8dfc-de8553239e25", "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "8d63dadf-b91b-4187-87b6-34a1114577ea", "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "b36d01a3-ddaf-4804-be18-18a6247adfcd", "aaf46cdc-934e-4284-b329-34aa701e3771", "575dce0c-8139-4e30-9295-1ee75969f7fe", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "a1473adb-5338-4a20-b4c3-126763e2d3d3", "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "241e802a-b65e-484f-88cd-c2dc10f9206d", "fd877b94-9bb5-4191-bb25-d79cbd93c167", "d047726b-c71c-4048-a99b-2e2f50dc107d", "40b95d31-1afc-469e-8d34-9a3a667d058e", "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "e6c54d94-498c-4562-a37c-b469d8e9a275", "64760eef-87f7-4ed3-93fd-655668ea9420", "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "da2738f2-fadb-4394-afa7-0a0674885afa", "88872991-7445-4a22-90b2-a3adadb0e827", "f576a613-2392-4067-9d1a-9345fb58d8d1", "431a1fdb-4799-4f3b-91c3-a683b003fc49", "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "4931188c-178e-4ee7-a348-39e8a7a56821", "85ff530b-261d-48c6-a441-facaa2e81e48", "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "8cbc9475-8d05-4e27-9c32-df960716c701", "378a05d8-963c-46c9-bcce-13c7657eac99", "e8d34729-86a4-4140-adfd-0a29c2106307", "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "e568650b-5dcd-4658-8f34-ded0b1e13992", "f208d6d8-d83a-4c2c-960d-877c37da84e5", "514e4c3a-c77d-4cde-a00f-046425e2301e", "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "01aeb693-138d-49d2-9403-c4f52d7d3d62", "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "83865853-59aa-449e-9600-74b9d89a6d6e", "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "b53317a0-8acf-4fd1-8de8-a5401e776b96", "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "10344bb3-7f65-46c2-b915-2d00d47be5b0", "185d7418-f250-42d0-b72e-0c8b70661e93", "379fa130-190e-4c3f-b7bc-6c8e834485f3", "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "e83e8899-c9b2-483b-b355-5decc942b959", "6385697e-9f1b-40bd-8817-f4a91f40508e", "24357373-078f-44ed-9ac4-6d334a668a11", "15619216-e993-4721-b590-4c520615a67d", "d2eb17db-1d39-41dc-b57f-301f6512fa75", "5a6e1e16-07de-48d8-8aae-faa766c05e88", "5a3164f2-b373-4152-93cf-090b13c12d27", "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "cbec226f-63d9-4eca-9f52-dfb6652f24df", "5b768e71-86f2-4879-b448-81061cbae951", "ca621ba5-54ab-4035-9942-d378e6fcde3c", "98767d61-b2e8-4d71-b661-e36783ee24c1", "a85ffc3a-e8fd-4040-93bf-78aff284d801", "88f46b67-14d4-4f45-ac2c-d66984f22191", "83809e84-4475-4b69-bc3e-4aad8568612f", "ce72ef99-22f1-43d4-8695-419dcb5d9330", "add64136-62e5-48ea-807e-88638d02df1e", "04936b66-3915-43ad-a8e5-809eadfd1141", "847d5ff3-8a31-4737-a970-aeae8fe21765", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "c49c5062-0966-4170-9efd-9968c913a6cf", "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "850d55f9-6eeb-4492-ad69-a72338f65ba4", "d87bd452-6da1-456e-8155-7dc988157b7d", "5bb68627-3198-40ca-b458-49f973db8752", "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "caf201a9-c2ce-4a26-9c3a-2b9525413711", "4e762605-34a8-406d-b72e-c1a089313320", "d3c3861d-c504-4c77-ba55-224ba82d0118", "2ddef153-167b-4e89-86b6-757a9e65dcac", "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "8a582fe2-0882-4b89-a82a-da6b2dc32937", "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "f35c5d71-b489-4e22-a115-f003df287317", "fbd7c32d-db2a-4418-b92c-566eb8911133", "87a476dc-0079-4583-a985-dee7a20a03de", "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "38879043-7e1e-47a9-8d46-6bec88e201df", "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "f9999590-1f94-4a34-a91e-951e47bedefd", "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "4eddc365-79b4-43ff-a9d7-99422dc34b93", "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "220457c1-1c9f-4c2e-afe6-9598926222c1", "bf361876-6620-407a-812f-bfe11e51e924", "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "c79da740-5030-45ec-a2e0-479e824a562c", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "a197e378-d31b-41c0-9635-cfdf1c1bb423", "737e618a-a410-49b5-bec3-9e55ff7fbc15", "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "30edb182-aa75-42c0-b0a9-e998bb29067c", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "eb1c4225-1c23-4241-8dd4-051389fde4ce", "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "e312efd0-35a1-407f-8439-b8d434b438a6", "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "ba42babc-0666-4393-a4f7-ceaf5a69191e", "c27515df-97a9-4162-8a60-dc0eeb51b775", "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "0f6da907-5854-4be6-859a-e9958747b0aa", "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "5edc2273-c26f-406c-83f3-f4d948e740dd", "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "0f0450f3-8b47-441e-a31b-15a91dc243e2", "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "817f252c-5143-4dae-b418-48c3e9f63728", "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "07e3cb2c-0608-410d-be4b-1511cb1a0448", "138d3531-8793-4f50-a2cd-f291b2863d78", "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "ddeff553-5233-4ae9-bbab-d64d2bd634be", "e212d415-0e93-435f-9e1a-f29005bb4723", "55f0a3a1-846e-40eb-8273-677371b8d912", "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "e7888eb1-13b0-4616-bd99-4bc0c2b054b9", "6ba5a05f-b095-4f0a-8654-b825f4f16334", "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "7cce6fc8-a07f-4d84-a53e-96e1879843c9", "45d3a03d-f441-458c-8883-df101a3bb146", "871b9555-69ca-4993-99d3-35a59f9f3599", "f2c64357-b1d2-41b7-849f-34d2682c0fad", "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "12fbff88-16b5-4b42-9754-cd001a789fb3", "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "0403d67d-6227-4ea8-8145-4e72db7da120", "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "bd1c6866-65fc-44b2-be51-5588fcff82b9", "1114e048-b69c-4f41-bc20-657245ae6e3f", "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "27aec9c9-dbb0-4939-8422-1742242471d0", "727454c0-d851-48b0-8b89-385611ab0704", "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "d20ee2f4-822c-4827-9e15-41500b1fff10", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "efec536f-72e8-4656-8960-5e85d091345b", "6f4191bb-912b-48a8-9ce7-682769541e6d", "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "517490a7-115a-48c6-8862-1a481504d5a8", "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "49d9671b-0a0a-4c09-8280-d215bfd30662", "05f3c945-dcc8-4393-9f3d-af65077a8f86", "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "554601fb-9b71-4bcc-abf4-21a611be4fde", "7b10f171-7f04-47c7-9fa2-5be43c76e535", "45239e6a-b035-4aaf-b339-8ad379fcb67e", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "7be5fb68-f9ef-476d-8b51-0256ebece19e", "6e22722b-dfb1-4508-a911-49ac840b40f8", "9ccba514-7cb6-4c5c-b377-700758f2f120", "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "7a74da6b-ea76-47db-92cc-874ad90df734", "f11f2808-adb4-46c0-802a-8660db50fa99", "43e32da2-fdd0-4156-90de-50dfd62636f9", "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "a20def93-0709-4eae-9bd2-31206e21e6b2", "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "6004abd0-afa4-4557-ba90-49d172e0a299", "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "970823b7-273b-460a-8afc-3a6811998529", "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "15b75071-74cc-47e0-b4c6-b43744a62a2b", "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "f99abdf0-6283-4e71-bd2b-b5c048a94743", "0a13e132-651d-11eb-ae93-0242ac130002", "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "e9f55347-2928-4c06-88e5-1a7f8169942e", "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "6a69f62d-ce75-4b57-8dce-6351eb55b362", "8b0e12da-d3c3-49db-bb4f-256703f380e5", "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "98a96a5a-64a0-4c42-92c5-489da3866cb0", "47e4bab7-c626-47dc-967b-255608c9a920", "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "40b19fa6-d835-400c-b301-41f3a2baacaf", "71158e3f-df67-472b-930e-7d287acaa3e1", "f44800ac-38ec-471f-936e-3fa7d9c53100", "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "24c8392b-aa3c-46b7-a545-43f71657fe98", "88f680b8-070e-402c-ae11-d2914f2257f1", "15434e33-5027-4914-88d5-3d4145ec25a9", "b98d0db6-511d-45de-ad02-e82a98729620", "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "0bbc6369-43e3-453d-9944-cae58821c173", "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "b7966f4a-b333-455b-8370-8ca53c229762", "43fa5350-db63-4b8f-9a01-789a427074e1", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "ec290c06-9b6b-4338-8b6b-095c0f284f10", "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "d4498716-1d52-438f-8084-4a603157d131", "b222df08-0e07-11eb-adc1-0242ac120002", "e1693bc8-7168-4eab-8718-cdcaa68a1738", "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "d3b70aad-097e-409c-9df2-450f80dc476b", "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "312d0384-401c-4b8b-abdf-685ffba9a332", "cc368ed0-2411-45dc-a222-510ace303cb2", "42333b2c-b425-441c-b70e-99404a17170f", "0e4164da-94bc-450d-a7be-a4b176179f1f", "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "ebef4391-1a81-4761-a40a-1db446c0e625", "f26307d8-14cd-47e3-a26b-4b4769f24af6", "03cc0c25-389f-4bf8-b48d-11878079f1ca", "8834e2f7-6b4b-4f09-8906-d2276470ee23", "7090adee-82e2-4269-bd59-80691e7c6338", "c74c0390-3e20-41fd-a69a-128f0275a5ea", "b6457d63-d2a2-4e29-859d-4e7affc153d1", "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "5f6a601c-2ecb-498b-9c33-660362323afa", "aa8e035d-7be4-48d3-a944-102aec04400d", "b243b280-65fe-48df-ba07-6ddea7646427", "236d8e89-ed95-4789-a982-36f4643738ba", "277a4393-446c-449a-b0ed-7fdc7795244c", "4fe074b4-b833-4081-8f24-7dcfeca72b42", "68bcd73b-37ef-49cb-95fc-edc809730be6", "86588b36-c6d3-465f-9cee-8f9093e07798", "502b42de-4306-40b4-9596-6f590c81f073", "0a99eb3e-1617-41bd-b095-13dc767f3def", "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "07f8bdc2-c9b3-472a-9817-5a670b872f53", "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "28ac00d6-22d9-4a3c-927f-bbd770104573", "452bce90-6fb0-43cc-97a5-affc283139b3", "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "ce7cf472-6fcc-490a-9481-3786840b5d9b", "c6fb44c6-71f5-49e6-9462-1425d328aee3", "9c0295ce-d60d-40bd-bd74-84673b7592b1", "0a4f6091-223b-41f6-8743-f322ec84930b", "98c5aeef-32d5-492f-b174-64a691896d25", "6fe4aa1e-0531-4510-8be2-782154b73b48", "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "d78b5d61-187d-44b6-bf02-93486a80de5a", "e9b61244-893f-427c-b287-3e708f321c6b", "70bc5215-526f-4477-963c-a47a5c9ebd12", "b6e04788-29e1-4557-bb14-77f761848ab8", "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "0685b176-c816-4837-8e7b-1216f346636b", "e84d89c4-f544-41ca-a6af-4b92fd38b023", "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "023394c4-29d5-46ab-92b8-6a534c6f447b", "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "ebea773c-a8f1-42ad-a856-00cb221966e8", "0b7163dc-7eee-4960-af17-c0cd517f92da", "98dedfdd-8333-49d4-9f23-d7018cccae53", "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "f24bcaea-0cd1-11eb-adc1-0242ac120002", "ccb5742c-c248-4982-8c5c-5571b9275ad3", "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "4abc0ec4-db5a-412f-9632-26659cddf145", "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "5cddf373-ef00-4112-ad72-960ac29bac34", "37db85d1-b089-490a-a59a-c7b6f984f480", "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "f1edd233-30b5-4823-9e6a-c4171b24d316", "e92a4287-e072-4a40-9739-370c106bb750", "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "8bc64091-6875-4881-aaf9-7bd25b5dda08", "56c217c3-2de2-479b-990f-5c109ba8458f", "eee00933-a761-4cd0-be70-c42fe91731e7", "bab049ca-7471-4828-9024-38279a4c04da", "c3a99af4-35a9-4668-879e-c09aeb4f2bdf", "d7654f02-e04b-4934-9838-65c46f187ebc", "2a072a96-a086-49fa-bcb5-15cc5a619093", "883faa95-175a-4e22-8181-e5761aeb373c", "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "63d1ccc0-2a43-4f4b-9289-361b308991ff", "4f154fb6-27d1-4813-a759-78b93e0b9c48", "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "33be4333-2c6b-44f4-ae28-102cdbde0a31", "395907ee-96e5-4666-af2e-2ca91688e151", "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "b0ce780f-10bd-496d-9067-066d23dc3aa5", "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "79b06761-465f-4f88-9ef2-150e24d3d737", "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "c615d676-f655-46b9-b913-78729021e5d7", "b19146a3-25d4-41b4-928b-1e2a92641b1b", "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "e6474a1b-5390-49cd-ab41-8d88655f7394", "692f0bec-83ba-4d04-af7e-e884a96059b6", "93671f99-04eb-4ab4-a161-70d446a84003", "0d5675be-bc88-4172-86d3-1e96a4476536", "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "4281cb20-2994-4580-aa63-c8b86d019934", "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "a34f79a3-8e5f-4cc3-b765-de00695452c2", "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "5589ab4f-a767-433c-961d-c91f3f704db1", "e8a95b5e-c891-46e2-b33a-93937d3abc31", "c86500e9-a645-4680-98d7-f882c70c1ea3", "58f50261-c53b-4c88-bd12-1d71f12eda4c", "34ebb878-1b15-4895-b352-ca2eeb99b274", "7a02e22e-b885-4404-b38b-1ddc7e65258a", "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "24de4f3b-804c-4165-b442-5a06a2302c7e", "731231b9-0b5d-4219-94dd-abb6959aa7ea", "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "d7bcd677-645d-4691-a8d4-7a5602b780d1", "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "6e897651-f157-4d8f-aaeb-df8151488385", "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "9847f263-4a81-424f-970c-875dab15b79b", "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "4b046706-5789-4673-b111-66f25fe99534", "73bba97f-a82d-42ce-b315-9182e76c57b1", "646bc99f-6682-4b47-a73a-17b1b64c9d34", "6c96fc76-0eb1-11eb-adc1-0242ac120002", "7050bba1-1aed-454e-8f73-3f46f09ce56a", "744a188b-0415-4792-896f-11ddb0588dbc", "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "faa48cae-6b25-4f00-a094-08947fef582f", "70ad0861-d1fe-491c-a45f-fa48148a300d", "a16980c2-0c56-4de0-9a79-17971979efdd", "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "954f0af7-62dd-418f-b3df-a84bc2c7a774", "a7ee1722-c3c5-aeff-3212-c777e4733217", "1dde5376-a648-492e-9e54-4241dd9b0c7f", "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "10c14723-61c7-4c75-92ca-9af245723ad2", "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "41421f44-58f9-455d-838a-c398859841d4", "ae9b0bd7-8888-4606-b444-0ed7410cb728", "8de1cbe8-d6f5-496d-8237-5f44a721c7a0", "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "43103702-5886-11ed-9b6a-0242ac120002", "16905e21-66ee-42fe-b256-1318ada2d770", "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "a7c3d773-caef-227e-a7e7-c2f13c622329", "214641c2-c579-4ecb-8427-0cf19df6842e", "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "07aa184a-870d-413d-893a-157f317f6f58", "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "f548a603-c9f2-4c89-b511-b089f7e94549", "93199800-b52a-4dec-b762-75212c196542", "526be59f-a573-4eea-b5f7-f0973207634d", "6345b048-8441-43a7-9bed-541133633d7a", "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "25676e10-2121-446e-80a4-71ff8506af47", "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "ac1c92b4-ac81-405a-9978-4604d78cc47e", "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "bdeb2cff-af74-4094-8426-724dc937f20a", "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "a383dec4-deec-4e6e-913b-ed9249670848", "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "ac20ae82-8758-4f38-958e-b44a3140ca88", "54786ddc-5b8a-11ed-9b6a-0242ac120002", "41ca393d-538c-408a-ac27-cf1e038be80c", "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "cd71385d-fd9b-4691-9b98-2b1f7e508714", "c8a180d6-47a3-4345-a609-53f9c3d834fc", "044ba588-dff4-4918-9808-3f95e8160606", "1af57a4b-460a-4738-9034-db68b880c665", "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "1dd05363-104e-4b4a-b963-196a534b03a1", "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "84b1ecf9-6eff-4004-bafb-bae5c0e251b2", "204b17ae-4007-471b-917b-b917b315c5db", "50d66fb0-03f8-4da0-8add-84e77d12a020", "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "c2b86e67-b880-4eec-b045-50bc98ef4844", "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "e593cf51-88db-4ee1-b920-37e89012a3c9", "90d6bd71-dffb-4989-8d86-a827fedd6624", "8202070f-edeb-4d31-a010-a26c72ac5600", "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "3268b746-88d8-4cd3-bffc-30077d02c787", "18988e1b-9087-4f8a-82fe-0414dce49878", "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "f53714ec-5077-420e-ad20-907ff9bb2958", "f117933c-980c-4f78-b384-e3d838111165", "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "a29c1813-ab1f-4dde-b489-330b952e91ae", "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "b655a06a-31c0-477a-95c2-3726b83d649d", "21d856f9-9281-4ded-9377-51a1a6e2a432", "b66474aa-bd92-4333-a16c-298155b120df", "b2309017-4235-44fe-b5af-b15363011957", "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "62510e69-616b-4078-b371-847da438cc03", "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "285b85b1-a555-4095-8652-a8a4106af63f", "84f52741-8834-4a8c-a413-2eb2269aa6c8", "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "be344333-921d-4c4d-8bb8-e584cf584780", "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "fb843269-508c-4b76-8b8d-88679db22ce7", "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "de587dce-915e-4218-aac4-835ca6af6f70", "c7942406-33dd-4377-a564-0f62db0593a3", "ab9e3b40-0c85-4ba1-aede-455d226fd124", "ef61af62-bc74-4f58-b49b-626448227652", "a20391f8-76fb-437b-abc0-dba2df1952c6", "899133d5-4d7c-4a7f-94ee-27355c879d90", "1ac8666b-046f-4201-8aba-1951aaec03a3", "1c67a717-32ba-409b-a45d-0fb704a73a81", "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "eca49c87-8a75-4f13-9c73-a5a29e845f03", "435e10e4-992a-4281-96f3-38b11106adde", "b3512211-c67e-4707-bedc-66efc7848863", "c15a46a0-07d4-4c87-b4b6-89207835a83b", "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "1f0f6176-6482-4027-b151-00071af39d7e", "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "9257c05b-4a4a-48e5-a670-b7b073cf401b", "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "99793437-3e16-439b-be0f-078782cf953d", "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "ac175779-025a-4f12-98b0-acdaeb77ea85", "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "90d50722-0483-4065-8e35-57efaadd354d", "180c7c5c-d64b-4a63-86e9-68910451bc8b", "d55b793d-f847-4eea-b59a-5ab09908ac90", "aef9d1f1-7396-4e92-a927-4567c7a495c1", "6c6d9280-e6d0-4b9d-80ac-254701b64916", "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "9212f354-7775-4e28-9c9f-8f0a4544e664", "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "ffa6861c-4461-4f59-8a41-578c39f3f23e", "a0459f02-ac51-4c09-b511-b8c9203fc429", "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "534f2ef7-e8a2-4433-816d-c91bccde289b", "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "84232095-ecca-4015-b0d7-7726507ee793", "4e2ed651-1906-4a59-a78a-18220fca1b22", "96036718-71cc-4027-a538-d1587e0006a7", "60f16a96-db70-42eb-8f76-16763e333590", "5afee48e-67dd-4e03-a783-f74259dcf998", "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "771d1eb5-9587-4568-95fb-9ec44153a012", "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "e28a5a99-da44-436d-b7a0-2afc20a5f413", "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "68d37776-61db-42f5-bf54-27e87072d17e", "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "d2b749ee-4225-417e-b20e-a8d2193cbb84", "1193d960-2369-499f-a158-7b50a31df682", "6b65c28e-11f3-46cb-902a-68f2cafaf474", "242301bc-f92f-4476-8718-78004a6efd9f", "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "52d097e2-063e-4c9c-8fbb-855c8948d135", "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "647c7b9e-d784-4fda-b9a0-45c565a7b729", "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "bb76d96b-821c-47cf-944b-7ce377864492", "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "1816994b-42e1-4fb1-afd2-134d88184f71", "12827a56-61a4-476a-a9cb-f3068f191073", "32b96012-7892-429e-b26c-ac2bf46066ff", "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "f4bbd493-b796-416e-bbf2-121235348529", "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "d06be4b9-8045-428b-a567-740a26d9db25", "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "65c3ca2c-525f-4ced-968e-246a713d164f", "347906f3-e207-4d18-ae5b-a9403d6bcdef", "a29808fd-ef50-49ff-9c7a-59a9b040b404", "e66779cc-383e-4224-a3a4-267eeb585c40", "85c312b7-f44d-4a51-a024-d671c40b49fc", "6da2c9f5-7c53-401b-aacb-92c040ce1215", "6bd75993-9888-4f91-9404-e1e4e4e34b77", "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "ff992eac-6449-4c60-8c1d-91c9722a1d48", "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "208748f7-881d-47ac-a29c-07ea84bf691d", "89ca78fd-b37c-4310-b3d3-81a023f83936", "a2910908-e86f-4687-aeba-76a5f996e652", "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "9c14c9fa-1a63-4a64-8e57-d19280559490", "221b251a-357a-49a9-920a-271802777cc0", "50919691-7302-437f-8e10-1fe088afa145", "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "f14e169e-9978-4c69-acb3-1cff8200bc36", "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "1c8774a0-44d4-4db0-91f8-e792359c70bd", "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "9fc3072c-dc8f-4bf7-b231-18950000fadd", "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "ada4b0c4-758b-46ac-9033-9004613a150d", "584bca0f-3608-4402-80fd-4075ff6072e3", "9a132afa-654e-11eb-ae93-0242ac130002", "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "a70dcb37-3bee-453a-99df-d0c683151be6", "85b0b087-eddf-4a2b-b033-d771fa2b9775", "2267fe65-0681-42ad-9a6d-46553d3f3480", "28c8f68b-098d-45af-8d43-8089f3e35403", "cd8c163e-a19b-402e-bdd5-419ff5859f12", "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "2c28c248-7f50-417a-9186-a85b223010ee", "84972c80-251c-4c3a-9079-4f00aad93938", "434c08ba-8406-4d15-8b24-782cb071a691", "bed2a484-9348-4143-8a8a-b801c979301c", "a0d7e4d2-bede-4141-8896-bc6e237e977c", "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "1c526788-0abe-4713-862f-b520da5e5316", "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "9f107a84-532c-41af-b005-8d12a607639f", "455b9d50-15a1-4b99-853f-8d37655a4c1b", "dee0a7a3-f200-4112-a99b-952196d81e42", "79ce34ca-af29-4d0e-b832-fc1b377020db", "2afafd61-6aae-4df4-baed-139fa1f4c345", "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "f0507c0f-a3a2-40f5-acc6-7f543c334993", "970007b7-ce32-49d0-a4a4-fbef016950bd", "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "f4264e47-f522-4c38-a420-04525d5b880f", "b2ddd389-f676-4ac4-845a-e00781a48e5f", "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "4a6713f6-3331-11ed-a261-0242ac120002", "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "5cc2cda8-f261-4d88-a2de-e9e193c86716", "2d22a514-e024-4428-9dba-41505bd63a5b", "01c42d3c-242d-4655-85b2-34f1739632f7", "77946e79-97f1-45a2-84b4-f37b5c0d8682", "27ba3207-dd30-4812-abbf-5d20c57d474e", "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "1228c958-e64e-4e71-92ad-7d429f4138ba", "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "b1377339-fda6-477a-b455-ac0923f9ec2c", "44143844-0631-49ab-97a0-96387d6b2d7c", "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "85de1f22-d189-44e4-8239-dc276b45379b", "92626ddd-662c-49e3-ac59-f6535f12d189", "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "e56d3073-83ff-4021-90fe-c658e0709e72", "deb9b646-a508-44ee-b7c9-d8965921c6b6", "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "cea2b7ea-792b-405f-95a1-b903ea06458f", "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "730fc21b-eaff-474b-ad23-90fd265d4988", "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "48917adc-a28e-4f5d-b729-11e75da8941f", "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "0900463c-b33b-49a8-be1d-552a3b553dae", "82a6714f-4899-4f16-9c1e-9a333544d4c3", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "1e59c230-6670-45bf-83b0-98903780607e", "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "5687f942-867b-4578-ade7-1e341c46e99a", "258fc8ce-8352-443a-9120-8a11e4857fa5", "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "4ae81040-fc1c-4249-bfa3-938d260214d9", "aa2efee7-34dd-446e-8a37-40790a66efd7", "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "ae215552-081e-44c7-805f-be16f975c8a2", "30bf1789-379d-4fdc-900f-55cd0a90a801", "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "4f7a6757-ff79-46db-9687-66501a02d9ec", "129966c9-de17-4334-a123-8b58172e664d", "696bfb54-227e-4602-ac5b-30d9d2053312", "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "7df1713a-1a5b-4a4b-a071-dc83b144a101", "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "814c95cc-8192-4378-a70a-f1aafd877af1", "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "99c840f2-2012-46fd-9141-c761987550ef", "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "de16d92c-c446-4d53-8938-10aeef41c8b6", "056c7317-9a09-4bd4-9067-d051312752ea", "60fc936d-2eb0-4543-8a13-911c750a1dfc", "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "114de787-4eb2-48cc-abdb-c0b449f93ea4", "207b0396-3689-42d9-8399-4222658efc99", "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "9248c7e1-2bf3-4661-a22c-600a8040b446", "146aace8-9bd6-42ba-be7a-0070d8027b76", "3d7679bd-0c00-440c-97b0-3f204273e6c7", "ea011323-7045-460b-b2d7-0f7442ea6b38", "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "e290b10b-1023-4452-a4a9-eb31a9013b3a", "ca5583e9-8f80-46ac-ab91-7f314d13b984", "cd3d1298-eb3b-476c-ac67-12847de55813", "867356ee-9352-41c9-a8f2-1be690d78216", "67f113fa-e23d-4271-befa-30113b3e08b1", "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "62b20d44-1546-4e61-afce-8e175eb9473c", "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "b6676963-0353-4f88-90f5-36c20d443c6a", "99cf1e02-00fb-4c0d-8375-563f978dfd37", "903076ff-f442-475a-b667-4f246bcc203b", "a77c1610-fc73-4019-8e29-0f51efc04a51", "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "cea72823-df4d-4567-950c-0b579eaf0846", "74a2b202-73e0-4693-9a3a-9d36146d0775", "5fc297ae-25b6-488a-8f25-cc12ac29b744", "12f6b752-042d-483e-bf9c-915a6d06ad75", "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "c1d867fe-8d95-4487-aab4-e53f2d339f90", "e13f668e-7f95-443d-98d2-1816a7648a7b", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "9c8c7000-3065-44a8-a555-79bcba5d9955", "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "ee5e119b-1f75-4b34-add8-3be976961e39", "33339be3-148b-4e16-af56-ad16ec6c7e7b", "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "01d2e2a1-5f09-44f7-9fc1-24faa7479b6d", "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "646ea171-dded-4578-8a4d-65e9822892e3", "84b1706c-932a-44c4-ae28-892b28a25b94", "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "1012f107-b8f1-4271-af30-5aed2de89b39", "074e0ded-6ced-4ebd-8b4d-53f55908119d", "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "af491bca-e752-4b44-9c86-df5680533dbc", "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "f0f7be61-9cf5-43be-9836-99d6ef448a18", "b1f73849-6329-4069-bc8f-78a604bb8b23", "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "0b80ade5-6997-4b1d-99a1-71701778ea61", "81ebd28b-9607-4478-bf06-974ed9d53ed7", "dc4576d4-7467-424f-9eee-fd2b02855fe0", "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "e9142d84-fbe0-401d-ac50-3e519fb00c89", "b4dc61f5-6cce-468e-a608-b48b469feaa2", "e6313acd-208c-44fc-a0ff-db85d572e90e", "f3d39c45-de1a-4486-a687-ab126124f744", "97dbf6e2-e436-44d8-abee-4261b24d3e41", "729ce0ea-5d8f-4769-9762-e35de441586d", "0fc35fc3-efe6-4898-8a37-0b233339524f", "c947b146-0abc-4c87-9c64-b17e9d7274a2", "91a2c315-9ee6-4052-a853-6f6a8238f90d", "9525dc73-0327-438c-8c04-13c0e037e9da", "a4694263-59a8-4608-a3a0-6f8d3a51664c", "f37aba28-a9e6-4045-882c-d5004043b337", "5e95028c-5229-4214-afae-d653d573d0ec", "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "f7375e28-5c14-432f-b8d1-1db26c832df3", "0e0255bf-2548-47b8-9582-c0955c9283f5", "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "d65aee4d-2292-4cea-b832-83accd6cfa43", "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "889719ef-dd62-43df-86c3-768fb08dc7c0", "18ee686c-38a3-4f65-9f44-48a077141f42", "af77cf95-c469-471c-b6a0-946c685c4798", "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "4bf943c6-5146-4273-98dd-e958fd1e3abf", "7f741dcf-fc22-4759-87b4-9ae8376676a2", "8a3038e8-9c9d-46f8-b184-66234a160f6f", "7d4aaec2-08ed-4430-8b96-28420e030e04", "75d0a94e-6252-448d-a7be-d953dff527bb", "327f48c1-a6db-4eb8-875a-f6981f1b0183", "5f03babb-12db-4eec-8c82-7b4cb5580868", "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "cd1f961e-0b96-436b-b7c6-38da4583ec00", "7b4f794b-590a-4ad4-ba18-7964a2832205", "438025f9-5856-4663-83f7-52f878a70a50", "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "213d6a77-3d55-4ce8-ba74-fcfef741974e", "aaafa146-074c-11eb-adc1-0242ac120002", "2433a154-bb3d-42e4-86c3-a26bdac91c45", "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "4f647cfa-b598-4e12-ad69-c68dd16caef8", "16c37b52-b141-42a5-a3ea-bbe098444397", "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "17769c90-230e-488b-a463-e05c08e9d48f", "222129f7-f4dc-4568-b0d2-22440a9639ba", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "e173ad47-4388-4012-ae62-bd13f71c18a8", "48bbc537-b652-4b4e-bd1d-281172df448f", "1edff897-9146-48d2-9066-52e8d8f80a2f", "c248c896-e412-4279-8c15-1c558067b6fa", "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "2cf29f11-e356-4f61-98c0-1bdb9393d6da", "d522eca2-2973-4391-a3e0-ef0374321dae", "62e0298b-e994-4189-bc87-bc699aa62d97", "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "a537cfc3-4297-4789-92b5-345bfd845ad0", "74a12f18-505c-4114-8d0b-8448dd5485c6", "4a2a2c3e-209f-4d01-b513-4155a540b469", "32410e29-5f94-4568-b6a3-d91a8adad863", "f64e5c19-879c-4bae-b471-6d84c8339677", "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "536e2947-3729-478c-9903-745aaffe60d2", "40aa399c-7b02-4715-8e5f-73572b493f33", "883835a7-df45-43e4-bf1d-4268768afda4", "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "b57ba453-b384-4ab9-9f40-1038086b4e53", "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "3bad990e-4848-4a78-9530-b427d854aac0", "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "09576804-7a05-458e-a817-eb718ca91f54", "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "b0524451-19af-4efa-a46f-562a977f792e", "b96b2031-7c17-4473-afe7-a30ce714db29", "37c1333a-a0db-48be-b64b-7393b2386e3b", "81325ce1-be01-4250-944f-b4789644556f", "3abd6094-7027-475f-9630-8ab9be7b9725", "d9047477-0359-48c9-b8c7-792cedcdc9c4", "0a98a10c-685d-4ab0-bddc-b6bdd1d48458", "56d19cb4-6414-4769-9644-1ed35ffbb148", "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "5cdb711b-5740-4fb2-ba88-f7945027afac", "164eda96-11b2-430b-85ff-6a265c15bf32", "a58353df-af43-4753-bad0-cd83ef35eef5", "56321594-9087-49d9-bf10-524fe8479452"], "uberAgent 7.2": ["dfe8b941-4e54-4242-b674-6b613d521962", "23c43900-e732-45a4-8354-63e4a6c187ce", "47d65ac0-c06f-4ba2-a2e3-d263139d0f51", "65d506d3-fcfe-4071-b4b2-bcefe721bbbb", "5d0fdb62-f225-42fb-8402-3dfe64da468a", "b743623c-2776-40e0-87b1-682b975d0ca5", "089dbdf6-b960-4bcc-90e3-ffc3480c20f6", "2d5e7a8b-f484-4a24-945d-7f0efd52eab0", "58800443-f9fc-4d55-ae0c-98a3966dfb97", "5de06a6f-673a-4fc0-8d48-bcfe3837b033", "1cf98dc2-fcb0-47c9-8aea-654c9284d1ae", "7ed2c9f7-c59d-4c82-a7e2-f859aa676099", "b120b587-a4c2-4b94-875d-99c9807d6955", "7c3b43d8-d794-47d2-800a-d277715aa460", "9a7a0393-2144-4626-9bf1-7c2f5a7321db", "2316929c-01aa-438c-970f-099145ab1ee6", "6d8a7cf1-8085-423b-b87d-7e880faabbdf", "2c95fa8a-8b8d-4787-afce-7117ceb8e3da", "95361ce5-c891-4b0a-87ca-e24607884a96", "1bc2e6c5-0885-472b-bed6-be5ea8eace55", "acf61bd8-d814-4272-81f0-a7a269aa69aa", "ddf36b67-e872-4507-ab2e-46bda21b842c", "bf241472-f014-4f01-a869-96f99330ca8c", "e0cfaecd-602d-41af-988d-f6ccebb2af26", "69483748-1525-4a6c-95ca-90dc8d431b68", "508a9374-ad52-4789-b568-fc358def2c65", "b9d9b652-d8ed-4697-89a2-a1186ee680ac", "f1408a58-0e94-4165-b80a-da9f96cf6fc3", "13db8d2e-7723-4c2c-93c1-a4d36994f7ef", "be2e3a5c-9cc7-4d02-842a-68e9cb26ec49", "84bae5d4-b518-4ae0-b331-6d4afd34d00f", "652c098d-dc11-4ba6-8566-c20e89042f2b", "0877ed01-da46-4c49-8476-d49cdd80dfa7", "234dc5df-40b5-49d1-bf53-0d44ce778eca", "10227522-8429-47e6-a301-f2b2d014e7ad", "719c22d7-c11a-4f2c-93a6-2cfdd5412f68", "a753a6af-3126-426d-8bd0-26ebbcb92254", "0ed75b9c-c73b-424d-9e7d-496cd565fbe0", "51719bf5-e4fd-4e44-8ba8-b830e7ac0731", "85de3a19-b675-4a51-bfc6-b11a5186c971", "7794fa3c-edea-4cff-bec7-267dd4770fd7", "4809c683-059b-4935-879d-36835986f8cf", "6ff08e55-ea53-4f27-94a1-eff92e6d9d5c", "53821412-17b0-4147-ade0-14faae67d54b", "6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4", "40b1fbe2-18ea-4ee7-be47-0294285811de", "b22a5b36-2431-493a-8be1-0bae56c28ef3", "ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e", "f5141b6d-9f42-41c6-a7bf-2a780678b29b", "89bb1f97-c7b9-40e8-b52b-7d6afbd67276", "adc9bcc4-c39c-4f6b-a711-1884017bf043", "60f1ce20-484e-41bd-85f4-ac4afec2c541", "0250638a-2b28-4541-86fc-ea4c558fa0c6", "09a910bf-f71f-4737-9c40-88880ba5913d", "821bcf4d-46c7-4b87-bc57-9509d3ba7c11", "9acf45ed-3a26-4062-bf08-56857613eb52", "ff39f1a6-84ac-476f-a1af-37fcdf53d7c0", "3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe", "88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0", "3603f18a-ec15-43a1-9af2-d196c8a7fec6", "f459ccb4-9805-41ea-b5b2-55e279e2424a", "452df256-da78-427a-866f-49fa04417d74", "7f2bb9d5-6395-4de5-969c-70c11fbe6b12", "53b1b378-9b06-4992-b972-dde6e423d2b4", "f68c4a4f-19ef-4817-952c-50dce331f4b0", "b6e2a2e3-2d30-43b1-a4ea-071e36595690", "d7329412-13bd-44ba-a072-3387f804a106", "47e0852a-cf81-4494-a8e6-31864f8c86ed", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "295a59c1-7b79-4b47-a930-df12c15fc9c2", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "5aad0995-46ab-41bd-a9ff-724f41114971", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "4d431012-2ab5-4db7-a84e-b29809da2172", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "b3503044-60ce-4bf4-bbcb-e3db98788823", "a6b33c02-8305-488f-8585-03cb2a7763f2", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "f663a6d9-9d1b-49b8-b2b1-0637914d199a", "55e29995-75e7-451a-bef0-6225e2f13597", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "b6d235fc-1d38-4b12-adbe-325f06728f37", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "6ea3bf32-9680-422d-9f50-e90716b12a66", "baca5663-583c-45f9-b5dc-ea96a22ce542", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "62120148-6b7a-42be-8b91-271c04e281a3", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "277efb8f-60be-4f10-b4d3-037802f37167", "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "41d1058a-aea7-4952-9293-29eaaf516465", "96f697b0-b499-4e5d-9908-a67bec11cdb6", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "acd74772-5f88-45c7-956b-6a7b36c294d2", "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "92772523-d9c1-4c93-9547-b0ca500baba3", "790317c0-0a36-4a6a-a105-6e576bf99a14", "707e097c-e20f-4f67-8807-1f72ff4500d6", "396ae3eb-4174-4b9b-880e-dc0364d78a19", "e61e8a88-59a9-451c-874e-70fcc9740d67", "48437c39-9e5f-47fb-af95-3d663c3f2919", "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "509e84b9-a71a-40e0-834f-05470369bd1e", "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "7d9263bd-dc47-4a58-bc92-5474abab390c", "c5f6a85d-b647-40f7-bbad-c10b66bab038", "8ffc5407-52e3-478f-9596-0a7371eafe13", "bf344fea-d947-4ef4-9192-34d008315d3a", "5a93eb65-dffa-4543-b761-94aa60098fb6", "7c81fec3-1c1d-43b0-996a-46753041b1b6", "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "e3fdf743-f05b-4051-990a-b66919be1743", "6b6976a3-b0e6-4723-ac24-ae38a737af41", "f7997770-92c3-4ec9-b112-774c4ef96f96", "966315ef-c5e1-4767-ba25-fce9c8de3660", "e7b18879-676e-4a0e-ae18-27039185a8e7", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "8023f872-3f1d-4301-a384-801889917ab4", "44a22d59-b175-4f13-8c16-cbaef5b581ff", "fe20dda1-6f37-4379-bbe0-a98d400cae90", "b7916c2a-fa2f-4795-9477-32b731f70f11", "0cf2e1c6-8d10-4273-8059-738778f981ad", "b86852fb-4c77-48f9-8519-eb1b2c308b59", "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "dc5c24af-6995-49b2-86eb-a9ff62199e82", "92b0b372-a939-44ed-a11b-5136cf680e27", "1c3121ed-041b-4d97-a075-07f54f20fb4a", "cd277474-5c52-4423-a52b-ac2d7969902f", "9df5f547-c86a-433e-b533-f2794357e242", "46490193-1b22-4c29-bdd6-5bf63907216f", "fa277e82-9b78-42dd-b05c-05555c7b6015", "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "91239011-fe3c-4b54-9f24-15c86bb65913", "2f78da12-f7c7-430b-8b19-a28f269b77a3", "18f2065c-d36c-464a-a748-bcf909acb2e3", "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "7f2954d2-99c2-4d42-a065-ca36740f187b", "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "83314318-052a-4c90-a1ad-660ece38d276", "07743f65-7ec9-404a-a519-913db7118a8d", "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "555155a2-03bf-4fe7-af74-d176b3fdbe16", "df4dc653-1029-47ba-8231-3c44238cc0ae", "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "1547e27c-3974-43e2-a7d7-7f484fb928ec", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "fad91067-08c5-4d1a-8d8c-d96a21b37814", "a982fc9c-6333-4ffb-a51d-addb04e8b529", "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "90f342e1-1aaa-4e43-b092-39fda57ed11e", "02ee49e2-e294-4d0f-9278-f5b3212fc588", "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "0eb46774-f1ab-4a74-8238-1155855f2263", "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "c90362e0-2df3-4e61-94fe-b37615814cb1", "974515da-6cc5-4c95-ae65-f97f9150ec7f", "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "c420410f-c2d8-4010-856b-dffe21866437", "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "f37b4bce-49d0-4087-9f5b-58bffda77316", "9827ae57-3802-418f-994b-d5ecf5cd974b", "93d298a1-d28f-47f1-a468-d971e7796679", "46dd5308-4572-4d12-aa43-8938f0184d4f", "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "f742bde7-9528-42e5-bd82-84f51a8387d2", "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "8d85cf08-bf97-4260-ba49-986a2a65129c", "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "2ff692c2-4594-41ec-8fcb-46587de769e0", "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "b23818c7-e575-4d13-8012-332075ec0a2b", "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "160d2780-31f7-4922-8b3a-efce30e63e96", "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "ab567429-1dfb-4674-b6d2-979fd2f9d125", "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "cbf93e5d-ca6c-4722-8bea-e9119007c248", "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "275641a5-a492-45e2-a817-7c81e9d9d3e9", "961e33d1-4f86-4fcf-80ab-930a708b2f82", "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "ad89044a-8f49-4673-9a55-cbd88a1b374f", "086ae989-9ca6-4fe7-895a-759c5544f247", "5de03871-5d46-4539-a82d-3aa992a69a83", "28036918-04d3-423d-91c0-55ecf99fb892", "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "046218bd-e0d8-4113-a3c3-895a12b2b298", "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "a80f662f-022f-4429-9b8c-b1a41aaa6688", "612e47e9-8a59-43a6-b404-f48683f45bd6", "833ef470-fa01-4631-a79b-6f291c9ac498", "9d8f9bb8-01af-4e15-a3a2-349071530530", "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "5df86130-4e95-4a54-90f7-26541b40aec2", "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "f10ed525-97fe-4fed-be7c-2feecca941b1", "5f9db380-ea57-4d1e-beab-8a2d33397e93", "487bb375-12ef-41f6-baae-c6a1572b4dd1", "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "8218c875-90b9-42e2-b60d-0b0069816d10", "53330955-dc52-487f-a3a2-da24dcff99b5", "f2485272-a156-4773-82d7-1d178bc4905b", "724ea201-6514-4f38-9739-e5973c34f49a", "6c304b02-06e6-402d-8be4-d5833cdf8198", "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "4916a35e-bfc4-47d0-8e25-a003d7067061", "73a883d0-0348-4be4-a8d8-51031c2564f8", "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "d223b46b-5621-4037-88fe-fda32eead684", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "480421f9-417f-4d3b-9552-fd2728443ec8", "60936b49-fca0-4f32-993d-7415edcf9a5d", "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "6597be7b-ac61-4ac8-bef4-d3ec88174853", "5b872a46-3b90-45c1-8419-f675db8053aa", "092af964-4233-4373-b4ba-d86ea2890288", "b64a026b-8deb-4c1d-92fd-98893209dff1", "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "34aa0252-6039-40ff-951f-939fd6ce47d8", "63647769-326d-4dde-a419-b925cc0caf42", "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "9d15044a-7cfe-4d23-8085-6ebc11df7685", "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "976dd1f2-a484-45ec-aa1d-0e87e882262b", "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "439957a7-ad86-4a8f-9705-a28131c6821b", "5a5152f1-463f-436b-b2f5-8eceb3964b42", "e0813366-0407-449a-9869-a2db1119dc41", "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "bf9e1387-b040-4393-9851-1598f8ecfae9", "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "9c226817-8dc9-46c2-a58d-66655aafd7dc", "7021255e-5db3-4946-a8b9-0ba7a4644a69", "36803969-5421-41ec-b92f-8500f79c23b0", "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "42205c73-75c8-4a63-9db1-e3782e06fda0", "41f6531d-af6e-4c6e-918f-b946f2b85a36", "e2482f8d-3443-4237-b906-cc145d87a076", "8b9606c9-28be-4a38-b146-0e313cc232c1", "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "4f281b83-0200-4b34-bf35-d24687ea57c2", "243380fa-11eb-4141-af92-e14925e77c1b", "baecf8fb-edbf-429f-9ade-31fc3f22b970", "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "0d7ceeef-3539-4392-8953-3dc664912714", "fc014922-5def-4da9-a0fc-28c973f41bfb", "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7", "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "9ace0707-b560-49b8-b6ca-5148b42f39fb", "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "9b0f8a61-91b2-464f-aceb-0527e0a45020", "1d218616-71b0-4c40-855b-9dbe75510f7f", "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "25ffa65d-76d8-4da5-a832-3f2b0136e133", "f50f3c09-557d-492d-81db-9064a8d4e211", "ec8c4047-fad9-416a-8c81-0f479353d7f6", "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "d13c43f0-f66b-4279-8b2c-5912077c1780", "d2451be2-b582-4e15-8701-4196ac180260", "f40017b3-cb2e-4335-ab5d-3babf679c1de", "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "f354eba5-623b-450f-b073-0b5b2773b6aa", "6414b5cd-b19d-447e-bb5e-9f03940b5784", "ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94", "bdc64095-d59a-42a2-8588-71fd9c9d9abc", "1fbc0671-5596-4e17-8682-f020a0b995dc", "552b6b65-df37-4d3e-a258-f2fc4771ae54", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "333cdbe8-27bb-4246-bf82-b41a0dca4b70", "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "4c21b805-4dd7-469f-b47d-7383a8fcb437", "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "4508a70e-97ef-4300-b62b-ff27992990ea", "857c8db3-c89b-42fb-882b-f681c7cf4da2", "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "3669afd2-9891-4534-a626-e5cf03810a61", "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "7417e29e-c2e7-4cf6-a2e8-767228c64837", "72ca7c75-bf85-45cd-aca7-255d360e423c", "060d5ad4-3153-47bb-8382-43e5e29eda92", "0e0bc253-07ed-43f1-816d-e1b220fe8971", "6e78b74f-c762-4800-82ad-f66787f10c8a", "84b0a8f3-680b-4096-a45b-e9a89221727c", "90ae0469-0cee-4509-b67f-e5efcef040f7", "bf9808c4-d24f-44a2-8398-b65227d406b6", "caa02837-f659-466f-bca6-48bde2826ab4", "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "4fc0deee-0057-4998-ab31-d24e46e0aba4", "e2e01011-5910-4267-9c3b-4149ed5479cf", "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "d2605a99-2218-4894-8fd3-2afb7946514d", "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "a2a3b925-7bb0-433b-b508-db9003263cc4", "68654bf0-4412-43d5-bfe8-5eaa393cd939", "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "952ed57c-8f99-453d-aee0-53a49c22f95d", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "75e508f7-932d-4ebc-af77-269237a84ce1", "50f852e6-af22-4c78-9ede-42ef36aa3453", "8cde342c-ba48-4b74-b615-172c330f2e93", "ea5c131b-380d-49f9-aeb3-920694da4d4b", "a2edbce1-95c8-4291-8676-0d45146862b3", "844f8eb2-610b-42c8-89a4-47596e089663", "6360757a-d460-456c-8b13-74cf0e60cceb", "24b6cf51-6122-469e-861a-22974e9c1e5b", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "9ed5959a-c43c-4c59-84e3-d28628429456", "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "b5de0c9a-6f19-43e0-af4e-55ad01f550af", "fef394cd-f44d-4040-9b18-95d92fe278c0", "48bfd177-7cf2-412b-ad77-baf923489e82", "2092cacb-d77b-4f98-ab0d-32b32f99a054", "ff0f2b05-09db-4095-b96d-1b75ca24894a", "49329257-089d-46e6-af37-4afce4290685", "7707a579-e0d8-4886-a853-ce47e4575aaa", "ee6cea48-c5b6-4304-a332-10fc6446f484", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "e76c8240-d68f-4773-8880-5c6f63595aaf", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "af4c4609-5755-42fe-8075-4effb49f5d44", "9ca2bf31-0570-44d8-a543-534c47c33ed7", "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "6ec86d9e-912e-4726-91a2-209359b999b9", "273a8dd8-3742-4302-bcc7-7df5a80fe425", "90217a70-13fc-48e4-b3db-0d836c5824ac", "3735d5ac-d770-4da0-99ff-156b180bc600", "948a0953-f287-4806-bbcb-3b2e396df89f", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "a1d9eec5-33b2-4177-8d24-27fe754d0812", "613c03ba-0779-4a53-8a1f-47f914a4ded3", "f356a9c4-effd-4608-bbf8-408afd5cd006", "a21bcd7e-38ec-49ad-b69a-9ea17e69509e", "df68f791-ad95-447f-a271-640a0dab9cf8", "e043f529-8514-4205-8ab0-7f7d2927b400", "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "065cceea-77ec-4030-9052-fc0affea7110", "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "36e037c4-c228-4866-b6a3-48eb292b9955", "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3", "e3f673b3-65d1-4d80-9146-466f8b63fa99", "270185ff-5f50-4d6d-a27f-24c3b8c9fef8", "5b2bbc47-dead-4ef7-8908-0cf73fcbecbf", "8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0", "06125661-3814-4e03-bfa2-1e4411c60ac3", "0a1f9d29-6465-4776-b091-7f43b26e4c89", "b1decb61-ed83-4339-8e95-53ea51901720", "a55349d8-9588-4c5a-8e3b-1925fe2a4ffe", "63c779ba-f638-40a0-a593-ddd45e8b1ddc", "ff301988-c231-4bd0-834c-ac9d73b86586", "3eb8c339-a765-48cc-a150-4364c04652bf", "3109530e-ab47-4cc6-a953-cac5ebcc93ae", "6ddab845-b1b8-49c2-bbf7-1a11967f64bc", "407aecb1-e762-4acf-8c7b-d087bcff3bb6", "7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2", "65744385-8541-44a6-8630-ffc824d7d4cc", "d51694fe-484a-46ac-92d6-969e76d60d10", "46612ae6-86be-4802-bc07-39b59feb1309", "f41b0311-44f9-44f0-816d-dd45e39d4bc8", "a5a2d357-1ab8-4675-a967-ef9990a59391", "02773bed-83bf-469f-b7ff-e676e7d78bab", "d353dac0-1b41-46c2-820c-d7d2561fc6ed", "caf02a0a-1e1c-4552-9b48-5e070bd88d11", "68578b43-65df-4f81-9a9b-92f32711a951", "13c02350-4177-4e45-ac17-cf7ca628ff5e", "b8fd0e93-ff58-4cbd-8f48-1c114e342e62", "39f1f9f2-9636-45de-98f6-a4046aa8e4b9", "28a452f3-786c-4fd8-b8f2-bddbe9d616d1", "74babdd6-a758-4549-9632-26535279e654", "fec96f39-988b-4586-b746-b93d59fd1922", "847def9e-924d-4e90-b7c4-5f581395a2b4", "ce7066a6-508a-42d3-995b-2952c65dc2ce", "4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6", "54127bd4-f541-4ac3-afdb-ea073f63f692", "002bdb95-0cf1-46a6-9e08-d38c128a6127", "c7a74c80-ba5a-486e-9974-ab9e682bc5e4", "34746e8c-5fb8-415a-b135-0abc167e912a", "ee63c85c-6d51-4d12-ad09-04e25877a947", "cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca", "1277f594-a7d1-4f28-a2d3-73af5cbeab43", "63e4f530-65dc-49cc-8f80-ccfa95c69d43", "dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c", "2f7979ae-f82b-45af-ac1d-2b10e93b0baa", "059c5af9-5131-4d8d-92b2-de4ad6146712", "7fd164ba-126a-4d9c-9392-0d4f7c243df0", "15904280-565c-4b73-9303-3291f964e7f9", "6902955a-01b7-432c-b32a-6f5f81d8f625", "3ab79e90-9fab-4cdf-a7b2-6522bc742adb", "654fcc6d-840d-4844-9b07-2c3300e54a26", "df6ecb8b-7822-4f4b-b412-08f524b4576c", "cad1fe90-2406-44dc-bd03-59d0b58fe722", "1027d292-dd87-4a1a-8701-2abe04d7783c", "41bb431f-56d8-4691-bb56-ed34e390906f", "de46c52b-0bf8-4936-a327-aace94f94ac6", "576426ad-0131-4001-ae01-be175da0c108", "4e7050dd-e548-483f-b7d6-527ab4fa784d", "3d2a2d59-929c-4b78-8c1a-145dfe9e07b1", "7d604714-e071-49ff-8726-edeb95a70679", "bdd8157d-8e85-4397-bb82-f06cc9c71dbb", "6b269392-9eba-40b5-acb6-55c882b20ba6", "b6f91281-20aa-446a-b986-38a92813a18f", "4aafb0fa-bff5-4b9d-b99e-8093e659c65f", "3da70954-0f2c-4103-adff-b7440368f50e", "e36941d0-c0f0-443f-bc6f-cb2952eb69ea", "6e90ae7a-7cd3-473f-a035-4ebb72d961da", "814ddeca-3d31-4265-8e07-8cc54fb44903", "bd1212e5-78da-431e-95fa-c58e3237a8e6", "9e099d99-44c2-42b6-a6d8-54c3545cab29", "7280c9f3-a5af-45d0-916a-bc01cb4151c9", "75bf09fa-1dd7-4d18-9af9-dd9e492562eb", "8fbf3271-1ef6-4e94-8210-03c2317947f6", "d102b8f5-61dc-4e68-bd83-9a3187c67377", "81315b50-6b60-4d8f-9928-3466e1022515", "2d367498-5112-4ae5-a06a-96e7bc33a211", "8e1cb247-6cf6-42fa-b440-3f27d57e9936", "7047d730-036f-4f40-b9d8-1c63e36d5e62", "2aa0a6b4-a865-495b-ab51-c28249537b75", "65236ec7-ace0-4f0c-82fd-737b04fd4dcb", "e4a74e34-ecde-4aab-b2fb-9112dd01aed0", "614a7e17-5643-4d89-b6fe-f9df1a79641c", "dca1b3e8-e043-4ec8-85d7-867f334b5724", "0b9ad457-2554-44c1-82c2-d56a99c42377", "8c31f563-f9a7-450c-bfa8-35f8f32f1f61", "9b64de98-9db3-4033-bd7a-f51430105f00", "aba15bdd-657f-422a-bab3-ac2d2a0d6f1c", "97aa2e88-555c-450d-85a6-229bcd87efb8", "304afd73-55a5-4bb9-8c21-0b1fc84ea9e4", "69ca12af-119d-44ed-b50f-a47af0ebc364", "b1c50487-1967-4315-a026-6491686d860e", "f0540f7e-2db3-4432-b9e0-3965486744bc", "130c9e58-28ac-4f83-8574-0a4cc913b97e", "92fa78e7-4d39-45f1-91a3-8b23f3f1088d", "33f41cdd-35ac-4ba8-814b-c6a4244a1ad4", "0bcfabcb-7929-47f4-93d6-b33fb67d34d1", "162ab1e4-6874-4564-853c-53ec3ab8be01", "11b1ed55-154d-4e82-8ad7-83739298f720", "c61daa90-3c1e-4f18-af62-8f288b5c9aaf", "fcc6d700-68d9-4241-9a1a-06874d621b06", "f92a6f1e-a512-4a15-9735-da09e78d7273", "7eff1a7f-dd45-4c20-877a-f21e342a7611", "0afecb6e-6223-4a82-99fb-bf5b981e92a5", "f0e2b768-5220-47dd-b891-d57b96fc0ec1", "34986307-b7f4-49be-92f3-e7a4d01ac5db", "9711de76-5d4f-4c50-a94f-21e4e8f8384d", "c3edc6a5-d9d4-48d8-930e-aab518390917", "d5866ddf-ce8f-4aea-b28e-d96485a20d3d", "259e5a6a-b8d2-4c38-86e2-26c5e651361d", "155dbf56-e0a4-4dd0-8905-8a98705045e8", "7fff6773-2baa-46de-a24a-b6eec1aba2d1", "e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f", "0b8baa3f-575c-46ee-8715-d6f28cc7d33c", "2f9356ae-bf43-41b8-b858-4496d83b2acb", "a05baa88-e922-4001-bc4d-8738135f27de", "5b40a734-99b6-4b98-a1d0-1cea51a08ab2", "6e2a900a-ced9-4e4a-a9c2-13e706f9518a", "91174a41-dc8f-401b-be89-7bfc140612a0", "8468111a-ef07-4654-903b-b863a80bbc95", "c048f047-7e2a-4888-b302-55f509d4a91d", "52753ea4-b3a0-4365-910d-36cff487b789", "fccfb43e-09a7-4bd2-8b37-a5a7df33386d", "5f87308a-0a5b-4623-ae15-d8fa1809bc60", "0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b", "a8f866e1-bdd4-425e-a27a-37619238d9c7", "07a99744-56ac-40d2-97b7-2095967b0e03", "3a8da4e0-36c1-40d2-8b29-b3e890d5172a", "0e29e3a7-1ad8-40aa-b691-9f82ecd33d66", "d7b50671-d1ad-4871-aa60-5aa5b331fe04", "409f8a98-4496-4aaa-818a-c931c0a8b832", "a6976974-ea6f-4e97-818e-ea08625c52cb", "3a9fa2ec-30bc-4ebd-b49e-7c9cff225502", "b4926b47-a9d7-434c-b3a0-adc3fa0bd13e", "28208707-fe31-437f-9a7f-4b1108b94d2e", "e15b518d-b4ce-4410-a9cd-501f23ce4a18", "760e75d8-c3b5-409b-a9bf-6130b4c4603f", "e0b06658-7d1d-4cd3-bf15-03467507ff7c", "4e87b8e2-2ee9-4b2a-a715-4727d297ece0", "bb09dd3e-2b78-4819-8e35-a7c1b874e449", "4c7f49ee-2638-43bb-b85b-ce676c30b260", "4358e5a5-7542-4dcb-b9f3-87667371839b", "62ed5b55-f991-406a-85d9-e8e8fdf18789", "e074832a-eada-4fd7-94a1-10642b130e16", "16fe46bb-4f64-46aa-817d-ff7bec4a2352", "8d5aca11-22b3-4f22-b7ba-90e60533e1fb", "3d0ed417-3d94-4963-a562-4a92c940656a", "7892ec59-c5bb-496d-8968-e5d210ca3ac4", "145095eb-e273-443b-83d0-f9b519b7867b", "5d756aee-ad3e-4306-ad95-cb1abec48de2", "48ea844d-19b1-4642-944e-fe39c2cc1fec", "8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9", "1908fcc1-1b92-4272-8214-0fbaf2fa5163", "a10a2c40-2c4d-49f8-b557-1a946bc55d9d", "736ffa74-5f6f-44ca-94ef-1c0df4f51d2a", "bbb7e38c-0b41-4a11-b306-d2a457b7ac2b", "fed85bf9-e075-4280-9159-fbe8a023d6fa", "0e20c89d-2264-44ae-8238-aeeaba609ece", "56e05d41-ce99-4ecd-912d-93f019ee0b71", "b5b78988-486d-4a80-b991-930eff3ff8bf", "805c55d9-31e6-4846-9878-c34c75054fe9", "80e1f67a-4596-4351-98f5-a9c3efabac95", "e3845023-ca9a-4024-b2b2-5422156d5527", "e8a52bbd-bced-459f-bd93-64db45ce7657", "fc4f4817-0c53-4683-a4ee-b17a64bc1039", "6ea858a8-ba71-4a12-b2cc-5d83312404c7", "93a19907-d4f9-4deb-9f91-aac4692776a6", "3215aa19-f060-4332-86d5-5602511f3ca8", "117d3d3a-755c-4a61-b23e-9171146d094c", "93d94efc-d7ad-4161-ad7d-1638c4f908d8", "318557a5-150c-4c8d-b70e-a9910e199857", "c3e76af5-4ce0-4a14-9c9a-25ceb8fda182", "f331aa1f-8c53-4fc3-b083-cc159bc971cb", "602a1f13-c640-4d73-b053-be9a2fa58b96", "9f2cc74d-78af-4eb2-bb64-9cd1d292b87b", "c3dbbc9f-ef1d-470a-a90a-d343448d5875", "edf3485d-dac4-4d50-90e4-b0e5813f7e60", "1d08ac94-400d-4469-a82f-daee9a908849", "7e9cf7b6-e827-11ed-a05b-15959c120003", "fa5b1358-b040-4403-9868-15f7d9ab6329", "c649a6c7-cd8c-4a78-9c04-000fc76df954", "e81528db-fc02-45e8-8e98-4e84aba1f10b", "7e9cf7b6-e827-11ed-a05b-0242ac120003", "a66bc059-c370-472c-a0d7-f8fd1bf9d583", "67add051-9ee7-4ad3-93ba-42935615ae8d", "295c9289-acee-4503-a571-8eacaef36b28", "72cd00d6-490c-4650-86ff-1d11f491daa1", "05296024-fe8a-4baf-8f3d-9a5f5624ceb2", "1a42dfa6-6cb2-4df9-9b48-295be477e835", "10cb6535-b31d-4512-9962-513dcbc42cc1", "7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8", "679085d5-f427-4484-9f58-1dc30a7c426d", "2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75", "39b64854-5497-4b57-a448-40977b8c9679", "a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f", "77564cc2-7382-438b-a7f6-395c2ae53b9a", "f239b326-2f41-4d6b-9dfa-c846a60ef505", "caa06de8-fdef-4c91-826a-7f9e163eef4b", "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "2158f96f-43c2-43cb-952a-ab4580f32382", "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "d797268e-28a9-49a7-b9a8-2f5039011c5c", "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "f426547a-e0f7-441a-b63e-854ac5bdf54d", "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "6d3a3952-6530-44a3-8554-cf17c116c615", "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "4c0aaedc-154c-4427-ada0-d80ef9c9deb6", "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "a4824fca-976f-4964-b334-0621379e84c4", "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "92a974db-ab84-457f-9ec0-55db83d7a825", "f9578658-9e71-4711-b634-3f9b50cd3c06", "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "f5240972-3938-4e56-8e4b-e33893176c1f", "fff9d2b7-e11c-4a69-93d3-40ef66189767", "cc9d3712-6310-4320-b2df-7cb408274d53", "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "327ff235-94eb-4f06-b9de-aaee571324be", "42a993dd-bb3e-48c8-b372-4d6684c4106c", "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "36210e0d-5b19-485d-a087-c096088885f0", "1723e720-616d-4ddc-ab02-f7e3685a4713", "90fb5e62-ca1f-4e22-b42e-cc521874c938", "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "57c4bf16-227f-4394-8ec7-1b745ee061c3", "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "0ea52357-cd59-4340-9981-c46c7e900428", "7aa7009a-28b9-4344-8c1f-159489a390df", "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "9719a8aa-401c-41af-8108-ced7ec9cd75c", "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "587254ee-a24b-4335-b3cd-065c0f1f4baa", "98b53e78-ebaf-46f8-be06-421aafd176d9", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "b5746143-59d6-4603-8d06-acbd60e166ee", "c09dad97-1c78-4f71-b127-7edb2b8e491a", "551d9c1f-816c-445b-a7a6-7a3864720d60", "e31033fc-33f0-4020-9a16-faf9b31cbf08", "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "8e3c7994-131e-4ba5-b6ea-804d49113a26", "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "e32d4572-9826-4738-b651-95fa63747e8a", "043c4b8b-3a54-4780-9682-081cb6b8185c", "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "c363385c-f75d-4753-a108-c1a8e28bdbda", "5cb299fc-5fb1-4d07-b989-0644c68b6043", "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "811f459f-9231-45d4-959a-0266c6311987", "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "7d6d30b8-5b91-4b90-a891-46cccaf29598", "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "087790e3-3287-436c-bccf-cbd0184a7db1", "6812a10b-60ea-420c-832f-dfcc33b646ba", "84b14121-9d14-416e-800b-f3b829c5a14d", "32e280f1-8ad4-46ef-9e80-910657611fbc", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "9cfc00b6-bfb7-49ce-9781-ef78503154bb", "3f5491e2-8db8-496b-9e95-1029fce852d4", "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "02030f2f-6199-49ec-b258-ea71b07e03dc", "74403157-20f5-415d-89a7-c505779585cf", "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "4d7cda18-1b12-4e52-b45c-d28653210df8", "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "c9783e20-4793-4164-ba96-d9ee483992c4", "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "94771a71-ba41-4b6e-a757-b531372eaab6", "2f869d59-7f6a-4931-992c-cce556ff2d53", "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "1775e15e-b61b-4d14-a1a3-80981298085a", "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "42b1a5b8-353f-4f10-b256-39de4467faff", "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "9292293b-8496-4715-9db6-37028dcda4b3", "52788a70-f1da-40dd-8fbd-73b5865d6568", "349d891d-fef0-4fe4-bc53-eee623a15969", "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "6f3e2987-db24-4c78-a860-b4f4095a7095", "1ec65a5f-9473-4f12-97da-622044d6df21", "d042284c-a296-4988-9be5-f424fadcc28c", "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "1327381e-6ab0-4f38-b583-4c1b8346a56b", "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "9ec9fb1b-e059-4489-9642-f270c207923d", "058f4380-962d-40a5-afce-50207d36d7e2", "fe63010f-8823-4864-a96b-a7b4a0f7b929", "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "c86133ad-4725-4bd0-8170-210788e0a7ba", "f5d19838-41b5-476c-98d8-ba8af4929ee2", "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "82880171-b475-4201-b811-e9c826cd5eaa", "023c654f-8f16-44d9-bb2b-00ff36a62af9", "d557dc06-62e8-4468-a8e8-7984124908ce", "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "a642964e-bead-4bed-8910-1bb4d63e3b4d", "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "e4a6b256-3e47-40fc-89d2-7a477edd6915", "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "9fff585c-c33e-4a86-b3cd-39312079a65f", "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "fa00b701-44c6-4679-994d-5a18afa8a707", "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "313d6012-51a0-4d93-8dfc-de8553239e25", "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "8d63dadf-b91b-4187-87b6-34a1114577ea", "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "b36d01a3-ddaf-4804-be18-18a6247adfcd", "aaf46cdc-934e-4284-b329-34aa701e3771", "575dce0c-8139-4e30-9295-1ee75969f7fe", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "a1473adb-5338-4a20-b4c3-126763e2d3d3", "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "241e802a-b65e-484f-88cd-c2dc10f9206d", "fd877b94-9bb5-4191-bb25-d79cbd93c167", "d047726b-c71c-4048-a99b-2e2f50dc107d", "40b95d31-1afc-469e-8d34-9a3a667d058e", "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "e6c54d94-498c-4562-a37c-b469d8e9a275", "64760eef-87f7-4ed3-93fd-655668ea9420", "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "da2738f2-fadb-4394-afa7-0a0674885afa", "88872991-7445-4a22-90b2-a3adadb0e827", "f576a613-2392-4067-9d1a-9345fb58d8d1", "431a1fdb-4799-4f3b-91c3-a683b003fc49", "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "4931188c-178e-4ee7-a348-39e8a7a56821", "85ff530b-261d-48c6-a441-facaa2e81e48", "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "8cbc9475-8d05-4e27-9c32-df960716c701", "378a05d8-963c-46c9-bcce-13c7657eac99", "e8d34729-86a4-4140-adfd-0a29c2106307", "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "e568650b-5dcd-4658-8f34-ded0b1e13992", "f208d6d8-d83a-4c2c-960d-877c37da84e5", "514e4c3a-c77d-4cde-a00f-046425e2301e", "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "01aeb693-138d-49d2-9403-c4f52d7d3d62", "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "83865853-59aa-449e-9600-74b9d89a6d6e", "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "b53317a0-8acf-4fd1-8de8-a5401e776b96", "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "10344bb3-7f65-46c2-b915-2d00d47be5b0", "185d7418-f250-42d0-b72e-0c8b70661e93", "379fa130-190e-4c3f-b7bc-6c8e834485f3", "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "e83e8899-c9b2-483b-b355-5decc942b959", "6385697e-9f1b-40bd-8817-f4a91f40508e", "24357373-078f-44ed-9ac4-6d334a668a11", "15619216-e993-4721-b590-4c520615a67d", "d2eb17db-1d39-41dc-b57f-301f6512fa75", "5a6e1e16-07de-48d8-8aae-faa766c05e88", "5a3164f2-b373-4152-93cf-090b13c12d27", "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "cbec226f-63d9-4eca-9f52-dfb6652f24df", "5b768e71-86f2-4879-b448-81061cbae951", "ca621ba5-54ab-4035-9942-d378e6fcde3c", "98767d61-b2e8-4d71-b661-e36783ee24c1", "a85ffc3a-e8fd-4040-93bf-78aff284d801", "88f46b67-14d4-4f45-ac2c-d66984f22191", "83809e84-4475-4b69-bc3e-4aad8568612f", "ce72ef99-22f1-43d4-8695-419dcb5d9330", "add64136-62e5-48ea-807e-88638d02df1e", "04936b66-3915-43ad-a8e5-809eadfd1141", "847d5ff3-8a31-4737-a970-aeae8fe21765", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "c49c5062-0966-4170-9efd-9968c913a6cf", "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "850d55f9-6eeb-4492-ad69-a72338f65ba4", "d87bd452-6da1-456e-8155-7dc988157b7d", "5bb68627-3198-40ca-b458-49f973db8752", "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "caf201a9-c2ce-4a26-9c3a-2b9525413711", "4e762605-34a8-406d-b72e-c1a089313320", "d3c3861d-c504-4c77-ba55-224ba82d0118", "2ddef153-167b-4e89-86b6-757a9e65dcac", "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "8a582fe2-0882-4b89-a82a-da6b2dc32937", "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "f35c5d71-b489-4e22-a115-f003df287317", "fbd7c32d-db2a-4418-b92c-566eb8911133", "87a476dc-0079-4583-a985-dee7a20a03de", "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "38879043-7e1e-47a9-8d46-6bec88e201df", "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "f9999590-1f94-4a34-a91e-951e47bedefd", "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "4eddc365-79b4-43ff-a9d7-99422dc34b93", "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "220457c1-1c9f-4c2e-afe6-9598926222c1", "bf361876-6620-407a-812f-bfe11e51e924", "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "c79da740-5030-45ec-a2e0-479e824a562c", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "a197e378-d31b-41c0-9635-cfdf1c1bb423", "737e618a-a410-49b5-bec3-9e55ff7fbc15", "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "30edb182-aa75-42c0-b0a9-e998bb29067c", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "eb1c4225-1c23-4241-8dd4-051389fde4ce", "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "e312efd0-35a1-407f-8439-b8d434b438a6", "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "ba42babc-0666-4393-a4f7-ceaf5a69191e", "c27515df-97a9-4162-8a60-dc0eeb51b775", "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "0f6da907-5854-4be6-859a-e9958747b0aa", "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "5edc2273-c26f-406c-83f3-f4d948e740dd", "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "0f0450f3-8b47-441e-a31b-15a91dc243e2", "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "817f252c-5143-4dae-b418-48c3e9f63728", "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "07e3cb2c-0608-410d-be4b-1511cb1a0448", "138d3531-8793-4f50-a2cd-f291b2863d78", "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "ddeff553-5233-4ae9-bbab-d64d2bd634be", "e212d415-0e93-435f-9e1a-f29005bb4723", "55f0a3a1-846e-40eb-8273-677371b8d912", "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "e7888eb1-13b0-4616-bd99-4bc0c2b054b9", "6ba5a05f-b095-4f0a-8654-b825f4f16334", "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "7cce6fc8-a07f-4d84-a53e-96e1879843c9", "45d3a03d-f441-458c-8883-df101a3bb146", "871b9555-69ca-4993-99d3-35a59f9f3599", "f2c64357-b1d2-41b7-849f-34d2682c0fad", "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "12fbff88-16b5-4b42-9754-cd001a789fb3", "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "0403d67d-6227-4ea8-8145-4e72db7da120", "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "bd1c6866-65fc-44b2-be51-5588fcff82b9", "1114e048-b69c-4f41-bc20-657245ae6e3f", "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "27aec9c9-dbb0-4939-8422-1742242471d0", "727454c0-d851-48b0-8b89-385611ab0704", "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "d20ee2f4-822c-4827-9e15-41500b1fff10", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "efec536f-72e8-4656-8960-5e85d091345b", "6f4191bb-912b-48a8-9ce7-682769541e6d", "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "517490a7-115a-48c6-8862-1a481504d5a8", "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "49d9671b-0a0a-4c09-8280-d215bfd30662", "05f3c945-dcc8-4393-9f3d-af65077a8f86", "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "554601fb-9b71-4bcc-abf4-21a611be4fde", "7b10f171-7f04-47c7-9fa2-5be43c76e535", "45239e6a-b035-4aaf-b339-8ad379fcb67e", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "7be5fb68-f9ef-476d-8b51-0256ebece19e", "6e22722b-dfb1-4508-a911-49ac840b40f8", "9ccba514-7cb6-4c5c-b377-700758f2f120", "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "7a74da6b-ea76-47db-92cc-874ad90df734", "f11f2808-adb4-46c0-802a-8660db50fa99", "43e32da2-fdd0-4156-90de-50dfd62636f9", "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "a20def93-0709-4eae-9bd2-31206e21e6b2", "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "6004abd0-afa4-4557-ba90-49d172e0a299", "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "970823b7-273b-460a-8afc-3a6811998529", "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "15b75071-74cc-47e0-b4c6-b43744a62a2b", "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "f99abdf0-6283-4e71-bd2b-b5c048a94743", "0a13e132-651d-11eb-ae93-0242ac130002", "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "e9f55347-2928-4c06-88e5-1a7f8169942e", "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "6a69f62d-ce75-4b57-8dce-6351eb55b362", "8b0e12da-d3c3-49db-bb4f-256703f380e5", "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "98a96a5a-64a0-4c42-92c5-489da3866cb0", "47e4bab7-c626-47dc-967b-255608c9a920", "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "40b19fa6-d835-400c-b301-41f3a2baacaf", "71158e3f-df67-472b-930e-7d287acaa3e1", "f44800ac-38ec-471f-936e-3fa7d9c53100", "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "24c8392b-aa3c-46b7-a545-43f71657fe98", "88f680b8-070e-402c-ae11-d2914f2257f1", "15434e33-5027-4914-88d5-3d4145ec25a9", "b98d0db6-511d-45de-ad02-e82a98729620", "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "0bbc6369-43e3-453d-9944-cae58821c173", "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "b7966f4a-b333-455b-8370-8ca53c229762", "43fa5350-db63-4b8f-9a01-789a427074e1", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "ec290c06-9b6b-4338-8b6b-095c0f284f10", "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "d4498716-1d52-438f-8084-4a603157d131", "b222df08-0e07-11eb-adc1-0242ac120002", "e1693bc8-7168-4eab-8718-cdcaa68a1738", "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "d3b70aad-097e-409c-9df2-450f80dc476b", "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "312d0384-401c-4b8b-abdf-685ffba9a332", "cc368ed0-2411-45dc-a222-510ace303cb2", "42333b2c-b425-441c-b70e-99404a17170f", "0e4164da-94bc-450d-a7be-a4b176179f1f", "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "ebef4391-1a81-4761-a40a-1db446c0e625", "f26307d8-14cd-47e3-a26b-4b4769f24af6", "03cc0c25-389f-4bf8-b48d-11878079f1ca", "8834e2f7-6b4b-4f09-8906-d2276470ee23", "7090adee-82e2-4269-bd59-80691e7c6338", "c74c0390-3e20-41fd-a69a-128f0275a5ea", "b6457d63-d2a2-4e29-859d-4e7affc153d1", "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "5f6a601c-2ecb-498b-9c33-660362323afa", "aa8e035d-7be4-48d3-a944-102aec04400d", "b243b280-65fe-48df-ba07-6ddea7646427", "236d8e89-ed95-4789-a982-36f4643738ba", "277a4393-446c-449a-b0ed-7fdc7795244c", "4fe074b4-b833-4081-8f24-7dcfeca72b42", "68bcd73b-37ef-49cb-95fc-edc809730be6", "86588b36-c6d3-465f-9cee-8f9093e07798", "502b42de-4306-40b4-9596-6f590c81f073", "0a99eb3e-1617-41bd-b095-13dc767f3def", "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "07f8bdc2-c9b3-472a-9817-5a670b872f53", "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "28ac00d6-22d9-4a3c-927f-bbd770104573", "452bce90-6fb0-43cc-97a5-affc283139b3", "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "ce7cf472-6fcc-490a-9481-3786840b5d9b", "c6fb44c6-71f5-49e6-9462-1425d328aee3", "9c0295ce-d60d-40bd-bd74-84673b7592b1", "0a4f6091-223b-41f6-8743-f322ec84930b", "98c5aeef-32d5-492f-b174-64a691896d25", "6fe4aa1e-0531-4510-8be2-782154b73b48", "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "d78b5d61-187d-44b6-bf02-93486a80de5a", "e9b61244-893f-427c-b287-3e708f321c6b", "70bc5215-526f-4477-963c-a47a5c9ebd12", "b6e04788-29e1-4557-bb14-77f761848ab8", "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "0685b176-c816-4837-8e7b-1216f346636b", "e84d89c4-f544-41ca-a6af-4b92fd38b023", "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "023394c4-29d5-46ab-92b8-6a534c6f447b", "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "ebea773c-a8f1-42ad-a856-00cb221966e8", "0b7163dc-7eee-4960-af17-c0cd517f92da", "98dedfdd-8333-49d4-9f23-d7018cccae53", "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "f24bcaea-0cd1-11eb-adc1-0242ac120002", "ccb5742c-c248-4982-8c5c-5571b9275ad3", "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "4abc0ec4-db5a-412f-9632-26659cddf145", "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "5cddf373-ef00-4112-ad72-960ac29bac34", "37db85d1-b089-490a-a59a-c7b6f984f480", "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "f1edd233-30b5-4823-9e6a-c4171b24d316", "e92a4287-e072-4a40-9739-370c106bb750", "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "8bc64091-6875-4881-aaf9-7bd25b5dda08", "56c217c3-2de2-479b-990f-5c109ba8458f", "eee00933-a761-4cd0-be70-c42fe91731e7", "bab049ca-7471-4828-9024-38279a4c04da", "c3a99af4-35a9-4668-879e-c09aeb4f2bdf", "d7654f02-e04b-4934-9838-65c46f187ebc", "2a072a96-a086-49fa-bcb5-15cc5a619093", "883faa95-175a-4e22-8181-e5761aeb373c", "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "63d1ccc0-2a43-4f4b-9289-361b308991ff", "4f154fb6-27d1-4813-a759-78b93e0b9c48", "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "33be4333-2c6b-44f4-ae28-102cdbde0a31", "395907ee-96e5-4666-af2e-2ca91688e151", "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "b0ce780f-10bd-496d-9067-066d23dc3aa5", "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "79b06761-465f-4f88-9ef2-150e24d3d737", "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "c615d676-f655-46b9-b913-78729021e5d7", "b19146a3-25d4-41b4-928b-1e2a92641b1b", "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "e6474a1b-5390-49cd-ab41-8d88655f7394", "692f0bec-83ba-4d04-af7e-e884a96059b6", "93671f99-04eb-4ab4-a161-70d446a84003", "0d5675be-bc88-4172-86d3-1e96a4476536", "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "4281cb20-2994-4580-aa63-c8b86d019934", "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "a34f79a3-8e5f-4cc3-b765-de00695452c2", "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "5589ab4f-a767-433c-961d-c91f3f704db1", "e8a95b5e-c891-46e2-b33a-93937d3abc31", "c86500e9-a645-4680-98d7-f882c70c1ea3", "58f50261-c53b-4c88-bd12-1d71f12eda4c", "34ebb878-1b15-4895-b352-ca2eeb99b274", "7a02e22e-b885-4404-b38b-1ddc7e65258a", "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "24de4f3b-804c-4165-b442-5a06a2302c7e", "731231b9-0b5d-4219-94dd-abb6959aa7ea", "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "d7bcd677-645d-4691-a8d4-7a5602b780d1", "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "6e897651-f157-4d8f-aaeb-df8151488385", "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "9847f263-4a81-424f-970c-875dab15b79b", "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "4b046706-5789-4673-b111-66f25fe99534", "73bba97f-a82d-42ce-b315-9182e76c57b1", "646bc99f-6682-4b47-a73a-17b1b64c9d34", "6c96fc76-0eb1-11eb-adc1-0242ac120002", "7050bba1-1aed-454e-8f73-3f46f09ce56a", "744a188b-0415-4792-896f-11ddb0588dbc", "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "faa48cae-6b25-4f00-a094-08947fef582f", "70ad0861-d1fe-491c-a45f-fa48148a300d", "a16980c2-0c56-4de0-9a79-17971979efdd", "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "954f0af7-62dd-418f-b3df-a84bc2c7a774", "a7ee1722-c3c5-aeff-3212-c777e4733217", "1dde5376-a648-492e-9e54-4241dd9b0c7f", "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "10c14723-61c7-4c75-92ca-9af245723ad2", "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "41421f44-58f9-455d-838a-c398859841d4", "ae9b0bd7-8888-4606-b444-0ed7410cb728", "8de1cbe8-d6f5-496d-8237-5f44a721c7a0", "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "43103702-5886-11ed-9b6a-0242ac120002", "16905e21-66ee-42fe-b256-1318ada2d770", "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "a7c3d773-caef-227e-a7e7-c2f13c622329", "214641c2-c579-4ecb-8427-0cf19df6842e", "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "07aa184a-870d-413d-893a-157f317f6f58", "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "f548a603-c9f2-4c89-b511-b089f7e94549", "93199800-b52a-4dec-b762-75212c196542", "526be59f-a573-4eea-b5f7-f0973207634d", "6345b048-8441-43a7-9bed-541133633d7a", "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "25676e10-2121-446e-80a4-71ff8506af47", "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "ac1c92b4-ac81-405a-9978-4604d78cc47e", "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "bdeb2cff-af74-4094-8426-724dc937f20a", "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "a383dec4-deec-4e6e-913b-ed9249670848", "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "ac20ae82-8758-4f38-958e-b44a3140ca88", "54786ddc-5b8a-11ed-9b6a-0242ac120002", "41ca393d-538c-408a-ac27-cf1e038be80c", "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "cd71385d-fd9b-4691-9b98-2b1f7e508714", "c8a180d6-47a3-4345-a609-53f9c3d834fc", "044ba588-dff4-4918-9808-3f95e8160606", "1af57a4b-460a-4738-9034-db68b880c665", "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "1dd05363-104e-4b4a-b963-196a534b03a1", "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "84b1ecf9-6eff-4004-bafb-bae5c0e251b2", "204b17ae-4007-471b-917b-b917b315c5db", "50d66fb0-03f8-4da0-8add-84e77d12a020", "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "c2b86e67-b880-4eec-b045-50bc98ef4844", "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "e593cf51-88db-4ee1-b920-37e89012a3c9", "90d6bd71-dffb-4989-8d86-a827fedd6624", "8202070f-edeb-4d31-a010-a26c72ac5600", "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "3268b746-88d8-4cd3-bffc-30077d02c787", "18988e1b-9087-4f8a-82fe-0414dce49878", "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "f53714ec-5077-420e-ad20-907ff9bb2958", "f117933c-980c-4f78-b384-e3d838111165", "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "a29c1813-ab1f-4dde-b489-330b952e91ae", "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "b655a06a-31c0-477a-95c2-3726b83d649d", "21d856f9-9281-4ded-9377-51a1a6e2a432", "b66474aa-bd92-4333-a16c-298155b120df", "b2309017-4235-44fe-b5af-b15363011957", "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "62510e69-616b-4078-b371-847da438cc03", "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "285b85b1-a555-4095-8652-a8a4106af63f", "84f52741-8834-4a8c-a413-2eb2269aa6c8", "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "be344333-921d-4c4d-8bb8-e584cf584780", "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "fb843269-508c-4b76-8b8d-88679db22ce7", "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "de587dce-915e-4218-aac4-835ca6af6f70", "c7942406-33dd-4377-a564-0f62db0593a3", "ab9e3b40-0c85-4ba1-aede-455d226fd124", "ef61af62-bc74-4f58-b49b-626448227652", "a20391f8-76fb-437b-abc0-dba2df1952c6", "899133d5-4d7c-4a7f-94ee-27355c879d90", "1ac8666b-046f-4201-8aba-1951aaec03a3", "1c67a717-32ba-409b-a45d-0fb704a73a81", "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "eca49c87-8a75-4f13-9c73-a5a29e845f03", "435e10e4-992a-4281-96f3-38b11106adde", "b3512211-c67e-4707-bedc-66efc7848863", "c15a46a0-07d4-4c87-b4b6-89207835a83b", "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "1f0f6176-6482-4027-b151-00071af39d7e", "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "9257c05b-4a4a-48e5-a670-b7b073cf401b", "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "99793437-3e16-439b-be0f-078782cf953d", "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "ac175779-025a-4f12-98b0-acdaeb77ea85", "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "90d50722-0483-4065-8e35-57efaadd354d", "180c7c5c-d64b-4a63-86e9-68910451bc8b", "d55b793d-f847-4eea-b59a-5ab09908ac90", "aef9d1f1-7396-4e92-a927-4567c7a495c1", "6c6d9280-e6d0-4b9d-80ac-254701b64916", "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "9212f354-7775-4e28-9c9f-8f0a4544e664", "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "ffa6861c-4461-4f59-8a41-578c39f3f23e", "a0459f02-ac51-4c09-b511-b8c9203fc429", "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "534f2ef7-e8a2-4433-816d-c91bccde289b", "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "84232095-ecca-4015-b0d7-7726507ee793", "4e2ed651-1906-4a59-a78a-18220fca1b22", "96036718-71cc-4027-a538-d1587e0006a7", "60f16a96-db70-42eb-8f76-16763e333590", "5afee48e-67dd-4e03-a783-f74259dcf998", "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "771d1eb5-9587-4568-95fb-9ec44153a012", "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "e28a5a99-da44-436d-b7a0-2afc20a5f413", "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "68d37776-61db-42f5-bf54-27e87072d17e", "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "d2b749ee-4225-417e-b20e-a8d2193cbb84", "1193d960-2369-499f-a158-7b50a31df682", "6b65c28e-11f3-46cb-902a-68f2cafaf474", "242301bc-f92f-4476-8718-78004a6efd9f", "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "52d097e2-063e-4c9c-8fbb-855c8948d135", "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "647c7b9e-d784-4fda-b9a0-45c565a7b729", "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "bb76d96b-821c-47cf-944b-7ce377864492", "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "1816994b-42e1-4fb1-afd2-134d88184f71", "12827a56-61a4-476a-a9cb-f3068f191073", "32b96012-7892-429e-b26c-ac2bf46066ff", "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "f4bbd493-b796-416e-bbf2-121235348529", "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "d06be4b9-8045-428b-a567-740a26d9db25", "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "65c3ca2c-525f-4ced-968e-246a713d164f", "347906f3-e207-4d18-ae5b-a9403d6bcdef", "a29808fd-ef50-49ff-9c7a-59a9b040b404", "e66779cc-383e-4224-a3a4-267eeb585c40", "85c312b7-f44d-4a51-a024-d671c40b49fc", "6da2c9f5-7c53-401b-aacb-92c040ce1215", "6bd75993-9888-4f91-9404-e1e4e4e34b77", "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "ff992eac-6449-4c60-8c1d-91c9722a1d48", "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "208748f7-881d-47ac-a29c-07ea84bf691d", "89ca78fd-b37c-4310-b3d3-81a023f83936", "a2910908-e86f-4687-aeba-76a5f996e652", "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "9c14c9fa-1a63-4a64-8e57-d19280559490", "221b251a-357a-49a9-920a-271802777cc0", "50919691-7302-437f-8e10-1fe088afa145", "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "f14e169e-9978-4c69-acb3-1cff8200bc36", "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "1c8774a0-44d4-4db0-91f8-e792359c70bd", "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "9fc3072c-dc8f-4bf7-b231-18950000fadd", "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "ada4b0c4-758b-46ac-9033-9004613a150d", "584bca0f-3608-4402-80fd-4075ff6072e3", "9a132afa-654e-11eb-ae93-0242ac130002", "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "a70dcb37-3bee-453a-99df-d0c683151be6", "85b0b087-eddf-4a2b-b033-d771fa2b9775", "2267fe65-0681-42ad-9a6d-46553d3f3480", "28c8f68b-098d-45af-8d43-8089f3e35403", "cd8c163e-a19b-402e-bdd5-419ff5859f12", "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "2c28c248-7f50-417a-9186-a85b223010ee", "84972c80-251c-4c3a-9079-4f00aad93938", "434c08ba-8406-4d15-8b24-782cb071a691", "bed2a484-9348-4143-8a8a-b801c979301c", "a0d7e4d2-bede-4141-8896-bc6e237e977c", "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "1c526788-0abe-4713-862f-b520da5e5316", "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "9f107a84-532c-41af-b005-8d12a607639f", "455b9d50-15a1-4b99-853f-8d37655a4c1b", "dee0a7a3-f200-4112-a99b-952196d81e42", "79ce34ca-af29-4d0e-b832-fc1b377020db", "2afafd61-6aae-4df4-baed-139fa1f4c345", "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "f0507c0f-a3a2-40f5-acc6-7f543c334993", "970007b7-ce32-49d0-a4a4-fbef016950bd", "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "f4264e47-f522-4c38-a420-04525d5b880f", "b2ddd389-f676-4ac4-845a-e00781a48e5f", "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "4a6713f6-3331-11ed-a261-0242ac120002", "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "5cc2cda8-f261-4d88-a2de-e9e193c86716", "2d22a514-e024-4428-9dba-41505bd63a5b", "01c42d3c-242d-4655-85b2-34f1739632f7", "77946e79-97f1-45a2-84b4-f37b5c0d8682", "27ba3207-dd30-4812-abbf-5d20c57d474e", "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "1228c958-e64e-4e71-92ad-7d429f4138ba", "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "b1377339-fda6-477a-b455-ac0923f9ec2c", "44143844-0631-49ab-97a0-96387d6b2d7c", "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "85de1f22-d189-44e4-8239-dc276b45379b", "92626ddd-662c-49e3-ac59-f6535f12d189", "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "e56d3073-83ff-4021-90fe-c658e0709e72", "deb9b646-a508-44ee-b7c9-d8965921c6b6", "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "cea2b7ea-792b-405f-95a1-b903ea06458f", "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "730fc21b-eaff-474b-ad23-90fd265d4988", "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "48917adc-a28e-4f5d-b729-11e75da8941f", "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "0900463c-b33b-49a8-be1d-552a3b553dae", "82a6714f-4899-4f16-9c1e-9a333544d4c3", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "1e59c230-6670-45bf-83b0-98903780607e", "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "5687f942-867b-4578-ade7-1e341c46e99a", "258fc8ce-8352-443a-9120-8a11e4857fa5", "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "4ae81040-fc1c-4249-bfa3-938d260214d9", "aa2efee7-34dd-446e-8a37-40790a66efd7", "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "ae215552-081e-44c7-805f-be16f975c8a2", "30bf1789-379d-4fdc-900f-55cd0a90a801", "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "4f7a6757-ff79-46db-9687-66501a02d9ec", "129966c9-de17-4334-a123-8b58172e664d", "696bfb54-227e-4602-ac5b-30d9d2053312", "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "7df1713a-1a5b-4a4b-a071-dc83b144a101", "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "814c95cc-8192-4378-a70a-f1aafd877af1", "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "99c840f2-2012-46fd-9141-c761987550ef", "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "de16d92c-c446-4d53-8938-10aeef41c8b6", "056c7317-9a09-4bd4-9067-d051312752ea", "60fc936d-2eb0-4543-8a13-911c750a1dfc", "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "114de787-4eb2-48cc-abdb-c0b449f93ea4", "207b0396-3689-42d9-8399-4222658efc99", "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "9248c7e1-2bf3-4661-a22c-600a8040b446", "146aace8-9bd6-42ba-be7a-0070d8027b76", "3d7679bd-0c00-440c-97b0-3f204273e6c7", "ea011323-7045-460b-b2d7-0f7442ea6b38", "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "e290b10b-1023-4452-a4a9-eb31a9013b3a", "ca5583e9-8f80-46ac-ab91-7f314d13b984", "cd3d1298-eb3b-476c-ac67-12847de55813", "867356ee-9352-41c9-a8f2-1be690d78216", "67f113fa-e23d-4271-befa-30113b3e08b1", "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "62b20d44-1546-4e61-afce-8e175eb9473c", "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "b6676963-0353-4f88-90f5-36c20d443c6a", "99cf1e02-00fb-4c0d-8375-563f978dfd37", "903076ff-f442-475a-b667-4f246bcc203b", "a77c1610-fc73-4019-8e29-0f51efc04a51", "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "cea72823-df4d-4567-950c-0b579eaf0846", "74a2b202-73e0-4693-9a3a-9d36146d0775", "5fc297ae-25b6-488a-8f25-cc12ac29b744", "12f6b752-042d-483e-bf9c-915a6d06ad75", "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "c1d867fe-8d95-4487-aab4-e53f2d339f90", "e13f668e-7f95-443d-98d2-1816a7648a7b", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "9c8c7000-3065-44a8-a555-79bcba5d9955", "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "ee5e119b-1f75-4b34-add8-3be976961e39", "33339be3-148b-4e16-af56-ad16ec6c7e7b", "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "01d2e2a1-5f09-44f7-9fc1-24faa7479b6d", "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "646ea171-dded-4578-8a4d-65e9822892e3", "84b1706c-932a-44c4-ae28-892b28a25b94", "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "1012f107-b8f1-4271-af30-5aed2de89b39", "074e0ded-6ced-4ebd-8b4d-53f55908119d", "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "af491bca-e752-4b44-9c86-df5680533dbc", "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "f0f7be61-9cf5-43be-9836-99d6ef448a18", "b1f73849-6329-4069-bc8f-78a604bb8b23", "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "0b80ade5-6997-4b1d-99a1-71701778ea61", "81ebd28b-9607-4478-bf06-974ed9d53ed7", "dc4576d4-7467-424f-9eee-fd2b02855fe0", "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "e9142d84-fbe0-401d-ac50-3e519fb00c89", "b4dc61f5-6cce-468e-a608-b48b469feaa2", "e6313acd-208c-44fc-a0ff-db85d572e90e", "f3d39c45-de1a-4486-a687-ab126124f744", "97dbf6e2-e436-44d8-abee-4261b24d3e41", "729ce0ea-5d8f-4769-9762-e35de441586d", "0fc35fc3-efe6-4898-8a37-0b233339524f", "c947b146-0abc-4c87-9c64-b17e9d7274a2", "91a2c315-9ee6-4052-a853-6f6a8238f90d", "9525dc73-0327-438c-8c04-13c0e037e9da", "a4694263-59a8-4608-a3a0-6f8d3a51664c", "f37aba28-a9e6-4045-882c-d5004043b337", "5e95028c-5229-4214-afae-d653d573d0ec", "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "f7375e28-5c14-432f-b8d1-1db26c832df3", "0e0255bf-2548-47b8-9582-c0955c9283f5", "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "d65aee4d-2292-4cea-b832-83accd6cfa43", "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "889719ef-dd62-43df-86c3-768fb08dc7c0", "18ee686c-38a3-4f65-9f44-48a077141f42", "af77cf95-c469-471c-b6a0-946c685c4798", "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "4bf943c6-5146-4273-98dd-e958fd1e3abf", "7f741dcf-fc22-4759-87b4-9ae8376676a2", "8a3038e8-9c9d-46f8-b184-66234a160f6f", "7d4aaec2-08ed-4430-8b96-28420e030e04", "75d0a94e-6252-448d-a7be-d953dff527bb", "327f48c1-a6db-4eb8-875a-f6981f1b0183", "5f03babb-12db-4eec-8c82-7b4cb5580868", "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "cd1f961e-0b96-436b-b7c6-38da4583ec00", "7b4f794b-590a-4ad4-ba18-7964a2832205", "438025f9-5856-4663-83f7-52f878a70a50", "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "213d6a77-3d55-4ce8-ba74-fcfef741974e", "aaafa146-074c-11eb-adc1-0242ac120002", "2433a154-bb3d-42e4-86c3-a26bdac91c45", "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "4f647cfa-b598-4e12-ad69-c68dd16caef8", "16c37b52-b141-42a5-a3ea-bbe098444397", "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "17769c90-230e-488b-a463-e05c08e9d48f", "222129f7-f4dc-4568-b0d2-22440a9639ba", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "e173ad47-4388-4012-ae62-bd13f71c18a8", "48bbc537-b652-4b4e-bd1d-281172df448f", "1edff897-9146-48d2-9066-52e8d8f80a2f", "c248c896-e412-4279-8c15-1c558067b6fa", "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "2cf29f11-e356-4f61-98c0-1bdb9393d6da", "d522eca2-2973-4391-a3e0-ef0374321dae", "62e0298b-e994-4189-bc87-bc699aa62d97", "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "a537cfc3-4297-4789-92b5-345bfd845ad0", "74a12f18-505c-4114-8d0b-8448dd5485c6", "4a2a2c3e-209f-4d01-b513-4155a540b469", "32410e29-5f94-4568-b6a3-d91a8adad863", "f64e5c19-879c-4bae-b471-6d84c8339677", "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "536e2947-3729-478c-9903-745aaffe60d2", "40aa399c-7b02-4715-8e5f-73572b493f33", "883835a7-df45-43e4-bf1d-4268768afda4", "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "b57ba453-b384-4ab9-9f40-1038086b4e53", "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "3bad990e-4848-4a78-9530-b427d854aac0", "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "09576804-7a05-458e-a817-eb718ca91f54", "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "b0524451-19af-4efa-a46f-562a977f792e", "b96b2031-7c17-4473-afe7-a30ce714db29", "37c1333a-a0db-48be-b64b-7393b2386e3b", "81325ce1-be01-4250-944f-b4789644556f", "3abd6094-7027-475f-9630-8ab9be7b9725", "d9047477-0359-48c9-b8c7-792cedcdc9c4", "0a98a10c-685d-4ab0-bddc-b6bdd1d48458", "56d19cb4-6414-4769-9644-1ed35ffbb148", "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "5cdb711b-5740-4fb2-ba88-f7945027afac", "164eda96-11b2-430b-85ff-6a265c15bf32", "a58353df-af43-4753-bad0-cd83ef35eef5", "56321594-9087-49d9-bf10-524fe8479452"], "uberAgent 7.1": ["dfe8b941-4e54-4242-b674-6b613d521962", "23c43900-e732-45a4-8354-63e4a6c187ce", "47d65ac0-c06f-4ba2-a2e3-d263139d0f51", "65d506d3-fcfe-4071-b4b2-bcefe721bbbb", "5d0fdb62-f225-42fb-8402-3dfe64da468a", "b743623c-2776-40e0-87b1-682b975d0ca5", "089dbdf6-b960-4bcc-90e3-ffc3480c20f6", "2d5e7a8b-f484-4a24-945d-7f0efd52eab0", "58800443-f9fc-4d55-ae0c-98a3966dfb97", "5de06a6f-673a-4fc0-8d48-bcfe3837b033", "1cf98dc2-fcb0-47c9-8aea-654c9284d1ae", "7ed2c9f7-c59d-4c82-a7e2-f859aa676099", "b120b587-a4c2-4b94-875d-99c9807d6955", "7c3b43d8-d794-47d2-800a-d277715aa460", "9a7a0393-2144-4626-9bf1-7c2f5a7321db", "2316929c-01aa-438c-970f-099145ab1ee6", "6d8a7cf1-8085-423b-b87d-7e880faabbdf", "2c95fa8a-8b8d-4787-afce-7117ceb8e3da", "95361ce5-c891-4b0a-87ca-e24607884a96", "1bc2e6c5-0885-472b-bed6-be5ea8eace55", "acf61bd8-d814-4272-81f0-a7a269aa69aa", "ddf36b67-e872-4507-ab2e-46bda21b842c", "bf241472-f014-4f01-a869-96f99330ca8c", "e0cfaecd-602d-41af-988d-f6ccebb2af26", "69483748-1525-4a6c-95ca-90dc8d431b68", "508a9374-ad52-4789-b568-fc358def2c65", "b9d9b652-d8ed-4697-89a2-a1186ee680ac", "f1408a58-0e94-4165-b80a-da9f96cf6fc3", "13db8d2e-7723-4c2c-93c1-a4d36994f7ef", "be2e3a5c-9cc7-4d02-842a-68e9cb26ec49", "84bae5d4-b518-4ae0-b331-6d4afd34d00f", "652c098d-dc11-4ba6-8566-c20e89042f2b", "0877ed01-da46-4c49-8476-d49cdd80dfa7", "234dc5df-40b5-49d1-bf53-0d44ce778eca", "10227522-8429-47e6-a301-f2b2d014e7ad", "719c22d7-c11a-4f2c-93a6-2cfdd5412f68", "a753a6af-3126-426d-8bd0-26ebbcb92254", "0ed75b9c-c73b-424d-9e7d-496cd565fbe0", "51719bf5-e4fd-4e44-8ba8-b830e7ac0731", "85de3a19-b675-4a51-bfc6-b11a5186c971", "7794fa3c-edea-4cff-bec7-267dd4770fd7", "4809c683-059b-4935-879d-36835986f8cf", "6ff08e55-ea53-4f27-94a1-eff92e6d9d5c", "53821412-17b0-4147-ade0-14faae67d54b", "6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4", "40b1fbe2-18ea-4ee7-be47-0294285811de", "b22a5b36-2431-493a-8be1-0bae56c28ef3", "ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e", "f5141b6d-9f42-41c6-a7bf-2a780678b29b", "89bb1f97-c7b9-40e8-b52b-7d6afbd67276", "adc9bcc4-c39c-4f6b-a711-1884017bf043", "60f1ce20-484e-41bd-85f4-ac4afec2c541", "0250638a-2b28-4541-86fc-ea4c558fa0c6", "09a910bf-f71f-4737-9c40-88880ba5913d", "821bcf4d-46c7-4b87-bc57-9509d3ba7c11", "9acf45ed-3a26-4062-bf08-56857613eb52", "ff39f1a6-84ac-476f-a1af-37fcdf53d7c0", "3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe", "88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0", "3603f18a-ec15-43a1-9af2-d196c8a7fec6", "f459ccb4-9805-41ea-b5b2-55e279e2424a", "452df256-da78-427a-866f-49fa04417d74", "7f2bb9d5-6395-4de5-969c-70c11fbe6b12", "53b1b378-9b06-4992-b972-dde6e423d2b4", "f68c4a4f-19ef-4817-952c-50dce331f4b0", "b6e2a2e3-2d30-43b1-a4ea-071e36595690", "d7329412-13bd-44ba-a072-3387f804a106", "ec8c4047-fad9-416a-8c81-0f479353d7f6", "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "d13c43f0-f66b-4279-8b2c-5912077c1780", "d2451be2-b582-4e15-8701-4196ac180260", "f40017b3-cb2e-4335-ab5d-3babf679c1de", "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "f354eba5-623b-450f-b073-0b5b2773b6aa", "6414b5cd-b19d-447e-bb5e-9f03940b5784", "ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94", "bdc64095-d59a-42a2-8588-71fd9c9d9abc", "1fbc0671-5596-4e17-8682-f020a0b995dc", "552b6b65-df37-4d3e-a258-f2fc4771ae54", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "333cdbe8-27bb-4246-bf82-b41a0dca4b70", "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "4c21b805-4dd7-469f-b47d-7383a8fcb437", "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "4508a70e-97ef-4300-b62b-ff27992990ea", "857c8db3-c89b-42fb-882b-f681c7cf4da2", "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "3669afd2-9891-4534-a626-e5cf03810a61", "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "7417e29e-c2e7-4cf6-a2e8-767228c64837", "72ca7c75-bf85-45cd-aca7-255d360e423c", "060d5ad4-3153-47bb-8382-43e5e29eda92", "0e0bc253-07ed-43f1-816d-e1b220fe8971", "6e78b74f-c762-4800-82ad-f66787f10c8a", "84b0a8f3-680b-4096-a45b-e9a89221727c", "90ae0469-0cee-4509-b67f-e5efcef040f7", "bf9808c4-d24f-44a2-8398-b65227d406b6", "caa02837-f659-466f-bca6-48bde2826ab4", "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "4fc0deee-0057-4998-ab31-d24e46e0aba4", "e2e01011-5910-4267-9c3b-4149ed5479cf", "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "d2605a99-2218-4894-8fd3-2afb7946514d", "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "a2a3b925-7bb0-433b-b508-db9003263cc4", "68654bf0-4412-43d5-bfe8-5eaa393cd939", "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "952ed57c-8f99-453d-aee0-53a49c22f95d", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "75e508f7-932d-4ebc-af77-269237a84ce1", "50f852e6-af22-4c78-9ede-42ef36aa3453", "8cde342c-ba48-4b74-b615-172c330f2e93", "ea5c131b-380d-49f9-aeb3-920694da4d4b", "a2edbce1-95c8-4291-8676-0d45146862b3", "844f8eb2-610b-42c8-89a4-47596e089663", "6360757a-d460-456c-8b13-74cf0e60cceb", "24b6cf51-6122-469e-861a-22974e9c1e5b", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "9ed5959a-c43c-4c59-84e3-d28628429456", "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "b5de0c9a-6f19-43e0-af4e-55ad01f550af", "fef394cd-f44d-4040-9b18-95d92fe278c0", "48bfd177-7cf2-412b-ad77-baf923489e82", "2092cacb-d77b-4f98-ab0d-32b32f99a054", "ff0f2b05-09db-4095-b96d-1b75ca24894a", "49329257-089d-46e6-af37-4afce4290685", "7707a579-e0d8-4886-a853-ce47e4575aaa", "ee6cea48-c5b6-4304-a332-10fc6446f484", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "e76c8240-d68f-4773-8880-5c6f63595aaf", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "af4c4609-5755-42fe-8075-4effb49f5d44", "9ca2bf31-0570-44d8-a543-534c47c33ed7", "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "6ec86d9e-912e-4726-91a2-209359b999b9", "273a8dd8-3742-4302-bcc7-7df5a80fe425", "90217a70-13fc-48e4-b3db-0d836c5824ac", "3735d5ac-d770-4da0-99ff-156b180bc600", "948a0953-f287-4806-bbcb-3b2e396df89f", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "a1d9eec5-33b2-4177-8d24-27fe754d0812", "613c03ba-0779-4a53-8a1f-47f914a4ded3", "f356a9c4-effd-4608-bbf8-408afd5cd006", "a21bcd7e-38ec-49ad-b69a-9ea17e69509e", "df68f791-ad95-447f-a271-640a0dab9cf8", "e043f529-8514-4205-8ab0-7f7d2927b400", "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "065cceea-77ec-4030-9052-fc0affea7110", "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "36e037c4-c228-4866-b6a3-48eb292b9955", "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3", "e3f673b3-65d1-4d80-9146-466f8b63fa99", "270185ff-5f50-4d6d-a27f-24c3b8c9fef8", "5b2bbc47-dead-4ef7-8908-0cf73fcbecbf", "8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0", "06125661-3814-4e03-bfa2-1e4411c60ac3", "0a1f9d29-6465-4776-b091-7f43b26e4c89", "b1decb61-ed83-4339-8e95-53ea51901720", "a55349d8-9588-4c5a-8e3b-1925fe2a4ffe", "63c779ba-f638-40a0-a593-ddd45e8b1ddc", "ff301988-c231-4bd0-834c-ac9d73b86586", "3eb8c339-a765-48cc-a150-4364c04652bf", "3109530e-ab47-4cc6-a953-cac5ebcc93ae", "6ddab845-b1b8-49c2-bbf7-1a11967f64bc", "407aecb1-e762-4acf-8c7b-d087bcff3bb6", "7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2", "65744385-8541-44a6-8630-ffc824d7d4cc", "d51694fe-484a-46ac-92d6-969e76d60d10", "46612ae6-86be-4802-bc07-39b59feb1309", "f41b0311-44f9-44f0-816d-dd45e39d4bc8", "a5a2d357-1ab8-4675-a967-ef9990a59391", "02773bed-83bf-469f-b7ff-e676e7d78bab", "d353dac0-1b41-46c2-820c-d7d2561fc6ed", "caf02a0a-1e1c-4552-9b48-5e070bd88d11", "68578b43-65df-4f81-9a9b-92f32711a951", "13c02350-4177-4e45-ac17-cf7ca628ff5e", "b8fd0e93-ff58-4cbd-8f48-1c114e342e62", "39f1f9f2-9636-45de-98f6-a4046aa8e4b9", "28a452f3-786c-4fd8-b8f2-bddbe9d616d1", "74babdd6-a758-4549-9632-26535279e654", "fec96f39-988b-4586-b746-b93d59fd1922", "847def9e-924d-4e90-b7c4-5f581395a2b4", "ce7066a6-508a-42d3-995b-2952c65dc2ce", "4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6", "54127bd4-f541-4ac3-afdb-ea073f63f692", "002bdb95-0cf1-46a6-9e08-d38c128a6127", "c7a74c80-ba5a-486e-9974-ab9e682bc5e4", "34746e8c-5fb8-415a-b135-0abc167e912a", "ee63c85c-6d51-4d12-ad09-04e25877a947", "cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca", "1277f594-a7d1-4f28-a2d3-73af5cbeab43", "63e4f530-65dc-49cc-8f80-ccfa95c69d43", "dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c", "2f7979ae-f82b-45af-ac1d-2b10e93b0baa", "059c5af9-5131-4d8d-92b2-de4ad6146712", "7fd164ba-126a-4d9c-9392-0d4f7c243df0", "15904280-565c-4b73-9303-3291f964e7f9", "6902955a-01b7-432c-b32a-6f5f81d8f625", "3ab79e90-9fab-4cdf-a7b2-6522bc742adb", "654fcc6d-840d-4844-9b07-2c3300e54a26", "df6ecb8b-7822-4f4b-b412-08f524b4576c", "cad1fe90-2406-44dc-bd03-59d0b58fe722", "1027d292-dd87-4a1a-8701-2abe04d7783c", "41bb431f-56d8-4691-bb56-ed34e390906f", "de46c52b-0bf8-4936-a327-aace94f94ac6", "576426ad-0131-4001-ae01-be175da0c108", "4e7050dd-e548-483f-b7d6-527ab4fa784d", "3d2a2d59-929c-4b78-8c1a-145dfe9e07b1", "7d604714-e071-49ff-8726-edeb95a70679", "bdd8157d-8e85-4397-bb82-f06cc9c71dbb", "6b269392-9eba-40b5-acb6-55c882b20ba6", "b6f91281-20aa-446a-b986-38a92813a18f", "4aafb0fa-bff5-4b9d-b99e-8093e659c65f", "3da70954-0f2c-4103-adff-b7440368f50e", "e36941d0-c0f0-443f-bc6f-cb2952eb69ea", "6e90ae7a-7cd3-473f-a035-4ebb72d961da", "814ddeca-3d31-4265-8e07-8cc54fb44903", "bd1212e5-78da-431e-95fa-c58e3237a8e6", "9e099d99-44c2-42b6-a6d8-54c3545cab29", "7280c9f3-a5af-45d0-916a-bc01cb4151c9", "75bf09fa-1dd7-4d18-9af9-dd9e492562eb", "8fbf3271-1ef6-4e94-8210-03c2317947f6", "d102b8f5-61dc-4e68-bd83-9a3187c67377", "81315b50-6b60-4d8f-9928-3466e1022515", "2d367498-5112-4ae5-a06a-96e7bc33a211", "8e1cb247-6cf6-42fa-b440-3f27d57e9936", "7047d730-036f-4f40-b9d8-1c63e36d5e62", "2aa0a6b4-a865-495b-ab51-c28249537b75", "65236ec7-ace0-4f0c-82fd-737b04fd4dcb", "e4a74e34-ecde-4aab-b2fb-9112dd01aed0", "614a7e17-5643-4d89-b6fe-f9df1a79641c", "dca1b3e8-e043-4ec8-85d7-867f334b5724", "0b9ad457-2554-44c1-82c2-d56a99c42377", "8c31f563-f9a7-450c-bfa8-35f8f32f1f61", "9b64de98-9db3-4033-bd7a-f51430105f00", "aba15bdd-657f-422a-bab3-ac2d2a0d6f1c", "97aa2e88-555c-450d-85a6-229bcd87efb8", "304afd73-55a5-4bb9-8c21-0b1fc84ea9e4", "69ca12af-119d-44ed-b50f-a47af0ebc364", "b1c50487-1967-4315-a026-6491686d860e", "f0540f7e-2db3-4432-b9e0-3965486744bc", "130c9e58-28ac-4f83-8574-0a4cc913b97e", "92fa78e7-4d39-45f1-91a3-8b23f3f1088d", "33f41cdd-35ac-4ba8-814b-c6a4244a1ad4", "0bcfabcb-7929-47f4-93d6-b33fb67d34d1", "162ab1e4-6874-4564-853c-53ec3ab8be01", "11b1ed55-154d-4e82-8ad7-83739298f720", "c61daa90-3c1e-4f18-af62-8f288b5c9aaf", "fcc6d700-68d9-4241-9a1a-06874d621b06", "f92a6f1e-a512-4a15-9735-da09e78d7273", "7eff1a7f-dd45-4c20-877a-f21e342a7611", "0afecb6e-6223-4a82-99fb-bf5b981e92a5", "f0e2b768-5220-47dd-b891-d57b96fc0ec1", "34986307-b7f4-49be-92f3-e7a4d01ac5db", "9711de76-5d4f-4c50-a94f-21e4e8f8384d", "c3edc6a5-d9d4-48d8-930e-aab518390917", "d5866ddf-ce8f-4aea-b28e-d96485a20d3d", "259e5a6a-b8d2-4c38-86e2-26c5e651361d", "155dbf56-e0a4-4dd0-8905-8a98705045e8", "7fff6773-2baa-46de-a24a-b6eec1aba2d1", "e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f", "0b8baa3f-575c-46ee-8715-d6f28cc7d33c", "2f9356ae-bf43-41b8-b858-4496d83b2acb", "a05baa88-e922-4001-bc4d-8738135f27de", "5b40a734-99b6-4b98-a1d0-1cea51a08ab2", "6e2a900a-ced9-4e4a-a9c2-13e706f9518a", "91174a41-dc8f-401b-be89-7bfc140612a0", "8468111a-ef07-4654-903b-b863a80bbc95", "c048f047-7e2a-4888-b302-55f509d4a91d", "52753ea4-b3a0-4365-910d-36cff487b789", "fccfb43e-09a7-4bd2-8b37-a5a7df33386d", "5f87308a-0a5b-4623-ae15-d8fa1809bc60", "0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b", "a8f866e1-bdd4-425e-a27a-37619238d9c7", "07a99744-56ac-40d2-97b7-2095967b0e03", "3a8da4e0-36c1-40d2-8b29-b3e890d5172a", "0e29e3a7-1ad8-40aa-b691-9f82ecd33d66", "d7b50671-d1ad-4871-aa60-5aa5b331fe04", "409f8a98-4496-4aaa-818a-c931c0a8b832", "a6976974-ea6f-4e97-818e-ea08625c52cb", "3a9fa2ec-30bc-4ebd-b49e-7c9cff225502", "b4926b47-a9d7-434c-b3a0-adc3fa0bd13e", "28208707-fe31-437f-9a7f-4b1108b94d2e", "e15b518d-b4ce-4410-a9cd-501f23ce4a18", "760e75d8-c3b5-409b-a9bf-6130b4c4603f", "e0b06658-7d1d-4cd3-bf15-03467507ff7c", "4e87b8e2-2ee9-4b2a-a715-4727d297ece0", "bb09dd3e-2b78-4819-8e35-a7c1b874e449", "4c7f49ee-2638-43bb-b85b-ce676c30b260", "4358e5a5-7542-4dcb-b9f3-87667371839b", "62ed5b55-f991-406a-85d9-e8e8fdf18789", "e074832a-eada-4fd7-94a1-10642b130e16", "16fe46bb-4f64-46aa-817d-ff7bec4a2352", "8d5aca11-22b3-4f22-b7ba-90e60533e1fb", "3d0ed417-3d94-4963-a562-4a92c940656a", "7892ec59-c5bb-496d-8968-e5d210ca3ac4", "145095eb-e273-443b-83d0-f9b519b7867b", "5d756aee-ad3e-4306-ad95-cb1abec48de2", "48ea844d-19b1-4642-944e-fe39c2cc1fec", "8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9", "1908fcc1-1b92-4272-8214-0fbaf2fa5163", "a10a2c40-2c4d-49f8-b557-1a946bc55d9d", "736ffa74-5f6f-44ca-94ef-1c0df4f51d2a", "bbb7e38c-0b41-4a11-b306-d2a457b7ac2b", "fed85bf9-e075-4280-9159-fbe8a023d6fa", "0e20c89d-2264-44ae-8238-aeeaba609ece", "56e05d41-ce99-4ecd-912d-93f019ee0b71", "b5b78988-486d-4a80-b991-930eff3ff8bf", "805c55d9-31e6-4846-9878-c34c75054fe9", "80e1f67a-4596-4351-98f5-a9c3efabac95", "e3845023-ca9a-4024-b2b2-5422156d5527", "e8a52bbd-bced-459f-bd93-64db45ce7657", "fc4f4817-0c53-4683-a4ee-b17a64bc1039", "6ea858a8-ba71-4a12-b2cc-5d83312404c7", "93a19907-d4f9-4deb-9f91-aac4692776a6", "3215aa19-f060-4332-86d5-5602511f3ca8", "117d3d3a-755c-4a61-b23e-9171146d094c", "93d94efc-d7ad-4161-ad7d-1638c4f908d8", "318557a5-150c-4c8d-b70e-a9910e199857", "c3e76af5-4ce0-4a14-9c9a-25ceb8fda182", "f331aa1f-8c53-4fc3-b083-cc159bc971cb", "602a1f13-c640-4d73-b053-be9a2fa58b96", "9f2cc74d-78af-4eb2-bb64-9cd1d292b87b", "c3dbbc9f-ef1d-470a-a90a-d343448d5875", "edf3485d-dac4-4d50-90e4-b0e5813f7e60", "1d08ac94-400d-4469-a82f-daee9a908849", "7e9cf7b6-e827-11ed-a05b-15959c120003", "fa5b1358-b040-4403-9868-15f7d9ab6329", "c649a6c7-cd8c-4a78-9c04-000fc76df954", "e81528db-fc02-45e8-8e98-4e84aba1f10b", "7e9cf7b6-e827-11ed-a05b-0242ac120003", "a66bc059-c370-472c-a0d7-f8fd1bf9d583", "67add051-9ee7-4ad3-93ba-42935615ae8d", "295c9289-acee-4503-a571-8eacaef36b28", "72cd00d6-490c-4650-86ff-1d11f491daa1", "05296024-fe8a-4baf-8f3d-9a5f5624ceb2", "1a42dfa6-6cb2-4df9-9b48-295be477e835", "10cb6535-b31d-4512-9962-513dcbc42cc1", "7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8", "679085d5-f427-4484-9f58-1dc30a7c426d", "2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75", "39b64854-5497-4b57-a448-40977b8c9679", "a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f", "77564cc2-7382-438b-a7f6-395c2ae53b9a", "f239b326-2f41-4d6b-9dfa-c846a60ef505", "caa06de8-fdef-4c91-826a-7f9e163eef4b", "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "2158f96f-43c2-43cb-952a-ab4580f32382", "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "d797268e-28a9-49a7-b9a8-2f5039011c5c", "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "f426547a-e0f7-441a-b63e-854ac5bdf54d", "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "6d3a3952-6530-44a3-8554-cf17c116c615", "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "4c0aaedc-154c-4427-ada0-d80ef9c9deb6", "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "a4824fca-976f-4964-b334-0621379e84c4", "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "92a974db-ab84-457f-9ec0-55db83d7a825", "f9578658-9e71-4711-b634-3f9b50cd3c06", "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "f5240972-3938-4e56-8e4b-e33893176c1f", "fff9d2b7-e11c-4a69-93d3-40ef66189767", "cc9d3712-6310-4320-b2df-7cb408274d53", "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "327ff235-94eb-4f06-b9de-aaee571324be", "42a993dd-bb3e-48c8-b372-4d6684c4106c", "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "36210e0d-5b19-485d-a087-c096088885f0", "1723e720-616d-4ddc-ab02-f7e3685a4713", "90fb5e62-ca1f-4e22-b42e-cc521874c938", "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "57c4bf16-227f-4394-8ec7-1b745ee061c3", "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "0ea52357-cd59-4340-9981-c46c7e900428", "7aa7009a-28b9-4344-8c1f-159489a390df", "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "9719a8aa-401c-41af-8108-ced7ec9cd75c", "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "587254ee-a24b-4335-b3cd-065c0f1f4baa", "98b53e78-ebaf-46f8-be06-421aafd176d9", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "b5746143-59d6-4603-8d06-acbd60e166ee", "c09dad97-1c78-4f71-b127-7edb2b8e491a", "551d9c1f-816c-445b-a7a6-7a3864720d60", "e31033fc-33f0-4020-9a16-faf9b31cbf08", "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "8e3c7994-131e-4ba5-b6ea-804d49113a26", "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "e32d4572-9826-4738-b651-95fa63747e8a", "043c4b8b-3a54-4780-9682-081cb6b8185c", "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "c363385c-f75d-4753-a108-c1a8e28bdbda", "5cb299fc-5fb1-4d07-b989-0644c68b6043", "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "811f459f-9231-45d4-959a-0266c6311987", "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "7d6d30b8-5b91-4b90-a891-46cccaf29598", "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "087790e3-3287-436c-bccf-cbd0184a7db1", "6812a10b-60ea-420c-832f-dfcc33b646ba", "84b14121-9d14-416e-800b-f3b829c5a14d", "32e280f1-8ad4-46ef-9e80-910657611fbc", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "9cfc00b6-bfb7-49ce-9781-ef78503154bb", "3f5491e2-8db8-496b-9e95-1029fce852d4", "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "02030f2f-6199-49ec-b258-ea71b07e03dc", "74403157-20f5-415d-89a7-c505779585cf", "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "4d7cda18-1b12-4e52-b45c-d28653210df8", "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "c9783e20-4793-4164-ba96-d9ee483992c4", "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "94771a71-ba41-4b6e-a757-b531372eaab6", "2f869d59-7f6a-4931-992c-cce556ff2d53", "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "1775e15e-b61b-4d14-a1a3-80981298085a", "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "42b1a5b8-353f-4f10-b256-39de4467faff", "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "9292293b-8496-4715-9db6-37028dcda4b3", "52788a70-f1da-40dd-8fbd-73b5865d6568", "349d891d-fef0-4fe4-bc53-eee623a15969", "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "6f3e2987-db24-4c78-a860-b4f4095a7095", "1ec65a5f-9473-4f12-97da-622044d6df21", "d042284c-a296-4988-9be5-f424fadcc28c", "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "1327381e-6ab0-4f38-b583-4c1b8346a56b", "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "9ec9fb1b-e059-4489-9642-f270c207923d", "058f4380-962d-40a5-afce-50207d36d7e2", "fe63010f-8823-4864-a96b-a7b4a0f7b929", "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "c86133ad-4725-4bd0-8170-210788e0a7ba", "f5d19838-41b5-476c-98d8-ba8af4929ee2", "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "82880171-b475-4201-b811-e9c826cd5eaa", "023c654f-8f16-44d9-bb2b-00ff36a62af9", "d557dc06-62e8-4468-a8e8-7984124908ce", "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "a642964e-bead-4bed-8910-1bb4d63e3b4d", "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "e4a6b256-3e47-40fc-89d2-7a477edd6915", "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "9fff585c-c33e-4a86-b3cd-39312079a65f", "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "fa00b701-44c6-4679-994d-5a18afa8a707", "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "313d6012-51a0-4d93-8dfc-de8553239e25", "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "8d63dadf-b91b-4187-87b6-34a1114577ea", "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "b36d01a3-ddaf-4804-be18-18a6247adfcd", "aaf46cdc-934e-4284-b329-34aa701e3771", "575dce0c-8139-4e30-9295-1ee75969f7fe", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "a1473adb-5338-4a20-b4c3-126763e2d3d3", "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "241e802a-b65e-484f-88cd-c2dc10f9206d", "fd877b94-9bb5-4191-bb25-d79cbd93c167", "d047726b-c71c-4048-a99b-2e2f50dc107d", "40b95d31-1afc-469e-8d34-9a3a667d058e", "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "e6c54d94-498c-4562-a37c-b469d8e9a275", "64760eef-87f7-4ed3-93fd-655668ea9420", "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "da2738f2-fadb-4394-afa7-0a0674885afa", "88872991-7445-4a22-90b2-a3adadb0e827", "f576a613-2392-4067-9d1a-9345fb58d8d1", "431a1fdb-4799-4f3b-91c3-a683b003fc49", "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "4931188c-178e-4ee7-a348-39e8a7a56821", "85ff530b-261d-48c6-a441-facaa2e81e48", "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "8cbc9475-8d05-4e27-9c32-df960716c701", "378a05d8-963c-46c9-bcce-13c7657eac99", "e8d34729-86a4-4140-adfd-0a29c2106307", "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "e568650b-5dcd-4658-8f34-ded0b1e13992", "f208d6d8-d83a-4c2c-960d-877c37da84e5", "514e4c3a-c77d-4cde-a00f-046425e2301e", "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "01aeb693-138d-49d2-9403-c4f52d7d3d62", "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "83865853-59aa-449e-9600-74b9d89a6d6e", "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "b53317a0-8acf-4fd1-8de8-a5401e776b96", "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "10344bb3-7f65-46c2-b915-2d00d47be5b0", "185d7418-f250-42d0-b72e-0c8b70661e93", "379fa130-190e-4c3f-b7bc-6c8e834485f3", "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "e83e8899-c9b2-483b-b355-5decc942b959", "6385697e-9f1b-40bd-8817-f4a91f40508e", "24357373-078f-44ed-9ac4-6d334a668a11", "15619216-e993-4721-b590-4c520615a67d", "d2eb17db-1d39-41dc-b57f-301f6512fa75", "5a6e1e16-07de-48d8-8aae-faa766c05e88", "5a3164f2-b373-4152-93cf-090b13c12d27", "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "cbec226f-63d9-4eca-9f52-dfb6652f24df", "5b768e71-86f2-4879-b448-81061cbae951", "ca621ba5-54ab-4035-9942-d378e6fcde3c", "98767d61-b2e8-4d71-b661-e36783ee24c1", "a85ffc3a-e8fd-4040-93bf-78aff284d801", "88f46b67-14d4-4f45-ac2c-d66984f22191", "83809e84-4475-4b69-bc3e-4aad8568612f", "ce72ef99-22f1-43d4-8695-419dcb5d9330", "add64136-62e5-48ea-807e-88638d02df1e", "04936b66-3915-43ad-a8e5-809eadfd1141", "847d5ff3-8a31-4737-a970-aeae8fe21765", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "c49c5062-0966-4170-9efd-9968c913a6cf", "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "850d55f9-6eeb-4492-ad69-a72338f65ba4", "d87bd452-6da1-456e-8155-7dc988157b7d", "5bb68627-3198-40ca-b458-49f973db8752", "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "caf201a9-c2ce-4a26-9c3a-2b9525413711", "4e762605-34a8-406d-b72e-c1a089313320", "d3c3861d-c504-4c77-ba55-224ba82d0118", "2ddef153-167b-4e89-86b6-757a9e65dcac", "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "8a582fe2-0882-4b89-a82a-da6b2dc32937", "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "f35c5d71-b489-4e22-a115-f003df287317", "fbd7c32d-db2a-4418-b92c-566eb8911133", "87a476dc-0079-4583-a985-dee7a20a03de", "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "38879043-7e1e-47a9-8d46-6bec88e201df", "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "f9999590-1f94-4a34-a91e-951e47bedefd", "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "4eddc365-79b4-43ff-a9d7-99422dc34b93", "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "220457c1-1c9f-4c2e-afe6-9598926222c1", "bf361876-6620-407a-812f-bfe11e51e924", "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "c79da740-5030-45ec-a2e0-479e824a562c", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "a197e378-d31b-41c0-9635-cfdf1c1bb423", "737e618a-a410-49b5-bec3-9e55ff7fbc15", "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "30edb182-aa75-42c0-b0a9-e998bb29067c", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "eb1c4225-1c23-4241-8dd4-051389fde4ce", "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "e312efd0-35a1-407f-8439-b8d434b438a6", "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "ba42babc-0666-4393-a4f7-ceaf5a69191e", "c27515df-97a9-4162-8a60-dc0eeb51b775", "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "0f6da907-5854-4be6-859a-e9958747b0aa", "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "5edc2273-c26f-406c-83f3-f4d948e740dd", "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "0f0450f3-8b47-441e-a31b-15a91dc243e2", "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "817f252c-5143-4dae-b418-48c3e9f63728", "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "07e3cb2c-0608-410d-be4b-1511cb1a0448", "138d3531-8793-4f50-a2cd-f291b2863d78", "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "ddeff553-5233-4ae9-bbab-d64d2bd634be", "e212d415-0e93-435f-9e1a-f29005bb4723", "55f0a3a1-846e-40eb-8273-677371b8d912", "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "e7888eb1-13b0-4616-bd99-4bc0c2b054b9", "6ba5a05f-b095-4f0a-8654-b825f4f16334", "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "7cce6fc8-a07f-4d84-a53e-96e1879843c9", "45d3a03d-f441-458c-8883-df101a3bb146", "871b9555-69ca-4993-99d3-35a59f9f3599", "f2c64357-b1d2-41b7-849f-34d2682c0fad", "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "12fbff88-16b5-4b42-9754-cd001a789fb3", "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "0403d67d-6227-4ea8-8145-4e72db7da120", "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "bd1c6866-65fc-44b2-be51-5588fcff82b9", "1114e048-b69c-4f41-bc20-657245ae6e3f", "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "27aec9c9-dbb0-4939-8422-1742242471d0", "727454c0-d851-48b0-8b89-385611ab0704", "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "d20ee2f4-822c-4827-9e15-41500b1fff10", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "efec536f-72e8-4656-8960-5e85d091345b", "6f4191bb-912b-48a8-9ce7-682769541e6d", "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "517490a7-115a-48c6-8862-1a481504d5a8", "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "49d9671b-0a0a-4c09-8280-d215bfd30662", "05f3c945-dcc8-4393-9f3d-af65077a8f86", "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "554601fb-9b71-4bcc-abf4-21a611be4fde", "7b10f171-7f04-47c7-9fa2-5be43c76e535", "45239e6a-b035-4aaf-b339-8ad379fcb67e", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "7be5fb68-f9ef-476d-8b51-0256ebece19e", "6e22722b-dfb1-4508-a911-49ac840b40f8", "9ccba514-7cb6-4c5c-b377-700758f2f120", "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "7a74da6b-ea76-47db-92cc-874ad90df734", "f11f2808-adb4-46c0-802a-8660db50fa99", "43e32da2-fdd0-4156-90de-50dfd62636f9", "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "a20def93-0709-4eae-9bd2-31206e21e6b2", "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "6004abd0-afa4-4557-ba90-49d172e0a299", "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "970823b7-273b-460a-8afc-3a6811998529", "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "15b75071-74cc-47e0-b4c6-b43744a62a2b", "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "f99abdf0-6283-4e71-bd2b-b5c048a94743", "0a13e132-651d-11eb-ae93-0242ac130002", "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "e9f55347-2928-4c06-88e5-1a7f8169942e", "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "6a69f62d-ce75-4b57-8dce-6351eb55b362", "8b0e12da-d3c3-49db-bb4f-256703f380e5", "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "98a96a5a-64a0-4c42-92c5-489da3866cb0", "47e4bab7-c626-47dc-967b-255608c9a920", "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "40b19fa6-d835-400c-b301-41f3a2baacaf", "71158e3f-df67-472b-930e-7d287acaa3e1", "f44800ac-38ec-471f-936e-3fa7d9c53100", "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "24c8392b-aa3c-46b7-a545-43f71657fe98", "88f680b8-070e-402c-ae11-d2914f2257f1", "15434e33-5027-4914-88d5-3d4145ec25a9", "b98d0db6-511d-45de-ad02-e82a98729620", "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "0bbc6369-43e3-453d-9944-cae58821c173", "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "b7966f4a-b333-455b-8370-8ca53c229762", "43fa5350-db63-4b8f-9a01-789a427074e1", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "ec290c06-9b6b-4338-8b6b-095c0f284f10", "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "d4498716-1d52-438f-8084-4a603157d131", "b222df08-0e07-11eb-adc1-0242ac120002", "e1693bc8-7168-4eab-8718-cdcaa68a1738", "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "d3b70aad-097e-409c-9df2-450f80dc476b", "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "312d0384-401c-4b8b-abdf-685ffba9a332", "cc368ed0-2411-45dc-a222-510ace303cb2", "42333b2c-b425-441c-b70e-99404a17170f", "0e4164da-94bc-450d-a7be-a4b176179f1f", "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "ebef4391-1a81-4761-a40a-1db446c0e625", "f26307d8-14cd-47e3-a26b-4b4769f24af6", "03cc0c25-389f-4bf8-b48d-11878079f1ca", "8834e2f7-6b4b-4f09-8906-d2276470ee23", "7090adee-82e2-4269-bd59-80691e7c6338", "c74c0390-3e20-41fd-a69a-128f0275a5ea", "b6457d63-d2a2-4e29-859d-4e7affc153d1", "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "5f6a601c-2ecb-498b-9c33-660362323afa", "aa8e035d-7be4-48d3-a944-102aec04400d", "b243b280-65fe-48df-ba07-6ddea7646427", "236d8e89-ed95-4789-a982-36f4643738ba", "277a4393-446c-449a-b0ed-7fdc7795244c", "4fe074b4-b833-4081-8f24-7dcfeca72b42", "68bcd73b-37ef-49cb-95fc-edc809730be6", "86588b36-c6d3-465f-9cee-8f9093e07798", "502b42de-4306-40b4-9596-6f590c81f073", "0a99eb3e-1617-41bd-b095-13dc767f3def", "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "07f8bdc2-c9b3-472a-9817-5a670b872f53", "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "28ac00d6-22d9-4a3c-927f-bbd770104573", "452bce90-6fb0-43cc-97a5-affc283139b3", "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "ce7cf472-6fcc-490a-9481-3786840b5d9b", "c6fb44c6-71f5-49e6-9462-1425d328aee3", "9c0295ce-d60d-40bd-bd74-84673b7592b1", "0a4f6091-223b-41f6-8743-f322ec84930b", "98c5aeef-32d5-492f-b174-64a691896d25", "6fe4aa1e-0531-4510-8be2-782154b73b48", "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "d78b5d61-187d-44b6-bf02-93486a80de5a", "e9b61244-893f-427c-b287-3e708f321c6b", "70bc5215-526f-4477-963c-a47a5c9ebd12", "b6e04788-29e1-4557-bb14-77f761848ab8", "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "0685b176-c816-4837-8e7b-1216f346636b", "e84d89c4-f544-41ca-a6af-4b92fd38b023", "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "023394c4-29d5-46ab-92b8-6a534c6f447b", "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "ebea773c-a8f1-42ad-a856-00cb221966e8", "0b7163dc-7eee-4960-af17-c0cd517f92da", "98dedfdd-8333-49d4-9f23-d7018cccae53", "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "f24bcaea-0cd1-11eb-adc1-0242ac120002", "ccb5742c-c248-4982-8c5c-5571b9275ad3", "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "4abc0ec4-db5a-412f-9632-26659cddf145", "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "5cddf373-ef00-4112-ad72-960ac29bac34", "37db85d1-b089-490a-a59a-c7b6f984f480", "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "f1edd233-30b5-4823-9e6a-c4171b24d316", "e92a4287-e072-4a40-9739-370c106bb750", "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "8bc64091-6875-4881-aaf9-7bd25b5dda08", "56c217c3-2de2-479b-990f-5c109ba8458f", "eee00933-a761-4cd0-be70-c42fe91731e7", "bab049ca-7471-4828-9024-38279a4c04da", "c3a99af4-35a9-4668-879e-c09aeb4f2bdf", "d7654f02-e04b-4934-9838-65c46f187ebc", "2a072a96-a086-49fa-bcb5-15cc5a619093", "883faa95-175a-4e22-8181-e5761aeb373c", "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "63d1ccc0-2a43-4f4b-9289-361b308991ff", "4f154fb6-27d1-4813-a759-78b93e0b9c48", "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "33be4333-2c6b-44f4-ae28-102cdbde0a31", "395907ee-96e5-4666-af2e-2ca91688e151", "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "b0ce780f-10bd-496d-9067-066d23dc3aa5", "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "79b06761-465f-4f88-9ef2-150e24d3d737", "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "c615d676-f655-46b9-b913-78729021e5d7", "b19146a3-25d4-41b4-928b-1e2a92641b1b", "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "e6474a1b-5390-49cd-ab41-8d88655f7394", "692f0bec-83ba-4d04-af7e-e884a96059b6", "93671f99-04eb-4ab4-a161-70d446a84003", "0d5675be-bc88-4172-86d3-1e96a4476536", "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "4281cb20-2994-4580-aa63-c8b86d019934", "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "a34f79a3-8e5f-4cc3-b765-de00695452c2", "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "5589ab4f-a767-433c-961d-c91f3f704db1", "e8a95b5e-c891-46e2-b33a-93937d3abc31", "c86500e9-a645-4680-98d7-f882c70c1ea3", "58f50261-c53b-4c88-bd12-1d71f12eda4c", "34ebb878-1b15-4895-b352-ca2eeb99b274", "7a02e22e-b885-4404-b38b-1ddc7e65258a", "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "24de4f3b-804c-4165-b442-5a06a2302c7e", "731231b9-0b5d-4219-94dd-abb6959aa7ea", "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "d7bcd677-645d-4691-a8d4-7a5602b780d1", "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "6e897651-f157-4d8f-aaeb-df8151488385", "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "9847f263-4a81-424f-970c-875dab15b79b", "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "4b046706-5789-4673-b111-66f25fe99534", "73bba97f-a82d-42ce-b315-9182e76c57b1", "646bc99f-6682-4b47-a73a-17b1b64c9d34", "6c96fc76-0eb1-11eb-adc1-0242ac120002", "7050bba1-1aed-454e-8f73-3f46f09ce56a", "744a188b-0415-4792-896f-11ddb0588dbc", "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "faa48cae-6b25-4f00-a094-08947fef582f", "70ad0861-d1fe-491c-a45f-fa48148a300d", "a16980c2-0c56-4de0-9a79-17971979efdd", "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "954f0af7-62dd-418f-b3df-a84bc2c7a774", "a7ee1722-c3c5-aeff-3212-c777e4733217", "1dde5376-a648-492e-9e54-4241dd9b0c7f", "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "10c14723-61c7-4c75-92ca-9af245723ad2", "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "41421f44-58f9-455d-838a-c398859841d4", "ae9b0bd7-8888-4606-b444-0ed7410cb728", "8de1cbe8-d6f5-496d-8237-5f44a721c7a0", "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "43103702-5886-11ed-9b6a-0242ac120002", "16905e21-66ee-42fe-b256-1318ada2d770", "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "a7c3d773-caef-227e-a7e7-c2f13c622329", "214641c2-c579-4ecb-8427-0cf19df6842e", "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "07aa184a-870d-413d-893a-157f317f6f58", "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "f548a603-c9f2-4c89-b511-b089f7e94549", "93199800-b52a-4dec-b762-75212c196542", "526be59f-a573-4eea-b5f7-f0973207634d", "6345b048-8441-43a7-9bed-541133633d7a", "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "25676e10-2121-446e-80a4-71ff8506af47", "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "ac1c92b4-ac81-405a-9978-4604d78cc47e", "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "bdeb2cff-af74-4094-8426-724dc937f20a", "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "a383dec4-deec-4e6e-913b-ed9249670848", "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "ac20ae82-8758-4f38-958e-b44a3140ca88", "54786ddc-5b8a-11ed-9b6a-0242ac120002", "41ca393d-538c-408a-ac27-cf1e038be80c", "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "cd71385d-fd9b-4691-9b98-2b1f7e508714", "c8a180d6-47a3-4345-a609-53f9c3d834fc", "044ba588-dff4-4918-9808-3f95e8160606", "1af57a4b-460a-4738-9034-db68b880c665", "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "1dd05363-104e-4b4a-b963-196a534b03a1", "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "84b1ecf9-6eff-4004-bafb-bae5c0e251b2", "204b17ae-4007-471b-917b-b917b315c5db", "50d66fb0-03f8-4da0-8add-84e77d12a020", "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "c2b86e67-b880-4eec-b045-50bc98ef4844", "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "e593cf51-88db-4ee1-b920-37e89012a3c9", "90d6bd71-dffb-4989-8d86-a827fedd6624", "8202070f-edeb-4d31-a010-a26c72ac5600", "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "3268b746-88d8-4cd3-bffc-30077d02c787", "18988e1b-9087-4f8a-82fe-0414dce49878", "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "f53714ec-5077-420e-ad20-907ff9bb2958", "f117933c-980c-4f78-b384-e3d838111165", "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "a29c1813-ab1f-4dde-b489-330b952e91ae", "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "b655a06a-31c0-477a-95c2-3726b83d649d", "21d856f9-9281-4ded-9377-51a1a6e2a432", "b66474aa-bd92-4333-a16c-298155b120df", "b2309017-4235-44fe-b5af-b15363011957", "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "62510e69-616b-4078-b371-847da438cc03", "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "285b85b1-a555-4095-8652-a8a4106af63f", "84f52741-8834-4a8c-a413-2eb2269aa6c8", "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "be344333-921d-4c4d-8bb8-e584cf584780", "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "fb843269-508c-4b76-8b8d-88679db22ce7", "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "de587dce-915e-4218-aac4-835ca6af6f70", "c7942406-33dd-4377-a564-0f62db0593a3", "ab9e3b40-0c85-4ba1-aede-455d226fd124", "ef61af62-bc74-4f58-b49b-626448227652", "a20391f8-76fb-437b-abc0-dba2df1952c6", "899133d5-4d7c-4a7f-94ee-27355c879d90", "1ac8666b-046f-4201-8aba-1951aaec03a3", "1c67a717-32ba-409b-a45d-0fb704a73a81", "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "eca49c87-8a75-4f13-9c73-a5a29e845f03", "435e10e4-992a-4281-96f3-38b11106adde", "b3512211-c67e-4707-bedc-66efc7848863", "c15a46a0-07d4-4c87-b4b6-89207835a83b", "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "1f0f6176-6482-4027-b151-00071af39d7e", "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "9257c05b-4a4a-48e5-a670-b7b073cf401b", "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "99793437-3e16-439b-be0f-078782cf953d", "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "ac175779-025a-4f12-98b0-acdaeb77ea85", "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "90d50722-0483-4065-8e35-57efaadd354d", "180c7c5c-d64b-4a63-86e9-68910451bc8b", "d55b793d-f847-4eea-b59a-5ab09908ac90", "aef9d1f1-7396-4e92-a927-4567c7a495c1", "6c6d9280-e6d0-4b9d-80ac-254701b64916", "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "9212f354-7775-4e28-9c9f-8f0a4544e664", "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "ffa6861c-4461-4f59-8a41-578c39f3f23e", "a0459f02-ac51-4c09-b511-b8c9203fc429", "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "534f2ef7-e8a2-4433-816d-c91bccde289b", "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "84232095-ecca-4015-b0d7-7726507ee793", "4e2ed651-1906-4a59-a78a-18220fca1b22", "96036718-71cc-4027-a538-d1587e0006a7", "60f16a96-db70-42eb-8f76-16763e333590", "5afee48e-67dd-4e03-a783-f74259dcf998", "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "771d1eb5-9587-4568-95fb-9ec44153a012", "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "e28a5a99-da44-436d-b7a0-2afc20a5f413", "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "68d37776-61db-42f5-bf54-27e87072d17e", "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "d2b749ee-4225-417e-b20e-a8d2193cbb84", "1193d960-2369-499f-a158-7b50a31df682", "6b65c28e-11f3-46cb-902a-68f2cafaf474", "242301bc-f92f-4476-8718-78004a6efd9f", "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "52d097e2-063e-4c9c-8fbb-855c8948d135", "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "647c7b9e-d784-4fda-b9a0-45c565a7b729", "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "bb76d96b-821c-47cf-944b-7ce377864492", "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "1816994b-42e1-4fb1-afd2-134d88184f71", "12827a56-61a4-476a-a9cb-f3068f191073", "32b96012-7892-429e-b26c-ac2bf46066ff", "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "f4bbd493-b796-416e-bbf2-121235348529", "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "d06be4b9-8045-428b-a567-740a26d9db25", "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "65c3ca2c-525f-4ced-968e-246a713d164f", "347906f3-e207-4d18-ae5b-a9403d6bcdef", "a29808fd-ef50-49ff-9c7a-59a9b040b404", "e66779cc-383e-4224-a3a4-267eeb585c40", "85c312b7-f44d-4a51-a024-d671c40b49fc", "6da2c9f5-7c53-401b-aacb-92c040ce1215", "6bd75993-9888-4f91-9404-e1e4e4e34b77", "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "ff992eac-6449-4c60-8c1d-91c9722a1d48", "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "208748f7-881d-47ac-a29c-07ea84bf691d", "89ca78fd-b37c-4310-b3d3-81a023f83936", "a2910908-e86f-4687-aeba-76a5f996e652", "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "9c14c9fa-1a63-4a64-8e57-d19280559490", "221b251a-357a-49a9-920a-271802777cc0", "50919691-7302-437f-8e10-1fe088afa145", "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "f14e169e-9978-4c69-acb3-1cff8200bc36", "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "1c8774a0-44d4-4db0-91f8-e792359c70bd", "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "9fc3072c-dc8f-4bf7-b231-18950000fadd", "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "ada4b0c4-758b-46ac-9033-9004613a150d", "584bca0f-3608-4402-80fd-4075ff6072e3", "9a132afa-654e-11eb-ae93-0242ac130002", "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "a70dcb37-3bee-453a-99df-d0c683151be6", "85b0b087-eddf-4a2b-b033-d771fa2b9775", "2267fe65-0681-42ad-9a6d-46553d3f3480", "28c8f68b-098d-45af-8d43-8089f3e35403", "cd8c163e-a19b-402e-bdd5-419ff5859f12", "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "2c28c248-7f50-417a-9186-a85b223010ee", "84972c80-251c-4c3a-9079-4f00aad93938", "434c08ba-8406-4d15-8b24-782cb071a691", "bed2a484-9348-4143-8a8a-b801c979301c", "a0d7e4d2-bede-4141-8896-bc6e237e977c", "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "1c526788-0abe-4713-862f-b520da5e5316", "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "9f107a84-532c-41af-b005-8d12a607639f", "455b9d50-15a1-4b99-853f-8d37655a4c1b", "dee0a7a3-f200-4112-a99b-952196d81e42", "79ce34ca-af29-4d0e-b832-fc1b377020db", "2afafd61-6aae-4df4-baed-139fa1f4c345", "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "f0507c0f-a3a2-40f5-acc6-7f543c334993", "970007b7-ce32-49d0-a4a4-fbef016950bd", "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "f4264e47-f522-4c38-a420-04525d5b880f", "b2ddd389-f676-4ac4-845a-e00781a48e5f", "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "4a6713f6-3331-11ed-a261-0242ac120002", "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "5cc2cda8-f261-4d88-a2de-e9e193c86716", "2d22a514-e024-4428-9dba-41505bd63a5b", "01c42d3c-242d-4655-85b2-34f1739632f7", "77946e79-97f1-45a2-84b4-f37b5c0d8682", "27ba3207-dd30-4812-abbf-5d20c57d474e", "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "1228c958-e64e-4e71-92ad-7d429f4138ba", "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "b1377339-fda6-477a-b455-ac0923f9ec2c", "44143844-0631-49ab-97a0-96387d6b2d7c", "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "85de1f22-d189-44e4-8239-dc276b45379b", "92626ddd-662c-49e3-ac59-f6535f12d189", "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "e56d3073-83ff-4021-90fe-c658e0709e72", "deb9b646-a508-44ee-b7c9-d8965921c6b6", "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "cea2b7ea-792b-405f-95a1-b903ea06458f", "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "730fc21b-eaff-474b-ad23-90fd265d4988", "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "48917adc-a28e-4f5d-b729-11e75da8941f", "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "0900463c-b33b-49a8-be1d-552a3b553dae", "82a6714f-4899-4f16-9c1e-9a333544d4c3", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "1e59c230-6670-45bf-83b0-98903780607e", "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "5687f942-867b-4578-ade7-1e341c46e99a", "258fc8ce-8352-443a-9120-8a11e4857fa5", "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "4ae81040-fc1c-4249-bfa3-938d260214d9", "aa2efee7-34dd-446e-8a37-40790a66efd7", "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "ae215552-081e-44c7-805f-be16f975c8a2", "30bf1789-379d-4fdc-900f-55cd0a90a801", "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "4f7a6757-ff79-46db-9687-66501a02d9ec", "129966c9-de17-4334-a123-8b58172e664d", "696bfb54-227e-4602-ac5b-30d9d2053312", "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "7df1713a-1a5b-4a4b-a071-dc83b144a101", "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "814c95cc-8192-4378-a70a-f1aafd877af1", "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "99c840f2-2012-46fd-9141-c761987550ef", "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "de16d92c-c446-4d53-8938-10aeef41c8b6", "056c7317-9a09-4bd4-9067-d051312752ea", "60fc936d-2eb0-4543-8a13-911c750a1dfc", "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "114de787-4eb2-48cc-abdb-c0b449f93ea4", "207b0396-3689-42d9-8399-4222658efc99", "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "9248c7e1-2bf3-4661-a22c-600a8040b446", "146aace8-9bd6-42ba-be7a-0070d8027b76", "3d7679bd-0c00-440c-97b0-3f204273e6c7", "ea011323-7045-460b-b2d7-0f7442ea6b38", "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "e290b10b-1023-4452-a4a9-eb31a9013b3a", "ca5583e9-8f80-46ac-ab91-7f314d13b984", "cd3d1298-eb3b-476c-ac67-12847de55813", "867356ee-9352-41c9-a8f2-1be690d78216", "67f113fa-e23d-4271-befa-30113b3e08b1", "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "62b20d44-1546-4e61-afce-8e175eb9473c", "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "b6676963-0353-4f88-90f5-36c20d443c6a", "99cf1e02-00fb-4c0d-8375-563f978dfd37", "903076ff-f442-475a-b667-4f246bcc203b", "a77c1610-fc73-4019-8e29-0f51efc04a51", "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "cea72823-df4d-4567-950c-0b579eaf0846", "74a2b202-73e0-4693-9a3a-9d36146d0775", "5fc297ae-25b6-488a-8f25-cc12ac29b744", "12f6b752-042d-483e-bf9c-915a6d06ad75", "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "c1d867fe-8d95-4487-aab4-e53f2d339f90", "e13f668e-7f95-443d-98d2-1816a7648a7b", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "9c8c7000-3065-44a8-a555-79bcba5d9955", "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "ee5e119b-1f75-4b34-add8-3be976961e39", "33339be3-148b-4e16-af56-ad16ec6c7e7b", "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "01d2e2a1-5f09-44f7-9fc1-24faa7479b6d", "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "646ea171-dded-4578-8a4d-65e9822892e3", "84b1706c-932a-44c4-ae28-892b28a25b94", "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "1012f107-b8f1-4271-af30-5aed2de89b39", "074e0ded-6ced-4ebd-8b4d-53f55908119d", "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "af491bca-e752-4b44-9c86-df5680533dbc", "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "f0f7be61-9cf5-43be-9836-99d6ef448a18", "b1f73849-6329-4069-bc8f-78a604bb8b23", "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "0b80ade5-6997-4b1d-99a1-71701778ea61", "81ebd28b-9607-4478-bf06-974ed9d53ed7", "dc4576d4-7467-424f-9eee-fd2b02855fe0", "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "e9142d84-fbe0-401d-ac50-3e519fb00c89", "b4dc61f5-6cce-468e-a608-b48b469feaa2", "e6313acd-208c-44fc-a0ff-db85d572e90e", "f3d39c45-de1a-4486-a687-ab126124f744", "97dbf6e2-e436-44d8-abee-4261b24d3e41", "729ce0ea-5d8f-4769-9762-e35de441586d", "0fc35fc3-efe6-4898-8a37-0b233339524f", "c947b146-0abc-4c87-9c64-b17e9d7274a2", "91a2c315-9ee6-4052-a853-6f6a8238f90d", "9525dc73-0327-438c-8c04-13c0e037e9da", "a4694263-59a8-4608-a3a0-6f8d3a51664c", "f37aba28-a9e6-4045-882c-d5004043b337", "5e95028c-5229-4214-afae-d653d573d0ec", "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "f7375e28-5c14-432f-b8d1-1db26c832df3", "0e0255bf-2548-47b8-9582-c0955c9283f5", "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "d65aee4d-2292-4cea-b832-83accd6cfa43", "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "889719ef-dd62-43df-86c3-768fb08dc7c0", "18ee686c-38a3-4f65-9f44-48a077141f42", "af77cf95-c469-471c-b6a0-946c685c4798", "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "4bf943c6-5146-4273-98dd-e958fd1e3abf", "7f741dcf-fc22-4759-87b4-9ae8376676a2", "8a3038e8-9c9d-46f8-b184-66234a160f6f", "7d4aaec2-08ed-4430-8b96-28420e030e04", "75d0a94e-6252-448d-a7be-d953dff527bb", "327f48c1-a6db-4eb8-875a-f6981f1b0183", "5f03babb-12db-4eec-8c82-7b4cb5580868", "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "cd1f961e-0b96-436b-b7c6-38da4583ec00", "7b4f794b-590a-4ad4-ba18-7964a2832205", "438025f9-5856-4663-83f7-52f878a70a50", "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "213d6a77-3d55-4ce8-ba74-fcfef741974e", "aaafa146-074c-11eb-adc1-0242ac120002", "2433a154-bb3d-42e4-86c3-a26bdac91c45", "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "4f647cfa-b598-4e12-ad69-c68dd16caef8", "16c37b52-b141-42a5-a3ea-bbe098444397", "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "17769c90-230e-488b-a463-e05c08e9d48f", "222129f7-f4dc-4568-b0d2-22440a9639ba", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "e173ad47-4388-4012-ae62-bd13f71c18a8", "48bbc537-b652-4b4e-bd1d-281172df448f", "1edff897-9146-48d2-9066-52e8d8f80a2f", "c248c896-e412-4279-8c15-1c558067b6fa", "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "2cf29f11-e356-4f61-98c0-1bdb9393d6da", "d522eca2-2973-4391-a3e0-ef0374321dae", "62e0298b-e994-4189-bc87-bc699aa62d97", "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "a537cfc3-4297-4789-92b5-345bfd845ad0", "74a12f18-505c-4114-8d0b-8448dd5485c6", "4a2a2c3e-209f-4d01-b513-4155a540b469", "32410e29-5f94-4568-b6a3-d91a8adad863", "f64e5c19-879c-4bae-b471-6d84c8339677", "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "536e2947-3729-478c-9903-745aaffe60d2", "40aa399c-7b02-4715-8e5f-73572b493f33", "883835a7-df45-43e4-bf1d-4268768afda4", "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "b57ba453-b384-4ab9-9f40-1038086b4e53", "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "3bad990e-4848-4a78-9530-b427d854aac0", "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "09576804-7a05-458e-a817-eb718ca91f54", "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "b0524451-19af-4efa-a46f-562a977f792e", "b96b2031-7c17-4473-afe7-a30ce714db29", "37c1333a-a0db-48be-b64b-7393b2386e3b", "81325ce1-be01-4250-944f-b4789644556f", "3abd6094-7027-475f-9630-8ab9be7b9725", "d9047477-0359-48c9-b8c7-792cedcdc9c4", "0a98a10c-685d-4ab0-bddc-b6bdd1d48458", "56d19cb4-6414-4769-9644-1ed35ffbb148", "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "5cdb711b-5740-4fb2-ba88-f7945027afac", "164eda96-11b2-430b-85ff-6a265c15bf32", "a58353df-af43-4753-bad0-cd83ef35eef5", "56321594-9087-49d9-bf10-524fe8479452"], "uberAgent 7.0": ["ec8c4047-fad9-416a-8c81-0f479353d7f6", "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "d13c43f0-f66b-4279-8b2c-5912077c1780", "d2451be2-b582-4e15-8701-4196ac180260", "f40017b3-cb2e-4335-ab5d-3babf679c1de", "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "f354eba5-623b-450f-b073-0b5b2773b6aa", "6414b5cd-b19d-447e-bb5e-9f03940b5784", "ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94", "bdc64095-d59a-42a2-8588-71fd9c9d9abc", "1fbc0671-5596-4e17-8682-f020a0b995dc", "552b6b65-df37-4d3e-a258-f2fc4771ae54", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "333cdbe8-27bb-4246-bf82-b41a0dca4b70", "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "4c21b805-4dd7-469f-b47d-7383a8fcb437", "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "4508a70e-97ef-4300-b62b-ff27992990ea", "857c8db3-c89b-42fb-882b-f681c7cf4da2", "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "3669afd2-9891-4534-a626-e5cf03810a61", "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "7417e29e-c2e7-4cf6-a2e8-767228c64837", "72ca7c75-bf85-45cd-aca7-255d360e423c", "060d5ad4-3153-47bb-8382-43e5e29eda92", "0e0bc253-07ed-43f1-816d-e1b220fe8971", "6e78b74f-c762-4800-82ad-f66787f10c8a", "84b0a8f3-680b-4096-a45b-e9a89221727c", "90ae0469-0cee-4509-b67f-e5efcef040f7", "bf9808c4-d24f-44a2-8398-b65227d406b6", "caa02837-f659-466f-bca6-48bde2826ab4", "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "4fc0deee-0057-4998-ab31-d24e46e0aba4", "e2e01011-5910-4267-9c3b-4149ed5479cf", "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "d2605a99-2218-4894-8fd3-2afb7946514d", "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "a2a3b925-7bb0-433b-b508-db9003263cc4", "68654bf0-4412-43d5-bfe8-5eaa393cd939", "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "952ed57c-8f99-453d-aee0-53a49c22f95d", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "75e508f7-932d-4ebc-af77-269237a84ce1", "50f852e6-af22-4c78-9ede-42ef36aa3453", "8cde342c-ba48-4b74-b615-172c330f2e93", "ea5c131b-380d-49f9-aeb3-920694da4d4b", "a2edbce1-95c8-4291-8676-0d45146862b3", "844f8eb2-610b-42c8-89a4-47596e089663", "6360757a-d460-456c-8b13-74cf0e60cceb", "24b6cf51-6122-469e-861a-22974e9c1e5b", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "9ed5959a-c43c-4c59-84e3-d28628429456", "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "b5de0c9a-6f19-43e0-af4e-55ad01f550af", "fef394cd-f44d-4040-9b18-95d92fe278c0", "48bfd177-7cf2-412b-ad77-baf923489e82", "2092cacb-d77b-4f98-ab0d-32b32f99a054", "ff0f2b05-09db-4095-b96d-1b75ca24894a", "49329257-089d-46e6-af37-4afce4290685", "7707a579-e0d8-4886-a853-ce47e4575aaa", "ee6cea48-c5b6-4304-a332-10fc6446f484", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "e76c8240-d68f-4773-8880-5c6f63595aaf", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "af4c4609-5755-42fe-8075-4effb49f5d44", "9ca2bf31-0570-44d8-a543-534c47c33ed7", "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "6ec86d9e-912e-4726-91a2-209359b999b9", "273a8dd8-3742-4302-bcc7-7df5a80fe425", "90217a70-13fc-48e4-b3db-0d836c5824ac", "3735d5ac-d770-4da0-99ff-156b180bc600", "948a0953-f287-4806-bbcb-3b2e396df89f", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "a1d9eec5-33b2-4177-8d24-27fe754d0812", "613c03ba-0779-4a53-8a1f-47f914a4ded3", "f356a9c4-effd-4608-bbf8-408afd5cd006", "a21bcd7e-38ec-49ad-b69a-9ea17e69509e", "df68f791-ad95-447f-a271-640a0dab9cf8", "e043f529-8514-4205-8ab0-7f7d2927b400", "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "065cceea-77ec-4030-9052-fc0affea7110", "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "36e037c4-c228-4866-b6a3-48eb292b9955", "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "9f2cc74d-78af-4eb2-bb64-9cd1d292b87b", "c3dbbc9f-ef1d-470a-a90a-d343448d5875", "edf3485d-dac4-4d50-90e4-b0e5813f7e60", "1d08ac94-400d-4469-a82f-daee9a908849", "7e9cf7b6-e827-11ed-a05b-15959c120003", "fa5b1358-b040-4403-9868-15f7d9ab6329", "c649a6c7-cd8c-4a78-9c04-000fc76df954", "e81528db-fc02-45e8-8e98-4e84aba1f10b", "7e9cf7b6-e827-11ed-a05b-0242ac120003", "a66bc059-c370-472c-a0d7-f8fd1bf9d583", "a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f", "77564cc2-7382-438b-a7f6-395c2ae53b9a", "f239b326-2f41-4d6b-9dfa-c846a60ef505", "caa06de8-fdef-4c91-826a-7f9e163eef4b", "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "2158f96f-43c2-43cb-952a-ab4580f32382", "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "d797268e-28a9-49a7-b9a8-2f5039011c5c", "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "f426547a-e0f7-441a-b63e-854ac5bdf54d", "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "6d3a3952-6530-44a3-8554-cf17c116c615", "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "4c0aaedc-154c-4427-ada0-d80ef9c9deb6", "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "a4824fca-976f-4964-b334-0621379e84c4", "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "92a974db-ab84-457f-9ec0-55db83d7a825", "f9578658-9e71-4711-b634-3f9b50cd3c06", "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "f5240972-3938-4e56-8e4b-e33893176c1f", "fff9d2b7-e11c-4a69-93d3-40ef66189767", "cc9d3712-6310-4320-b2df-7cb408274d53", "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "327ff235-94eb-4f06-b9de-aaee571324be", "42a993dd-bb3e-48c8-b372-4d6684c4106c", "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "36210e0d-5b19-485d-a087-c096088885f0", "1723e720-616d-4ddc-ab02-f7e3685a4713", "90fb5e62-ca1f-4e22-b42e-cc521874c938", "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "57c4bf16-227f-4394-8ec7-1b745ee061c3", "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "0ea52357-cd59-4340-9981-c46c7e900428", "7aa7009a-28b9-4344-8c1f-159489a390df", "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "9719a8aa-401c-41af-8108-ced7ec9cd75c", "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "587254ee-a24b-4335-b3cd-065c0f1f4baa", "98b53e78-ebaf-46f8-be06-421aafd176d9", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "b5746143-59d6-4603-8d06-acbd60e166ee", "c09dad97-1c78-4f71-b127-7edb2b8e491a", "551d9c1f-816c-445b-a7a6-7a3864720d60", "e31033fc-33f0-4020-9a16-faf9b31cbf08", "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "8e3c7994-131e-4ba5-b6ea-804d49113a26", "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "e32d4572-9826-4738-b651-95fa63747e8a", "043c4b8b-3a54-4780-9682-081cb6b8185c", "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "c363385c-f75d-4753-a108-c1a8e28bdbda", "5cb299fc-5fb1-4d07-b989-0644c68b6043", "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "811f459f-9231-45d4-959a-0266c6311987", "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "7d6d30b8-5b91-4b90-a891-46cccaf29598", "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "087790e3-3287-436c-bccf-cbd0184a7db1", "6812a10b-60ea-420c-832f-dfcc33b646ba", "84b14121-9d14-416e-800b-f3b829c5a14d", "32e280f1-8ad4-46ef-9e80-910657611fbc", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "9cfc00b6-bfb7-49ce-9781-ef78503154bb", "3f5491e2-8db8-496b-9e95-1029fce852d4", "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "02030f2f-6199-49ec-b258-ea71b07e03dc", "74403157-20f5-415d-89a7-c505779585cf", "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "4d7cda18-1b12-4e52-b45c-d28653210df8", "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "c9783e20-4793-4164-ba96-d9ee483992c4", "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "94771a71-ba41-4b6e-a757-b531372eaab6", "2f869d59-7f6a-4931-992c-cce556ff2d53", "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "1775e15e-b61b-4d14-a1a3-80981298085a", "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "42b1a5b8-353f-4f10-b256-39de4467faff", "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "9292293b-8496-4715-9db6-37028dcda4b3", "52788a70-f1da-40dd-8fbd-73b5865d6568", "349d891d-fef0-4fe4-bc53-eee623a15969", "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "6f3e2987-db24-4c78-a860-b4f4095a7095", "1ec65a5f-9473-4f12-97da-622044d6df21", "d042284c-a296-4988-9be5-f424fadcc28c", "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "1327381e-6ab0-4f38-b583-4c1b8346a56b", "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "9ec9fb1b-e059-4489-9642-f270c207923d", "058f4380-962d-40a5-afce-50207d36d7e2", "fe63010f-8823-4864-a96b-a7b4a0f7b929", "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "c86133ad-4725-4bd0-8170-210788e0a7ba", "f5d19838-41b5-476c-98d8-ba8af4929ee2", "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "82880171-b475-4201-b811-e9c826cd5eaa", "023c654f-8f16-44d9-bb2b-00ff36a62af9", "d557dc06-62e8-4468-a8e8-7984124908ce", "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "a642964e-bead-4bed-8910-1bb4d63e3b4d", "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "e4a6b256-3e47-40fc-89d2-7a477edd6915", "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "9fff585c-c33e-4a86-b3cd-39312079a65f", "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "fa00b701-44c6-4679-994d-5a18afa8a707", "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "313d6012-51a0-4d93-8dfc-de8553239e25", "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "8d63dadf-b91b-4187-87b6-34a1114577ea", "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "b36d01a3-ddaf-4804-be18-18a6247adfcd", "aaf46cdc-934e-4284-b329-34aa701e3771", "575dce0c-8139-4e30-9295-1ee75969f7fe", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "a1473adb-5338-4a20-b4c3-126763e2d3d3", "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "241e802a-b65e-484f-88cd-c2dc10f9206d", "fd877b94-9bb5-4191-bb25-d79cbd93c167", "d047726b-c71c-4048-a99b-2e2f50dc107d", "40b95d31-1afc-469e-8d34-9a3a667d058e", "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "e6c54d94-498c-4562-a37c-b469d8e9a275", "64760eef-87f7-4ed3-93fd-655668ea9420", "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "da2738f2-fadb-4394-afa7-0a0674885afa", "88872991-7445-4a22-90b2-a3adadb0e827", "f576a613-2392-4067-9d1a-9345fb58d8d1", "431a1fdb-4799-4f3b-91c3-a683b003fc49", "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "4931188c-178e-4ee7-a348-39e8a7a56821", "85ff530b-261d-48c6-a441-facaa2e81e48", "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "8cbc9475-8d05-4e27-9c32-df960716c701", "378a05d8-963c-46c9-bcce-13c7657eac99", "e8d34729-86a4-4140-adfd-0a29c2106307", "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "e568650b-5dcd-4658-8f34-ded0b1e13992", "f208d6d8-d83a-4c2c-960d-877c37da84e5", "514e4c3a-c77d-4cde-a00f-046425e2301e", "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "01aeb693-138d-49d2-9403-c4f52d7d3d62", "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "83865853-59aa-449e-9600-74b9d89a6d6e", "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "b53317a0-8acf-4fd1-8de8-a5401e776b96", "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "10344bb3-7f65-46c2-b915-2d00d47be5b0", "185d7418-f250-42d0-b72e-0c8b70661e93", "379fa130-190e-4c3f-b7bc-6c8e834485f3", "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "e83e8899-c9b2-483b-b355-5decc942b959", "6385697e-9f1b-40bd-8817-f4a91f40508e", "24357373-078f-44ed-9ac4-6d334a668a11", "15619216-e993-4721-b590-4c520615a67d", "d2eb17db-1d39-41dc-b57f-301f6512fa75", "5a6e1e16-07de-48d8-8aae-faa766c05e88", "5a3164f2-b373-4152-93cf-090b13c12d27", "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "cbec226f-63d9-4eca-9f52-dfb6652f24df", "5b768e71-86f2-4879-b448-81061cbae951", "ca621ba5-54ab-4035-9942-d378e6fcde3c", "98767d61-b2e8-4d71-b661-e36783ee24c1", "a85ffc3a-e8fd-4040-93bf-78aff284d801", "88f46b67-14d4-4f45-ac2c-d66984f22191", "83809e84-4475-4b69-bc3e-4aad8568612f", "ce72ef99-22f1-43d4-8695-419dcb5d9330", "add64136-62e5-48ea-807e-88638d02df1e", "04936b66-3915-43ad-a8e5-809eadfd1141", "847d5ff3-8a31-4737-a970-aeae8fe21765", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "c49c5062-0966-4170-9efd-9968c913a6cf", "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "850d55f9-6eeb-4492-ad69-a72338f65ba4", "d87bd452-6da1-456e-8155-7dc988157b7d", "5bb68627-3198-40ca-b458-49f973db8752", "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "caf201a9-c2ce-4a26-9c3a-2b9525413711", "4e762605-34a8-406d-b72e-c1a089313320", "d3c3861d-c504-4c77-ba55-224ba82d0118", "2ddef153-167b-4e89-86b6-757a9e65dcac", "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "8a582fe2-0882-4b89-a82a-da6b2dc32937", "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "f35c5d71-b489-4e22-a115-f003df287317", "fbd7c32d-db2a-4418-b92c-566eb8911133", "87a476dc-0079-4583-a985-dee7a20a03de", "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "38879043-7e1e-47a9-8d46-6bec88e201df", "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "f9999590-1f94-4a34-a91e-951e47bedefd", "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "4eddc365-79b4-43ff-a9d7-99422dc34b93", "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "220457c1-1c9f-4c2e-afe6-9598926222c1", "bf361876-6620-407a-812f-bfe11e51e924", "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "c79da740-5030-45ec-a2e0-479e824a562c", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "a197e378-d31b-41c0-9635-cfdf1c1bb423", "737e618a-a410-49b5-bec3-9e55ff7fbc15", "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "30edb182-aa75-42c0-b0a9-e998bb29067c", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "eb1c4225-1c23-4241-8dd4-051389fde4ce", "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "e312efd0-35a1-407f-8439-b8d434b438a6", "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "ba42babc-0666-4393-a4f7-ceaf5a69191e", "c27515df-97a9-4162-8a60-dc0eeb51b775", "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "0f6da907-5854-4be6-859a-e9958747b0aa", "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "5edc2273-c26f-406c-83f3-f4d948e740dd", "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "0f0450f3-8b47-441e-a31b-15a91dc243e2", "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "817f252c-5143-4dae-b418-48c3e9f63728", "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "07e3cb2c-0608-410d-be4b-1511cb1a0448", "138d3531-8793-4f50-a2cd-f291b2863d78", "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "ddeff553-5233-4ae9-bbab-d64d2bd634be", "e212d415-0e93-435f-9e1a-f29005bb4723", "55f0a3a1-846e-40eb-8273-677371b8d912", "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "e7888eb1-13b0-4616-bd99-4bc0c2b054b9", "6ba5a05f-b095-4f0a-8654-b825f4f16334", "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "7cce6fc8-a07f-4d84-a53e-96e1879843c9", "45d3a03d-f441-458c-8883-df101a3bb146", "871b9555-69ca-4993-99d3-35a59f9f3599", "f2c64357-b1d2-41b7-849f-34d2682c0fad", "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "12fbff88-16b5-4b42-9754-cd001a789fb3", "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "0403d67d-6227-4ea8-8145-4e72db7da120", "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "bd1c6866-65fc-44b2-be51-5588fcff82b9", "1114e048-b69c-4f41-bc20-657245ae6e3f", "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "27aec9c9-dbb0-4939-8422-1742242471d0", "727454c0-d851-48b0-8b89-385611ab0704", "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "d20ee2f4-822c-4827-9e15-41500b1fff10", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "efec536f-72e8-4656-8960-5e85d091345b", "6f4191bb-912b-48a8-9ce7-682769541e6d", "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "517490a7-115a-48c6-8862-1a481504d5a8", "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "49d9671b-0a0a-4c09-8280-d215bfd30662", "05f3c945-dcc8-4393-9f3d-af65077a8f86", "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "554601fb-9b71-4bcc-abf4-21a611be4fde", "7b10f171-7f04-47c7-9fa2-5be43c76e535", "45239e6a-b035-4aaf-b339-8ad379fcb67e", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "7be5fb68-f9ef-476d-8b51-0256ebece19e", "6e22722b-dfb1-4508-a911-49ac840b40f8", "9ccba514-7cb6-4c5c-b377-700758f2f120", "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "7a74da6b-ea76-47db-92cc-874ad90df734", "f11f2808-adb4-46c0-802a-8660db50fa99", "43e32da2-fdd0-4156-90de-50dfd62636f9", "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "a20def93-0709-4eae-9bd2-31206e21e6b2", "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "6004abd0-afa4-4557-ba90-49d172e0a299", "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "970823b7-273b-460a-8afc-3a6811998529", "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "15b75071-74cc-47e0-b4c6-b43744a62a2b", "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "f99abdf0-6283-4e71-bd2b-b5c048a94743", "0a13e132-651d-11eb-ae93-0242ac130002", "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "e9f55347-2928-4c06-88e5-1a7f8169942e", "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "6a69f62d-ce75-4b57-8dce-6351eb55b362", "8b0e12da-d3c3-49db-bb4f-256703f380e5", "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "98a96a5a-64a0-4c42-92c5-489da3866cb0", "47e4bab7-c626-47dc-967b-255608c9a920", "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "40b19fa6-d835-400c-b301-41f3a2baacaf", "71158e3f-df67-472b-930e-7d287acaa3e1", "f44800ac-38ec-471f-936e-3fa7d9c53100", "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "24c8392b-aa3c-46b7-a545-43f71657fe98", "88f680b8-070e-402c-ae11-d2914f2257f1", "15434e33-5027-4914-88d5-3d4145ec25a9", "b98d0db6-511d-45de-ad02-e82a98729620", "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "0bbc6369-43e3-453d-9944-cae58821c173", "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "b7966f4a-b333-455b-8370-8ca53c229762", "43fa5350-db63-4b8f-9a01-789a427074e1", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "ec290c06-9b6b-4338-8b6b-095c0f284f10", "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "d4498716-1d52-438f-8084-4a603157d131", "b222df08-0e07-11eb-adc1-0242ac120002", "e1693bc8-7168-4eab-8718-cdcaa68a1738", "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "d3b70aad-097e-409c-9df2-450f80dc476b", "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "312d0384-401c-4b8b-abdf-685ffba9a332", "cc368ed0-2411-45dc-a222-510ace303cb2", "42333b2c-b425-441c-b70e-99404a17170f", "0e4164da-94bc-450d-a7be-a4b176179f1f", "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "ebef4391-1a81-4761-a40a-1db446c0e625", "f26307d8-14cd-47e3-a26b-4b4769f24af6", "03cc0c25-389f-4bf8-b48d-11878079f1ca", "8834e2f7-6b4b-4f09-8906-d2276470ee23", "7090adee-82e2-4269-bd59-80691e7c6338", "c74c0390-3e20-41fd-a69a-128f0275a5ea", "b6457d63-d2a2-4e29-859d-4e7affc153d1", "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "5f6a601c-2ecb-498b-9c33-660362323afa", "aa8e035d-7be4-48d3-a944-102aec04400d", "b243b280-65fe-48df-ba07-6ddea7646427", "236d8e89-ed95-4789-a982-36f4643738ba", "277a4393-446c-449a-b0ed-7fdc7795244c", "4fe074b4-b833-4081-8f24-7dcfeca72b42", "68bcd73b-37ef-49cb-95fc-edc809730be6", "86588b36-c6d3-465f-9cee-8f9093e07798", "502b42de-4306-40b4-9596-6f590c81f073", "0a99eb3e-1617-41bd-b095-13dc767f3def", "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "07f8bdc2-c9b3-472a-9817-5a670b872f53", "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "28ac00d6-22d9-4a3c-927f-bbd770104573", "452bce90-6fb0-43cc-97a5-affc283139b3", "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "ce7cf472-6fcc-490a-9481-3786840b5d9b", "c6fb44c6-71f5-49e6-9462-1425d328aee3", "9c0295ce-d60d-40bd-bd74-84673b7592b1", "0a4f6091-223b-41f6-8743-f322ec84930b", "98c5aeef-32d5-492f-b174-64a691896d25", "6fe4aa1e-0531-4510-8be2-782154b73b48", "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "d78b5d61-187d-44b6-bf02-93486a80de5a", "e9b61244-893f-427c-b287-3e708f321c6b", "70bc5215-526f-4477-963c-a47a5c9ebd12", "b6e04788-29e1-4557-bb14-77f761848ab8", "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "0685b176-c816-4837-8e7b-1216f346636b", "e84d89c4-f544-41ca-a6af-4b92fd38b023", "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "023394c4-29d5-46ab-92b8-6a534c6f447b", "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "ebea773c-a8f1-42ad-a856-00cb221966e8", "0b7163dc-7eee-4960-af17-c0cd517f92da", "98dedfdd-8333-49d4-9f23-d7018cccae53", "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "f24bcaea-0cd1-11eb-adc1-0242ac120002", "ccb5742c-c248-4982-8c5c-5571b9275ad3", "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "4abc0ec4-db5a-412f-9632-26659cddf145", "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "5cddf373-ef00-4112-ad72-960ac29bac34", "37db85d1-b089-490a-a59a-c7b6f984f480", "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "f1edd233-30b5-4823-9e6a-c4171b24d316", "e92a4287-e072-4a40-9739-370c106bb750", "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "8bc64091-6875-4881-aaf9-7bd25b5dda08", "56c217c3-2de2-479b-990f-5c109ba8458f", "eee00933-a761-4cd0-be70-c42fe91731e7", "bab049ca-7471-4828-9024-38279a4c04da", "c3a99af4-35a9-4668-879e-c09aeb4f2bdf", "d7654f02-e04b-4934-9838-65c46f187ebc", "2a072a96-a086-49fa-bcb5-15cc5a619093", "883faa95-175a-4e22-8181-e5761aeb373c", "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "63d1ccc0-2a43-4f4b-9289-361b308991ff", "4f154fb6-27d1-4813-a759-78b93e0b9c48", "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "33be4333-2c6b-44f4-ae28-102cdbde0a31", "395907ee-96e5-4666-af2e-2ca91688e151", "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "b0ce780f-10bd-496d-9067-066d23dc3aa5", "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "79b06761-465f-4f88-9ef2-150e24d3d737", "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "c615d676-f655-46b9-b913-78729021e5d7", "b19146a3-25d4-41b4-928b-1e2a92641b1b", "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "e6474a1b-5390-49cd-ab41-8d88655f7394", "692f0bec-83ba-4d04-af7e-e884a96059b6", "93671f99-04eb-4ab4-a161-70d446a84003", "0d5675be-bc88-4172-86d3-1e96a4476536", "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "4281cb20-2994-4580-aa63-c8b86d019934", "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "a34f79a3-8e5f-4cc3-b765-de00695452c2", "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "5589ab4f-a767-433c-961d-c91f3f704db1", "e8a95b5e-c891-46e2-b33a-93937d3abc31", "c86500e9-a645-4680-98d7-f882c70c1ea3", "58f50261-c53b-4c88-bd12-1d71f12eda4c", "34ebb878-1b15-4895-b352-ca2eeb99b274", "7a02e22e-b885-4404-b38b-1ddc7e65258a", "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "24de4f3b-804c-4165-b442-5a06a2302c7e", "731231b9-0b5d-4219-94dd-abb6959aa7ea", "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "d7bcd677-645d-4691-a8d4-7a5602b780d1", "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "6e897651-f157-4d8f-aaeb-df8151488385", "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "9847f263-4a81-424f-970c-875dab15b79b", "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "4b046706-5789-4673-b111-66f25fe99534", "73bba97f-a82d-42ce-b315-9182e76c57b1", "646bc99f-6682-4b47-a73a-17b1b64c9d34", "6c96fc76-0eb1-11eb-adc1-0242ac120002", "7050bba1-1aed-454e-8f73-3f46f09ce56a", "744a188b-0415-4792-896f-11ddb0588dbc", "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "faa48cae-6b25-4f00-a094-08947fef582f", "70ad0861-d1fe-491c-a45f-fa48148a300d", "a16980c2-0c56-4de0-9a79-17971979efdd", "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "954f0af7-62dd-418f-b3df-a84bc2c7a774", "a7ee1722-c3c5-aeff-3212-c777e4733217", "1dde5376-a648-492e-9e54-4241dd9b0c7f", "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "10c14723-61c7-4c75-92ca-9af245723ad2", "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "41421f44-58f9-455d-838a-c398859841d4", "ae9b0bd7-8888-4606-b444-0ed7410cb728", "8de1cbe8-d6f5-496d-8237-5f44a721c7a0", "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "43103702-5886-11ed-9b6a-0242ac120002", "16905e21-66ee-42fe-b256-1318ada2d770", "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "a7c3d773-caef-227e-a7e7-c2f13c622329", "214641c2-c579-4ecb-8427-0cf19df6842e", "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "07aa184a-870d-413d-893a-157f317f6f58", "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "f548a603-c9f2-4c89-b511-b089f7e94549", "93199800-b52a-4dec-b762-75212c196542", "526be59f-a573-4eea-b5f7-f0973207634d", "6345b048-8441-43a7-9bed-541133633d7a", "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "25676e10-2121-446e-80a4-71ff8506af47", "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "ac1c92b4-ac81-405a-9978-4604d78cc47e", "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "bdeb2cff-af74-4094-8426-724dc937f20a", "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "a383dec4-deec-4e6e-913b-ed9249670848", "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "ac20ae82-8758-4f38-958e-b44a3140ca88", "54786ddc-5b8a-11ed-9b6a-0242ac120002", "41ca393d-538c-408a-ac27-cf1e038be80c", "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "cd71385d-fd9b-4691-9b98-2b1f7e508714", "c8a180d6-47a3-4345-a609-53f9c3d834fc", "044ba588-dff4-4918-9808-3f95e8160606", "1af57a4b-460a-4738-9034-db68b880c665", "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "1dd05363-104e-4b4a-b963-196a534b03a1", "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "84b1ecf9-6eff-4004-bafb-bae5c0e251b2", "204b17ae-4007-471b-917b-b917b315c5db", "50d66fb0-03f8-4da0-8add-84e77d12a020", "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "c2b86e67-b880-4eec-b045-50bc98ef4844", "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "e593cf51-88db-4ee1-b920-37e89012a3c9", "90d6bd71-dffb-4989-8d86-a827fedd6624", "8202070f-edeb-4d31-a010-a26c72ac5600", "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "3268b746-88d8-4cd3-bffc-30077d02c787", "18988e1b-9087-4f8a-82fe-0414dce49878", "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "f53714ec-5077-420e-ad20-907ff9bb2958", "f117933c-980c-4f78-b384-e3d838111165", "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "a29c1813-ab1f-4dde-b489-330b952e91ae", "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "b655a06a-31c0-477a-95c2-3726b83d649d", "21d856f9-9281-4ded-9377-51a1a6e2a432", "b66474aa-bd92-4333-a16c-298155b120df", "b2309017-4235-44fe-b5af-b15363011957", "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "62510e69-616b-4078-b371-847da438cc03", "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "285b85b1-a555-4095-8652-a8a4106af63f", "84f52741-8834-4a8c-a413-2eb2269aa6c8", "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "be344333-921d-4c4d-8bb8-e584cf584780", "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "fb843269-508c-4b76-8b8d-88679db22ce7", "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "de587dce-915e-4218-aac4-835ca6af6f70", "c7942406-33dd-4377-a564-0f62db0593a3", "ab9e3b40-0c85-4ba1-aede-455d226fd124", "ef61af62-bc74-4f58-b49b-626448227652", "a20391f8-76fb-437b-abc0-dba2df1952c6", "899133d5-4d7c-4a7f-94ee-27355c879d90", "1ac8666b-046f-4201-8aba-1951aaec03a3", "1c67a717-32ba-409b-a45d-0fb704a73a81", "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "eca49c87-8a75-4f13-9c73-a5a29e845f03", "435e10e4-992a-4281-96f3-38b11106adde", "b3512211-c67e-4707-bedc-66efc7848863", "c15a46a0-07d4-4c87-b4b6-89207835a83b", "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "1f0f6176-6482-4027-b151-00071af39d7e", "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "9257c05b-4a4a-48e5-a670-b7b073cf401b", "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "99793437-3e16-439b-be0f-078782cf953d", "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "ac175779-025a-4f12-98b0-acdaeb77ea85", "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "90d50722-0483-4065-8e35-57efaadd354d", "180c7c5c-d64b-4a63-86e9-68910451bc8b", "d55b793d-f847-4eea-b59a-5ab09908ac90", "aef9d1f1-7396-4e92-a927-4567c7a495c1", "6c6d9280-e6d0-4b9d-80ac-254701b64916", "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "9212f354-7775-4e28-9c9f-8f0a4544e664", "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "ffa6861c-4461-4f59-8a41-578c39f3f23e", "a0459f02-ac51-4c09-b511-b8c9203fc429", "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "534f2ef7-e8a2-4433-816d-c91bccde289b", "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "84232095-ecca-4015-b0d7-7726507ee793", "4e2ed651-1906-4a59-a78a-18220fca1b22", "96036718-71cc-4027-a538-d1587e0006a7", "60f16a96-db70-42eb-8f76-16763e333590", "5afee48e-67dd-4e03-a783-f74259dcf998", "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "771d1eb5-9587-4568-95fb-9ec44153a012", "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "e28a5a99-da44-436d-b7a0-2afc20a5f413", "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "68d37776-61db-42f5-bf54-27e87072d17e", "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "d2b749ee-4225-417e-b20e-a8d2193cbb84", "1193d960-2369-499f-a158-7b50a31df682", "6b65c28e-11f3-46cb-902a-68f2cafaf474", "242301bc-f92f-4476-8718-78004a6efd9f", "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "52d097e2-063e-4c9c-8fbb-855c8948d135", "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "647c7b9e-d784-4fda-b9a0-45c565a7b729", "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "bb76d96b-821c-47cf-944b-7ce377864492", "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "1816994b-42e1-4fb1-afd2-134d88184f71", "12827a56-61a4-476a-a9cb-f3068f191073", "32b96012-7892-429e-b26c-ac2bf46066ff", "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "f4bbd493-b796-416e-bbf2-121235348529", "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "d06be4b9-8045-428b-a567-740a26d9db25", "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "65c3ca2c-525f-4ced-968e-246a713d164f", "347906f3-e207-4d18-ae5b-a9403d6bcdef", "a29808fd-ef50-49ff-9c7a-59a9b040b404", "e66779cc-383e-4224-a3a4-267eeb585c40", "85c312b7-f44d-4a51-a024-d671c40b49fc", "6da2c9f5-7c53-401b-aacb-92c040ce1215", "6bd75993-9888-4f91-9404-e1e4e4e34b77", "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "ff992eac-6449-4c60-8c1d-91c9722a1d48", "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "208748f7-881d-47ac-a29c-07ea84bf691d", "89ca78fd-b37c-4310-b3d3-81a023f83936", "a2910908-e86f-4687-aeba-76a5f996e652", "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "9c14c9fa-1a63-4a64-8e57-d19280559490", "221b251a-357a-49a9-920a-271802777cc0", "50919691-7302-437f-8e10-1fe088afa145", "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "f14e169e-9978-4c69-acb3-1cff8200bc36", "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "1c8774a0-44d4-4db0-91f8-e792359c70bd", "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "9fc3072c-dc8f-4bf7-b231-18950000fadd", "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "ada4b0c4-758b-46ac-9033-9004613a150d", "584bca0f-3608-4402-80fd-4075ff6072e3", "9a132afa-654e-11eb-ae93-0242ac130002", "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "a70dcb37-3bee-453a-99df-d0c683151be6", "85b0b087-eddf-4a2b-b033-d771fa2b9775", "2267fe65-0681-42ad-9a6d-46553d3f3480", "28c8f68b-098d-45af-8d43-8089f3e35403", "cd8c163e-a19b-402e-bdd5-419ff5859f12", "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "2c28c248-7f50-417a-9186-a85b223010ee", "84972c80-251c-4c3a-9079-4f00aad93938", "434c08ba-8406-4d15-8b24-782cb071a691", "bed2a484-9348-4143-8a8a-b801c979301c", "a0d7e4d2-bede-4141-8896-bc6e237e977c", "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "1c526788-0abe-4713-862f-b520da5e5316", "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "9f107a84-532c-41af-b005-8d12a607639f", "455b9d50-15a1-4b99-853f-8d37655a4c1b", "dee0a7a3-f200-4112-a99b-952196d81e42", "79ce34ca-af29-4d0e-b832-fc1b377020db", "2afafd61-6aae-4df4-baed-139fa1f4c345", "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "f0507c0f-a3a2-40f5-acc6-7f543c334993", "970007b7-ce32-49d0-a4a4-fbef016950bd", "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "f4264e47-f522-4c38-a420-04525d5b880f", "b2ddd389-f676-4ac4-845a-e00781a48e5f", "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "4a6713f6-3331-11ed-a261-0242ac120002", "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "5cc2cda8-f261-4d88-a2de-e9e193c86716", "2d22a514-e024-4428-9dba-41505bd63a5b", "01c42d3c-242d-4655-85b2-34f1739632f7", "77946e79-97f1-45a2-84b4-f37b5c0d8682", "27ba3207-dd30-4812-abbf-5d20c57d474e", "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "1228c958-e64e-4e71-92ad-7d429f4138ba", "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "b1377339-fda6-477a-b455-ac0923f9ec2c", "44143844-0631-49ab-97a0-96387d6b2d7c", "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "85de1f22-d189-44e4-8239-dc276b45379b", "92626ddd-662c-49e3-ac59-f6535f12d189", "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "e56d3073-83ff-4021-90fe-c658e0709e72", "deb9b646-a508-44ee-b7c9-d8965921c6b6", "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "cea2b7ea-792b-405f-95a1-b903ea06458f", "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "730fc21b-eaff-474b-ad23-90fd265d4988", "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "48917adc-a28e-4f5d-b729-11e75da8941f", "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "0900463c-b33b-49a8-be1d-552a3b553dae", "82a6714f-4899-4f16-9c1e-9a333544d4c3", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "1e59c230-6670-45bf-83b0-98903780607e", "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "5687f942-867b-4578-ade7-1e341c46e99a", "258fc8ce-8352-443a-9120-8a11e4857fa5", "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "4ae81040-fc1c-4249-bfa3-938d260214d9", "aa2efee7-34dd-446e-8a37-40790a66efd7", "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "ae215552-081e-44c7-805f-be16f975c8a2", "30bf1789-379d-4fdc-900f-55cd0a90a801", "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "4f7a6757-ff79-46db-9687-66501a02d9ec", "129966c9-de17-4334-a123-8b58172e664d", "696bfb54-227e-4602-ac5b-30d9d2053312", "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "7df1713a-1a5b-4a4b-a071-dc83b144a101", "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "814c95cc-8192-4378-a70a-f1aafd877af1", "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "99c840f2-2012-46fd-9141-c761987550ef", "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "de16d92c-c446-4d53-8938-10aeef41c8b6", "056c7317-9a09-4bd4-9067-d051312752ea", "60fc936d-2eb0-4543-8a13-911c750a1dfc", "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "114de787-4eb2-48cc-abdb-c0b449f93ea4", "207b0396-3689-42d9-8399-4222658efc99", "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "9248c7e1-2bf3-4661-a22c-600a8040b446", "146aace8-9bd6-42ba-be7a-0070d8027b76", "3d7679bd-0c00-440c-97b0-3f204273e6c7", "ea011323-7045-460b-b2d7-0f7442ea6b38", "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "e290b10b-1023-4452-a4a9-eb31a9013b3a", "ca5583e9-8f80-46ac-ab91-7f314d13b984", "cd3d1298-eb3b-476c-ac67-12847de55813", "867356ee-9352-41c9-a8f2-1be690d78216", "67f113fa-e23d-4271-befa-30113b3e08b1", "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "62b20d44-1546-4e61-afce-8e175eb9473c", "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "b6676963-0353-4f88-90f5-36c20d443c6a", "99cf1e02-00fb-4c0d-8375-563f978dfd37", "903076ff-f442-475a-b667-4f246bcc203b", "a77c1610-fc73-4019-8e29-0f51efc04a51", "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "cea72823-df4d-4567-950c-0b579eaf0846", "74a2b202-73e0-4693-9a3a-9d36146d0775", "5fc297ae-25b6-488a-8f25-cc12ac29b744", "12f6b752-042d-483e-bf9c-915a6d06ad75", "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "c1d867fe-8d95-4487-aab4-e53f2d339f90", "e13f668e-7f95-443d-98d2-1816a7648a7b", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "9c8c7000-3065-44a8-a555-79bcba5d9955", "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "ee5e119b-1f75-4b34-add8-3be976961e39", "33339be3-148b-4e16-af56-ad16ec6c7e7b", "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "01d2e2a1-5f09-44f7-9fc1-24faa7479b6d", "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "646ea171-dded-4578-8a4d-65e9822892e3", "84b1706c-932a-44c4-ae28-892b28a25b94", "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "1012f107-b8f1-4271-af30-5aed2de89b39", "074e0ded-6ced-4ebd-8b4d-53f55908119d", "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "af491bca-e752-4b44-9c86-df5680533dbc", "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "f0f7be61-9cf5-43be-9836-99d6ef448a18", "b1f73849-6329-4069-bc8f-78a604bb8b23", "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "0b80ade5-6997-4b1d-99a1-71701778ea61", "81ebd28b-9607-4478-bf06-974ed9d53ed7", "dc4576d4-7467-424f-9eee-fd2b02855fe0", "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "e9142d84-fbe0-401d-ac50-3e519fb00c89", "b4dc61f5-6cce-468e-a608-b48b469feaa2", "e6313acd-208c-44fc-a0ff-db85d572e90e", "f3d39c45-de1a-4486-a687-ab126124f744", "97dbf6e2-e436-44d8-abee-4261b24d3e41", "729ce0ea-5d8f-4769-9762-e35de441586d", "0fc35fc3-efe6-4898-8a37-0b233339524f", "c947b146-0abc-4c87-9c64-b17e9d7274a2", "91a2c315-9ee6-4052-a853-6f6a8238f90d", "9525dc73-0327-438c-8c04-13c0e037e9da", "a4694263-59a8-4608-a3a0-6f8d3a51664c", "f37aba28-a9e6-4045-882c-d5004043b337", "5e95028c-5229-4214-afae-d653d573d0ec", "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "f7375e28-5c14-432f-b8d1-1db26c832df3", "0e0255bf-2548-47b8-9582-c0955c9283f5", "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "d65aee4d-2292-4cea-b832-83accd6cfa43", "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "889719ef-dd62-43df-86c3-768fb08dc7c0", "18ee686c-38a3-4f65-9f44-48a077141f42", "af77cf95-c469-471c-b6a0-946c685c4798", "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "4bf943c6-5146-4273-98dd-e958fd1e3abf", "7f741dcf-fc22-4759-87b4-9ae8376676a2", "8a3038e8-9c9d-46f8-b184-66234a160f6f", "7d4aaec2-08ed-4430-8b96-28420e030e04", "75d0a94e-6252-448d-a7be-d953dff527bb", "327f48c1-a6db-4eb8-875a-f6981f1b0183", "5f03babb-12db-4eec-8c82-7b4cb5580868", "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "cd1f961e-0b96-436b-b7c6-38da4583ec00", "7b4f794b-590a-4ad4-ba18-7964a2832205", "438025f9-5856-4663-83f7-52f878a70a50", "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "213d6a77-3d55-4ce8-ba74-fcfef741974e", "aaafa146-074c-11eb-adc1-0242ac120002", "2433a154-bb3d-42e4-86c3-a26bdac91c45", "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "4f647cfa-b598-4e12-ad69-c68dd16caef8", "16c37b52-b141-42a5-a3ea-bbe098444397", "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "17769c90-230e-488b-a463-e05c08e9d48f", "222129f7-f4dc-4568-b0d2-22440a9639ba", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "e173ad47-4388-4012-ae62-bd13f71c18a8", "48bbc537-b652-4b4e-bd1d-281172df448f", "1edff897-9146-48d2-9066-52e8d8f80a2f", "c248c896-e412-4279-8c15-1c558067b6fa", "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "2cf29f11-e356-4f61-98c0-1bdb9393d6da", "d522eca2-2973-4391-a3e0-ef0374321dae", "62e0298b-e994-4189-bc87-bc699aa62d97", "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "a537cfc3-4297-4789-92b5-345bfd845ad0", "74a12f18-505c-4114-8d0b-8448dd5485c6", "4a2a2c3e-209f-4d01-b513-4155a540b469", "32410e29-5f94-4568-b6a3-d91a8adad863", "f64e5c19-879c-4bae-b471-6d84c8339677", "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "536e2947-3729-478c-9903-745aaffe60d2", "40aa399c-7b02-4715-8e5f-73572b493f33", "883835a7-df45-43e4-bf1d-4268768afda4", "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "b57ba453-b384-4ab9-9f40-1038086b4e53", "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "3bad990e-4848-4a78-9530-b427d854aac0", "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "09576804-7a05-458e-a817-eb718ca91f54", "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "b0524451-19af-4efa-a46f-562a977f792e", "b96b2031-7c17-4473-afe7-a30ce714db29", "37c1333a-a0db-48be-b64b-7393b2386e3b", "81325ce1-be01-4250-944f-b4789644556f", "3abd6094-7027-475f-9630-8ab9be7b9725", "d9047477-0359-48c9-b8c7-792cedcdc9c4", "0a98a10c-685d-4ab0-bddc-b6bdd1d48458", "56d19cb4-6414-4769-9644-1ed35ffbb148", "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "5cdb711b-5740-4fb2-ba88-f7945027afac", "164eda96-11b2-430b-85ff-6a265c15bf32", "a58353df-af43-4753-bad0-cd83ef35eef5", "56321594-9087-49d9-bf10-524fe8479452"], "uberAgent 6.2": ["ec8c4047-fad9-416a-8c81-0f479353d7f6", "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "d13c43f0-f66b-4279-8b2c-5912077c1780", "d2451be2-b582-4e15-8701-4196ac180260", "f40017b3-cb2e-4335-ab5d-3babf679c1de", "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "f354eba5-623b-450f-b073-0b5b2773b6aa", "6414b5cd-b19d-447e-bb5e-9f03940b5784", "bdc64095-d59a-42a2-8588-71fd9c9d9abc", "1fbc0671-5596-4e17-8682-f020a0b995dc", "552b6b65-df37-4d3e-a258-f2fc4771ae54", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "4c21b805-4dd7-469f-b47d-7383a8fcb437", "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "4508a70e-97ef-4300-b62b-ff27992990ea", "857c8db3-c89b-42fb-882b-f681c7cf4da2", "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "3669afd2-9891-4534-a626-e5cf03810a61", "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "7417e29e-c2e7-4cf6-a2e8-767228c64837", "72ca7c75-bf85-45cd-aca7-255d360e423c", "060d5ad4-3153-47bb-8382-43e5e29eda92", "0e0bc253-07ed-43f1-816d-e1b220fe8971", "6e78b74f-c762-4800-82ad-f66787f10c8a", "84b0a8f3-680b-4096-a45b-e9a89221727c", "90ae0469-0cee-4509-b67f-e5efcef040f7", "bf9808c4-d24f-44a2-8398-b65227d406b6", "caa02837-f659-466f-bca6-48bde2826ab4", "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "4fc0deee-0057-4998-ab31-d24e46e0aba4", "e2e01011-5910-4267-9c3b-4149ed5479cf", "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "d2605a99-2218-4894-8fd3-2afb7946514d", "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "a2a3b925-7bb0-433b-b508-db9003263cc4", "68654bf0-4412-43d5-bfe8-5eaa393cd939", "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "952ed57c-8f99-453d-aee0-53a49c22f95d", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "75e508f7-932d-4ebc-af77-269237a84ce1", "8cde342c-ba48-4b74-b615-172c330f2e93", "ea5c131b-380d-49f9-aeb3-920694da4d4b", "a2edbce1-95c8-4291-8676-0d45146862b3", "844f8eb2-610b-42c8-89a4-47596e089663", "6360757a-d460-456c-8b13-74cf0e60cceb", "24b6cf51-6122-469e-861a-22974e9c1e5b", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "9ed5959a-c43c-4c59-84e3-d28628429456", "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "fef394cd-f44d-4040-9b18-95d92fe278c0", "48bfd177-7cf2-412b-ad77-baf923489e82", "2092cacb-d77b-4f98-ab0d-32b32f99a054", "ff0f2b05-09db-4095-b96d-1b75ca24894a", "49329257-089d-46e6-af37-4afce4290685", "7707a579-e0d8-4886-a853-ce47e4575aaa", "ee6cea48-c5b6-4304-a332-10fc6446f484", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "e76c8240-d68f-4773-8880-5c6f63595aaf", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "af4c4609-5755-42fe-8075-4effb49f5d44", "9ca2bf31-0570-44d8-a543-534c47c33ed7", "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "6ec86d9e-912e-4726-91a2-209359b999b9", "273a8dd8-3742-4302-bcc7-7df5a80fe425", "90217a70-13fc-48e4-b3db-0d836c5824ac", "3735d5ac-d770-4da0-99ff-156b180bc600", "948a0953-f287-4806-bbcb-3b2e396df89f", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "a1d9eec5-33b2-4177-8d24-27fe754d0812", "613c03ba-0779-4a53-8a1f-47f914a4ded3", "f356a9c4-effd-4608-bbf8-408afd5cd006", "df68f791-ad95-447f-a271-640a0dab9cf8", "e043f529-8514-4205-8ab0-7f7d2927b400", "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "065cceea-77ec-4030-9052-fc0affea7110", "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "36e037c4-c228-4866-b6a3-48eb292b9955", "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "9f2cc74d-78af-4eb2-bb64-9cd1d292b87b", "c3dbbc9f-ef1d-470a-a90a-d343448d5875", "edf3485d-dac4-4d50-90e4-b0e5813f7e60", "1d08ac94-400d-4469-a82f-daee9a908849", "7e9cf7b6-e827-11ed-a05b-15959c120003", "fa5b1358-b040-4403-9868-15f7d9ab6329", "e81528db-fc02-45e8-8e98-4e84aba1f10b", "a66bc059-c370-472c-a0d7-f8fd1bf9d583", "a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f", "77564cc2-7382-438b-a7f6-395c2ae53b9a", "f239b326-2f41-4d6b-9dfa-c846a60ef505", "caa06de8-fdef-4c91-826a-7f9e163eef4b", "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "2158f96f-43c2-43cb-952a-ab4580f32382", "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "d797268e-28a9-49a7-b9a8-2f5039011c5c", "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "f426547a-e0f7-441a-b63e-854ac5bdf54d", "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "6d3a3952-6530-44a3-8554-cf17c116c615", "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "a4824fca-976f-4964-b334-0621379e84c4", "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "92a974db-ab84-457f-9ec0-55db83d7a825", "f9578658-9e71-4711-b634-3f9b50cd3c06", "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "f5240972-3938-4e56-8e4b-e33893176c1f", "fff9d2b7-e11c-4a69-93d3-40ef66189767", "cc9d3712-6310-4320-b2df-7cb408274d53", "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "42a993dd-bb3e-48c8-b372-4d6684c4106c", "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "36210e0d-5b19-485d-a087-c096088885f0", "1723e720-616d-4ddc-ab02-f7e3685a4713", "90fb5e62-ca1f-4e22-b42e-cc521874c938", "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "57c4bf16-227f-4394-8ec7-1b745ee061c3", "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "0ea52357-cd59-4340-9981-c46c7e900428", "7aa7009a-28b9-4344-8c1f-159489a390df", "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "9719a8aa-401c-41af-8108-ced7ec9cd75c", "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "587254ee-a24b-4335-b3cd-065c0f1f4baa", "98b53e78-ebaf-46f8-be06-421aafd176d9", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "b5746143-59d6-4603-8d06-acbd60e166ee", "551d9c1f-816c-445b-a7a6-7a3864720d60", "e31033fc-33f0-4020-9a16-faf9b31cbf08", "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "8e3c7994-131e-4ba5-b6ea-804d49113a26", "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "e32d4572-9826-4738-b651-95fa63747e8a", "043c4b8b-3a54-4780-9682-081cb6b8185c", "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "c363385c-f75d-4753-a108-c1a8e28bdbda", "5cb299fc-5fb1-4d07-b989-0644c68b6043", "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "811f459f-9231-45d4-959a-0266c6311987", "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "7d6d30b8-5b91-4b90-a891-46cccaf29598", "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "087790e3-3287-436c-bccf-cbd0184a7db1", "6812a10b-60ea-420c-832f-dfcc33b646ba", "84b14121-9d14-416e-800b-f3b829c5a14d", "32e280f1-8ad4-46ef-9e80-910657611fbc", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "3f5491e2-8db8-496b-9e95-1029fce852d4", "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "02030f2f-6199-49ec-b258-ea71b07e03dc", "74403157-20f5-415d-89a7-c505779585cf", "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "4d7cda18-1b12-4e52-b45c-d28653210df8", "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "c9783e20-4793-4164-ba96-d9ee483992c4", "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "94771a71-ba41-4b6e-a757-b531372eaab6", "2f869d59-7f6a-4931-992c-cce556ff2d53", "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "1775e15e-b61b-4d14-a1a3-80981298085a", "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "42b1a5b8-353f-4f10-b256-39de4467faff", "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "9292293b-8496-4715-9db6-37028dcda4b3", "52788a70-f1da-40dd-8fbd-73b5865d6568", "349d891d-fef0-4fe4-bc53-eee623a15969", "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "6f3e2987-db24-4c78-a860-b4f4095a7095", "1ec65a5f-9473-4f12-97da-622044d6df21", "d042284c-a296-4988-9be5-f424fadcc28c", "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "1327381e-6ab0-4f38-b583-4c1b8346a56b", "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "9ec9fb1b-e059-4489-9642-f270c207923d", "058f4380-962d-40a5-afce-50207d36d7e2", "fe63010f-8823-4864-a96b-a7b4a0f7b929", "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "c86133ad-4725-4bd0-8170-210788e0a7ba", "f5d19838-41b5-476c-98d8-ba8af4929ee2", "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "82880171-b475-4201-b811-e9c826cd5eaa", "023c654f-8f16-44d9-bb2b-00ff36a62af9", "d557dc06-62e8-4468-a8e8-7984124908ce", "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "a642964e-bead-4bed-8910-1bb4d63e3b4d", "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "e4a6b256-3e47-40fc-89d2-7a477edd6915", "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "9fff585c-c33e-4a86-b3cd-39312079a65f", "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "fa00b701-44c6-4679-994d-5a18afa8a707", "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "313d6012-51a0-4d93-8dfc-de8553239e25", "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "8d63dadf-b91b-4187-87b6-34a1114577ea", "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "b36d01a3-ddaf-4804-be18-18a6247adfcd", "aaf46cdc-934e-4284-b329-34aa701e3771", "575dce0c-8139-4e30-9295-1ee75969f7fe", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "a1473adb-5338-4a20-b4c3-126763e2d3d3", "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "241e802a-b65e-484f-88cd-c2dc10f9206d", "fd877b94-9bb5-4191-bb25-d79cbd93c167", "d047726b-c71c-4048-a99b-2e2f50dc107d", "40b95d31-1afc-469e-8d34-9a3a667d058e", "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "e6c54d94-498c-4562-a37c-b469d8e9a275", "64760eef-87f7-4ed3-93fd-655668ea9420", "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "da2738f2-fadb-4394-afa7-0a0674885afa", "88872991-7445-4a22-90b2-a3adadb0e827", "f576a613-2392-4067-9d1a-9345fb58d8d1", "431a1fdb-4799-4f3b-91c3-a683b003fc49", "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "4931188c-178e-4ee7-a348-39e8a7a56821", "85ff530b-261d-48c6-a441-facaa2e81e48", "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "8cbc9475-8d05-4e27-9c32-df960716c701", "378a05d8-963c-46c9-bcce-13c7657eac99", "e8d34729-86a4-4140-adfd-0a29c2106307", "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "e568650b-5dcd-4658-8f34-ded0b1e13992", "f208d6d8-d83a-4c2c-960d-877c37da84e5", "514e4c3a-c77d-4cde-a00f-046425e2301e", "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "01aeb693-138d-49d2-9403-c4f52d7d3d62", "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "83865853-59aa-449e-9600-74b9d89a6d6e", "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "b53317a0-8acf-4fd1-8de8-a5401e776b96", "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "10344bb3-7f65-46c2-b915-2d00d47be5b0", "185d7418-f250-42d0-b72e-0c8b70661e93", "379fa130-190e-4c3f-b7bc-6c8e834485f3", "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "e83e8899-c9b2-483b-b355-5decc942b959", "6385697e-9f1b-40bd-8817-f4a91f40508e", "24357373-078f-44ed-9ac4-6d334a668a11", "15619216-e993-4721-b590-4c520615a67d", "d2eb17db-1d39-41dc-b57f-301f6512fa75", "5a6e1e16-07de-48d8-8aae-faa766c05e88", "5a3164f2-b373-4152-93cf-090b13c12d27", "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "5b768e71-86f2-4879-b448-81061cbae951", "ca621ba5-54ab-4035-9942-d378e6fcde3c", "98767d61-b2e8-4d71-b661-e36783ee24c1", "a85ffc3a-e8fd-4040-93bf-78aff284d801", "88f46b67-14d4-4f45-ac2c-d66984f22191", "83809e84-4475-4b69-bc3e-4aad8568612f", "ce72ef99-22f1-43d4-8695-419dcb5d9330", "add64136-62e5-48ea-807e-88638d02df1e", "04936b66-3915-43ad-a8e5-809eadfd1141", "847d5ff3-8a31-4737-a970-aeae8fe21765", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "c49c5062-0966-4170-9efd-9968c913a6cf", "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "850d55f9-6eeb-4492-ad69-a72338f65ba4", "d87bd452-6da1-456e-8155-7dc988157b7d", "5bb68627-3198-40ca-b458-49f973db8752", "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "caf201a9-c2ce-4a26-9c3a-2b9525413711", "4e762605-34a8-406d-b72e-c1a089313320", "d3c3861d-c504-4c77-ba55-224ba82d0118", "2ddef153-167b-4e89-86b6-757a9e65dcac", "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "8a582fe2-0882-4b89-a82a-da6b2dc32937", "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "f35c5d71-b489-4e22-a115-f003df287317", "fbd7c32d-db2a-4418-b92c-566eb8911133", "87a476dc-0079-4583-a985-dee7a20a03de", "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "38879043-7e1e-47a9-8d46-6bec88e201df", "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "f9999590-1f94-4a34-a91e-951e47bedefd", "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "4eddc365-79b4-43ff-a9d7-99422dc34b93", "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "220457c1-1c9f-4c2e-afe6-9598926222c1", "bf361876-6620-407a-812f-bfe11e51e924", "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "c79da740-5030-45ec-a2e0-479e824a562c", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "a197e378-d31b-41c0-9635-cfdf1c1bb423", "737e618a-a410-49b5-bec3-9e55ff7fbc15", "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "30edb182-aa75-42c0-b0a9-e998bb29067c", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "eb1c4225-1c23-4241-8dd4-051389fde4ce", "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "e312efd0-35a1-407f-8439-b8d434b438a6", "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "ba42babc-0666-4393-a4f7-ceaf5a69191e", "c27515df-97a9-4162-8a60-dc0eeb51b775", "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "0f6da907-5854-4be6-859a-e9958747b0aa", "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "5edc2273-c26f-406c-83f3-f4d948e740dd", "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "0f0450f3-8b47-441e-a31b-15a91dc243e2", "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "817f252c-5143-4dae-b418-48c3e9f63728", "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "07e3cb2c-0608-410d-be4b-1511cb1a0448", "138d3531-8793-4f50-a2cd-f291b2863d78", "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "ddeff553-5233-4ae9-bbab-d64d2bd634be", "e212d415-0e93-435f-9e1a-f29005bb4723", "55f0a3a1-846e-40eb-8273-677371b8d912", "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "6ba5a05f-b095-4f0a-8654-b825f4f16334", "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "45d3a03d-f441-458c-8883-df101a3bb146", "871b9555-69ca-4993-99d3-35a59f9f3599", "f2c64357-b1d2-41b7-849f-34d2682c0fad", "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "12fbff88-16b5-4b42-9754-cd001a789fb3", "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "0403d67d-6227-4ea8-8145-4e72db7da120", "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "bd1c6866-65fc-44b2-be51-5588fcff82b9", "1114e048-b69c-4f41-bc20-657245ae6e3f", "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "27aec9c9-dbb0-4939-8422-1742242471d0", "727454c0-d851-48b0-8b89-385611ab0704", "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "d20ee2f4-822c-4827-9e15-41500b1fff10", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "efec536f-72e8-4656-8960-5e85d091345b", "6f4191bb-912b-48a8-9ce7-682769541e6d", "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "517490a7-115a-48c6-8862-1a481504d5a8", "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "49d9671b-0a0a-4c09-8280-d215bfd30662", "05f3c945-dcc8-4393-9f3d-af65077a8f86", "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "554601fb-9b71-4bcc-abf4-21a611be4fde", "7b10f171-7f04-47c7-9fa2-5be43c76e535", "45239e6a-b035-4aaf-b339-8ad379fcb67e", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "7be5fb68-f9ef-476d-8b51-0256ebece19e", "6e22722b-dfb1-4508-a911-49ac840b40f8", "9ccba514-7cb6-4c5c-b377-700758f2f120", "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "7a74da6b-ea76-47db-92cc-874ad90df734", "f11f2808-adb4-46c0-802a-8660db50fa99", "43e32da2-fdd0-4156-90de-50dfd62636f9", "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "a20def93-0709-4eae-9bd2-31206e21e6b2", "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "6004abd0-afa4-4557-ba90-49d172e0a299", "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "970823b7-273b-460a-8afc-3a6811998529", "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "15b75071-74cc-47e0-b4c6-b43744a62a2b", "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "f99abdf0-6283-4e71-bd2b-b5c048a94743", "0a13e132-651d-11eb-ae93-0242ac130002", "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "e9f55347-2928-4c06-88e5-1a7f8169942e", "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "6a69f62d-ce75-4b57-8dce-6351eb55b362", "8b0e12da-d3c3-49db-bb4f-256703f380e5", "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "98a96a5a-64a0-4c42-92c5-489da3866cb0", "47e4bab7-c626-47dc-967b-255608c9a920", "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "40b19fa6-d835-400c-b301-41f3a2baacaf", "f44800ac-38ec-471f-936e-3fa7d9c53100", "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "24c8392b-aa3c-46b7-a545-43f71657fe98", "88f680b8-070e-402c-ae11-d2914f2257f1", "15434e33-5027-4914-88d5-3d4145ec25a9", "b98d0db6-511d-45de-ad02-e82a98729620", "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "0bbc6369-43e3-453d-9944-cae58821c173", "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "b7966f4a-b333-455b-8370-8ca53c229762", "43fa5350-db63-4b8f-9a01-789a427074e1", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "ec290c06-9b6b-4338-8b6b-095c0f284f10", "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "d4498716-1d52-438f-8084-4a603157d131", "b222df08-0e07-11eb-adc1-0242ac120002", "e1693bc8-7168-4eab-8718-cdcaa68a1738", "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "d3b70aad-097e-409c-9df2-450f80dc476b", "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "312d0384-401c-4b8b-abdf-685ffba9a332", "cc368ed0-2411-45dc-a222-510ace303cb2", "42333b2c-b425-441c-b70e-99404a17170f", "0e4164da-94bc-450d-a7be-a4b176179f1f", "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "ebef4391-1a81-4761-a40a-1db446c0e625", "f26307d8-14cd-47e3-a26b-4b4769f24af6", "03cc0c25-389f-4bf8-b48d-11878079f1ca", "8834e2f7-6b4b-4f09-8906-d2276470ee23", "7090adee-82e2-4269-bd59-80691e7c6338", "c74c0390-3e20-41fd-a69a-128f0275a5ea", "b6457d63-d2a2-4e29-859d-4e7affc153d1", "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "5f6a601c-2ecb-498b-9c33-660362323afa", "aa8e035d-7be4-48d3-a944-102aec04400d", "b243b280-65fe-48df-ba07-6ddea7646427", "236d8e89-ed95-4789-a982-36f4643738ba", "277a4393-446c-449a-b0ed-7fdc7795244c", "4fe074b4-b833-4081-8f24-7dcfeca72b42", "68bcd73b-37ef-49cb-95fc-edc809730be6", "86588b36-c6d3-465f-9cee-8f9093e07798", "502b42de-4306-40b4-9596-6f590c81f073", "0a99eb3e-1617-41bd-b095-13dc767f3def", "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "07f8bdc2-c9b3-472a-9817-5a670b872f53", "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "28ac00d6-22d9-4a3c-927f-bbd770104573", "452bce90-6fb0-43cc-97a5-affc283139b3", "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "ce7cf472-6fcc-490a-9481-3786840b5d9b", "c6fb44c6-71f5-49e6-9462-1425d328aee3", "9c0295ce-d60d-40bd-bd74-84673b7592b1", "0a4f6091-223b-41f6-8743-f322ec84930b", "98c5aeef-32d5-492f-b174-64a691896d25", "6fe4aa1e-0531-4510-8be2-782154b73b48", "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "d78b5d61-187d-44b6-bf02-93486a80de5a", "e9b61244-893f-427c-b287-3e708f321c6b", "70bc5215-526f-4477-963c-a47a5c9ebd12", "b6e04788-29e1-4557-bb14-77f761848ab8", "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "0685b176-c816-4837-8e7b-1216f346636b", "e84d89c4-f544-41ca-a6af-4b92fd38b023", "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "023394c4-29d5-46ab-92b8-6a534c6f447b", "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "ebea773c-a8f1-42ad-a856-00cb221966e8", "0b7163dc-7eee-4960-af17-c0cd517f92da", "98dedfdd-8333-49d4-9f23-d7018cccae53", "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "f24bcaea-0cd1-11eb-adc1-0242ac120002", "ccb5742c-c248-4982-8c5c-5571b9275ad3", "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "4abc0ec4-db5a-412f-9632-26659cddf145", "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "5cddf373-ef00-4112-ad72-960ac29bac34", "37db85d1-b089-490a-a59a-c7b6f984f480", "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "f1edd233-30b5-4823-9e6a-c4171b24d316", "e92a4287-e072-4a40-9739-370c106bb750", "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "8bc64091-6875-4881-aaf9-7bd25b5dda08", "56c217c3-2de2-479b-990f-5c109ba8458f", "eee00933-a761-4cd0-be70-c42fe91731e7", "bab049ca-7471-4828-9024-38279a4c04da", "d7654f02-e04b-4934-9838-65c46f187ebc", "2a072a96-a086-49fa-bcb5-15cc5a619093", "883faa95-175a-4e22-8181-e5761aeb373c", "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "63d1ccc0-2a43-4f4b-9289-361b308991ff", "4f154fb6-27d1-4813-a759-78b93e0b9c48", "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "33be4333-2c6b-44f4-ae28-102cdbde0a31", "395907ee-96e5-4666-af2e-2ca91688e151", "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "b0ce780f-10bd-496d-9067-066d23dc3aa5", "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "79b06761-465f-4f88-9ef2-150e24d3d737", "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "c615d676-f655-46b9-b913-78729021e5d7", "b19146a3-25d4-41b4-928b-1e2a92641b1b", "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "e6474a1b-5390-49cd-ab41-8d88655f7394", "692f0bec-83ba-4d04-af7e-e884a96059b6", "93671f99-04eb-4ab4-a161-70d446a84003", "0d5675be-bc88-4172-86d3-1e96a4476536", "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "4281cb20-2994-4580-aa63-c8b86d019934", "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "a34f79a3-8e5f-4cc3-b765-de00695452c2", "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "5589ab4f-a767-433c-961d-c91f3f704db1", "e8a95b5e-c891-46e2-b33a-93937d3abc31", "c86500e9-a645-4680-98d7-f882c70c1ea3", "58f50261-c53b-4c88-bd12-1d71f12eda4c", "34ebb878-1b15-4895-b352-ca2eeb99b274", "7a02e22e-b885-4404-b38b-1ddc7e65258a", "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "24de4f3b-804c-4165-b442-5a06a2302c7e", "731231b9-0b5d-4219-94dd-abb6959aa7ea", "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "d7bcd677-645d-4691-a8d4-7a5602b780d1", "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "6e897651-f157-4d8f-aaeb-df8151488385", "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "9847f263-4a81-424f-970c-875dab15b79b", "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "4b046706-5789-4673-b111-66f25fe99534", "73bba97f-a82d-42ce-b315-9182e76c57b1", "646bc99f-6682-4b47-a73a-17b1b64c9d34", "6c96fc76-0eb1-11eb-adc1-0242ac120002", "7050bba1-1aed-454e-8f73-3f46f09ce56a", "744a188b-0415-4792-896f-11ddb0588dbc", "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "faa48cae-6b25-4f00-a094-08947fef582f", "70ad0861-d1fe-491c-a45f-fa48148a300d", "a16980c2-0c56-4de0-9a79-17971979efdd", "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "954f0af7-62dd-418f-b3df-a84bc2c7a774", "a7ee1722-c3c5-aeff-3212-c777e4733217", "1dde5376-a648-492e-9e54-4241dd9b0c7f", "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "10c14723-61c7-4c75-92ca-9af245723ad2", "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "41421f44-58f9-455d-838a-c398859841d4", "ae9b0bd7-8888-4606-b444-0ed7410cb728", "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "43103702-5886-11ed-9b6a-0242ac120002", "16905e21-66ee-42fe-b256-1318ada2d770", "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "a7c3d773-caef-227e-a7e7-c2f13c622329", "214641c2-c579-4ecb-8427-0cf19df6842e", "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "07aa184a-870d-413d-893a-157f317f6f58", "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "f548a603-c9f2-4c89-b511-b089f7e94549", "93199800-b52a-4dec-b762-75212c196542", "526be59f-a573-4eea-b5f7-f0973207634d", "6345b048-8441-43a7-9bed-541133633d7a", "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "25676e10-2121-446e-80a4-71ff8506af47", "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "ac1c92b4-ac81-405a-9978-4604d78cc47e", "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "bdeb2cff-af74-4094-8426-724dc937f20a", "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "a383dec4-deec-4e6e-913b-ed9249670848", "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "ac20ae82-8758-4f38-958e-b44a3140ca88", "54786ddc-5b8a-11ed-9b6a-0242ac120002", "41ca393d-538c-408a-ac27-cf1e038be80c", "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "cd71385d-fd9b-4691-9b98-2b1f7e508714", "c8a180d6-47a3-4345-a609-53f9c3d834fc", "044ba588-dff4-4918-9808-3f95e8160606", "1af57a4b-460a-4738-9034-db68b880c665", "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "1dd05363-104e-4b4a-b963-196a534b03a1", "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "204b17ae-4007-471b-917b-b917b315c5db", "50d66fb0-03f8-4da0-8add-84e77d12a020", "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "c2b86e67-b880-4eec-b045-50bc98ef4844", "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "e593cf51-88db-4ee1-b920-37e89012a3c9", "8202070f-edeb-4d31-a010-a26c72ac5600", "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "3268b746-88d8-4cd3-bffc-30077d02c787", "18988e1b-9087-4f8a-82fe-0414dce49878", "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "f53714ec-5077-420e-ad20-907ff9bb2958", "f117933c-980c-4f78-b384-e3d838111165", "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "a29c1813-ab1f-4dde-b489-330b952e91ae", "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "b655a06a-31c0-477a-95c2-3726b83d649d", "21d856f9-9281-4ded-9377-51a1a6e2a432", "b66474aa-bd92-4333-a16c-298155b120df", "b2309017-4235-44fe-b5af-b15363011957", "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "62510e69-616b-4078-b371-847da438cc03", "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "285b85b1-a555-4095-8652-a8a4106af63f", "84f52741-8834-4a8c-a413-2eb2269aa6c8", "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "be344333-921d-4c4d-8bb8-e584cf584780", "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "fb843269-508c-4b76-8b8d-88679db22ce7", "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "de587dce-915e-4218-aac4-835ca6af6f70", "c7942406-33dd-4377-a564-0f62db0593a3", "ab9e3b40-0c85-4ba1-aede-455d226fd124", "ef61af62-bc74-4f58-b49b-626448227652", "a20391f8-76fb-437b-abc0-dba2df1952c6", "899133d5-4d7c-4a7f-94ee-27355c879d90", "1ac8666b-046f-4201-8aba-1951aaec03a3", "1c67a717-32ba-409b-a45d-0fb704a73a81", "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "eca49c87-8a75-4f13-9c73-a5a29e845f03", "435e10e4-992a-4281-96f3-38b11106adde", "b3512211-c67e-4707-bedc-66efc7848863", "c15a46a0-07d4-4c87-b4b6-89207835a83b", "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "1f0f6176-6482-4027-b151-00071af39d7e", "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "9257c05b-4a4a-48e5-a670-b7b073cf401b", "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "99793437-3e16-439b-be0f-078782cf953d", "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "ac175779-025a-4f12-98b0-acdaeb77ea85", "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "90d50722-0483-4065-8e35-57efaadd354d", "180c7c5c-d64b-4a63-86e9-68910451bc8b", "d55b793d-f847-4eea-b59a-5ab09908ac90", "aef9d1f1-7396-4e92-a927-4567c7a495c1", "6c6d9280-e6d0-4b9d-80ac-254701b64916", "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "9212f354-7775-4e28-9c9f-8f0a4544e664", "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "ffa6861c-4461-4f59-8a41-578c39f3f23e", "a0459f02-ac51-4c09-b511-b8c9203fc429", "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "534f2ef7-e8a2-4433-816d-c91bccde289b", "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "84232095-ecca-4015-b0d7-7726507ee793", "4e2ed651-1906-4a59-a78a-18220fca1b22", "60f16a96-db70-42eb-8f76-16763e333590", "5afee48e-67dd-4e03-a783-f74259dcf998", "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "771d1eb5-9587-4568-95fb-9ec44153a012", "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "e28a5a99-da44-436d-b7a0-2afc20a5f413", "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "68d37776-61db-42f5-bf54-27e87072d17e", "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "d2b749ee-4225-417e-b20e-a8d2193cbb84", "1193d960-2369-499f-a158-7b50a31df682", "6b65c28e-11f3-46cb-902a-68f2cafaf474", "242301bc-f92f-4476-8718-78004a6efd9f", "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "52d097e2-063e-4c9c-8fbb-855c8948d135", "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "647c7b9e-d784-4fda-b9a0-45c565a7b729", "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "bb76d96b-821c-47cf-944b-7ce377864492", "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "1816994b-42e1-4fb1-afd2-134d88184f71", "12827a56-61a4-476a-a9cb-f3068f191073", "32b96012-7892-429e-b26c-ac2bf46066ff", "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "f4bbd493-b796-416e-bbf2-121235348529", "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "d06be4b9-8045-428b-a567-740a26d9db25", "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "65c3ca2c-525f-4ced-968e-246a713d164f", "347906f3-e207-4d18-ae5b-a9403d6bcdef", "a29808fd-ef50-49ff-9c7a-59a9b040b404", "e66779cc-383e-4224-a3a4-267eeb585c40", "85c312b7-f44d-4a51-a024-d671c40b49fc", "6da2c9f5-7c53-401b-aacb-92c040ce1215", "6bd75993-9888-4f91-9404-e1e4e4e34b77", "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "ff992eac-6449-4c60-8c1d-91c9722a1d48", "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "208748f7-881d-47ac-a29c-07ea84bf691d", "89ca78fd-b37c-4310-b3d3-81a023f83936", "a2910908-e86f-4687-aeba-76a5f996e652", "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "9c14c9fa-1a63-4a64-8e57-d19280559490", "221b251a-357a-49a9-920a-271802777cc0", "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "f14e169e-9978-4c69-acb3-1cff8200bc36", "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "1c8774a0-44d4-4db0-91f8-e792359c70bd", "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "9fc3072c-dc8f-4bf7-b231-18950000fadd", "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "ada4b0c4-758b-46ac-9033-9004613a150d", "584bca0f-3608-4402-80fd-4075ff6072e3", "9a132afa-654e-11eb-ae93-0242ac130002", "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "a70dcb37-3bee-453a-99df-d0c683151be6", "85b0b087-eddf-4a2b-b033-d771fa2b9775", "2267fe65-0681-42ad-9a6d-46553d3f3480", "28c8f68b-098d-45af-8d43-8089f3e35403", "cd8c163e-a19b-402e-bdd5-419ff5859f12", "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "2c28c248-7f50-417a-9186-a85b223010ee", "84972c80-251c-4c3a-9079-4f00aad93938", "434c08ba-8406-4d15-8b24-782cb071a691", "bed2a484-9348-4143-8a8a-b801c979301c", "a0d7e4d2-bede-4141-8896-bc6e237e977c", "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "1c526788-0abe-4713-862f-b520da5e5316", "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "9f107a84-532c-41af-b005-8d12a607639f", "455b9d50-15a1-4b99-853f-8d37655a4c1b", "dee0a7a3-f200-4112-a99b-952196d81e42", "79ce34ca-af29-4d0e-b832-fc1b377020db", "2afafd61-6aae-4df4-baed-139fa1f4c345", "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "f0507c0f-a3a2-40f5-acc6-7f543c334993", "970007b7-ce32-49d0-a4a4-fbef016950bd", "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "f4264e47-f522-4c38-a420-04525d5b880f", "b2ddd389-f676-4ac4-845a-e00781a48e5f", "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "4a6713f6-3331-11ed-a261-0242ac120002", "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "5cc2cda8-f261-4d88-a2de-e9e193c86716", "01c42d3c-242d-4655-85b2-34f1739632f7", "77946e79-97f1-45a2-84b4-f37b5c0d8682", "27ba3207-dd30-4812-abbf-5d20c57d474e", "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "1228c958-e64e-4e71-92ad-7d429f4138ba", "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "b1377339-fda6-477a-b455-ac0923f9ec2c", "44143844-0631-49ab-97a0-96387d6b2d7c", "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "85de1f22-d189-44e4-8239-dc276b45379b", "92626ddd-662c-49e3-ac59-f6535f12d189", "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "e56d3073-83ff-4021-90fe-c658e0709e72", "deb9b646-a508-44ee-b7c9-d8965921c6b6", "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "cea2b7ea-792b-405f-95a1-b903ea06458f", "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "730fc21b-eaff-474b-ad23-90fd265d4988", "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "48917adc-a28e-4f5d-b729-11e75da8941f", "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "0900463c-b33b-49a8-be1d-552a3b553dae", "82a6714f-4899-4f16-9c1e-9a333544d4c3", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "1e59c230-6670-45bf-83b0-98903780607e", "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "258fc8ce-8352-443a-9120-8a11e4857fa5", "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "4ae81040-fc1c-4249-bfa3-938d260214d9", "aa2efee7-34dd-446e-8a37-40790a66efd7", "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "ae215552-081e-44c7-805f-be16f975c8a2", "30bf1789-379d-4fdc-900f-55cd0a90a801", "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "4f7a6757-ff79-46db-9687-66501a02d9ec", "129966c9-de17-4334-a123-8b58172e664d", "696bfb54-227e-4602-ac5b-30d9d2053312", "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "7df1713a-1a5b-4a4b-a071-dc83b144a101", "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "814c95cc-8192-4378-a70a-f1aafd877af1", "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "99c840f2-2012-46fd-9141-c761987550ef", "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "de16d92c-c446-4d53-8938-10aeef41c8b6", "056c7317-9a09-4bd4-9067-d051312752ea", "60fc936d-2eb0-4543-8a13-911c750a1dfc", "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "114de787-4eb2-48cc-abdb-c0b449f93ea4", "207b0396-3689-42d9-8399-4222658efc99", "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "9248c7e1-2bf3-4661-a22c-600a8040b446", "146aace8-9bd6-42ba-be7a-0070d8027b76", "3d7679bd-0c00-440c-97b0-3f204273e6c7", "ea011323-7045-460b-b2d7-0f7442ea6b38", "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "e290b10b-1023-4452-a4a9-eb31a9013b3a", "ca5583e9-8f80-46ac-ab91-7f314d13b984", "cd3d1298-eb3b-476c-ac67-12847de55813", "867356ee-9352-41c9-a8f2-1be690d78216", "67f113fa-e23d-4271-befa-30113b3e08b1", "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "62b20d44-1546-4e61-afce-8e175eb9473c", "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "b6676963-0353-4f88-90f5-36c20d443c6a", "99cf1e02-00fb-4c0d-8375-563f978dfd37", "903076ff-f442-475a-b667-4f246bcc203b", "a77c1610-fc73-4019-8e29-0f51efc04a51", "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "cea72823-df4d-4567-950c-0b579eaf0846", "74a2b202-73e0-4693-9a3a-9d36146d0775", "5fc297ae-25b6-488a-8f25-cc12ac29b744", "12f6b752-042d-483e-bf9c-915a6d06ad75", "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "c1d867fe-8d95-4487-aab4-e53f2d339f90", "e13f668e-7f95-443d-98d2-1816a7648a7b", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "9c8c7000-3065-44a8-a555-79bcba5d9955", "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "ee5e119b-1f75-4b34-add8-3be976961e39", "33339be3-148b-4e16-af56-ad16ec6c7e7b", "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "646ea171-dded-4578-8a4d-65e9822892e3", "84b1706c-932a-44c4-ae28-892b28a25b94", "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "074e0ded-6ced-4ebd-8b4d-53f55908119d", "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "af491bca-e752-4b44-9c86-df5680533dbc", "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "f0f7be61-9cf5-43be-9836-99d6ef448a18", "b1f73849-6329-4069-bc8f-78a604bb8b23", "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "0b80ade5-6997-4b1d-99a1-71701778ea61", "81ebd28b-9607-4478-bf06-974ed9d53ed7", "dc4576d4-7467-424f-9eee-fd2b02855fe0", "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "e9142d84-fbe0-401d-ac50-3e519fb00c89", "b4dc61f5-6cce-468e-a608-b48b469feaa2", "e6313acd-208c-44fc-a0ff-db85d572e90e", "f3d39c45-de1a-4486-a687-ab126124f744", "97dbf6e2-e436-44d8-abee-4261b24d3e41", "729ce0ea-5d8f-4769-9762-e35de441586d", "0fc35fc3-efe6-4898-8a37-0b233339524f", "c947b146-0abc-4c87-9c64-b17e9d7274a2", "91a2c315-9ee6-4052-a853-6f6a8238f90d", "9525dc73-0327-438c-8c04-13c0e037e9da", "a4694263-59a8-4608-a3a0-6f8d3a51664c", "f37aba28-a9e6-4045-882c-d5004043b337", "5e95028c-5229-4214-afae-d653d573d0ec", "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "f7375e28-5c14-432f-b8d1-1db26c832df3", "0e0255bf-2548-47b8-9582-c0955c9283f5", "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "889719ef-dd62-43df-86c3-768fb08dc7c0", "af77cf95-c469-471c-b6a0-946c685c4798", "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "4bf943c6-5146-4273-98dd-e958fd1e3abf", "7f741dcf-fc22-4759-87b4-9ae8376676a2", "8a3038e8-9c9d-46f8-b184-66234a160f6f", "7d4aaec2-08ed-4430-8b96-28420e030e04", "75d0a94e-6252-448d-a7be-d953dff527bb", "327f48c1-a6db-4eb8-875a-f6981f1b0183", "5f03babb-12db-4eec-8c82-7b4cb5580868", "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "cd1f961e-0b96-436b-b7c6-38da4583ec00", "7b4f794b-590a-4ad4-ba18-7964a2832205", "438025f9-5856-4663-83f7-52f878a70a50", "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "213d6a77-3d55-4ce8-ba74-fcfef741974e", "aaafa146-074c-11eb-adc1-0242ac120002", "2433a154-bb3d-42e4-86c3-a26bdac91c45", "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "4f647cfa-b598-4e12-ad69-c68dd16caef8", "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "17769c90-230e-488b-a463-e05c08e9d48f", "222129f7-f4dc-4568-b0d2-22440a9639ba", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "e173ad47-4388-4012-ae62-bd13f71c18a8", "48bbc537-b652-4b4e-bd1d-281172df448f", "1edff897-9146-48d2-9066-52e8d8f80a2f", "c248c896-e412-4279-8c15-1c558067b6fa", "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "d522eca2-2973-4391-a3e0-ef0374321dae", "62e0298b-e994-4189-bc87-bc699aa62d97", "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "a537cfc3-4297-4789-92b5-345bfd845ad0", "74a12f18-505c-4114-8d0b-8448dd5485c6", "4a2a2c3e-209f-4d01-b513-4155a540b469", "32410e29-5f94-4568-b6a3-d91a8adad863", "f64e5c19-879c-4bae-b471-6d84c8339677", "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "536e2947-3729-478c-9903-745aaffe60d2", "40aa399c-7b02-4715-8e5f-73572b493f33", "883835a7-df45-43e4-bf1d-4268768afda4", "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "b57ba453-b384-4ab9-9f40-1038086b4e53", "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "3bad990e-4848-4a78-9530-b427d854aac0", "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "09576804-7a05-458e-a817-eb718ca91f54", "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "b0524451-19af-4efa-a46f-562a977f792e", "b96b2031-7c17-4473-afe7-a30ce714db29", "37c1333a-a0db-48be-b64b-7393b2386e3b", "81325ce1-be01-4250-944f-b4789644556f", "3abd6094-7027-475f-9630-8ab9be7b9725", "d9047477-0359-48c9-b8c7-792cedcdc9c4", "56d19cb4-6414-4769-9644-1ed35ffbb148", "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "5cdb711b-5740-4fb2-ba88-f7945027afac", "164eda96-11b2-430b-85ff-6a265c15bf32", "a58353df-af43-4753-bad0-cd83ef35eef5", "56321594-9087-49d9-bf10-524fe8479452"], "uberAgent 6.1": ["ec8c4047-fad9-416a-8c81-0f479353d7f6", "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "d13c43f0-f66b-4279-8b2c-5912077c1780", "d2451be2-b582-4e15-8701-4196ac180260", "f40017b3-cb2e-4335-ab5d-3babf679c1de", "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "f354eba5-623b-450f-b073-0b5b2773b6aa", "6414b5cd-b19d-447e-bb5e-9f03940b5784", "bdc64095-d59a-42a2-8588-71fd9c9d9abc", "1fbc0671-5596-4e17-8682-f020a0b995dc", "552b6b65-df37-4d3e-a258-f2fc4771ae54", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "4c21b805-4dd7-469f-b47d-7383a8fcb437", "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "4508a70e-97ef-4300-b62b-ff27992990ea", "857c8db3-c89b-42fb-882b-f681c7cf4da2", "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "3669afd2-9891-4534-a626-e5cf03810a61", "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "7417e29e-c2e7-4cf6-a2e8-767228c64837", "72ca7c75-bf85-45cd-aca7-255d360e423c", "060d5ad4-3153-47bb-8382-43e5e29eda92", "0e0bc253-07ed-43f1-816d-e1b220fe8971", "6e78b74f-c762-4800-82ad-f66787f10c8a", "84b0a8f3-680b-4096-a45b-e9a89221727c", "90ae0469-0cee-4509-b67f-e5efcef040f7", "bf9808c4-d24f-44a2-8398-b65227d406b6", "caa02837-f659-466f-bca6-48bde2826ab4", "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "4fc0deee-0057-4998-ab31-d24e46e0aba4", "e2e01011-5910-4267-9c3b-4149ed5479cf", "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "d2605a99-2218-4894-8fd3-2afb7946514d", "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "a2a3b925-7bb0-433b-b508-db9003263cc4", "68654bf0-4412-43d5-bfe8-5eaa393cd939", "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "952ed57c-8f99-453d-aee0-53a49c22f95d", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "75e508f7-932d-4ebc-af77-269237a84ce1", "ea5c131b-380d-49f9-aeb3-920694da4d4b", "a2edbce1-95c8-4291-8676-0d45146862b3", "844f8eb2-610b-42c8-89a4-47596e089663", "6360757a-d460-456c-8b13-74cf0e60cceb", "24b6cf51-6122-469e-861a-22974e9c1e5b", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "9ed5959a-c43c-4c59-84e3-d28628429456", "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "fef394cd-f44d-4040-9b18-95d92fe278c0", "48bfd177-7cf2-412b-ad77-baf923489e82", "2092cacb-d77b-4f98-ab0d-32b32f99a054", "ff0f2b05-09db-4095-b96d-1b75ca24894a", "7707a579-e0d8-4886-a853-ce47e4575aaa", "ee6cea48-c5b6-4304-a332-10fc6446f484", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "e76c8240-d68f-4773-8880-5c6f63595aaf", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "af4c4609-5755-42fe-8075-4effb49f5d44", "9ca2bf31-0570-44d8-a543-534c47c33ed7", "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "6ec86d9e-912e-4726-91a2-209359b999b9", "273a8dd8-3742-4302-bcc7-7df5a80fe425", "90217a70-13fc-48e4-b3db-0d836c5824ac", "3735d5ac-d770-4da0-99ff-156b180bc600", "948a0953-f287-4806-bbcb-3b2e396df89f", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "a1d9eec5-33b2-4177-8d24-27fe754d0812", "613c03ba-0779-4a53-8a1f-47f914a4ded3", "f356a9c4-effd-4608-bbf8-408afd5cd006", "df68f791-ad95-447f-a271-640a0dab9cf8", "e043f529-8514-4205-8ab0-7f7d2927b400", "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "065cceea-77ec-4030-9052-fc0affea7110", "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "36e037c4-c228-4866-b6a3-48eb292b9955", "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "caa06de8-fdef-4c91-826a-7f9e163eef4b", "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "2158f96f-43c2-43cb-952a-ab4580f32382", "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "d797268e-28a9-49a7-b9a8-2f5039011c5c", "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "f426547a-e0f7-441a-b63e-854ac5bdf54d", "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "6d3a3952-6530-44a3-8554-cf17c116c615", "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "a4824fca-976f-4964-b334-0621379e84c4", "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "92a974db-ab84-457f-9ec0-55db83d7a825", "f9578658-9e71-4711-b634-3f9b50cd3c06", "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "f5240972-3938-4e56-8e4b-e33893176c1f", "fff9d2b7-e11c-4a69-93d3-40ef66189767", "cc9d3712-6310-4320-b2df-7cb408274d53", "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "42a993dd-bb3e-48c8-b372-4d6684c4106c", "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "36210e0d-5b19-485d-a087-c096088885f0", "1723e720-616d-4ddc-ab02-f7e3685a4713", "90fb5e62-ca1f-4e22-b42e-cc521874c938", "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "57c4bf16-227f-4394-8ec7-1b745ee061c3", "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "0ea52357-cd59-4340-9981-c46c7e900428", "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "9719a8aa-401c-41af-8108-ced7ec9cd75c", "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "587254ee-a24b-4335-b3cd-065c0f1f4baa", "98b53e78-ebaf-46f8-be06-421aafd176d9", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "b5746143-59d6-4603-8d06-acbd60e166ee", "551d9c1f-816c-445b-a7a6-7a3864720d60", "e31033fc-33f0-4020-9a16-faf9b31cbf08", "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "8e3c7994-131e-4ba5-b6ea-804d49113a26", "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "e32d4572-9826-4738-b651-95fa63747e8a", "043c4b8b-3a54-4780-9682-081cb6b8185c", "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "c363385c-f75d-4753-a108-c1a8e28bdbda", "5cb299fc-5fb1-4d07-b989-0644c68b6043", "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "811f459f-9231-45d4-959a-0266c6311987", "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "7d6d30b8-5b91-4b90-a891-46cccaf29598", "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "087790e3-3287-436c-bccf-cbd0184a7db1", "6812a10b-60ea-420c-832f-dfcc33b646ba", "84b14121-9d14-416e-800b-f3b829c5a14d", "32e280f1-8ad4-46ef-9e80-910657611fbc", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "3f5491e2-8db8-496b-9e95-1029fce852d4", "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "02030f2f-6199-49ec-b258-ea71b07e03dc", "74403157-20f5-415d-89a7-c505779585cf", "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "4d7cda18-1b12-4e52-b45c-d28653210df8", "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "c9783e20-4793-4164-ba96-d9ee483992c4", "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "94771a71-ba41-4b6e-a757-b531372eaab6", "2f869d59-7f6a-4931-992c-cce556ff2d53", "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "1775e15e-b61b-4d14-a1a3-80981298085a", "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "42b1a5b8-353f-4f10-b256-39de4467faff", "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "9292293b-8496-4715-9db6-37028dcda4b3", "52788a70-f1da-40dd-8fbd-73b5865d6568", "349d891d-fef0-4fe4-bc53-eee623a15969", "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "6f3e2987-db24-4c78-a860-b4f4095a7095", "1ec65a5f-9473-4f12-97da-622044d6df21", "d042284c-a296-4988-9be5-f424fadcc28c", "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "1327381e-6ab0-4f38-b583-4c1b8346a56b", "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "9ec9fb1b-e059-4489-9642-f270c207923d", "058f4380-962d-40a5-afce-50207d36d7e2", "fe63010f-8823-4864-a96b-a7b4a0f7b929", "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "c86133ad-4725-4bd0-8170-210788e0a7ba", "f5d19838-41b5-476c-98d8-ba8af4929ee2", "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "82880171-b475-4201-b811-e9c826cd5eaa", "023c654f-8f16-44d9-bb2b-00ff36a62af9", "d557dc06-62e8-4468-a8e8-7984124908ce", "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "a642964e-bead-4bed-8910-1bb4d63e3b4d", "e4a6b256-3e47-40fc-89d2-7a477edd6915", "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "9fff585c-c33e-4a86-b3cd-39312079a65f", "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "fa00b701-44c6-4679-994d-5a18afa8a707", "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "313d6012-51a0-4d93-8dfc-de8553239e25", "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "b36d01a3-ddaf-4804-be18-18a6247adfcd", "aaf46cdc-934e-4284-b329-34aa701e3771", "575dce0c-8139-4e30-9295-1ee75969f7fe", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "a1473adb-5338-4a20-b4c3-126763e2d3d3", "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "241e802a-b65e-484f-88cd-c2dc10f9206d", "fd877b94-9bb5-4191-bb25-d79cbd93c167", "d047726b-c71c-4048-a99b-2e2f50dc107d", "40b95d31-1afc-469e-8d34-9a3a667d058e", "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "e6c54d94-498c-4562-a37c-b469d8e9a275", "64760eef-87f7-4ed3-93fd-655668ea9420", "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "da2738f2-fadb-4394-afa7-0a0674885afa", "88872991-7445-4a22-90b2-a3adadb0e827", "f576a613-2392-4067-9d1a-9345fb58d8d1", "431a1fdb-4799-4f3b-91c3-a683b003fc49", "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "4931188c-178e-4ee7-a348-39e8a7a56821", "85ff530b-261d-48c6-a441-facaa2e81e48", "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "8cbc9475-8d05-4e27-9c32-df960716c701", "378a05d8-963c-46c9-bcce-13c7657eac99", "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "e568650b-5dcd-4658-8f34-ded0b1e13992", "f208d6d8-d83a-4c2c-960d-877c37da84e5", "514e4c3a-c77d-4cde-a00f-046425e2301e", "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "01aeb693-138d-49d2-9403-c4f52d7d3d62", "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "83865853-59aa-449e-9600-74b9d89a6d6e", "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "b53317a0-8acf-4fd1-8de8-a5401e776b96", "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "10344bb3-7f65-46c2-b915-2d00d47be5b0", "185d7418-f250-42d0-b72e-0c8b70661e93", "379fa130-190e-4c3f-b7bc-6c8e834485f3", "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "e83e8899-c9b2-483b-b355-5decc942b959", "6385697e-9f1b-40bd-8817-f4a91f40508e", "24357373-078f-44ed-9ac4-6d334a668a11", "15619216-e993-4721-b590-4c520615a67d", "d2eb17db-1d39-41dc-b57f-301f6512fa75", "5a6e1e16-07de-48d8-8aae-faa766c05e88", "5a3164f2-b373-4152-93cf-090b13c12d27", "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "5b768e71-86f2-4879-b448-81061cbae951", "98767d61-b2e8-4d71-b661-e36783ee24c1", "a85ffc3a-e8fd-4040-93bf-78aff284d801", "88f46b67-14d4-4f45-ac2c-d66984f22191", "83809e84-4475-4b69-bc3e-4aad8568612f", "ce72ef99-22f1-43d4-8695-419dcb5d9330", "add64136-62e5-48ea-807e-88638d02df1e", "04936b66-3915-43ad-a8e5-809eadfd1141", "847d5ff3-8a31-4737-a970-aeae8fe21765", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "c49c5062-0966-4170-9efd-9968c913a6cf", "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "850d55f9-6eeb-4492-ad69-a72338f65ba4", "d87bd452-6da1-456e-8155-7dc988157b7d", "5bb68627-3198-40ca-b458-49f973db8752", "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "caf201a9-c2ce-4a26-9c3a-2b9525413711", "4e762605-34a8-406d-b72e-c1a089313320", "d3c3861d-c504-4c77-ba55-224ba82d0118", "2ddef153-167b-4e89-86b6-757a9e65dcac", "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "8a582fe2-0882-4b89-a82a-da6b2dc32937", "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "f35c5d71-b489-4e22-a115-f003df287317", "fbd7c32d-db2a-4418-b92c-566eb8911133", "87a476dc-0079-4583-a985-dee7a20a03de", "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "38879043-7e1e-47a9-8d46-6bec88e201df", "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "f9999590-1f94-4a34-a91e-951e47bedefd", "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "4eddc365-79b4-43ff-a9d7-99422dc34b93", "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "220457c1-1c9f-4c2e-afe6-9598926222c1", "bf361876-6620-407a-812f-bfe11e51e924", "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "c79da740-5030-45ec-a2e0-479e824a562c", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "a197e378-d31b-41c0-9635-cfdf1c1bb423", "737e618a-a410-49b5-bec3-9e55ff7fbc15", "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "30edb182-aa75-42c0-b0a9-e998bb29067c", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "eb1c4225-1c23-4241-8dd4-051389fde4ce", "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "e312efd0-35a1-407f-8439-b8d434b438a6", "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "ba42babc-0666-4393-a4f7-ceaf5a69191e", "c27515df-97a9-4162-8a60-dc0eeb51b775", "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "0f6da907-5854-4be6-859a-e9958747b0aa", "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "5edc2273-c26f-406c-83f3-f4d948e740dd", "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "0f0450f3-8b47-441e-a31b-15a91dc243e2", "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "817f252c-5143-4dae-b418-48c3e9f63728", "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "07e3cb2c-0608-410d-be4b-1511cb1a0448", "138d3531-8793-4f50-a2cd-f291b2863d78", "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "ddeff553-5233-4ae9-bbab-d64d2bd634be", "e212d415-0e93-435f-9e1a-f29005bb4723", "55f0a3a1-846e-40eb-8273-677371b8d912", "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "6ba5a05f-b095-4f0a-8654-b825f4f16334", "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "45d3a03d-f441-458c-8883-df101a3bb146", "871b9555-69ca-4993-99d3-35a59f9f3599", "f2c64357-b1d2-41b7-849f-34d2682c0fad", "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "12fbff88-16b5-4b42-9754-cd001a789fb3", "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "0403d67d-6227-4ea8-8145-4e72db7da120", "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "bd1c6866-65fc-44b2-be51-5588fcff82b9", "1114e048-b69c-4f41-bc20-657245ae6e3f", "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "27aec9c9-dbb0-4939-8422-1742242471d0", "727454c0-d851-48b0-8b89-385611ab0704", "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "d20ee2f4-822c-4827-9e15-41500b1fff10", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "efec536f-72e8-4656-8960-5e85d091345b", "6f4191bb-912b-48a8-9ce7-682769541e6d", "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "517490a7-115a-48c6-8862-1a481504d5a8", "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "49d9671b-0a0a-4c09-8280-d215bfd30662", "05f3c945-dcc8-4393-9f3d-af65077a8f86", "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "554601fb-9b71-4bcc-abf4-21a611be4fde", "7b10f171-7f04-47c7-9fa2-5be43c76e535", "45239e6a-b035-4aaf-b339-8ad379fcb67e", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "7be5fb68-f9ef-476d-8b51-0256ebece19e", "6e22722b-dfb1-4508-a911-49ac840b40f8", "9ccba514-7cb6-4c5c-b377-700758f2f120", "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "7a74da6b-ea76-47db-92cc-874ad90df734", "f11f2808-adb4-46c0-802a-8660db50fa99", "43e32da2-fdd0-4156-90de-50dfd62636f9", "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "a20def93-0709-4eae-9bd2-31206e21e6b2", "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "6004abd0-afa4-4557-ba90-49d172e0a299", "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "970823b7-273b-460a-8afc-3a6811998529", "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "15b75071-74cc-47e0-b4c6-b43744a62a2b", "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "f99abdf0-6283-4e71-bd2b-b5c048a94743", "0a13e132-651d-11eb-ae93-0242ac130002", "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "e9f55347-2928-4c06-88e5-1a7f8169942e", "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "6a69f62d-ce75-4b57-8dce-6351eb55b362", "8b0e12da-d3c3-49db-bb4f-256703f380e5", "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "98a96a5a-64a0-4c42-92c5-489da3866cb0", "47e4bab7-c626-47dc-967b-255608c9a920", "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "40b19fa6-d835-400c-b301-41f3a2baacaf", "f44800ac-38ec-471f-936e-3fa7d9c53100", "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "24c8392b-aa3c-46b7-a545-43f71657fe98", "88f680b8-070e-402c-ae11-d2914f2257f1", "15434e33-5027-4914-88d5-3d4145ec25a9", "b98d0db6-511d-45de-ad02-e82a98729620", "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "0bbc6369-43e3-453d-9944-cae58821c173", "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "b7966f4a-b333-455b-8370-8ca53c229762", "43fa5350-db63-4b8f-9a01-789a427074e1", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "ec290c06-9b6b-4338-8b6b-095c0f284f10", "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "d4498716-1d52-438f-8084-4a603157d131", "b222df08-0e07-11eb-adc1-0242ac120002", "e1693bc8-7168-4eab-8718-cdcaa68a1738", "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "d3b70aad-097e-409c-9df2-450f80dc476b", "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "312d0384-401c-4b8b-abdf-685ffba9a332", "cc368ed0-2411-45dc-a222-510ace303cb2", "42333b2c-b425-441c-b70e-99404a17170f", "0e4164da-94bc-450d-a7be-a4b176179f1f", "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "ebef4391-1a81-4761-a40a-1db446c0e625", "f26307d8-14cd-47e3-a26b-4b4769f24af6", "03cc0c25-389f-4bf8-b48d-11878079f1ca", "8834e2f7-6b4b-4f09-8906-d2276470ee23", "7090adee-82e2-4269-bd59-80691e7c6338", "c74c0390-3e20-41fd-a69a-128f0275a5ea", "b6457d63-d2a2-4e29-859d-4e7affc153d1", "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "5f6a601c-2ecb-498b-9c33-660362323afa", "aa8e035d-7be4-48d3-a944-102aec04400d", "b243b280-65fe-48df-ba07-6ddea7646427", "236d8e89-ed95-4789-a982-36f4643738ba", "277a4393-446c-449a-b0ed-7fdc7795244c", "4fe074b4-b833-4081-8f24-7dcfeca72b42", "68bcd73b-37ef-49cb-95fc-edc809730be6", "86588b36-c6d3-465f-9cee-8f9093e07798", "502b42de-4306-40b4-9596-6f590c81f073", "0a99eb3e-1617-41bd-b095-13dc767f3def", "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "07f8bdc2-c9b3-472a-9817-5a670b872f53", "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "28ac00d6-22d9-4a3c-927f-bbd770104573", "452bce90-6fb0-43cc-97a5-affc283139b3", "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "ce7cf472-6fcc-490a-9481-3786840b5d9b", "c6fb44c6-71f5-49e6-9462-1425d328aee3", "9c0295ce-d60d-40bd-bd74-84673b7592b1", "0a4f6091-223b-41f6-8743-f322ec84930b", "98c5aeef-32d5-492f-b174-64a691896d25", "6fe4aa1e-0531-4510-8be2-782154b73b48", "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "d78b5d61-187d-44b6-bf02-93486a80de5a", "e9b61244-893f-427c-b287-3e708f321c6b", "70bc5215-526f-4477-963c-a47a5c9ebd12", "b6e04788-29e1-4557-bb14-77f761848ab8", "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "0685b176-c816-4837-8e7b-1216f346636b", "e84d89c4-f544-41ca-a6af-4b92fd38b023", "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "023394c4-29d5-46ab-92b8-6a534c6f447b", "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "ebea773c-a8f1-42ad-a856-00cb221966e8", "0b7163dc-7eee-4960-af17-c0cd517f92da", "98dedfdd-8333-49d4-9f23-d7018cccae53", "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "f24bcaea-0cd1-11eb-adc1-0242ac120002", "ccb5742c-c248-4982-8c5c-5571b9275ad3", "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "4abc0ec4-db5a-412f-9632-26659cddf145", "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "5cddf373-ef00-4112-ad72-960ac29bac34", "37db85d1-b089-490a-a59a-c7b6f984f480", "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "f1edd233-30b5-4823-9e6a-c4171b24d316", "e92a4287-e072-4a40-9739-370c106bb750", "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "8bc64091-6875-4881-aaf9-7bd25b5dda08", "56c217c3-2de2-479b-990f-5c109ba8458f", "eee00933-a761-4cd0-be70-c42fe91731e7", "bab049ca-7471-4828-9024-38279a4c04da", "2a072a96-a086-49fa-bcb5-15cc5a619093", "883faa95-175a-4e22-8181-e5761aeb373c", "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "63d1ccc0-2a43-4f4b-9289-361b308991ff", "4f154fb6-27d1-4813-a759-78b93e0b9c48", "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "33be4333-2c6b-44f4-ae28-102cdbde0a31", "395907ee-96e5-4666-af2e-2ca91688e151", "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "b0ce780f-10bd-496d-9067-066d23dc3aa5", "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "79b06761-465f-4f88-9ef2-150e24d3d737", "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "c615d676-f655-46b9-b913-78729021e5d7", "b19146a3-25d4-41b4-928b-1e2a92641b1b", "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "e6474a1b-5390-49cd-ab41-8d88655f7394", "692f0bec-83ba-4d04-af7e-e884a96059b6", "93671f99-04eb-4ab4-a161-70d446a84003", "0d5675be-bc88-4172-86d3-1e96a4476536", "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "4281cb20-2994-4580-aa63-c8b86d019934", "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "a34f79a3-8e5f-4cc3-b765-de00695452c2", "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "5589ab4f-a767-433c-961d-c91f3f704db1", "e8a95b5e-c891-46e2-b33a-93937d3abc31", "c86500e9-a645-4680-98d7-f882c70c1ea3", "58f50261-c53b-4c88-bd12-1d71f12eda4c", "34ebb878-1b15-4895-b352-ca2eeb99b274", "7a02e22e-b885-4404-b38b-1ddc7e65258a", "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "24de4f3b-804c-4165-b442-5a06a2302c7e", "731231b9-0b5d-4219-94dd-abb6959aa7ea", "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "d7bcd677-645d-4691-a8d4-7a5602b780d1", "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "6e897651-f157-4d8f-aaeb-df8151488385", "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "9847f263-4a81-424f-970c-875dab15b79b", "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "4b046706-5789-4673-b111-66f25fe99534", "73bba97f-a82d-42ce-b315-9182e76c57b1", "646bc99f-6682-4b47-a73a-17b1b64c9d34", "6c96fc76-0eb1-11eb-adc1-0242ac120002", "7050bba1-1aed-454e-8f73-3f46f09ce56a", "744a188b-0415-4792-896f-11ddb0588dbc", "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "faa48cae-6b25-4f00-a094-08947fef582f", "70ad0861-d1fe-491c-a45f-fa48148a300d", "a16980c2-0c56-4de0-9a79-17971979efdd", "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "954f0af7-62dd-418f-b3df-a84bc2c7a774", "a7ee1722-c3c5-aeff-3212-c777e4733217", "1dde5376-a648-492e-9e54-4241dd9b0c7f", "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "10c14723-61c7-4c75-92ca-9af245723ad2", "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "41421f44-58f9-455d-838a-c398859841d4", "ae9b0bd7-8888-4606-b444-0ed7410cb728", "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "43103702-5886-11ed-9b6a-0242ac120002", "16905e21-66ee-42fe-b256-1318ada2d770", "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "a7c3d773-caef-227e-a7e7-c2f13c622329", "214641c2-c579-4ecb-8427-0cf19df6842e", "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "07aa184a-870d-413d-893a-157f317f6f58", "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "f548a603-c9f2-4c89-b511-b089f7e94549", "93199800-b52a-4dec-b762-75212c196542", "526be59f-a573-4eea-b5f7-f0973207634d", "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "25676e10-2121-446e-80a4-71ff8506af47", "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "ac1c92b4-ac81-405a-9978-4604d78cc47e", "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "bdeb2cff-af74-4094-8426-724dc937f20a", "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "a383dec4-deec-4e6e-913b-ed9249670848", "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "ac20ae82-8758-4f38-958e-b44a3140ca88", "54786ddc-5b8a-11ed-9b6a-0242ac120002", "41ca393d-538c-408a-ac27-cf1e038be80c", "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "cd71385d-fd9b-4691-9b98-2b1f7e508714", "c8a180d6-47a3-4345-a609-53f9c3d834fc", "044ba588-dff4-4918-9808-3f95e8160606", "1af57a4b-460a-4738-9034-db68b880c665", "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "1dd05363-104e-4b4a-b963-196a534b03a1", "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "204b17ae-4007-471b-917b-b917b315c5db", "50d66fb0-03f8-4da0-8add-84e77d12a020", "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "c2b86e67-b880-4eec-b045-50bc98ef4844", "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "e593cf51-88db-4ee1-b920-37e89012a3c9", "8202070f-edeb-4d31-a010-a26c72ac5600", "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "3268b746-88d8-4cd3-bffc-30077d02c787", "18988e1b-9087-4f8a-82fe-0414dce49878", "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "f53714ec-5077-420e-ad20-907ff9bb2958", "f117933c-980c-4f78-b384-e3d838111165", "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "a29c1813-ab1f-4dde-b489-330b952e91ae", "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "b655a06a-31c0-477a-95c2-3726b83d649d", "21d856f9-9281-4ded-9377-51a1a6e2a432", "b66474aa-bd92-4333-a16c-298155b120df", "b2309017-4235-44fe-b5af-b15363011957", "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "62510e69-616b-4078-b371-847da438cc03", "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "285b85b1-a555-4095-8652-a8a4106af63f", "84f52741-8834-4a8c-a413-2eb2269aa6c8", "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "be344333-921d-4c4d-8bb8-e584cf584780", "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "fb843269-508c-4b76-8b8d-88679db22ce7", "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "de587dce-915e-4218-aac4-835ca6af6f70", "c7942406-33dd-4377-a564-0f62db0593a3", "ab9e3b40-0c85-4ba1-aede-455d226fd124", "ef61af62-bc74-4f58-b49b-626448227652", "a20391f8-76fb-437b-abc0-dba2df1952c6", "899133d5-4d7c-4a7f-94ee-27355c879d90", "1ac8666b-046f-4201-8aba-1951aaec03a3", "1c67a717-32ba-409b-a45d-0fb704a73a81", "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "eca49c87-8a75-4f13-9c73-a5a29e845f03", "435e10e4-992a-4281-96f3-38b11106adde", "b3512211-c67e-4707-bedc-66efc7848863", "c15a46a0-07d4-4c87-b4b6-89207835a83b", "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "1f0f6176-6482-4027-b151-00071af39d7e", "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "9257c05b-4a4a-48e5-a670-b7b073cf401b", "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "99793437-3e16-439b-be0f-078782cf953d", "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "ac175779-025a-4f12-98b0-acdaeb77ea85", "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "90d50722-0483-4065-8e35-57efaadd354d", "180c7c5c-d64b-4a63-86e9-68910451bc8b", "d55b793d-f847-4eea-b59a-5ab09908ac90", "aef9d1f1-7396-4e92-a927-4567c7a495c1", "6c6d9280-e6d0-4b9d-80ac-254701b64916", "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "9212f354-7775-4e28-9c9f-8f0a4544e664", "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "ffa6861c-4461-4f59-8a41-578c39f3f23e", "a0459f02-ac51-4c09-b511-b8c9203fc429", "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "534f2ef7-e8a2-4433-816d-c91bccde289b", "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "84232095-ecca-4015-b0d7-7726507ee793", "4e2ed651-1906-4a59-a78a-18220fca1b22", "60f16a96-db70-42eb-8f76-16763e333590", "5afee48e-67dd-4e03-a783-f74259dcf998", "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "771d1eb5-9587-4568-95fb-9ec44153a012", "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "e28a5a99-da44-436d-b7a0-2afc20a5f413", "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "d2b749ee-4225-417e-b20e-a8d2193cbb84", "1193d960-2369-499f-a158-7b50a31df682", "6b65c28e-11f3-46cb-902a-68f2cafaf474", "242301bc-f92f-4476-8718-78004a6efd9f", "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "52d097e2-063e-4c9c-8fbb-855c8948d135", "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "647c7b9e-d784-4fda-b9a0-45c565a7b729", "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "bb76d96b-821c-47cf-944b-7ce377864492", "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "1816994b-42e1-4fb1-afd2-134d88184f71", "12827a56-61a4-476a-a9cb-f3068f191073", "32b96012-7892-429e-b26c-ac2bf46066ff", "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "f4bbd493-b796-416e-bbf2-121235348529", "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "d06be4b9-8045-428b-a567-740a26d9db25", "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "65c3ca2c-525f-4ced-968e-246a713d164f", "347906f3-e207-4d18-ae5b-a9403d6bcdef", "a29808fd-ef50-49ff-9c7a-59a9b040b404", "e66779cc-383e-4224-a3a4-267eeb585c40", "85c312b7-f44d-4a51-a024-d671c40b49fc", "6da2c9f5-7c53-401b-aacb-92c040ce1215", "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "ff992eac-6449-4c60-8c1d-91c9722a1d48", "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "208748f7-881d-47ac-a29c-07ea84bf691d", "89ca78fd-b37c-4310-b3d3-81a023f83936", "a2910908-e86f-4687-aeba-76a5f996e652", "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "9c14c9fa-1a63-4a64-8e57-d19280559490", "221b251a-357a-49a9-920a-271802777cc0", "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "f14e169e-9978-4c69-acb3-1cff8200bc36", "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "1c8774a0-44d4-4db0-91f8-e792359c70bd", "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "9fc3072c-dc8f-4bf7-b231-18950000fadd", "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "ada4b0c4-758b-46ac-9033-9004613a150d", "584bca0f-3608-4402-80fd-4075ff6072e3", "9a132afa-654e-11eb-ae93-0242ac130002", "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "a70dcb37-3bee-453a-99df-d0c683151be6", "85b0b087-eddf-4a2b-b033-d771fa2b9775", "2267fe65-0681-42ad-9a6d-46553d3f3480", "28c8f68b-098d-45af-8d43-8089f3e35403", "cd8c163e-a19b-402e-bdd5-419ff5859f12", "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "2c28c248-7f50-417a-9186-a85b223010ee", "84972c80-251c-4c3a-9079-4f00aad93938", "434c08ba-8406-4d15-8b24-782cb071a691", "bed2a484-9348-4143-8a8a-b801c979301c", "a0d7e4d2-bede-4141-8896-bc6e237e977c", "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "1c526788-0abe-4713-862f-b520da5e5316", "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "9f107a84-532c-41af-b005-8d12a607639f", "455b9d50-15a1-4b99-853f-8d37655a4c1b", "dee0a7a3-f200-4112-a99b-952196d81e42", "79ce34ca-af29-4d0e-b832-fc1b377020db", "2afafd61-6aae-4df4-baed-139fa1f4c345", "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "f0507c0f-a3a2-40f5-acc6-7f543c334993", "970007b7-ce32-49d0-a4a4-fbef016950bd", "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "b2ddd389-f676-4ac4-845a-e00781a48e5f", "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "4a6713f6-3331-11ed-a261-0242ac120002", "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "5cc2cda8-f261-4d88-a2de-e9e193c86716", "01c42d3c-242d-4655-85b2-34f1739632f7", "77946e79-97f1-45a2-84b4-f37b5c0d8682", "27ba3207-dd30-4812-abbf-5d20c57d474e", "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "1228c958-e64e-4e71-92ad-7d429f4138ba", "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "b1377339-fda6-477a-b455-ac0923f9ec2c", "44143844-0631-49ab-97a0-96387d6b2d7c", "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "85de1f22-d189-44e4-8239-dc276b45379b", "92626ddd-662c-49e3-ac59-f6535f12d189", "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "e56d3073-83ff-4021-90fe-c658e0709e72", "deb9b646-a508-44ee-b7c9-d8965921c6b6", "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "cea2b7ea-792b-405f-95a1-b903ea06458f", "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "730fc21b-eaff-474b-ad23-90fd265d4988", "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "48917adc-a28e-4f5d-b729-11e75da8941f", "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "0900463c-b33b-49a8-be1d-552a3b553dae", "82a6714f-4899-4f16-9c1e-9a333544d4c3", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "1e59c230-6670-45bf-83b0-98903780607e", "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "258fc8ce-8352-443a-9120-8a11e4857fa5", "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "4ae81040-fc1c-4249-bfa3-938d260214d9", "aa2efee7-34dd-446e-8a37-40790a66efd7", "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "ae215552-081e-44c7-805f-be16f975c8a2", "30bf1789-379d-4fdc-900f-55cd0a90a801", "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "4f7a6757-ff79-46db-9687-66501a02d9ec", "129966c9-de17-4334-a123-8b58172e664d", "696bfb54-227e-4602-ac5b-30d9d2053312", "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "7df1713a-1a5b-4a4b-a071-dc83b144a101", "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "814c95cc-8192-4378-a70a-f1aafd877af1", "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "99c840f2-2012-46fd-9141-c761987550ef", "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "de16d92c-c446-4d53-8938-10aeef41c8b6", "056c7317-9a09-4bd4-9067-d051312752ea", "60fc936d-2eb0-4543-8a13-911c750a1dfc", "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "114de787-4eb2-48cc-abdb-c0b449f93ea4", "207b0396-3689-42d9-8399-4222658efc99", "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "9248c7e1-2bf3-4661-a22c-600a8040b446", "146aace8-9bd6-42ba-be7a-0070d8027b76", "3d7679bd-0c00-440c-97b0-3f204273e6c7", "ea011323-7045-460b-b2d7-0f7442ea6b38", "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "e290b10b-1023-4452-a4a9-eb31a9013b3a", "ca5583e9-8f80-46ac-ab91-7f314d13b984", "cd3d1298-eb3b-476c-ac67-12847de55813", "867356ee-9352-41c9-a8f2-1be690d78216", "67f113fa-e23d-4271-befa-30113b3e08b1", "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "62b20d44-1546-4e61-afce-8e175eb9473c", "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "b6676963-0353-4f88-90f5-36c20d443c6a", "99cf1e02-00fb-4c0d-8375-563f978dfd37", "903076ff-f442-475a-b667-4f246bcc203b", "a77c1610-fc73-4019-8e29-0f51efc04a51", "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "cea72823-df4d-4567-950c-0b579eaf0846", "74a2b202-73e0-4693-9a3a-9d36146d0775", "5fc297ae-25b6-488a-8f25-cc12ac29b744", "12f6b752-042d-483e-bf9c-915a6d06ad75", "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "c1d867fe-8d95-4487-aab4-e53f2d339f90", "e13f668e-7f95-443d-98d2-1816a7648a7b", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "9c8c7000-3065-44a8-a555-79bcba5d9955", "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "ee5e119b-1f75-4b34-add8-3be976961e39", "33339be3-148b-4e16-af56-ad16ec6c7e7b", "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "646ea171-dded-4578-8a4d-65e9822892e3", "84b1706c-932a-44c4-ae28-892b28a25b94", "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "074e0ded-6ced-4ebd-8b4d-53f55908119d", "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "af491bca-e752-4b44-9c86-df5680533dbc", "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "f0f7be61-9cf5-43be-9836-99d6ef448a18", "b1f73849-6329-4069-bc8f-78a604bb8b23", "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "0b80ade5-6997-4b1d-99a1-71701778ea61", "81ebd28b-9607-4478-bf06-974ed9d53ed7", "dc4576d4-7467-424f-9eee-fd2b02855fe0", "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "e9142d84-fbe0-401d-ac50-3e519fb00c89", "b4dc61f5-6cce-468e-a608-b48b469feaa2", "e6313acd-208c-44fc-a0ff-db85d572e90e", "f3d39c45-de1a-4486-a687-ab126124f744", "97dbf6e2-e436-44d8-abee-4261b24d3e41", "0fc35fc3-efe6-4898-8a37-0b233339524f", "c947b146-0abc-4c87-9c64-b17e9d7274a2", "91a2c315-9ee6-4052-a853-6f6a8238f90d", "9525dc73-0327-438c-8c04-13c0e037e9da", "a4694263-59a8-4608-a3a0-6f8d3a51664c", "f37aba28-a9e6-4045-882c-d5004043b337", "5e95028c-5229-4214-afae-d653d573d0ec", "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "f7375e28-5c14-432f-b8d1-1db26c832df3", "0e0255bf-2548-47b8-9582-c0955c9283f5", "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "889719ef-dd62-43df-86c3-768fb08dc7c0", "af77cf95-c469-471c-b6a0-946c685c4798", "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "4bf943c6-5146-4273-98dd-e958fd1e3abf", "7f741dcf-fc22-4759-87b4-9ae8376676a2", "8a3038e8-9c9d-46f8-b184-66234a160f6f", "7d4aaec2-08ed-4430-8b96-28420e030e04", "75d0a94e-6252-448d-a7be-d953dff527bb", "327f48c1-a6db-4eb8-875a-f6981f1b0183", "5f03babb-12db-4eec-8c82-7b4cb5580868", "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "cd1f961e-0b96-436b-b7c6-38da4583ec00", "7b4f794b-590a-4ad4-ba18-7964a2832205", "438025f9-5856-4663-83f7-52f878a70a50", "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "213d6a77-3d55-4ce8-ba74-fcfef741974e", "aaafa146-074c-11eb-adc1-0242ac120002", "2433a154-bb3d-42e4-86c3-a26bdac91c45", "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "4f647cfa-b598-4e12-ad69-c68dd16caef8", "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "17769c90-230e-488b-a463-e05c08e9d48f", "e173ad47-4388-4012-ae62-bd13f71c18a8", "48bbc537-b652-4b4e-bd1d-281172df448f", "1edff897-9146-48d2-9066-52e8d8f80a2f", "c248c896-e412-4279-8c15-1c558067b6fa", "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "d522eca2-2973-4391-a3e0-ef0374321dae", "62e0298b-e994-4189-bc87-bc699aa62d97", "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "a537cfc3-4297-4789-92b5-345bfd845ad0", "4a2a2c3e-209f-4d01-b513-4155a540b469", "f64e5c19-879c-4bae-b471-6d84c8339677", "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "536e2947-3729-478c-9903-745aaffe60d2", "40aa399c-7b02-4715-8e5f-73572b493f33", "883835a7-df45-43e4-bf1d-4268768afda4", "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "b57ba453-b384-4ab9-9f40-1038086b4e53", "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "3bad990e-4848-4a78-9530-b427d854aac0", "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "09576804-7a05-458e-a817-eb718ca91f54", "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "b0524451-19af-4efa-a46f-562a977f792e", "b96b2031-7c17-4473-afe7-a30ce714db29", "37c1333a-a0db-48be-b64b-7393b2386e3b", "81325ce1-be01-4250-944f-b4789644556f", "3abd6094-7027-475f-9630-8ab9be7b9725", "d9047477-0359-48c9-b8c7-792cedcdc9c4", "56d19cb4-6414-4769-9644-1ed35ffbb148", "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "5cdb711b-5740-4fb2-ba88-f7945027afac", "164eda96-11b2-430b-85ff-6a265c15bf32", "a58353df-af43-4753-bad0-cd83ef35eef5", "56321594-9087-49d9-bf10-524fe8479452"], "uberAgent 6.0": ["ec8c4047-fad9-416a-8c81-0f479353d7f6", "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "d13c43f0-f66b-4279-8b2c-5912077c1780", "f40017b3-cb2e-4335-ab5d-3babf679c1de", "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "f354eba5-623b-450f-b073-0b5b2773b6aa", "6414b5cd-b19d-447e-bb5e-9f03940b5784", "1fbc0671-5596-4e17-8682-f020a0b995dc", "552b6b65-df37-4d3e-a258-f2fc4771ae54", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "4c21b805-4dd7-469f-b47d-7383a8fcb437", "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "4508a70e-97ef-4300-b62b-ff27992990ea", "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "3669afd2-9891-4534-a626-e5cf03810a61", "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "7417e29e-c2e7-4cf6-a2e8-767228c64837", "72ca7c75-bf85-45cd-aca7-255d360e423c", "0e0bc253-07ed-43f1-816d-e1b220fe8971", "6e78b74f-c762-4800-82ad-f66787f10c8a", "84b0a8f3-680b-4096-a45b-e9a89221727c", "90ae0469-0cee-4509-b67f-e5efcef040f7", "bf9808c4-d24f-44a2-8398-b65227d406b6", "caa02837-f659-466f-bca6-48bde2826ab4", "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "4fc0deee-0057-4998-ab31-d24e46e0aba4", "e2e01011-5910-4267-9c3b-4149ed5479cf", "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "d2605a99-2218-4894-8fd3-2afb7946514d", "a2a3b925-7bb0-433b-b508-db9003263cc4", "68654bf0-4412-43d5-bfe8-5eaa393cd939", "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "952ed57c-8f99-453d-aee0-53a49c22f95d", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "75e508f7-932d-4ebc-af77-269237a84ce1", "a2edbce1-95c8-4291-8676-0d45146862b3", "844f8eb2-610b-42c8-89a4-47596e089663", "6360757a-d460-456c-8b13-74cf0e60cceb", "24b6cf51-6122-469e-861a-22974e9c1e5b", "9ed5959a-c43c-4c59-84e3-d28628429456", "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "fef394cd-f44d-4040-9b18-95d92fe278c0", "48bfd177-7cf2-412b-ad77-baf923489e82", "2092cacb-d77b-4f98-ab0d-32b32f99a054", "ff0f2b05-09db-4095-b96d-1b75ca24894a", "7707a579-e0d8-4886-a853-ce47e4575aaa", "ee6cea48-c5b6-4304-a332-10fc6446f484", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "e76c8240-d68f-4773-8880-5c6f63595aaf", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "af4c4609-5755-42fe-8075-4effb49f5d44", "9ca2bf31-0570-44d8-a543-534c47c33ed7", "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "6ec86d9e-912e-4726-91a2-209359b999b9", "90217a70-13fc-48e4-b3db-0d836c5824ac", "3735d5ac-d770-4da0-99ff-156b180bc600", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "caa06de8-fdef-4c91-826a-7f9e163eef4b", "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "2158f96f-43c2-43cb-952a-ab4580f32382", "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "d797268e-28a9-49a7-b9a8-2f5039011c5c", "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "f426547a-e0f7-441a-b63e-854ac5bdf54d", "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "6d3a3952-6530-44a3-8554-cf17c116c615", "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "a4824fca-976f-4964-b334-0621379e84c4", "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "92a974db-ab84-457f-9ec0-55db83d7a825", "f9578658-9e71-4711-b634-3f9b50cd3c06", "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "f5240972-3938-4e56-8e4b-e33893176c1f", "fff9d2b7-e11c-4a69-93d3-40ef66189767", "cc9d3712-6310-4320-b2df-7cb408274d53", "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "42a993dd-bb3e-48c8-b372-4d6684c4106c", "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "36210e0d-5b19-485d-a087-c096088885f0", "1723e720-616d-4ddc-ab02-f7e3685a4713", "90fb5e62-ca1f-4e22-b42e-cc521874c938", "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "57c4bf16-227f-4394-8ec7-1b745ee061c3", "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "0ea52357-cd59-4340-9981-c46c7e900428", "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "9719a8aa-401c-41af-8108-ced7ec9cd75c", "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "587254ee-a24b-4335-b3cd-065c0f1f4baa", "98b53e78-ebaf-46f8-be06-421aafd176d9", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "b5746143-59d6-4603-8d06-acbd60e166ee", "551d9c1f-816c-445b-a7a6-7a3864720d60", "e31033fc-33f0-4020-9a16-faf9b31cbf08", "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "8e3c7994-131e-4ba5-b6ea-804d49113a26", "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "e32d4572-9826-4738-b651-95fa63747e8a", "043c4b8b-3a54-4780-9682-081cb6b8185c", "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "c363385c-f75d-4753-a108-c1a8e28bdbda", "5cb299fc-5fb1-4d07-b989-0644c68b6043", "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "811f459f-9231-45d4-959a-0266c6311987", "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "7d6d30b8-5b91-4b90-a891-46cccaf29598", "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "087790e3-3287-436c-bccf-cbd0184a7db1", "6812a10b-60ea-420c-832f-dfcc33b646ba", "84b14121-9d14-416e-800b-f3b829c5a14d", "32e280f1-8ad4-46ef-9e80-910657611fbc", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "3f5491e2-8db8-496b-9e95-1029fce852d4", "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "02030f2f-6199-49ec-b258-ea71b07e03dc", "74403157-20f5-415d-89a7-c505779585cf", "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "4d7cda18-1b12-4e52-b45c-d28653210df8", "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "c9783e20-4793-4164-ba96-d9ee483992c4", "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "94771a71-ba41-4b6e-a757-b531372eaab6", "2f869d59-7f6a-4931-992c-cce556ff2d53", "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "1775e15e-b61b-4d14-a1a3-80981298085a", "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "42b1a5b8-353f-4f10-b256-39de4467faff", "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "9292293b-8496-4715-9db6-37028dcda4b3", "52788a70-f1da-40dd-8fbd-73b5865d6568", "349d891d-fef0-4fe4-bc53-eee623a15969", "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "6f3e2987-db24-4c78-a860-b4f4095a7095", "1ec65a5f-9473-4f12-97da-622044d6df21", "d042284c-a296-4988-9be5-f424fadcc28c", "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "1327381e-6ab0-4f38-b583-4c1b8346a56b", "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "9ec9fb1b-e059-4489-9642-f270c207923d", "058f4380-962d-40a5-afce-50207d36d7e2", "fe63010f-8823-4864-a96b-a7b4a0f7b929", "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "c86133ad-4725-4bd0-8170-210788e0a7ba", "f5d19838-41b5-476c-98d8-ba8af4929ee2", "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "82880171-b475-4201-b811-e9c826cd5eaa", "023c654f-8f16-44d9-bb2b-00ff36a62af9", "d557dc06-62e8-4468-a8e8-7984124908ce", "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "a642964e-bead-4bed-8910-1bb4d63e3b4d", "e4a6b256-3e47-40fc-89d2-7a477edd6915", "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "9fff585c-c33e-4a86-b3cd-39312079a65f", "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "fa00b701-44c6-4679-994d-5a18afa8a707", "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "313d6012-51a0-4d93-8dfc-de8553239e25", "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "b36d01a3-ddaf-4804-be18-18a6247adfcd", "aaf46cdc-934e-4284-b329-34aa701e3771", "575dce0c-8139-4e30-9295-1ee75969f7fe", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "a1473adb-5338-4a20-b4c3-126763e2d3d3", "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "241e802a-b65e-484f-88cd-c2dc10f9206d", "fd877b94-9bb5-4191-bb25-d79cbd93c167", "d047726b-c71c-4048-a99b-2e2f50dc107d", "40b95d31-1afc-469e-8d34-9a3a667d058e", "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "e6c54d94-498c-4562-a37c-b469d8e9a275", "64760eef-87f7-4ed3-93fd-655668ea9420", "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "da2738f2-fadb-4394-afa7-0a0674885afa", "88872991-7445-4a22-90b2-a3adadb0e827", "f576a613-2392-4067-9d1a-9345fb58d8d1", "431a1fdb-4799-4f3b-91c3-a683b003fc49", "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "4931188c-178e-4ee7-a348-39e8a7a56821", "85ff530b-261d-48c6-a441-facaa2e81e48", "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "8cbc9475-8d05-4e27-9c32-df960716c701", "378a05d8-963c-46c9-bcce-13c7657eac99", "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "e568650b-5dcd-4658-8f34-ded0b1e13992", "f208d6d8-d83a-4c2c-960d-877c37da84e5", "514e4c3a-c77d-4cde-a00f-046425e2301e", "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "01aeb693-138d-49d2-9403-c4f52d7d3d62", "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "83865853-59aa-449e-9600-74b9d89a6d6e", "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "b53317a0-8acf-4fd1-8de8-a5401e776b96", "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "10344bb3-7f65-46c2-b915-2d00d47be5b0", "185d7418-f250-42d0-b72e-0c8b70661e93", "379fa130-190e-4c3f-b7bc-6c8e834485f3", "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "e83e8899-c9b2-483b-b355-5decc942b959", "6385697e-9f1b-40bd-8817-f4a91f40508e", "24357373-078f-44ed-9ac4-6d334a668a11", "15619216-e993-4721-b590-4c520615a67d", "d2eb17db-1d39-41dc-b57f-301f6512fa75", "5a6e1e16-07de-48d8-8aae-faa766c05e88", "5a3164f2-b373-4152-93cf-090b13c12d27", "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "5b768e71-86f2-4879-b448-81061cbae951", "98767d61-b2e8-4d71-b661-e36783ee24c1", "a85ffc3a-e8fd-4040-93bf-78aff284d801", "88f46b67-14d4-4f45-ac2c-d66984f22191", "83809e84-4475-4b69-bc3e-4aad8568612f", "ce72ef99-22f1-43d4-8695-419dcb5d9330", "add64136-62e5-48ea-807e-88638d02df1e", "04936b66-3915-43ad-a8e5-809eadfd1141", "847d5ff3-8a31-4737-a970-aeae8fe21765", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "c49c5062-0966-4170-9efd-9968c913a6cf", "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "850d55f9-6eeb-4492-ad69-a72338f65ba4", "d87bd452-6da1-456e-8155-7dc988157b7d", "5bb68627-3198-40ca-b458-49f973db8752", "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "caf201a9-c2ce-4a26-9c3a-2b9525413711", "4e762605-34a8-406d-b72e-c1a089313320", "d3c3861d-c504-4c77-ba55-224ba82d0118", "2ddef153-167b-4e89-86b6-757a9e65dcac", "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "8a582fe2-0882-4b89-a82a-da6b2dc32937", "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "f35c5d71-b489-4e22-a115-f003df287317", "fbd7c32d-db2a-4418-b92c-566eb8911133", "87a476dc-0079-4583-a985-dee7a20a03de", "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "38879043-7e1e-47a9-8d46-6bec88e201df", "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "f9999590-1f94-4a34-a91e-951e47bedefd", "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "4eddc365-79b4-43ff-a9d7-99422dc34b93", "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "220457c1-1c9f-4c2e-afe6-9598926222c1", "bf361876-6620-407a-812f-bfe11e51e924", "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "c79da740-5030-45ec-a2e0-479e824a562c", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "a197e378-d31b-41c0-9635-cfdf1c1bb423", "737e618a-a410-49b5-bec3-9e55ff7fbc15", "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "30edb182-aa75-42c0-b0a9-e998bb29067c", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "eb1c4225-1c23-4241-8dd4-051389fde4ce", "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "e312efd0-35a1-407f-8439-b8d434b438a6", "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "ba42babc-0666-4393-a4f7-ceaf5a69191e", "c27515df-97a9-4162-8a60-dc0eeb51b775", "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "0f6da907-5854-4be6-859a-e9958747b0aa", "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "5edc2273-c26f-406c-83f3-f4d948e740dd", "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "0f0450f3-8b47-441e-a31b-15a91dc243e2", "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "817f252c-5143-4dae-b418-48c3e9f63728", "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "07e3cb2c-0608-410d-be4b-1511cb1a0448", "138d3531-8793-4f50-a2cd-f291b2863d78", "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "ddeff553-5233-4ae9-bbab-d64d2bd634be", "e212d415-0e93-435f-9e1a-f29005bb4723", "55f0a3a1-846e-40eb-8273-677371b8d912", "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "6ba5a05f-b095-4f0a-8654-b825f4f16334", "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "45d3a03d-f441-458c-8883-df101a3bb146", "871b9555-69ca-4993-99d3-35a59f9f3599", "f2c64357-b1d2-41b7-849f-34d2682c0fad", "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "12fbff88-16b5-4b42-9754-cd001a789fb3", "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "0403d67d-6227-4ea8-8145-4e72db7da120", "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "bd1c6866-65fc-44b2-be51-5588fcff82b9", "1114e048-b69c-4f41-bc20-657245ae6e3f", "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "27aec9c9-dbb0-4939-8422-1742242471d0", "727454c0-d851-48b0-8b89-385611ab0704", "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "d20ee2f4-822c-4827-9e15-41500b1fff10", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "efec536f-72e8-4656-8960-5e85d091345b", "6f4191bb-912b-48a8-9ce7-682769541e6d", "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "517490a7-115a-48c6-8862-1a481504d5a8", "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "49d9671b-0a0a-4c09-8280-d215bfd30662", "05f3c945-dcc8-4393-9f3d-af65077a8f86", "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "554601fb-9b71-4bcc-abf4-21a611be4fde", "7b10f171-7f04-47c7-9fa2-5be43c76e535", "45239e6a-b035-4aaf-b339-8ad379fcb67e", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "7be5fb68-f9ef-476d-8b51-0256ebece19e", "6e22722b-dfb1-4508-a911-49ac840b40f8", "9ccba514-7cb6-4c5c-b377-700758f2f120", "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "7a74da6b-ea76-47db-92cc-874ad90df734", "f11f2808-adb4-46c0-802a-8660db50fa99", "43e32da2-fdd0-4156-90de-50dfd62636f9", "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "a20def93-0709-4eae-9bd2-31206e21e6b2", "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "6004abd0-afa4-4557-ba90-49d172e0a299", "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "970823b7-273b-460a-8afc-3a6811998529", "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "15b75071-74cc-47e0-b4c6-b43744a62a2b", "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "f99abdf0-6283-4e71-bd2b-b5c048a94743", "0a13e132-651d-11eb-ae93-0242ac130002", "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "e9f55347-2928-4c06-88e5-1a7f8169942e", "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "6a69f62d-ce75-4b57-8dce-6351eb55b362", "8b0e12da-d3c3-49db-bb4f-256703f380e5", "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "98a96a5a-64a0-4c42-92c5-489da3866cb0", "47e4bab7-c626-47dc-967b-255608c9a920", "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "40b19fa6-d835-400c-b301-41f3a2baacaf", "f44800ac-38ec-471f-936e-3fa7d9c53100", "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "24c8392b-aa3c-46b7-a545-43f71657fe98", "88f680b8-070e-402c-ae11-d2914f2257f1", "15434e33-5027-4914-88d5-3d4145ec25a9", "b98d0db6-511d-45de-ad02-e82a98729620", "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "0bbc6369-43e3-453d-9944-cae58821c173", "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "b7966f4a-b333-455b-8370-8ca53c229762", "43fa5350-db63-4b8f-9a01-789a427074e1", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "ec290c06-9b6b-4338-8b6b-095c0f284f10", "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "d4498716-1d52-438f-8084-4a603157d131", "b222df08-0e07-11eb-adc1-0242ac120002", "e1693bc8-7168-4eab-8718-cdcaa68a1738", "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "d3b70aad-097e-409c-9df2-450f80dc476b", "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "312d0384-401c-4b8b-abdf-685ffba9a332", "cc368ed0-2411-45dc-a222-510ace303cb2", "42333b2c-b425-441c-b70e-99404a17170f", "0e4164da-94bc-450d-a7be-a4b176179f1f", "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "ebef4391-1a81-4761-a40a-1db446c0e625", "f26307d8-14cd-47e3-a26b-4b4769f24af6", "03cc0c25-389f-4bf8-b48d-11878079f1ca", "8834e2f7-6b4b-4f09-8906-d2276470ee23", "7090adee-82e2-4269-bd59-80691e7c6338", "c74c0390-3e20-41fd-a69a-128f0275a5ea", "b6457d63-d2a2-4e29-859d-4e7affc153d1", "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "5f6a601c-2ecb-498b-9c33-660362323afa", "aa8e035d-7be4-48d3-a944-102aec04400d", "b243b280-65fe-48df-ba07-6ddea7646427", "236d8e89-ed95-4789-a982-36f4643738ba", "277a4393-446c-449a-b0ed-7fdc7795244c", "4fe074b4-b833-4081-8f24-7dcfeca72b42", "68bcd73b-37ef-49cb-95fc-edc809730be6", "86588b36-c6d3-465f-9cee-8f9093e07798", "502b42de-4306-40b4-9596-6f590c81f073", "0a99eb3e-1617-41bd-b095-13dc767f3def", "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "07f8bdc2-c9b3-472a-9817-5a670b872f53", "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "28ac00d6-22d9-4a3c-927f-bbd770104573", "452bce90-6fb0-43cc-97a5-affc283139b3", "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "ce7cf472-6fcc-490a-9481-3786840b5d9b", "c6fb44c6-71f5-49e6-9462-1425d328aee3", "9c0295ce-d60d-40bd-bd74-84673b7592b1", "0a4f6091-223b-41f6-8743-f322ec84930b", "98c5aeef-32d5-492f-b174-64a691896d25", "6fe4aa1e-0531-4510-8be2-782154b73b48", "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "d78b5d61-187d-44b6-bf02-93486a80de5a", "e9b61244-893f-427c-b287-3e708f321c6b", "70bc5215-526f-4477-963c-a47a5c9ebd12", "b6e04788-29e1-4557-bb14-77f761848ab8", "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "0685b176-c816-4837-8e7b-1216f346636b", "e84d89c4-f544-41ca-a6af-4b92fd38b023", "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "023394c4-29d5-46ab-92b8-6a534c6f447b", "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "ebea773c-a8f1-42ad-a856-00cb221966e8", "0b7163dc-7eee-4960-af17-c0cd517f92da", "98dedfdd-8333-49d4-9f23-d7018cccae53", "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "f24bcaea-0cd1-11eb-adc1-0242ac120002", "ccb5742c-c248-4982-8c5c-5571b9275ad3", "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "4abc0ec4-db5a-412f-9632-26659cddf145", "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "5cddf373-ef00-4112-ad72-960ac29bac34", "37db85d1-b089-490a-a59a-c7b6f984f480", "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "f1edd233-30b5-4823-9e6a-c4171b24d316", "e92a4287-e072-4a40-9739-370c106bb750", "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "8bc64091-6875-4881-aaf9-7bd25b5dda08", "56c217c3-2de2-479b-990f-5c109ba8458f", "eee00933-a761-4cd0-be70-c42fe91731e7", "bab049ca-7471-4828-9024-38279a4c04da", "2a072a96-a086-49fa-bcb5-15cc5a619093", "883faa95-175a-4e22-8181-e5761aeb373c", "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "63d1ccc0-2a43-4f4b-9289-361b308991ff", "4f154fb6-27d1-4813-a759-78b93e0b9c48", "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "33be4333-2c6b-44f4-ae28-102cdbde0a31", "395907ee-96e5-4666-af2e-2ca91688e151", "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "b0ce780f-10bd-496d-9067-066d23dc3aa5", "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "79b06761-465f-4f88-9ef2-150e24d3d737", "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "c615d676-f655-46b9-b913-78729021e5d7", "b19146a3-25d4-41b4-928b-1e2a92641b1b", "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "e6474a1b-5390-49cd-ab41-8d88655f7394", "692f0bec-83ba-4d04-af7e-e884a96059b6", "93671f99-04eb-4ab4-a161-70d446a84003", "0d5675be-bc88-4172-86d3-1e96a4476536", "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "4281cb20-2994-4580-aa63-c8b86d019934", "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "a34f79a3-8e5f-4cc3-b765-de00695452c2", "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "5589ab4f-a767-433c-961d-c91f3f704db1", "e8a95b5e-c891-46e2-b33a-93937d3abc31", "c86500e9-a645-4680-98d7-f882c70c1ea3", "58f50261-c53b-4c88-bd12-1d71f12eda4c", "34ebb878-1b15-4895-b352-ca2eeb99b274", "7a02e22e-b885-4404-b38b-1ddc7e65258a", "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "24de4f3b-804c-4165-b442-5a06a2302c7e", "731231b9-0b5d-4219-94dd-abb6959aa7ea", "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "d7bcd677-645d-4691-a8d4-7a5602b780d1", "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "6e897651-f157-4d8f-aaeb-df8151488385", "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "9847f263-4a81-424f-970c-875dab15b79b", "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "4b046706-5789-4673-b111-66f25fe99534", "73bba97f-a82d-42ce-b315-9182e76c57b1", "646bc99f-6682-4b47-a73a-17b1b64c9d34", "6c96fc76-0eb1-11eb-adc1-0242ac120002", "7050bba1-1aed-454e-8f73-3f46f09ce56a", "744a188b-0415-4792-896f-11ddb0588dbc", "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "faa48cae-6b25-4f00-a094-08947fef582f", "70ad0861-d1fe-491c-a45f-fa48148a300d", "a16980c2-0c56-4de0-9a79-17971979efdd", "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "954f0af7-62dd-418f-b3df-a84bc2c7a774", "a7ee1722-c3c5-aeff-3212-c777e4733217", "1dde5376-a648-492e-9e54-4241dd9b0c7f", "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "10c14723-61c7-4c75-92ca-9af245723ad2", "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "41421f44-58f9-455d-838a-c398859841d4", "ae9b0bd7-8888-4606-b444-0ed7410cb728", "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "43103702-5886-11ed-9b6a-0242ac120002", "16905e21-66ee-42fe-b256-1318ada2d770", "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "a7c3d773-caef-227e-a7e7-c2f13c622329", "214641c2-c579-4ecb-8427-0cf19df6842e", "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "07aa184a-870d-413d-893a-157f317f6f58", "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "f548a603-c9f2-4c89-b511-b089f7e94549", "93199800-b52a-4dec-b762-75212c196542", "526be59f-a573-4eea-b5f7-f0973207634d", "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "25676e10-2121-446e-80a4-71ff8506af47", "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "ac1c92b4-ac81-405a-9978-4604d78cc47e", "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "bdeb2cff-af74-4094-8426-724dc937f20a", "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "a383dec4-deec-4e6e-913b-ed9249670848", "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "ac20ae82-8758-4f38-958e-b44a3140ca88", "54786ddc-5b8a-11ed-9b6a-0242ac120002", "41ca393d-538c-408a-ac27-cf1e038be80c", "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "cd71385d-fd9b-4691-9b98-2b1f7e508714", "c8a180d6-47a3-4345-a609-53f9c3d834fc", "044ba588-dff4-4918-9808-3f95e8160606", "1af57a4b-460a-4738-9034-db68b880c665", "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "1dd05363-104e-4b4a-b963-196a534b03a1", "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "204b17ae-4007-471b-917b-b917b315c5db", "50d66fb0-03f8-4da0-8add-84e77d12a020", "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "c2b86e67-b880-4eec-b045-50bc98ef4844", "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "e593cf51-88db-4ee1-b920-37e89012a3c9", "8202070f-edeb-4d31-a010-a26c72ac5600", "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "3268b746-88d8-4cd3-bffc-30077d02c787", "18988e1b-9087-4f8a-82fe-0414dce49878", "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "f53714ec-5077-420e-ad20-907ff9bb2958", "f117933c-980c-4f78-b384-e3d838111165", "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "a29c1813-ab1f-4dde-b489-330b952e91ae", "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "b655a06a-31c0-477a-95c2-3726b83d649d", "21d856f9-9281-4ded-9377-51a1a6e2a432", "b66474aa-bd92-4333-a16c-298155b120df", "b2309017-4235-44fe-b5af-b15363011957", "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "62510e69-616b-4078-b371-847da438cc03", "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "285b85b1-a555-4095-8652-a8a4106af63f", "84f52741-8834-4a8c-a413-2eb2269aa6c8", "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "be344333-921d-4c4d-8bb8-e584cf584780", "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "fb843269-508c-4b76-8b8d-88679db22ce7", "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "de587dce-915e-4218-aac4-835ca6af6f70", "c7942406-33dd-4377-a564-0f62db0593a3", "ab9e3b40-0c85-4ba1-aede-455d226fd124", "ef61af62-bc74-4f58-b49b-626448227652", "a20391f8-76fb-437b-abc0-dba2df1952c6", "899133d5-4d7c-4a7f-94ee-27355c879d90", "1ac8666b-046f-4201-8aba-1951aaec03a3", "1c67a717-32ba-409b-a45d-0fb704a73a81", "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "eca49c87-8a75-4f13-9c73-a5a29e845f03", "435e10e4-992a-4281-96f3-38b11106adde", "b3512211-c67e-4707-bedc-66efc7848863", "c15a46a0-07d4-4c87-b4b6-89207835a83b", "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "1f0f6176-6482-4027-b151-00071af39d7e", "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "9257c05b-4a4a-48e5-a670-b7b073cf401b", "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "99793437-3e16-439b-be0f-078782cf953d", "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "ac175779-025a-4f12-98b0-acdaeb77ea85", "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "90d50722-0483-4065-8e35-57efaadd354d", "180c7c5c-d64b-4a63-86e9-68910451bc8b", "d55b793d-f847-4eea-b59a-5ab09908ac90", "aef9d1f1-7396-4e92-a927-4567c7a495c1", "6c6d9280-e6d0-4b9d-80ac-254701b64916", "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "9212f354-7775-4e28-9c9f-8f0a4544e664", "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "ffa6861c-4461-4f59-8a41-578c39f3f23e", "a0459f02-ac51-4c09-b511-b8c9203fc429", "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "534f2ef7-e8a2-4433-816d-c91bccde289b", "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "84232095-ecca-4015-b0d7-7726507ee793", "4e2ed651-1906-4a59-a78a-18220fca1b22", "60f16a96-db70-42eb-8f76-16763e333590", "5afee48e-67dd-4e03-a783-f74259dcf998", "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "771d1eb5-9587-4568-95fb-9ec44153a012", "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "e28a5a99-da44-436d-b7a0-2afc20a5f413", "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "d2b749ee-4225-417e-b20e-a8d2193cbb84", "1193d960-2369-499f-a158-7b50a31df682", "6b65c28e-11f3-46cb-902a-68f2cafaf474", "242301bc-f92f-4476-8718-78004a6efd9f", "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "52d097e2-063e-4c9c-8fbb-855c8948d135", "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "647c7b9e-d784-4fda-b9a0-45c565a7b729", "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "bb76d96b-821c-47cf-944b-7ce377864492", "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "1816994b-42e1-4fb1-afd2-134d88184f71", "12827a56-61a4-476a-a9cb-f3068f191073", "32b96012-7892-429e-b26c-ac2bf46066ff", "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "f4bbd493-b796-416e-bbf2-121235348529", "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "d06be4b9-8045-428b-a567-740a26d9db25", "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "65c3ca2c-525f-4ced-968e-246a713d164f", "347906f3-e207-4d18-ae5b-a9403d6bcdef", "a29808fd-ef50-49ff-9c7a-59a9b040b404", "e66779cc-383e-4224-a3a4-267eeb585c40", "85c312b7-f44d-4a51-a024-d671c40b49fc", "6da2c9f5-7c53-401b-aacb-92c040ce1215", "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "ff992eac-6449-4c60-8c1d-91c9722a1d48", "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "208748f7-881d-47ac-a29c-07ea84bf691d", "89ca78fd-b37c-4310-b3d3-81a023f83936", "a2910908-e86f-4687-aeba-76a5f996e652", "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "9c14c9fa-1a63-4a64-8e57-d19280559490", "221b251a-357a-49a9-920a-271802777cc0", "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "f14e169e-9978-4c69-acb3-1cff8200bc36", "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "1c8774a0-44d4-4db0-91f8-e792359c70bd", "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "9fc3072c-dc8f-4bf7-b231-18950000fadd", "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "ada4b0c4-758b-46ac-9033-9004613a150d", "584bca0f-3608-4402-80fd-4075ff6072e3", "9a132afa-654e-11eb-ae93-0242ac130002", "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "a70dcb37-3bee-453a-99df-d0c683151be6", "85b0b087-eddf-4a2b-b033-d771fa2b9775", "2267fe65-0681-42ad-9a6d-46553d3f3480", "28c8f68b-098d-45af-8d43-8089f3e35403", "cd8c163e-a19b-402e-bdd5-419ff5859f12", "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "2c28c248-7f50-417a-9186-a85b223010ee", "84972c80-251c-4c3a-9079-4f00aad93938", "434c08ba-8406-4d15-8b24-782cb071a691", "bed2a484-9348-4143-8a8a-b801c979301c", "a0d7e4d2-bede-4141-8896-bc6e237e977c", "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "1c526788-0abe-4713-862f-b520da5e5316", "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "9f107a84-532c-41af-b005-8d12a607639f", "455b9d50-15a1-4b99-853f-8d37655a4c1b", "dee0a7a3-f200-4112-a99b-952196d81e42", "79ce34ca-af29-4d0e-b832-fc1b377020db", "2afafd61-6aae-4df4-baed-139fa1f4c345", "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "f0507c0f-a3a2-40f5-acc6-7f543c334993", "970007b7-ce32-49d0-a4a4-fbef016950bd", "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "b2ddd389-f676-4ac4-845a-e00781a48e5f", "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "4a6713f6-3331-11ed-a261-0242ac120002", "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "5cc2cda8-f261-4d88-a2de-e9e193c86716", "01c42d3c-242d-4655-85b2-34f1739632f7", "77946e79-97f1-45a2-84b4-f37b5c0d8682", "27ba3207-dd30-4812-abbf-5d20c57d474e", "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "1228c958-e64e-4e71-92ad-7d429f4138ba", "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "b1377339-fda6-477a-b455-ac0923f9ec2c", "44143844-0631-49ab-97a0-96387d6b2d7c", "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "85de1f22-d189-44e4-8239-dc276b45379b", "92626ddd-662c-49e3-ac59-f6535f12d189", "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "e56d3073-83ff-4021-90fe-c658e0709e72", "deb9b646-a508-44ee-b7c9-d8965921c6b6", "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "cea2b7ea-792b-405f-95a1-b903ea06458f", "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "730fc21b-eaff-474b-ad23-90fd265d4988", "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "48917adc-a28e-4f5d-b729-11e75da8941f", "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "0900463c-b33b-49a8-be1d-552a3b553dae", "82a6714f-4899-4f16-9c1e-9a333544d4c3", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "1e59c230-6670-45bf-83b0-98903780607e", "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "258fc8ce-8352-443a-9120-8a11e4857fa5", "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "4ae81040-fc1c-4249-bfa3-938d260214d9", "aa2efee7-34dd-446e-8a37-40790a66efd7", "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "ae215552-081e-44c7-805f-be16f975c8a2", "30bf1789-379d-4fdc-900f-55cd0a90a801", "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "4f7a6757-ff79-46db-9687-66501a02d9ec", "129966c9-de17-4334-a123-8b58172e664d", "696bfb54-227e-4602-ac5b-30d9d2053312", "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "7df1713a-1a5b-4a4b-a071-dc83b144a101", "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "814c95cc-8192-4378-a70a-f1aafd877af1", "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "99c840f2-2012-46fd-9141-c761987550ef", "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "de16d92c-c446-4d53-8938-10aeef41c8b6", "056c7317-9a09-4bd4-9067-d051312752ea", "60fc936d-2eb0-4543-8a13-911c750a1dfc", "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "114de787-4eb2-48cc-abdb-c0b449f93ea4", "207b0396-3689-42d9-8399-4222658efc99", "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "9248c7e1-2bf3-4661-a22c-600a8040b446", "146aace8-9bd6-42ba-be7a-0070d8027b76", "3d7679bd-0c00-440c-97b0-3f204273e6c7", "ea011323-7045-460b-b2d7-0f7442ea6b38", "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "e290b10b-1023-4452-a4a9-eb31a9013b3a", "ca5583e9-8f80-46ac-ab91-7f314d13b984", "cd3d1298-eb3b-476c-ac67-12847de55813", "867356ee-9352-41c9-a8f2-1be690d78216", "67f113fa-e23d-4271-befa-30113b3e08b1", "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "62b20d44-1546-4e61-afce-8e175eb9473c", "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "b6676963-0353-4f88-90f5-36c20d443c6a", "99cf1e02-00fb-4c0d-8375-563f978dfd37", "903076ff-f442-475a-b667-4f246bcc203b", "a77c1610-fc73-4019-8e29-0f51efc04a51", "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "cea72823-df4d-4567-950c-0b579eaf0846", "74a2b202-73e0-4693-9a3a-9d36146d0775", "5fc297ae-25b6-488a-8f25-cc12ac29b744", "12f6b752-042d-483e-bf9c-915a6d06ad75", "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "c1d867fe-8d95-4487-aab4-e53f2d339f90", "e13f668e-7f95-443d-98d2-1816a7648a7b", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "9c8c7000-3065-44a8-a555-79bcba5d9955", "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "ee5e119b-1f75-4b34-add8-3be976961e39", "33339be3-148b-4e16-af56-ad16ec6c7e7b", "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "646ea171-dded-4578-8a4d-65e9822892e3", "84b1706c-932a-44c4-ae28-892b28a25b94", "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "074e0ded-6ced-4ebd-8b4d-53f55908119d", "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "af491bca-e752-4b44-9c86-df5680533dbc", "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "f0f7be61-9cf5-43be-9836-99d6ef448a18", "b1f73849-6329-4069-bc8f-78a604bb8b23", "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "0b80ade5-6997-4b1d-99a1-71701778ea61", "81ebd28b-9607-4478-bf06-974ed9d53ed7", "dc4576d4-7467-424f-9eee-fd2b02855fe0", "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "e9142d84-fbe0-401d-ac50-3e519fb00c89", "b4dc61f5-6cce-468e-a608-b48b469feaa2", "e6313acd-208c-44fc-a0ff-db85d572e90e", "f3d39c45-de1a-4486-a687-ab126124f744", "97dbf6e2-e436-44d8-abee-4261b24d3e41", "0fc35fc3-efe6-4898-8a37-0b233339524f", "c947b146-0abc-4c87-9c64-b17e9d7274a2", "91a2c315-9ee6-4052-a853-6f6a8238f90d", "9525dc73-0327-438c-8c04-13c0e037e9da", "a4694263-59a8-4608-a3a0-6f8d3a51664c", "f37aba28-a9e6-4045-882c-d5004043b337", "5e95028c-5229-4214-afae-d653d573d0ec", "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "f7375e28-5c14-432f-b8d1-1db26c832df3", "0e0255bf-2548-47b8-9582-c0955c9283f5", "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "889719ef-dd62-43df-86c3-768fb08dc7c0", "af77cf95-c469-471c-b6a0-946c685c4798", "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "4bf943c6-5146-4273-98dd-e958fd1e3abf", "7f741dcf-fc22-4759-87b4-9ae8376676a2", "8a3038e8-9c9d-46f8-b184-66234a160f6f", "7d4aaec2-08ed-4430-8b96-28420e030e04", "75d0a94e-6252-448d-a7be-d953dff527bb", "327f48c1-a6db-4eb8-875a-f6981f1b0183", "5f03babb-12db-4eec-8c82-7b4cb5580868", "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "cd1f961e-0b96-436b-b7c6-38da4583ec00", "7b4f794b-590a-4ad4-ba18-7964a2832205", "438025f9-5856-4663-83f7-52f878a70a50", "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "213d6a77-3d55-4ce8-ba74-fcfef741974e", "aaafa146-074c-11eb-adc1-0242ac120002", "2433a154-bb3d-42e4-86c3-a26bdac91c45", "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "4f647cfa-b598-4e12-ad69-c68dd16caef8", "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "17769c90-230e-488b-a463-e05c08e9d48f", "e173ad47-4388-4012-ae62-bd13f71c18a8", "48bbc537-b652-4b4e-bd1d-281172df448f", "1edff897-9146-48d2-9066-52e8d8f80a2f", "c248c896-e412-4279-8c15-1c558067b6fa", "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "d522eca2-2973-4391-a3e0-ef0374321dae", "62e0298b-e994-4189-bc87-bc699aa62d97", "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "a537cfc3-4297-4789-92b5-345bfd845ad0", "4a2a2c3e-209f-4d01-b513-4155a540b469", "f64e5c19-879c-4bae-b471-6d84c8339677", "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "536e2947-3729-478c-9903-745aaffe60d2", "40aa399c-7b02-4715-8e5f-73572b493f33", "883835a7-df45-43e4-bf1d-4268768afda4", "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "b57ba453-b384-4ab9-9f40-1038086b4e53", "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "3bad990e-4848-4a78-9530-b427d854aac0", "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "09576804-7a05-458e-a817-eb718ca91f54", "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "b0524451-19af-4efa-a46f-562a977f792e", "b96b2031-7c17-4473-afe7-a30ce714db29", "37c1333a-a0db-48be-b64b-7393b2386e3b", "81325ce1-be01-4250-944f-b4789644556f", "3abd6094-7027-475f-9630-8ab9be7b9725", "d9047477-0359-48c9-b8c7-792cedcdc9c4", "56d19cb4-6414-4769-9644-1ed35ffbb148", "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "5cdb711b-5740-4fb2-ba88-f7945027afac", "164eda96-11b2-430b-85ff-6a265c15bf32", "a58353df-af43-4753-bad0-cd83ef35eef5", "56321594-9087-49d9-bf10-524fe8479452"]}, "errors": {"uberAgent (develop)": {"missing_field": {"dst_port": {"refs": ["d7fb8f0e-bd5f-45c2-b467-19571c490d7e"], "logsource.categories": ["firewall"], "logsource.products": [null]}, "EventID": {"refs": ["f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7"], "logsource.categories": ["registry_event"], "logsource.products": ["windows"]}, "User": {"refs": ["f674e36a-4b91-431e-8aef-f8a96c2aca35", "944e8941-f6f6-4ee8-ac05-1c224e923c0e"], "logsource.categories": ["registry_set"], "logsource.products": ["windows"]}, "Description": {"refs": ["092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "cbb56d62-4060-40f7-9466-d8aaf3123f83", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "754ed792-634f-40ae-b3bc-e0448d33f695", "145322e4-0fd3-486b-81ca-9addc75736d8", "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "52ff7941-8211-46f9-84f8-9903efb7077d", "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "b1876533-4ed5-4a83-90f3-b8645840a413", "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "758ff488-18d5-4cbe-8ec4-02b6285a434f", "d08a2711-ee8b-4323-bdec-b7d85e892b31", "46123129-1024-423e-9fae-43af4a0fa9a5", "6938366d-8954-4ddc-baff-c830b3ba8fcd", "0ba1da6d-b6ce-4366-828c-18826c9de23e", "9fbf5927-5261-4284-a71d-f681029ea574", "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "54773c5f-f1cc-4703-9126-2f797d96a69d", "d679950c-abb7-43a6-80fb-2a480c4fc450", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "03552375-cc2c-4883-bbe4-7958d5a980be", "87911521-7098-470b-a459-9a57fc80bdfd", "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "48a61b29-389f-4032-b317-b30de6b95314", "0b0cd537-fc77-4e6e-a973-e53495c1083d", "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "fca949cc-79ca-446e-8064-01aa7e52ece5", "e37db05d-d1f9-49c8-b464-cee1a4b11638", "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "9d5a1274-922a-49d0-87f3-8c653483b909", "7530cd3d-7671-43e3-b209-976966f6ea48", "41f407b5-3096-44ea-a74f-96d04fbc41be", "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "5722dff1-4bdd-4949-86ab-fbaf707e767a", "eb2d07d4-49cb-4523-801a-da002df36602", "811e0002-b13b-4a15-9d00-a613fce66e42", "762f2482-ff21-4970-8939-0aa317a886bb", "38646daa-e78f-4ace-9de0-55547b2d30da", "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "c4e49831-1496-40cf-8ce1-b53f942b02f9", "2c32b543-1058-4808-91c6-5b31b8bed6c5", "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "b52e84a3-029e-4529-b09b-71d19dd27e94", "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "198effb6-6c98-4d0c-9ea3-451fa143c45c", "d85873ef-a0f8-4c48-a53a-6b621f11729d", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "f38a82d2-fba3-4781-b549-525efbec8506", "57bff678-25d1-4d6c-8211-8ca106d12053", "037dcd71-33a8-4392-bb01-293c94663e5a", "afe52666-401e-4a02-b4ff-5d128990b8cb", "4ede543c-e098-43d9-a28f-dd784a13132f", "bb780e0c-16cf-4383-8383-1e5471db6cf9", "148431ce-4b70-403d-8525-fcc2993f29ea"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Product": {"refs": ["d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "9ef27c24-4903-4192-881a-3adde7ff92a5", "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "b37998de-a70b-4f33-b219-ec36bf433dc0", "26488ad0-f9fd-4536-876f-52fea846a2e4", "c625d754-6a3d-4f65-9c9a-536aea960d37", "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "24c77512-782b-448a-8950-eddb0785fc71", "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "e01fa958-6893-41d4-ae03-182477c5e77d", "a96970af-f126-420d-90e1-d37bf25e50e1", "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "0afbd410-de03-4078-8491-f132303cb67d", "37e8d358-6408-4853-82f4-98333fca7014", "ca387a8e-1c84-4da3-9993-028b45342d30", "4833155a-4053-4c9c-a997-777fcea0baa7", "88656cec-6c3b-487c-82c0-f73ebb805503", "cd764533-2e07-40d6-a718-cfeec7f2da7f"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "PreviousCreationUtcTime": {"refs": ["558eebe5-f2ba-4104-b339-36f7902bcc1a"], "logsource.categories": ["file_change"], "logsource.products": ["windows"]}, "Initiated": {"refs": ["5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4", "d58ba5c6-0ed7-4b9d-a433-6878379efda9", "7610a4ea-c06d-495f-a2ac-0a696abcfd3b", "3ab65069-d82a-4d44-a759-466661a082d1", "5c80b618-0dbb-46e6-acbb-03d90bcb6d83", "c539afac-c12a-46ed-b1bd-5a5567c9f045", "cdc8da7d-c303-42f8-b08c-b4ab47230263", "3b5ba899-9842-4bc2-acc2-12308498bf42", "9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4", "8d7e392e-9b28-49e1-831d-5949c6281228", "5205613d-2a63-4412-a895-3a2458b587b3", "786cdae8-fefb-4eb2-9227-04e34060db01", "b1e5da3b-ca8e-4adf-915c-9921f3d85481", "e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97", "b3ad3c0f-c949-47a1-a30e-b0491ccae876", "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7", "18249279-932f-45e2-b37a-8925f2597670", "50e54b8d-ad73-43f8-96a1-5191685b17a4", "9e02c8ec-02b9-43e8-81eb-34a475ba7965", "ed74fe75-7594-4b4b-ae38-e38e3fd2eb23", "08249dc0-a28d-4555-8ba5-9255a198e08c", "7b434893-c57d-4f41-908d-6a17bf1ae98f", "7cd1dcdc-6edf-4896-86dc-d1f19ad64903", "992a6cae-db6a-43c8-9cec-76d7195c96fc", "4b657234-038e-4ad5-997c-4be42340bce4", "bef0bc5a-b9ae-425d-85c6-7b2d705980c6", "efafe0bf-4238-479e-af8f-797bd3490d2d", "75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84", "0531e43a-d77d-47c2-b89f-5fe50321c805", "e54979bd-c5f9-4d6c-967b-a04b19ac4c74", "4b89abaa-99fe-4232-afdd-8f9aa4d20382", "07837ab9-60e1-481f-a74d-c31fb496a94c", "c7e91a02-d771-4a6d-a700-42587e0b1095", "37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1", "0dba975d-a193-4ed1-a067-424df57570d1", "9976fa64-2804-423c-8a5b-646ade840773", "20384606-a124-4fec-acbb-8bd373728613", "25eabf56-22f0-4915-a1ed-056b8dae0a68", "6d8c3d20-a5e1-494f-8412-4571d716cf5c", "fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4"], "logsource.categories": ["network_connection"], "logsource.products": ["windows"]}, "Type": {"refs": ["c4b890e5-8d8c-4496-8c66-c805753817cd"], "logsource.categories": ["process_tampering"], "logsource.products": ["windows"]}, "SourceImage": {"refs": ["2e4e488a-6164-4811-9ea1-f960c7359c40", "66d31e5f-52d6-40a4-9615-002d3789a119", "02d1d718-dd13-41af-989d-ea85c7fab93f", "99b97608-3e21-4bfe-8217-2a127c396a0e", "c15e99a3-c474-48ab-b9a7-84549a7a9d16", "a1a144b7-5c9b-4853-a559-2172be8d4a03", "c0aac16a-b1e7-4330-bab0-3c27bb4987c7", "fb656378-f909-47c1-8747-278bf09f4f4f"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "StartAddress": {"refs": ["6309645e-122d-4c5b-bb2b-22e4f9c2fa42"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "IntegrityLevel": {"refs": ["0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "3c05e90d-7eba-4324-9972-5d7f711a60a8", "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "3037d961-21e9-4732-b27a-637bcc7bf539", "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "40f9af16-589d-4984-b78d-8c2aec023197", "4cbef972-f347-4170-b62a-8253f6168e6d", "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "853e74f9-9392-4935-ad3b-2e8c040dae86", "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "89a9a0e0-f61a-42e5-8957-b1479565a658", "a743ceba-c771-4d75-97eb-8a90f7f4844c", "b697e69c-746f-4a86-9f59-7bfff8eab881", "7a01183d-71a2-46ad-ad5c-acd989ac1793", "224f140f-3553-4cd1-af78-13d81bf9f7cc", "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "80fc36aa-945e-4181-89f2-2f907ab6775d", "d937b75f-a665-4480-88a5-2f20e9f9b22a", "1ca6bd18-0ba0-44ca-851c-92ed89a61085"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "CurrentDirectory": {"refs": ["631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "95eadcb2-92e4-4ed1-9031-92547773a6db", "ed825c86-c009-4014-b413-b76003e33d35", "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "02b18447-ea83-4b1b-8805-714a8a34546a", "3a6586ad-127a-4d3b-a677-1e6eacdf8fde"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Provider_Name": {"refs": ["7dc2dedd-7603-461a-bc13-15803d132355"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "ParentUser": {"refs": ["590a5f4c-6c8c-4f10-8307-89afe9453a9d", "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "LogonId": {"refs": ["d21374ff-f574-44a7-9998-4a8c8bf33d7d", "178e615d-e666-498b-9630-9ed363038101"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}}}, "uberAgent 7.3": {"missing_field": {"dst_port": {"refs": ["d7fb8f0e-bd5f-45c2-b467-19571c490d7e"], "logsource.categories": ["firewall"], "logsource.products": [null]}, "EventID": {"refs": ["f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7"], "logsource.categories": ["registry_event"], "logsource.products": ["windows"]}, "User": {"refs": ["f674e36a-4b91-431e-8aef-f8a96c2aca35", "944e8941-f6f6-4ee8-ac05-1c224e923c0e"], "logsource.categories": ["registry_set"], "logsource.products": ["windows"]}, "Description": {"refs": ["092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "cbb56d62-4060-40f7-9466-d8aaf3123f83", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "754ed792-634f-40ae-b3bc-e0448d33f695", "145322e4-0fd3-486b-81ca-9addc75736d8", "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "52ff7941-8211-46f9-84f8-9903efb7077d", "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "b1876533-4ed5-4a83-90f3-b8645840a413", "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "758ff488-18d5-4cbe-8ec4-02b6285a434f", "d08a2711-ee8b-4323-bdec-b7d85e892b31", "46123129-1024-423e-9fae-43af4a0fa9a5", "6938366d-8954-4ddc-baff-c830b3ba8fcd", "0ba1da6d-b6ce-4366-828c-18826c9de23e", "9fbf5927-5261-4284-a71d-f681029ea574", "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "54773c5f-f1cc-4703-9126-2f797d96a69d", "d679950c-abb7-43a6-80fb-2a480c4fc450", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "03552375-cc2c-4883-bbe4-7958d5a980be", "87911521-7098-470b-a459-9a57fc80bdfd", "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "48a61b29-389f-4032-b317-b30de6b95314", "0b0cd537-fc77-4e6e-a973-e53495c1083d", "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "fca949cc-79ca-446e-8064-01aa7e52ece5", "e37db05d-d1f9-49c8-b464-cee1a4b11638", "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "9d5a1274-922a-49d0-87f3-8c653483b909", "7530cd3d-7671-43e3-b209-976966f6ea48", "41f407b5-3096-44ea-a74f-96d04fbc41be", "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "5722dff1-4bdd-4949-86ab-fbaf707e767a", "eb2d07d4-49cb-4523-801a-da002df36602", "811e0002-b13b-4a15-9d00-a613fce66e42", "762f2482-ff21-4970-8939-0aa317a886bb", "38646daa-e78f-4ace-9de0-55547b2d30da", "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "c4e49831-1496-40cf-8ce1-b53f942b02f9", "2c32b543-1058-4808-91c6-5b31b8bed6c5", "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "b52e84a3-029e-4529-b09b-71d19dd27e94", "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "198effb6-6c98-4d0c-9ea3-451fa143c45c", "d85873ef-a0f8-4c48-a53a-6b621f11729d", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "f38a82d2-fba3-4781-b549-525efbec8506", "57bff678-25d1-4d6c-8211-8ca106d12053", "037dcd71-33a8-4392-bb01-293c94663e5a", "afe52666-401e-4a02-b4ff-5d128990b8cb", "4ede543c-e098-43d9-a28f-dd784a13132f", "bb780e0c-16cf-4383-8383-1e5471db6cf9", "148431ce-4b70-403d-8525-fcc2993f29ea"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Product": {"refs": ["d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "9ef27c24-4903-4192-881a-3adde7ff92a5", "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "b37998de-a70b-4f33-b219-ec36bf433dc0", "26488ad0-f9fd-4536-876f-52fea846a2e4", "c625d754-6a3d-4f65-9c9a-536aea960d37", "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "24c77512-782b-448a-8950-eddb0785fc71", "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "e01fa958-6893-41d4-ae03-182477c5e77d", "a96970af-f126-420d-90e1-d37bf25e50e1", "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "0afbd410-de03-4078-8491-f132303cb67d", "37e8d358-6408-4853-82f4-98333fca7014", "ca387a8e-1c84-4da3-9993-028b45342d30", "4833155a-4053-4c9c-a997-777fcea0baa7", "88656cec-6c3b-487c-82c0-f73ebb805503", "cd764533-2e07-40d6-a718-cfeec7f2da7f"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "PreviousCreationUtcTime": {"refs": ["558eebe5-f2ba-4104-b339-36f7902bcc1a"], "logsource.categories": ["file_change"], "logsource.products": ["windows"]}, "Initiated": {"refs": ["5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4", "d58ba5c6-0ed7-4b9d-a433-6878379efda9", "7610a4ea-c06d-495f-a2ac-0a696abcfd3b", "3ab65069-d82a-4d44-a759-466661a082d1", "5c80b618-0dbb-46e6-acbb-03d90bcb6d83", "c539afac-c12a-46ed-b1bd-5a5567c9f045", "cdc8da7d-c303-42f8-b08c-b4ab47230263", "3b5ba899-9842-4bc2-acc2-12308498bf42", "9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4", "8d7e392e-9b28-49e1-831d-5949c6281228", "5205613d-2a63-4412-a895-3a2458b587b3", "786cdae8-fefb-4eb2-9227-04e34060db01", "b1e5da3b-ca8e-4adf-915c-9921f3d85481", "e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97", "b3ad3c0f-c949-47a1-a30e-b0491ccae876", "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7", "18249279-932f-45e2-b37a-8925f2597670", "50e54b8d-ad73-43f8-96a1-5191685b17a4", "9e02c8ec-02b9-43e8-81eb-34a475ba7965", "ed74fe75-7594-4b4b-ae38-e38e3fd2eb23", "08249dc0-a28d-4555-8ba5-9255a198e08c", "7b434893-c57d-4f41-908d-6a17bf1ae98f", "7cd1dcdc-6edf-4896-86dc-d1f19ad64903", "992a6cae-db6a-43c8-9cec-76d7195c96fc", "4b657234-038e-4ad5-997c-4be42340bce4", "bef0bc5a-b9ae-425d-85c6-7b2d705980c6", "efafe0bf-4238-479e-af8f-797bd3490d2d", "75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84", "0531e43a-d77d-47c2-b89f-5fe50321c805", "e54979bd-c5f9-4d6c-967b-a04b19ac4c74", "4b89abaa-99fe-4232-afdd-8f9aa4d20382", "07837ab9-60e1-481f-a74d-c31fb496a94c", "c7e91a02-d771-4a6d-a700-42587e0b1095", "37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1", "0dba975d-a193-4ed1-a067-424df57570d1", "9976fa64-2804-423c-8a5b-646ade840773", "20384606-a124-4fec-acbb-8bd373728613", "25eabf56-22f0-4915-a1ed-056b8dae0a68", "6d8c3d20-a5e1-494f-8412-4571d716cf5c", "fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4"], "logsource.categories": ["network_connection"], "logsource.products": ["windows"]}, "Type": {"refs": ["c4b890e5-8d8c-4496-8c66-c805753817cd"], "logsource.categories": ["process_tampering"], "logsource.products": ["windows"]}, "SourceImage": {"refs": ["2e4e488a-6164-4811-9ea1-f960c7359c40", "66d31e5f-52d6-40a4-9615-002d3789a119", "02d1d718-dd13-41af-989d-ea85c7fab93f", "99b97608-3e21-4bfe-8217-2a127c396a0e", "c15e99a3-c474-48ab-b9a7-84549a7a9d16", "a1a144b7-5c9b-4853-a559-2172be8d4a03", "c0aac16a-b1e7-4330-bab0-3c27bb4987c7", "fb656378-f909-47c1-8747-278bf09f4f4f"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "StartAddress": {"refs": ["6309645e-122d-4c5b-bb2b-22e4f9c2fa42"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "IntegrityLevel": {"refs": ["0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "3c05e90d-7eba-4324-9972-5d7f711a60a8", "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "3037d961-21e9-4732-b27a-637bcc7bf539", "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "40f9af16-589d-4984-b78d-8c2aec023197", "4cbef972-f347-4170-b62a-8253f6168e6d", "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "853e74f9-9392-4935-ad3b-2e8c040dae86", "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "89a9a0e0-f61a-42e5-8957-b1479565a658", "a743ceba-c771-4d75-97eb-8a90f7f4844c", "b697e69c-746f-4a86-9f59-7bfff8eab881", "7a01183d-71a2-46ad-ad5c-acd989ac1793", "224f140f-3553-4cd1-af78-13d81bf9f7cc", "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "80fc36aa-945e-4181-89f2-2f907ab6775d", "d937b75f-a665-4480-88a5-2f20e9f9b22a", "1ca6bd18-0ba0-44ca-851c-92ed89a61085"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "CurrentDirectory": {"refs": ["631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "95eadcb2-92e4-4ed1-9031-92547773a6db", "ed825c86-c009-4014-b413-b76003e33d35", "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "02b18447-ea83-4b1b-8805-714a8a34546a", "3a6586ad-127a-4d3b-a677-1e6eacdf8fde"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Provider_Name": {"refs": ["7dc2dedd-7603-461a-bc13-15803d132355"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "ParentUser": {"refs": ["590a5f4c-6c8c-4f10-8307-89afe9453a9d", "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "LogonId": {"refs": ["d21374ff-f574-44a7-9998-4a8c8bf33d7d", "178e615d-e666-498b-9630-9ed363038101"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}}}, "uberAgent 7.2": {"missing_field": {"dst_port": {"refs": ["d7fb8f0e-bd5f-45c2-b467-19571c490d7e"], "logsource.categories": ["firewall"], "logsource.products": [null]}, "EventID": {"refs": ["f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7"], "logsource.categories": ["registry_event"], "logsource.products": ["windows"]}, "User": {"refs": ["f674e36a-4b91-431e-8aef-f8a96c2aca35", "944e8941-f6f6-4ee8-ac05-1c224e923c0e"], "logsource.categories": ["registry_set"], "logsource.products": ["windows"]}, "Description": {"refs": ["092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "cbb56d62-4060-40f7-9466-d8aaf3123f83", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "754ed792-634f-40ae-b3bc-e0448d33f695", "145322e4-0fd3-486b-81ca-9addc75736d8", "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "52ff7941-8211-46f9-84f8-9903efb7077d", "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "b1876533-4ed5-4a83-90f3-b8645840a413", "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "758ff488-18d5-4cbe-8ec4-02b6285a434f", "d08a2711-ee8b-4323-bdec-b7d85e892b31", "46123129-1024-423e-9fae-43af4a0fa9a5", "6938366d-8954-4ddc-baff-c830b3ba8fcd", "0ba1da6d-b6ce-4366-828c-18826c9de23e", "9fbf5927-5261-4284-a71d-f681029ea574", "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "54773c5f-f1cc-4703-9126-2f797d96a69d", "d679950c-abb7-43a6-80fb-2a480c4fc450", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "03552375-cc2c-4883-bbe4-7958d5a980be", "87911521-7098-470b-a459-9a57fc80bdfd", "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "48a61b29-389f-4032-b317-b30de6b95314", "0b0cd537-fc77-4e6e-a973-e53495c1083d", "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "fca949cc-79ca-446e-8064-01aa7e52ece5", "e37db05d-d1f9-49c8-b464-cee1a4b11638", "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "9d5a1274-922a-49d0-87f3-8c653483b909", "7530cd3d-7671-43e3-b209-976966f6ea48", "41f407b5-3096-44ea-a74f-96d04fbc41be", "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "5722dff1-4bdd-4949-86ab-fbaf707e767a", "eb2d07d4-49cb-4523-801a-da002df36602", "811e0002-b13b-4a15-9d00-a613fce66e42", "762f2482-ff21-4970-8939-0aa317a886bb", "38646daa-e78f-4ace-9de0-55547b2d30da", "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "c4e49831-1496-40cf-8ce1-b53f942b02f9", "2c32b543-1058-4808-91c6-5b31b8bed6c5", "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "b52e84a3-029e-4529-b09b-71d19dd27e94", "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "198effb6-6c98-4d0c-9ea3-451fa143c45c", "d85873ef-a0f8-4c48-a53a-6b621f11729d", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "f38a82d2-fba3-4781-b549-525efbec8506", "57bff678-25d1-4d6c-8211-8ca106d12053", "037dcd71-33a8-4392-bb01-293c94663e5a", "afe52666-401e-4a02-b4ff-5d128990b8cb", "4ede543c-e098-43d9-a28f-dd784a13132f", "bb780e0c-16cf-4383-8383-1e5471db6cf9", "148431ce-4b70-403d-8525-fcc2993f29ea"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Product": {"refs": ["d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "9ef27c24-4903-4192-881a-3adde7ff92a5", "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "b37998de-a70b-4f33-b219-ec36bf433dc0", "26488ad0-f9fd-4536-876f-52fea846a2e4", "c625d754-6a3d-4f65-9c9a-536aea960d37", "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "24c77512-782b-448a-8950-eddb0785fc71", "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "e01fa958-6893-41d4-ae03-182477c5e77d", "a96970af-f126-420d-90e1-d37bf25e50e1", "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "0afbd410-de03-4078-8491-f132303cb67d", "37e8d358-6408-4853-82f4-98333fca7014", "ca387a8e-1c84-4da3-9993-028b45342d30", "4833155a-4053-4c9c-a997-777fcea0baa7", "88656cec-6c3b-487c-82c0-f73ebb805503", "cd764533-2e07-40d6-a718-cfeec7f2da7f"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "PreviousCreationUtcTime": {"refs": ["558eebe5-f2ba-4104-b339-36f7902bcc1a"], "logsource.categories": ["file_change"], "logsource.products": ["windows"]}, "Initiated": {"refs": ["5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4", "d58ba5c6-0ed7-4b9d-a433-6878379efda9", "7610a4ea-c06d-495f-a2ac-0a696abcfd3b", "3ab65069-d82a-4d44-a759-466661a082d1", "5c80b618-0dbb-46e6-acbb-03d90bcb6d83", "c539afac-c12a-46ed-b1bd-5a5567c9f045", "cdc8da7d-c303-42f8-b08c-b4ab47230263", "3b5ba899-9842-4bc2-acc2-12308498bf42", "9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4", "8d7e392e-9b28-49e1-831d-5949c6281228", "5205613d-2a63-4412-a895-3a2458b587b3", "786cdae8-fefb-4eb2-9227-04e34060db01", "b1e5da3b-ca8e-4adf-915c-9921f3d85481", "e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97", "b3ad3c0f-c949-47a1-a30e-b0491ccae876", "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7", "18249279-932f-45e2-b37a-8925f2597670", "50e54b8d-ad73-43f8-96a1-5191685b17a4", "9e02c8ec-02b9-43e8-81eb-34a475ba7965", "ed74fe75-7594-4b4b-ae38-e38e3fd2eb23", "08249dc0-a28d-4555-8ba5-9255a198e08c", "7b434893-c57d-4f41-908d-6a17bf1ae98f", "7cd1dcdc-6edf-4896-86dc-d1f19ad64903", "992a6cae-db6a-43c8-9cec-76d7195c96fc", "4b657234-038e-4ad5-997c-4be42340bce4", "bef0bc5a-b9ae-425d-85c6-7b2d705980c6", "efafe0bf-4238-479e-af8f-797bd3490d2d", "75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84", "0531e43a-d77d-47c2-b89f-5fe50321c805", "e54979bd-c5f9-4d6c-967b-a04b19ac4c74", "4b89abaa-99fe-4232-afdd-8f9aa4d20382", "07837ab9-60e1-481f-a74d-c31fb496a94c", "c7e91a02-d771-4a6d-a700-42587e0b1095", "37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1", "0dba975d-a193-4ed1-a067-424df57570d1", "9976fa64-2804-423c-8a5b-646ade840773", "20384606-a124-4fec-acbb-8bd373728613", "25eabf56-22f0-4915-a1ed-056b8dae0a68", "6d8c3d20-a5e1-494f-8412-4571d716cf5c", "fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4"], "logsource.categories": ["network_connection"], "logsource.products": ["windows"]}, "Type": {"refs": ["c4b890e5-8d8c-4496-8c66-c805753817cd"], "logsource.categories": ["process_tampering"], "logsource.products": ["windows"]}, "SourceImage": {"refs": ["2e4e488a-6164-4811-9ea1-f960c7359c40", "66d31e5f-52d6-40a4-9615-002d3789a119", "02d1d718-dd13-41af-989d-ea85c7fab93f", "99b97608-3e21-4bfe-8217-2a127c396a0e", "c15e99a3-c474-48ab-b9a7-84549a7a9d16", "a1a144b7-5c9b-4853-a559-2172be8d4a03", "c0aac16a-b1e7-4330-bab0-3c27bb4987c7", "fb656378-f909-47c1-8747-278bf09f4f4f"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "StartAddress": {"refs": ["6309645e-122d-4c5b-bb2b-22e4f9c2fa42"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "IntegrityLevel": {"refs": ["0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "3c05e90d-7eba-4324-9972-5d7f711a60a8", "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "3037d961-21e9-4732-b27a-637bcc7bf539", "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "40f9af16-589d-4984-b78d-8c2aec023197", "4cbef972-f347-4170-b62a-8253f6168e6d", "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "853e74f9-9392-4935-ad3b-2e8c040dae86", "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "89a9a0e0-f61a-42e5-8957-b1479565a658", "a743ceba-c771-4d75-97eb-8a90f7f4844c", "b697e69c-746f-4a86-9f59-7bfff8eab881", "7a01183d-71a2-46ad-ad5c-acd989ac1793", "224f140f-3553-4cd1-af78-13d81bf9f7cc", "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "80fc36aa-945e-4181-89f2-2f907ab6775d", "d937b75f-a665-4480-88a5-2f20e9f9b22a", "1ca6bd18-0ba0-44ca-851c-92ed89a61085"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "CurrentDirectory": {"refs": ["631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "95eadcb2-92e4-4ed1-9031-92547773a6db", "ed825c86-c009-4014-b413-b76003e33d35", "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "02b18447-ea83-4b1b-8805-714a8a34546a", "3a6586ad-127a-4d3b-a677-1e6eacdf8fde"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Provider_Name": {"refs": ["7dc2dedd-7603-461a-bc13-15803d132355"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "ParentUser": {"refs": ["590a5f4c-6c8c-4f10-8307-89afe9453a9d", "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "LogonId": {"refs": ["d21374ff-f574-44a7-9998-4a8c8bf33d7d", "178e615d-e666-498b-9630-9ed363038101"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}}}, "uberAgent 7.1": {"missing_field": {"dst_port": {"refs": ["d7fb8f0e-bd5f-45c2-b467-19571c490d7e"], "logsource.categories": ["firewall"], "logsource.products": [null]}, "TargetObject": {"refs": ["47e0852a-cf81-4494-a8e6-31864f8c86ed", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "295a59c1-7b79-4b47-a930-df12c15fc9c2", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "5aad0995-46ab-41bd-a9ff-724f41114971", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "4d431012-2ab5-4db7-a84e-b29809da2172", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "b3503044-60ce-4bf4-bbcb-e3db98788823", "a6b33c02-8305-488f-8585-03cb2a7763f2", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "55e29995-75e7-451a-bef0-6225e2f13597", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "b6d235fc-1d38-4b12-adbe-325f06728f37", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "6ea3bf32-9680-422d-9f50-e90716b12a66", "baca5663-583c-45f9-b5dc-ea96a22ce542", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "62120148-6b7a-42be-8b91-271c04e281a3", "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "92772523-d9c1-4c93-9547-b0ca500baba3", "790317c0-0a36-4a6a-a105-6e576bf99a14", "707e097c-e20f-4f67-8807-1f72ff4500d6", "396ae3eb-4174-4b9b-880e-dc0364d78a19", "e61e8a88-59a9-451c-874e-70fcc9740d67", "48437c39-9e5f-47fb-af95-3d663c3f2919", "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "509e84b9-a71a-40e0-834f-05470369bd1e", "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "7d9263bd-dc47-4a58-bc92-5474abab390c", "c5f6a85d-b647-40f7-bbad-c10b66bab038", "8ffc5407-52e3-478f-9596-0a7371eafe13", "bf344fea-d947-4ef4-9192-34d008315d3a", "5a93eb65-dffa-4543-b761-94aa60098fb6", "7c81fec3-1c1d-43b0-996a-46753041b1b6", "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "e3fdf743-f05b-4051-990a-b66919be1743", "6b6976a3-b0e6-4723-ac24-ae38a737af41", "f7997770-92c3-4ec9-b112-774c4ef96f96", "966315ef-c5e1-4767-ba25-fce9c8de3660", "e7b18879-676e-4a0e-ae18-27039185a8e7", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "8023f872-3f1d-4301-a384-801889917ab4", "44a22d59-b175-4f13-8c16-cbaef5b581ff", "fe20dda1-6f37-4379-bbe0-a98d400cae90", "b7916c2a-fa2f-4795-9477-32b731f70f11", "b86852fb-4c77-48f9-8519-eb1b2c308b59", "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "dc5c24af-6995-49b2-86eb-a9ff62199e82", "92b0b372-a939-44ed-a11b-5136cf680e27", "1c3121ed-041b-4d97-a075-07f54f20fb4a", "9df5f547-c86a-433e-b533-f2794357e242", "46490193-1b22-4c29-bdd6-5bf63907216f", "fa277e82-9b78-42dd-b05c-05555c7b6015", "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "91239011-fe3c-4b54-9f24-15c86bb65913", "2f78da12-f7c7-430b-8b19-a28f269b77a3", "18f2065c-d36c-464a-a748-bcf909acb2e3", "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "7f2954d2-99c2-4d42-a065-ca36740f187b", "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "83314318-052a-4c90-a1ad-660ece38d276", "07743f65-7ec9-404a-a519-913db7118a8d", "f674e36a-4b91-431e-8aef-f8a96c2aca35", "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "555155a2-03bf-4fe7-af74-d176b3fdbe16", "df4dc653-1029-47ba-8231-3c44238cc0ae", "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "1547e27c-3974-43e2-a7d7-7f484fb928ec", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "fad91067-08c5-4d1a-8d8c-d96a21b37814", "a982fc9c-6333-4ffb-a51d-addb04e8b529", "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "90f342e1-1aaa-4e43-b092-39fda57ed11e", "02ee49e2-e294-4d0f-9278-f5b3212fc588", "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "0eb46774-f1ab-4a74-8238-1155855f2263", "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "c90362e0-2df3-4e61-94fe-b37615814cb1", "974515da-6cc5-4c95-ae65-f97f9150ec7f", "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "c420410f-c2d8-4010-856b-dffe21866437", "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "f37b4bce-49d0-4087-9f5b-58bffda77316", "9827ae57-3802-418f-994b-d5ecf5cd974b", "93d298a1-d28f-47f1-a468-d971e7796679", "46dd5308-4572-4d12-aa43-8938f0184d4f", "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "f742bde7-9528-42e5-bd82-84f51a8387d2", "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "8d85cf08-bf97-4260-ba49-986a2a65129c", "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "2ff692c2-4594-41ec-8fcb-46587de769e0", "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "b23818c7-e575-4d13-8012-332075ec0a2b", "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "160d2780-31f7-4922-8b3a-efce30e63e96", "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "ab567429-1dfb-4674-b6d2-979fd2f9d125", "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "cbf93e5d-ca6c-4722-8bea-e9119007c248", "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "275641a5-a492-45e2-a817-7c81e9d9d3e9", "961e33d1-4f86-4fcf-80ab-930a708b2f82", "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "ad89044a-8f49-4673-9a55-cbd88a1b374f", "086ae989-9ca6-4fe7-895a-759c5544f247", "5de03871-5d46-4539-a82d-3aa992a69a83", "28036918-04d3-423d-91c0-55ecf99fb892", "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "046218bd-e0d8-4113-a3c3-895a12b2b298", "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "a80f662f-022f-4429-9b8c-b1a41aaa6688", "612e47e9-8a59-43a6-b404-f48683f45bd6", "833ef470-fa01-4631-a79b-6f291c9ac498", "9d8f9bb8-01af-4e15-a3a2-349071530530", "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "5df86130-4e95-4a54-90f7-26541b40aec2", "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "f10ed525-97fe-4fed-be7c-2feecca941b1", "5f9db380-ea57-4d1e-beab-8a2d33397e93", "487bb375-12ef-41f6-baae-c6a1572b4dd1", "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "8218c875-90b9-42e2-b60d-0b0069816d10", "f2485272-a156-4773-82d7-1d178bc4905b", "724ea201-6514-4f38-9739-e5973c34f49a", "6c304b02-06e6-402d-8be4-d5833cdf8198", "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "4916a35e-bfc4-47d0-8e25-a003d7067061", "73a883d0-0348-4be4-a8d8-51031c2564f8", "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "d223b46b-5621-4037-88fe-fda32eead684", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "480421f9-417f-4d3b-9552-fd2728443ec8", "60936b49-fca0-4f32-993d-7415edcf9a5d", "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "6597be7b-ac61-4ac8-bef4-d3ec88174853", "5b872a46-3b90-45c1-8419-f675db8053aa", "092af964-4233-4373-b4ba-d86ea2890288", "b64a026b-8deb-4c1d-92fd-98893209dff1", "34aa0252-6039-40ff-951f-939fd6ce47d8", "63647769-326d-4dde-a419-b925cc0caf42", "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "9d15044a-7cfe-4d23-8085-6ebc11df7685", "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "976dd1f2-a484-45ec-aa1d-0e87e882262b", "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "944e8941-f6f6-4ee8-ac05-1c224e923c0e", "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "439957a7-ad86-4a8f-9705-a28131c6821b", "5a5152f1-463f-436b-b2f5-8eceb3964b42", "e0813366-0407-449a-9869-a2db1119dc41", "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "bf9e1387-b040-4393-9851-1598f8ecfae9", "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "9c226817-8dc9-46c2-a58d-66655aafd7dc", "7021255e-5db3-4946-a8b9-0ba7a4644a69", "36803969-5421-41ec-b92f-8500f79c23b0", "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "42205c73-75c8-4a63-9db1-e3782e06fda0", "41f6531d-af6e-4c6e-918f-b946f2b85a36", "e2482f8d-3443-4237-b906-cc145d87a076", "8b9606c9-28be-4a38-b146-0e313cc232c1", "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "4f281b83-0200-4b34-bf35-d24687ea57c2", "243380fa-11eb-4141-af92-e14925e77c1b", "baecf8fb-edbf-429f-9ade-31fc3f22b970", "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "0d7ceeef-3539-4392-8953-3dc664912714", "fc014922-5def-4da9-a0fc-28c973f41bfb", "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7"], "logsource.categories": ["registry_event", "registry_set"], "logsource.products": ["windows"]}, "EventType": {"refs": ["f663a6d9-9d1b-49b8-b2b1-0637914d199a", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "277efb8f-60be-4f10-b4d3-037802f37167", "41d1058a-aea7-4952-9293-29eaaf516465", "96f697b0-b499-4e5d-9908-a67bec11cdb6", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "acd74772-5f88-45c7-956b-6a7b36c294d2", "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "0cf2e1c6-8d10-4273-8059-738778f981ad", "cd277474-5c52-4423-a52b-ac2d7969902f", "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "53330955-dc52-487f-a3a2-da24dcff99b5", "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "9ace0707-b560-49b8-b6ca-5148b42f39fb", "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "9b0f8a61-91b2-464f-aceb-0527e0a45020", "1d218616-71b0-4c40-855b-9dbe75510f7f", "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "25ffa65d-76d8-4da5-a832-3f2b0136e133", "f50f3c09-557d-492d-81db-9064a8d4e211"], "logsource.categories": ["registry_event", "registry_delete", "registry_set", "registry_add"], "logsource.products": ["windows"]}, "EventID": {"refs": ["f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7"], "logsource.categories": ["registry_event"], "logsource.products": ["windows"]}, "Description": {"refs": ["092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "cbb56d62-4060-40f7-9466-d8aaf3123f83", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "754ed792-634f-40ae-b3bc-e0448d33f695", "145322e4-0fd3-486b-81ca-9addc75736d8", "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "52ff7941-8211-46f9-84f8-9903efb7077d", "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "b1876533-4ed5-4a83-90f3-b8645840a413", "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "758ff488-18d5-4cbe-8ec4-02b6285a434f", "d08a2711-ee8b-4323-bdec-b7d85e892b31", "46123129-1024-423e-9fae-43af4a0fa9a5", "6938366d-8954-4ddc-baff-c830b3ba8fcd", "0ba1da6d-b6ce-4366-828c-18826c9de23e", "9fbf5927-5261-4284-a71d-f681029ea574", "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "54773c5f-f1cc-4703-9126-2f797d96a69d", "d679950c-abb7-43a6-80fb-2a480c4fc450", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "03552375-cc2c-4883-bbe4-7958d5a980be", "87911521-7098-470b-a459-9a57fc80bdfd", "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "48a61b29-389f-4032-b317-b30de6b95314", "0b0cd537-fc77-4e6e-a973-e53495c1083d", "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "fca949cc-79ca-446e-8064-01aa7e52ece5", "e37db05d-d1f9-49c8-b464-cee1a4b11638", "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "9d5a1274-922a-49d0-87f3-8c653483b909", "7530cd3d-7671-43e3-b209-976966f6ea48", "41f407b5-3096-44ea-a74f-96d04fbc41be", "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "5722dff1-4bdd-4949-86ab-fbaf707e767a", "eb2d07d4-49cb-4523-801a-da002df36602", "811e0002-b13b-4a15-9d00-a613fce66e42", "762f2482-ff21-4970-8939-0aa317a886bb", "38646daa-e78f-4ace-9de0-55547b2d30da", "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "c4e49831-1496-40cf-8ce1-b53f942b02f9", "2c32b543-1058-4808-91c6-5b31b8bed6c5", "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "b52e84a3-029e-4529-b09b-71d19dd27e94", "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "198effb6-6c98-4d0c-9ea3-451fa143c45c", "d85873ef-a0f8-4c48-a53a-6b621f11729d", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "f38a82d2-fba3-4781-b549-525efbec8506", "57bff678-25d1-4d6c-8211-8ca106d12053", "037dcd71-33a8-4392-bb01-293c94663e5a", "afe52666-401e-4a02-b4ff-5d128990b8cb", "4ede543c-e098-43d9-a28f-dd784a13132f", "bb780e0c-16cf-4383-8383-1e5471db6cf9", "148431ce-4b70-403d-8525-fcc2993f29ea"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Product": {"refs": ["d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "9ef27c24-4903-4192-881a-3adde7ff92a5", "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "b37998de-a70b-4f33-b219-ec36bf433dc0", "26488ad0-f9fd-4536-876f-52fea846a2e4", "c625d754-6a3d-4f65-9c9a-536aea960d37", "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "24c77512-782b-448a-8950-eddb0785fc71", "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "e01fa958-6893-41d4-ae03-182477c5e77d", "a96970af-f126-420d-90e1-d37bf25e50e1", "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "0afbd410-de03-4078-8491-f132303cb67d", "37e8d358-6408-4853-82f4-98333fca7014", "ca387a8e-1c84-4da3-9993-028b45342d30", "4833155a-4053-4c9c-a997-777fcea0baa7", "88656cec-6c3b-487c-82c0-f73ebb805503", "cd764533-2e07-40d6-a718-cfeec7f2da7f"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "PreviousCreationUtcTime": {"refs": ["558eebe5-f2ba-4104-b339-36f7902bcc1a"], "logsource.categories": ["file_change"], "logsource.products": ["windows"]}, "Initiated": {"refs": ["5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4", "d58ba5c6-0ed7-4b9d-a433-6878379efda9", "7610a4ea-c06d-495f-a2ac-0a696abcfd3b", "3ab65069-d82a-4d44-a759-466661a082d1", "5c80b618-0dbb-46e6-acbb-03d90bcb6d83", "c539afac-c12a-46ed-b1bd-5a5567c9f045", "cdc8da7d-c303-42f8-b08c-b4ab47230263", "3b5ba899-9842-4bc2-acc2-12308498bf42", "9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4", "8d7e392e-9b28-49e1-831d-5949c6281228", "5205613d-2a63-4412-a895-3a2458b587b3", "786cdae8-fefb-4eb2-9227-04e34060db01", "b1e5da3b-ca8e-4adf-915c-9921f3d85481", "e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97", "b3ad3c0f-c949-47a1-a30e-b0491ccae876", "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7", "18249279-932f-45e2-b37a-8925f2597670", "50e54b8d-ad73-43f8-96a1-5191685b17a4", "9e02c8ec-02b9-43e8-81eb-34a475ba7965", "ed74fe75-7594-4b4b-ae38-e38e3fd2eb23", "08249dc0-a28d-4555-8ba5-9255a198e08c", "7b434893-c57d-4f41-908d-6a17bf1ae98f", "7cd1dcdc-6edf-4896-86dc-d1f19ad64903", "992a6cae-db6a-43c8-9cec-76d7195c96fc", "4b657234-038e-4ad5-997c-4be42340bce4", "bef0bc5a-b9ae-425d-85c6-7b2d705980c6", "efafe0bf-4238-479e-af8f-797bd3490d2d", "75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84", "0531e43a-d77d-47c2-b89f-5fe50321c805", "e54979bd-c5f9-4d6c-967b-a04b19ac4c74", "4b89abaa-99fe-4232-afdd-8f9aa4d20382", "07837ab9-60e1-481f-a74d-c31fb496a94c", "c7e91a02-d771-4a6d-a700-42587e0b1095", "37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1", "0dba975d-a193-4ed1-a067-424df57570d1", "9976fa64-2804-423c-8a5b-646ade840773", "20384606-a124-4fec-acbb-8bd373728613", "25eabf56-22f0-4915-a1ed-056b8dae0a68", "6d8c3d20-a5e1-494f-8412-4571d716cf5c", "fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4"], "logsource.categories": ["network_connection"], "logsource.products": ["windows"]}, "Type": {"refs": ["c4b890e5-8d8c-4496-8c66-c805753817cd"], "logsource.categories": ["process_tampering"], "logsource.products": ["windows"]}, "SourceImage": {"refs": ["2e4e488a-6164-4811-9ea1-f960c7359c40", "66d31e5f-52d6-40a4-9615-002d3789a119", "02d1d718-dd13-41af-989d-ea85c7fab93f", "99b97608-3e21-4bfe-8217-2a127c396a0e", "c15e99a3-c474-48ab-b9a7-84549a7a9d16", "a1a144b7-5c9b-4853-a559-2172be8d4a03", "c0aac16a-b1e7-4330-bab0-3c27bb4987c7", "fb656378-f909-47c1-8747-278bf09f4f4f"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "StartAddress": {"refs": ["6309645e-122d-4c5b-bb2b-22e4f9c2fa42"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "IntegrityLevel": {"refs": ["0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "3c05e90d-7eba-4324-9972-5d7f711a60a8", "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "3037d961-21e9-4732-b27a-637bcc7bf539", "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "40f9af16-589d-4984-b78d-8c2aec023197", "4cbef972-f347-4170-b62a-8253f6168e6d", "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "853e74f9-9392-4935-ad3b-2e8c040dae86", "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "89a9a0e0-f61a-42e5-8957-b1479565a658", "a743ceba-c771-4d75-97eb-8a90f7f4844c", "b697e69c-746f-4a86-9f59-7bfff8eab881", "7a01183d-71a2-46ad-ad5c-acd989ac1793", "224f140f-3553-4cd1-af78-13d81bf9f7cc", "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "80fc36aa-945e-4181-89f2-2f907ab6775d", "d937b75f-a665-4480-88a5-2f20e9f9b22a", "1ca6bd18-0ba0-44ca-851c-92ed89a61085"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "CurrentDirectory": {"refs": ["631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "95eadcb2-92e4-4ed1-9031-92547773a6db", "ed825c86-c009-4014-b413-b76003e33d35", "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "02b18447-ea83-4b1b-8805-714a8a34546a", "3a6586ad-127a-4d3b-a677-1e6eacdf8fde"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Provider_Name": {"refs": ["7dc2dedd-7603-461a-bc13-15803d132355"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "ParentUser": {"refs": ["590a5f4c-6c8c-4f10-8307-89afe9453a9d", "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "LogonId": {"refs": ["d21374ff-f574-44a7-9998-4a8c8bf33d7d", "178e615d-e666-498b-9630-9ed363038101"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}}}, "uberAgent 7.0": {"missing_field": {"dst_port": {"refs": ["d7fb8f0e-bd5f-45c2-b467-19571c490d7e"], "logsource.categories": ["firewall"], "logsource.products": [null]}, "TargetObject": {"refs": ["47e0852a-cf81-4494-a8e6-31864f8c86ed", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "295a59c1-7b79-4b47-a930-df12c15fc9c2", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "5aad0995-46ab-41bd-a9ff-724f41114971", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "4d431012-2ab5-4db7-a84e-b29809da2172", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "b3503044-60ce-4bf4-bbcb-e3db98788823", "a6b33c02-8305-488f-8585-03cb2a7763f2", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "55e29995-75e7-451a-bef0-6225e2f13597", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "b6d235fc-1d38-4b12-adbe-325f06728f37", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "6ea3bf32-9680-422d-9f50-e90716b12a66", "baca5663-583c-45f9-b5dc-ea96a22ce542", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "62120148-6b7a-42be-8b91-271c04e281a3", "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "92772523-d9c1-4c93-9547-b0ca500baba3", "790317c0-0a36-4a6a-a105-6e576bf99a14", "707e097c-e20f-4f67-8807-1f72ff4500d6", "396ae3eb-4174-4b9b-880e-dc0364d78a19", "e61e8a88-59a9-451c-874e-70fcc9740d67", "48437c39-9e5f-47fb-af95-3d663c3f2919", "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "509e84b9-a71a-40e0-834f-05470369bd1e", "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "7d9263bd-dc47-4a58-bc92-5474abab390c", "c5f6a85d-b647-40f7-bbad-c10b66bab038", "8ffc5407-52e3-478f-9596-0a7371eafe13", "bf344fea-d947-4ef4-9192-34d008315d3a", "5a93eb65-dffa-4543-b761-94aa60098fb6", "7c81fec3-1c1d-43b0-996a-46753041b1b6", "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "e3fdf743-f05b-4051-990a-b66919be1743", "6b6976a3-b0e6-4723-ac24-ae38a737af41", "f7997770-92c3-4ec9-b112-774c4ef96f96", "966315ef-c5e1-4767-ba25-fce9c8de3660", "e7b18879-676e-4a0e-ae18-27039185a8e7", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "8023f872-3f1d-4301-a384-801889917ab4", "44a22d59-b175-4f13-8c16-cbaef5b581ff", "fe20dda1-6f37-4379-bbe0-a98d400cae90", "b7916c2a-fa2f-4795-9477-32b731f70f11", "b86852fb-4c77-48f9-8519-eb1b2c308b59", "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "dc5c24af-6995-49b2-86eb-a9ff62199e82", "92b0b372-a939-44ed-a11b-5136cf680e27", "1c3121ed-041b-4d97-a075-07f54f20fb4a", "9df5f547-c86a-433e-b533-f2794357e242", "46490193-1b22-4c29-bdd6-5bf63907216f", "fa277e82-9b78-42dd-b05c-05555c7b6015", "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "91239011-fe3c-4b54-9f24-15c86bb65913", "2f78da12-f7c7-430b-8b19-a28f269b77a3", "18f2065c-d36c-464a-a748-bcf909acb2e3", "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "7f2954d2-99c2-4d42-a065-ca36740f187b", "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "83314318-052a-4c90-a1ad-660ece38d276", "07743f65-7ec9-404a-a519-913db7118a8d", "f674e36a-4b91-431e-8aef-f8a96c2aca35", "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "555155a2-03bf-4fe7-af74-d176b3fdbe16", "df4dc653-1029-47ba-8231-3c44238cc0ae", "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "1547e27c-3974-43e2-a7d7-7f484fb928ec", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "fad91067-08c5-4d1a-8d8c-d96a21b37814", "a982fc9c-6333-4ffb-a51d-addb04e8b529", "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "90f342e1-1aaa-4e43-b092-39fda57ed11e", "02ee49e2-e294-4d0f-9278-f5b3212fc588", "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "0eb46774-f1ab-4a74-8238-1155855f2263", "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "c90362e0-2df3-4e61-94fe-b37615814cb1", "974515da-6cc5-4c95-ae65-f97f9150ec7f", "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "c420410f-c2d8-4010-856b-dffe21866437", "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "f37b4bce-49d0-4087-9f5b-58bffda77316", "9827ae57-3802-418f-994b-d5ecf5cd974b", "93d298a1-d28f-47f1-a468-d971e7796679", "46dd5308-4572-4d12-aa43-8938f0184d4f", "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "f742bde7-9528-42e5-bd82-84f51a8387d2", "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "8d85cf08-bf97-4260-ba49-986a2a65129c", "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "2ff692c2-4594-41ec-8fcb-46587de769e0", "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "b23818c7-e575-4d13-8012-332075ec0a2b", "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "160d2780-31f7-4922-8b3a-efce30e63e96", "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "ab567429-1dfb-4674-b6d2-979fd2f9d125", "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "cbf93e5d-ca6c-4722-8bea-e9119007c248", "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "275641a5-a492-45e2-a817-7c81e9d9d3e9", "961e33d1-4f86-4fcf-80ab-930a708b2f82", "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "ad89044a-8f49-4673-9a55-cbd88a1b374f", "086ae989-9ca6-4fe7-895a-759c5544f247", "5de03871-5d46-4539-a82d-3aa992a69a83", "28036918-04d3-423d-91c0-55ecf99fb892", "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "046218bd-e0d8-4113-a3c3-895a12b2b298", "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "a80f662f-022f-4429-9b8c-b1a41aaa6688", "612e47e9-8a59-43a6-b404-f48683f45bd6", "833ef470-fa01-4631-a79b-6f291c9ac498", "9d8f9bb8-01af-4e15-a3a2-349071530530", "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "5df86130-4e95-4a54-90f7-26541b40aec2", "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "f10ed525-97fe-4fed-be7c-2feecca941b1", "5f9db380-ea57-4d1e-beab-8a2d33397e93", "487bb375-12ef-41f6-baae-c6a1572b4dd1", "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "8218c875-90b9-42e2-b60d-0b0069816d10", "f2485272-a156-4773-82d7-1d178bc4905b", "724ea201-6514-4f38-9739-e5973c34f49a", "6c304b02-06e6-402d-8be4-d5833cdf8198", "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "4916a35e-bfc4-47d0-8e25-a003d7067061", "73a883d0-0348-4be4-a8d8-51031c2564f8", "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "d223b46b-5621-4037-88fe-fda32eead684", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "480421f9-417f-4d3b-9552-fd2728443ec8", "60936b49-fca0-4f32-993d-7415edcf9a5d", "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "6597be7b-ac61-4ac8-bef4-d3ec88174853", "5b872a46-3b90-45c1-8419-f675db8053aa", "092af964-4233-4373-b4ba-d86ea2890288", "b64a026b-8deb-4c1d-92fd-98893209dff1", "34aa0252-6039-40ff-951f-939fd6ce47d8", "63647769-326d-4dde-a419-b925cc0caf42", "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "9d15044a-7cfe-4d23-8085-6ebc11df7685", "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "976dd1f2-a484-45ec-aa1d-0e87e882262b", "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "944e8941-f6f6-4ee8-ac05-1c224e923c0e", "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "439957a7-ad86-4a8f-9705-a28131c6821b", "5a5152f1-463f-436b-b2f5-8eceb3964b42", "e0813366-0407-449a-9869-a2db1119dc41", "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "bf9e1387-b040-4393-9851-1598f8ecfae9", "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "9c226817-8dc9-46c2-a58d-66655aafd7dc", "7021255e-5db3-4946-a8b9-0ba7a4644a69", "36803969-5421-41ec-b92f-8500f79c23b0", "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "42205c73-75c8-4a63-9db1-e3782e06fda0", "41f6531d-af6e-4c6e-918f-b946f2b85a36", "e2482f8d-3443-4237-b906-cc145d87a076", "8b9606c9-28be-4a38-b146-0e313cc232c1", "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "4f281b83-0200-4b34-bf35-d24687ea57c2", "243380fa-11eb-4141-af92-e14925e77c1b", "baecf8fb-edbf-429f-9ade-31fc3f22b970", "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "0d7ceeef-3539-4392-8953-3dc664912714", "fc014922-5def-4da9-a0fc-28c973f41bfb", "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7"], "logsource.categories": ["registry_event", "registry_set"], "logsource.products": ["windows"]}, "EventType": {"refs": ["f663a6d9-9d1b-49b8-b2b1-0637914d199a", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "277efb8f-60be-4f10-b4d3-037802f37167", "41d1058a-aea7-4952-9293-29eaaf516465", "96f697b0-b499-4e5d-9908-a67bec11cdb6", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "acd74772-5f88-45c7-956b-6a7b36c294d2", "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "0cf2e1c6-8d10-4273-8059-738778f981ad", "cd277474-5c52-4423-a52b-ac2d7969902f", "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "53330955-dc52-487f-a3a2-da24dcff99b5", "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "9ace0707-b560-49b8-b6ca-5148b42f39fb", "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "9b0f8a61-91b2-464f-aceb-0527e0a45020", "1d218616-71b0-4c40-855b-9dbe75510f7f", "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "25ffa65d-76d8-4da5-a832-3f2b0136e133", "f50f3c09-557d-492d-81db-9064a8d4e211"], "logsource.categories": ["registry_event", "registry_delete", "registry_set", "registry_add"], "logsource.products": ["windows"]}, "EventID": {"refs": ["f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7"], "logsource.categories": ["registry_event"], "logsource.products": ["windows"]}, "Description": {"refs": ["092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "cbb56d62-4060-40f7-9466-d8aaf3123f83", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "754ed792-634f-40ae-b3bc-e0448d33f695", "145322e4-0fd3-486b-81ca-9addc75736d8", "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "52ff7941-8211-46f9-84f8-9903efb7077d", "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "b1876533-4ed5-4a83-90f3-b8645840a413", "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "758ff488-18d5-4cbe-8ec4-02b6285a434f", "d08a2711-ee8b-4323-bdec-b7d85e892b31", "46123129-1024-423e-9fae-43af4a0fa9a5", "6938366d-8954-4ddc-baff-c830b3ba8fcd", "0ba1da6d-b6ce-4366-828c-18826c9de23e", "9fbf5927-5261-4284-a71d-f681029ea574", "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "54773c5f-f1cc-4703-9126-2f797d96a69d", "d679950c-abb7-43a6-80fb-2a480c4fc450", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "03552375-cc2c-4883-bbe4-7958d5a980be", "87911521-7098-470b-a459-9a57fc80bdfd", "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "48a61b29-389f-4032-b317-b30de6b95314", "0b0cd537-fc77-4e6e-a973-e53495c1083d", "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "fca949cc-79ca-446e-8064-01aa7e52ece5", "e37db05d-d1f9-49c8-b464-cee1a4b11638", "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "9d5a1274-922a-49d0-87f3-8c653483b909", "7530cd3d-7671-43e3-b209-976966f6ea48", "41f407b5-3096-44ea-a74f-96d04fbc41be", "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "5722dff1-4bdd-4949-86ab-fbaf707e767a", "eb2d07d4-49cb-4523-801a-da002df36602", "811e0002-b13b-4a15-9d00-a613fce66e42", "762f2482-ff21-4970-8939-0aa317a886bb", "38646daa-e78f-4ace-9de0-55547b2d30da", "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "c4e49831-1496-40cf-8ce1-b53f942b02f9", "2c32b543-1058-4808-91c6-5b31b8bed6c5", "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "b52e84a3-029e-4529-b09b-71d19dd27e94", "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "198effb6-6c98-4d0c-9ea3-451fa143c45c", "d85873ef-a0f8-4c48-a53a-6b621f11729d", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "f38a82d2-fba3-4781-b549-525efbec8506", "57bff678-25d1-4d6c-8211-8ca106d12053", "037dcd71-33a8-4392-bb01-293c94663e5a", "afe52666-401e-4a02-b4ff-5d128990b8cb", "4ede543c-e098-43d9-a28f-dd784a13132f", "bb780e0c-16cf-4383-8383-1e5471db6cf9", "148431ce-4b70-403d-8525-fcc2993f29ea"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Product": {"refs": ["d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "9ef27c24-4903-4192-881a-3adde7ff92a5", "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "b37998de-a70b-4f33-b219-ec36bf433dc0", "26488ad0-f9fd-4536-876f-52fea846a2e4", "c625d754-6a3d-4f65-9c9a-536aea960d37", "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "24c77512-782b-448a-8950-eddb0785fc71", "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "e01fa958-6893-41d4-ae03-182477c5e77d", "a96970af-f126-420d-90e1-d37bf25e50e1", "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "0afbd410-de03-4078-8491-f132303cb67d", "37e8d358-6408-4853-82f4-98333fca7014", "ca387a8e-1c84-4da3-9993-028b45342d30", "4833155a-4053-4c9c-a997-777fcea0baa7", "88656cec-6c3b-487c-82c0-f73ebb805503", "cd764533-2e07-40d6-a718-cfeec7f2da7f"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Initiated": {"refs": ["5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4", "d58ba5c6-0ed7-4b9d-a433-6878379efda9", "7610a4ea-c06d-495f-a2ac-0a696abcfd3b", "3ab65069-d82a-4d44-a759-466661a082d1", "5c80b618-0dbb-46e6-acbb-03d90bcb6d83", "c539afac-c12a-46ed-b1bd-5a5567c9f045", "cdc8da7d-c303-42f8-b08c-b4ab47230263", "3b5ba899-9842-4bc2-acc2-12308498bf42", "9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4", "8d7e392e-9b28-49e1-831d-5949c6281228", "5205613d-2a63-4412-a895-3a2458b587b3", "786cdae8-fefb-4eb2-9227-04e34060db01", "b1e5da3b-ca8e-4adf-915c-9921f3d85481", "e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97", "b3ad3c0f-c949-47a1-a30e-b0491ccae876", "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7", "18249279-932f-45e2-b37a-8925f2597670", "50e54b8d-ad73-43f8-96a1-5191685b17a4", "9e02c8ec-02b9-43e8-81eb-34a475ba7965", "ed74fe75-7594-4b4b-ae38-e38e3fd2eb23", "08249dc0-a28d-4555-8ba5-9255a198e08c", "7b434893-c57d-4f41-908d-6a17bf1ae98f", "7cd1dcdc-6edf-4896-86dc-d1f19ad64903", "992a6cae-db6a-43c8-9cec-76d7195c96fc", "4b657234-038e-4ad5-997c-4be42340bce4", "bef0bc5a-b9ae-425d-85c6-7b2d705980c6", "efafe0bf-4238-479e-af8f-797bd3490d2d", "75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84", "0531e43a-d77d-47c2-b89f-5fe50321c805", "e54979bd-c5f9-4d6c-967b-a04b19ac4c74", "4b89abaa-99fe-4232-afdd-8f9aa4d20382", "07837ab9-60e1-481f-a74d-c31fb496a94c", "c7e91a02-d771-4a6d-a700-42587e0b1095", "37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1", "0dba975d-a193-4ed1-a067-424df57570d1", "9976fa64-2804-423c-8a5b-646ade840773", "20384606-a124-4fec-acbb-8bd373728613", "25eabf56-22f0-4915-a1ed-056b8dae0a68", "6d8c3d20-a5e1-494f-8412-4571d716cf5c", "fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4"], "logsource.categories": ["network_connection"], "logsource.products": ["windows"]}, "Type": {"refs": ["c4b890e5-8d8c-4496-8c66-c805753817cd"], "logsource.categories": ["process_tampering"], "logsource.products": ["windows"]}, "SourceImage": {"refs": ["2e4e488a-6164-4811-9ea1-f960c7359c40", "66d31e5f-52d6-40a4-9615-002d3789a119", "02d1d718-dd13-41af-989d-ea85c7fab93f", "99b97608-3e21-4bfe-8217-2a127c396a0e", "c15e99a3-c474-48ab-b9a7-84549a7a9d16", "a1a144b7-5c9b-4853-a559-2172be8d4a03", "c0aac16a-b1e7-4330-bab0-3c27bb4987c7", "fb656378-f909-47c1-8747-278bf09f4f4f"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "StartAddress": {"refs": ["6309645e-122d-4c5b-bb2b-22e4f9c2fa42"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "IntegrityLevel": {"refs": ["0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "3c05e90d-7eba-4324-9972-5d7f711a60a8", "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "3037d961-21e9-4732-b27a-637bcc7bf539", "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "40f9af16-589d-4984-b78d-8c2aec023197", "4cbef972-f347-4170-b62a-8253f6168e6d", "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "853e74f9-9392-4935-ad3b-2e8c040dae86", "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "89a9a0e0-f61a-42e5-8957-b1479565a658", "a743ceba-c771-4d75-97eb-8a90f7f4844c", "b697e69c-746f-4a86-9f59-7bfff8eab881", "7a01183d-71a2-46ad-ad5c-acd989ac1793", "224f140f-3553-4cd1-af78-13d81bf9f7cc", "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "80fc36aa-945e-4181-89f2-2f907ab6775d", "d937b75f-a665-4480-88a5-2f20e9f9b22a", "1ca6bd18-0ba0-44ca-851c-92ed89a61085"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "CurrentDirectory": {"refs": ["631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "95eadcb2-92e4-4ed1-9031-92547773a6db", "ed825c86-c009-4014-b413-b76003e33d35", "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "02b18447-ea83-4b1b-8805-714a8a34546a", "3a6586ad-127a-4d3b-a677-1e6eacdf8fde"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Provider_Name": {"refs": ["7dc2dedd-7603-461a-bc13-15803d132355"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "ParentUser": {"refs": ["590a5f4c-6c8c-4f10-8307-89afe9453a9d", "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "LogonId": {"refs": ["d21374ff-f574-44a7-9998-4a8c8bf33d7d", "178e615d-e666-498b-9630-9ed363038101"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}}}, "uberAgent 6.2": {"missing_field": {"dst_port": {"refs": ["d7fb8f0e-bd5f-45c2-b467-19571c490d7e"], "logsource.categories": ["firewall"], "logsource.products": [null]}, "TargetObject": {"refs": ["47e0852a-cf81-4494-a8e6-31864f8c86ed", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "295a59c1-7b79-4b47-a930-df12c15fc9c2", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "5aad0995-46ab-41bd-a9ff-724f41114971", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "4d431012-2ab5-4db7-a84e-b29809da2172", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "b3503044-60ce-4bf4-bbcb-e3db98788823", "a6b33c02-8305-488f-8585-03cb2a7763f2", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "55e29995-75e7-451a-bef0-6225e2f13597", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "b6d235fc-1d38-4b12-adbe-325f06728f37", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "6ea3bf32-9680-422d-9f50-e90716b12a66", "baca5663-583c-45f9-b5dc-ea96a22ce542", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "62120148-6b7a-42be-8b91-271c04e281a3", "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "92772523-d9c1-4c93-9547-b0ca500baba3", "790317c0-0a36-4a6a-a105-6e576bf99a14", "707e097c-e20f-4f67-8807-1f72ff4500d6", "396ae3eb-4174-4b9b-880e-dc0364d78a19", "e61e8a88-59a9-451c-874e-70fcc9740d67", "48437c39-9e5f-47fb-af95-3d663c3f2919", "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "509e84b9-a71a-40e0-834f-05470369bd1e", "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "7d9263bd-dc47-4a58-bc92-5474abab390c", "c5f6a85d-b647-40f7-bbad-c10b66bab038", "8ffc5407-52e3-478f-9596-0a7371eafe13", "bf344fea-d947-4ef4-9192-34d008315d3a", "5a93eb65-dffa-4543-b761-94aa60098fb6", "7c81fec3-1c1d-43b0-996a-46753041b1b6", "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "e3fdf743-f05b-4051-990a-b66919be1743", "6b6976a3-b0e6-4723-ac24-ae38a737af41", "f7997770-92c3-4ec9-b112-774c4ef96f96", "966315ef-c5e1-4767-ba25-fce9c8de3660", "e7b18879-676e-4a0e-ae18-27039185a8e7", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "8023f872-3f1d-4301-a384-801889917ab4", "44a22d59-b175-4f13-8c16-cbaef5b581ff", "fe20dda1-6f37-4379-bbe0-a98d400cae90", "b7916c2a-fa2f-4795-9477-32b731f70f11", "b86852fb-4c77-48f9-8519-eb1b2c308b59", "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "dc5c24af-6995-49b2-86eb-a9ff62199e82", "92b0b372-a939-44ed-a11b-5136cf680e27", "1c3121ed-041b-4d97-a075-07f54f20fb4a", "9df5f547-c86a-433e-b533-f2794357e242", "46490193-1b22-4c29-bdd6-5bf63907216f", "fa277e82-9b78-42dd-b05c-05555c7b6015", "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "91239011-fe3c-4b54-9f24-15c86bb65913", "2f78da12-f7c7-430b-8b19-a28f269b77a3", "18f2065c-d36c-464a-a748-bcf909acb2e3", "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "7f2954d2-99c2-4d42-a065-ca36740f187b", "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "83314318-052a-4c90-a1ad-660ece38d276", "07743f65-7ec9-404a-a519-913db7118a8d", "f674e36a-4b91-431e-8aef-f8a96c2aca35", "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "555155a2-03bf-4fe7-af74-d176b3fdbe16", "df4dc653-1029-47ba-8231-3c44238cc0ae", "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "1547e27c-3974-43e2-a7d7-7f484fb928ec", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "fad91067-08c5-4d1a-8d8c-d96a21b37814", "a982fc9c-6333-4ffb-a51d-addb04e8b529", "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "90f342e1-1aaa-4e43-b092-39fda57ed11e", "02ee49e2-e294-4d0f-9278-f5b3212fc588", "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "0eb46774-f1ab-4a74-8238-1155855f2263", "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "c90362e0-2df3-4e61-94fe-b37615814cb1", "974515da-6cc5-4c95-ae65-f97f9150ec7f", "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "c420410f-c2d8-4010-856b-dffe21866437", "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "f37b4bce-49d0-4087-9f5b-58bffda77316", "9827ae57-3802-418f-994b-d5ecf5cd974b", "93d298a1-d28f-47f1-a468-d971e7796679", "46dd5308-4572-4d12-aa43-8938f0184d4f", "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "f742bde7-9528-42e5-bd82-84f51a8387d2", "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "8d85cf08-bf97-4260-ba49-986a2a65129c", "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "2ff692c2-4594-41ec-8fcb-46587de769e0", "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "b23818c7-e575-4d13-8012-332075ec0a2b", "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "160d2780-31f7-4922-8b3a-efce30e63e96", "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "ab567429-1dfb-4674-b6d2-979fd2f9d125", "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "cbf93e5d-ca6c-4722-8bea-e9119007c248", "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "275641a5-a492-45e2-a817-7c81e9d9d3e9", "961e33d1-4f86-4fcf-80ab-930a708b2f82", "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "ad89044a-8f49-4673-9a55-cbd88a1b374f", "086ae989-9ca6-4fe7-895a-759c5544f247", "5de03871-5d46-4539-a82d-3aa992a69a83", "28036918-04d3-423d-91c0-55ecf99fb892", "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "046218bd-e0d8-4113-a3c3-895a12b2b298", "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "a80f662f-022f-4429-9b8c-b1a41aaa6688", "612e47e9-8a59-43a6-b404-f48683f45bd6", "833ef470-fa01-4631-a79b-6f291c9ac498", "9d8f9bb8-01af-4e15-a3a2-349071530530", "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "5df86130-4e95-4a54-90f7-26541b40aec2", "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "f10ed525-97fe-4fed-be7c-2feecca941b1", "5f9db380-ea57-4d1e-beab-8a2d33397e93", "487bb375-12ef-41f6-baae-c6a1572b4dd1", "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "8218c875-90b9-42e2-b60d-0b0069816d10", "f2485272-a156-4773-82d7-1d178bc4905b", "724ea201-6514-4f38-9739-e5973c34f49a", "6c304b02-06e6-402d-8be4-d5833cdf8198", "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "4916a35e-bfc4-47d0-8e25-a003d7067061", "73a883d0-0348-4be4-a8d8-51031c2564f8", "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "d223b46b-5621-4037-88fe-fda32eead684", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "480421f9-417f-4d3b-9552-fd2728443ec8", "60936b49-fca0-4f32-993d-7415edcf9a5d", "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "6597be7b-ac61-4ac8-bef4-d3ec88174853", "5b872a46-3b90-45c1-8419-f675db8053aa", "092af964-4233-4373-b4ba-d86ea2890288", "b64a026b-8deb-4c1d-92fd-98893209dff1", "34aa0252-6039-40ff-951f-939fd6ce47d8", "63647769-326d-4dde-a419-b925cc0caf42", "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "9d15044a-7cfe-4d23-8085-6ebc11df7685", "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "976dd1f2-a484-45ec-aa1d-0e87e882262b", "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "944e8941-f6f6-4ee8-ac05-1c224e923c0e", "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "439957a7-ad86-4a8f-9705-a28131c6821b", "5a5152f1-463f-436b-b2f5-8eceb3964b42", "e0813366-0407-449a-9869-a2db1119dc41", "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "bf9e1387-b040-4393-9851-1598f8ecfae9", "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "9c226817-8dc9-46c2-a58d-66655aafd7dc", "7021255e-5db3-4946-a8b9-0ba7a4644a69", "36803969-5421-41ec-b92f-8500f79c23b0", "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "42205c73-75c8-4a63-9db1-e3782e06fda0", "41f6531d-af6e-4c6e-918f-b946f2b85a36", "e2482f8d-3443-4237-b906-cc145d87a076", "8b9606c9-28be-4a38-b146-0e313cc232c1", "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "4f281b83-0200-4b34-bf35-d24687ea57c2", "243380fa-11eb-4141-af92-e14925e77c1b", "baecf8fb-edbf-429f-9ade-31fc3f22b970", "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "0d7ceeef-3539-4392-8953-3dc664912714", "fc014922-5def-4da9-a0fc-28c973f41bfb", "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7"], "logsource.categories": ["registry_event", "registry_set"], "logsource.products": ["windows"]}, "EventType": {"refs": ["f663a6d9-9d1b-49b8-b2b1-0637914d199a", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "277efb8f-60be-4f10-b4d3-037802f37167", "41d1058a-aea7-4952-9293-29eaaf516465", "96f697b0-b499-4e5d-9908-a67bec11cdb6", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "acd74772-5f88-45c7-956b-6a7b36c294d2", "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "0cf2e1c6-8d10-4273-8059-738778f981ad", "cd277474-5c52-4423-a52b-ac2d7969902f", "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "53330955-dc52-487f-a3a2-da24dcff99b5", "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "9ace0707-b560-49b8-b6ca-5148b42f39fb", "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "9b0f8a61-91b2-464f-aceb-0527e0a45020", "1d218616-71b0-4c40-855b-9dbe75510f7f", "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "25ffa65d-76d8-4da5-a832-3f2b0136e133", "f50f3c09-557d-492d-81db-9064a8d4e211"], "logsource.categories": ["registry_event", "registry_delete", "registry_set", "registry_add"], "logsource.products": ["windows"]}, "EventID": {"refs": ["f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7"], "logsource.categories": ["registry_event"], "logsource.products": ["windows"]}, "Description": {"refs": ["092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "cbb56d62-4060-40f7-9466-d8aaf3123f83", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "754ed792-634f-40ae-b3bc-e0448d33f695", "145322e4-0fd3-486b-81ca-9addc75736d8", "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "52ff7941-8211-46f9-84f8-9903efb7077d", "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "b1876533-4ed5-4a83-90f3-b8645840a413", "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "758ff488-18d5-4cbe-8ec4-02b6285a434f", "d08a2711-ee8b-4323-bdec-b7d85e892b31", "46123129-1024-423e-9fae-43af4a0fa9a5", "6938366d-8954-4ddc-baff-c830b3ba8fcd", "0ba1da6d-b6ce-4366-828c-18826c9de23e", "9fbf5927-5261-4284-a71d-f681029ea574", "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "54773c5f-f1cc-4703-9126-2f797d96a69d", "d679950c-abb7-43a6-80fb-2a480c4fc450", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "03552375-cc2c-4883-bbe4-7958d5a980be", "87911521-7098-470b-a459-9a57fc80bdfd", "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "48a61b29-389f-4032-b317-b30de6b95314", "0b0cd537-fc77-4e6e-a973-e53495c1083d", "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "fca949cc-79ca-446e-8064-01aa7e52ece5", "e37db05d-d1f9-49c8-b464-cee1a4b11638", "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "9d5a1274-922a-49d0-87f3-8c653483b909", "7530cd3d-7671-43e3-b209-976966f6ea48", "41f407b5-3096-44ea-a74f-96d04fbc41be", "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "5722dff1-4bdd-4949-86ab-fbaf707e767a", "eb2d07d4-49cb-4523-801a-da002df36602", "811e0002-b13b-4a15-9d00-a613fce66e42", "762f2482-ff21-4970-8939-0aa317a886bb", "38646daa-e78f-4ace-9de0-55547b2d30da", "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "c4e49831-1496-40cf-8ce1-b53f942b02f9", "2c32b543-1058-4808-91c6-5b31b8bed6c5", "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "b52e84a3-029e-4529-b09b-71d19dd27e94", "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "198effb6-6c98-4d0c-9ea3-451fa143c45c", "d85873ef-a0f8-4c48-a53a-6b621f11729d", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "f38a82d2-fba3-4781-b549-525efbec8506", "57bff678-25d1-4d6c-8211-8ca106d12053", "037dcd71-33a8-4392-bb01-293c94663e5a", "afe52666-401e-4a02-b4ff-5d128990b8cb", "4ede543c-e098-43d9-a28f-dd784a13132f", "bb780e0c-16cf-4383-8383-1e5471db6cf9", "148431ce-4b70-403d-8525-fcc2993f29ea"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Product": {"refs": ["d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "9ef27c24-4903-4192-881a-3adde7ff92a5", "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "b37998de-a70b-4f33-b219-ec36bf433dc0", "26488ad0-f9fd-4536-876f-52fea846a2e4", "c625d754-6a3d-4f65-9c9a-536aea960d37", "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "24c77512-782b-448a-8950-eddb0785fc71", "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "e01fa958-6893-41d4-ae03-182477c5e77d", "a96970af-f126-420d-90e1-d37bf25e50e1", "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "0afbd410-de03-4078-8491-f132303cb67d", "37e8d358-6408-4853-82f4-98333fca7014", "ca387a8e-1c84-4da3-9993-028b45342d30", "4833155a-4053-4c9c-a997-777fcea0baa7", "88656cec-6c3b-487c-82c0-f73ebb805503", "cd764533-2e07-40d6-a718-cfeec7f2da7f"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Initiated": {"refs": ["5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4", "d58ba5c6-0ed7-4b9d-a433-6878379efda9", "7610a4ea-c06d-495f-a2ac-0a696abcfd3b", "3ab65069-d82a-4d44-a759-466661a082d1", "5c80b618-0dbb-46e6-acbb-03d90bcb6d83", "c539afac-c12a-46ed-b1bd-5a5567c9f045", "cdc8da7d-c303-42f8-b08c-b4ab47230263", "3b5ba899-9842-4bc2-acc2-12308498bf42", "9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4", "8d7e392e-9b28-49e1-831d-5949c6281228", "5205613d-2a63-4412-a895-3a2458b587b3", "786cdae8-fefb-4eb2-9227-04e34060db01", "b1e5da3b-ca8e-4adf-915c-9921f3d85481", "e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97", "b3ad3c0f-c949-47a1-a30e-b0491ccae876", "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7", "18249279-932f-45e2-b37a-8925f2597670", "50e54b8d-ad73-43f8-96a1-5191685b17a4", "9e02c8ec-02b9-43e8-81eb-34a475ba7965", "ed74fe75-7594-4b4b-ae38-e38e3fd2eb23", "08249dc0-a28d-4555-8ba5-9255a198e08c", "7b434893-c57d-4f41-908d-6a17bf1ae98f", "7cd1dcdc-6edf-4896-86dc-d1f19ad64903", "992a6cae-db6a-43c8-9cec-76d7195c96fc", "4b657234-038e-4ad5-997c-4be42340bce4", "bef0bc5a-b9ae-425d-85c6-7b2d705980c6", "efafe0bf-4238-479e-af8f-797bd3490d2d", "75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84", "0531e43a-d77d-47c2-b89f-5fe50321c805", "e54979bd-c5f9-4d6c-967b-a04b19ac4c74", "4b89abaa-99fe-4232-afdd-8f9aa4d20382", "07837ab9-60e1-481f-a74d-c31fb496a94c", "c7e91a02-d771-4a6d-a700-42587e0b1095", "37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1", "0dba975d-a193-4ed1-a067-424df57570d1", "9976fa64-2804-423c-8a5b-646ade840773", "20384606-a124-4fec-acbb-8bd373728613", "25eabf56-22f0-4915-a1ed-056b8dae0a68", "6d8c3d20-a5e1-494f-8412-4571d716cf5c", "fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4"], "logsource.categories": ["network_connection"], "logsource.products": ["windows"]}, "Type": {"refs": ["c4b890e5-8d8c-4496-8c66-c805753817cd"], "logsource.categories": ["process_tampering"], "logsource.products": ["windows"]}, "SourceImage": {"refs": ["2e4e488a-6164-4811-9ea1-f960c7359c40", "66d31e5f-52d6-40a4-9615-002d3789a119", "02d1d718-dd13-41af-989d-ea85c7fab93f", "99b97608-3e21-4bfe-8217-2a127c396a0e", "c15e99a3-c474-48ab-b9a7-84549a7a9d16", "a1a144b7-5c9b-4853-a559-2172be8d4a03", "c0aac16a-b1e7-4330-bab0-3c27bb4987c7", "fb656378-f909-47c1-8747-278bf09f4f4f"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "StartAddress": {"refs": ["6309645e-122d-4c5b-bb2b-22e4f9c2fa42"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "IntegrityLevel": {"refs": ["0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "3c05e90d-7eba-4324-9972-5d7f711a60a8", "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "3037d961-21e9-4732-b27a-637bcc7bf539", "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "40f9af16-589d-4984-b78d-8c2aec023197", "4cbef972-f347-4170-b62a-8253f6168e6d", "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "853e74f9-9392-4935-ad3b-2e8c040dae86", "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "89a9a0e0-f61a-42e5-8957-b1479565a658", "a743ceba-c771-4d75-97eb-8a90f7f4844c", "b697e69c-746f-4a86-9f59-7bfff8eab881", "7a01183d-71a2-46ad-ad5c-acd989ac1793", "224f140f-3553-4cd1-af78-13d81bf9f7cc", "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "80fc36aa-945e-4181-89f2-2f907ab6775d", "d937b75f-a665-4480-88a5-2f20e9f9b22a", "1ca6bd18-0ba0-44ca-851c-92ed89a61085"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "CurrentDirectory": {"refs": ["631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "95eadcb2-92e4-4ed1-9031-92547773a6db", "ed825c86-c009-4014-b413-b76003e33d35", "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "02b18447-ea83-4b1b-8805-714a8a34546a", "3a6586ad-127a-4d3b-a677-1e6eacdf8fde"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Provider_Name": {"refs": ["7dc2dedd-7603-461a-bc13-15803d132355"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "ParentUser": {"refs": ["590a5f4c-6c8c-4f10-8307-89afe9453a9d", "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "LogonId": {"refs": ["d21374ff-f574-44a7-9998-4a8c8bf33d7d", "178e615d-e666-498b-9630-9ed363038101"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}}}, "uberAgent 6.1": {"missing_field": {"TargetObject": {"refs": ["47e0852a-cf81-4494-a8e6-31864f8c86ed", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "295a59c1-7b79-4b47-a930-df12c15fc9c2", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "5aad0995-46ab-41bd-a9ff-724f41114971", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "4d431012-2ab5-4db7-a84e-b29809da2172", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "b3503044-60ce-4bf4-bbcb-e3db98788823", "a6b33c02-8305-488f-8585-03cb2a7763f2", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "55e29995-75e7-451a-bef0-6225e2f13597", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "b6d235fc-1d38-4b12-adbe-325f06728f37", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "6ea3bf32-9680-422d-9f50-e90716b12a66", "baca5663-583c-45f9-b5dc-ea96a22ce542", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "62120148-6b7a-42be-8b91-271c04e281a3", "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "92772523-d9c1-4c93-9547-b0ca500baba3", "790317c0-0a36-4a6a-a105-6e576bf99a14", "707e097c-e20f-4f67-8807-1f72ff4500d6", "396ae3eb-4174-4b9b-880e-dc0364d78a19", "e61e8a88-59a9-451c-874e-70fcc9740d67", "48437c39-9e5f-47fb-af95-3d663c3f2919", "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "509e84b9-a71a-40e0-834f-05470369bd1e", "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "7d9263bd-dc47-4a58-bc92-5474abab390c", "c5f6a85d-b647-40f7-bbad-c10b66bab038", "8ffc5407-52e3-478f-9596-0a7371eafe13", "bf344fea-d947-4ef4-9192-34d008315d3a", "5a93eb65-dffa-4543-b761-94aa60098fb6", "7c81fec3-1c1d-43b0-996a-46753041b1b6", "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "e3fdf743-f05b-4051-990a-b66919be1743", "6b6976a3-b0e6-4723-ac24-ae38a737af41", "f7997770-92c3-4ec9-b112-774c4ef96f96", "966315ef-c5e1-4767-ba25-fce9c8de3660", "e7b18879-676e-4a0e-ae18-27039185a8e7", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "8023f872-3f1d-4301-a384-801889917ab4", "44a22d59-b175-4f13-8c16-cbaef5b581ff", "fe20dda1-6f37-4379-bbe0-a98d400cae90", "b7916c2a-fa2f-4795-9477-32b731f70f11", "b86852fb-4c77-48f9-8519-eb1b2c308b59", "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "dc5c24af-6995-49b2-86eb-a9ff62199e82", "92b0b372-a939-44ed-a11b-5136cf680e27", "1c3121ed-041b-4d97-a075-07f54f20fb4a", "9df5f547-c86a-433e-b533-f2794357e242", "46490193-1b22-4c29-bdd6-5bf63907216f", "fa277e82-9b78-42dd-b05c-05555c7b6015", "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "91239011-fe3c-4b54-9f24-15c86bb65913", "2f78da12-f7c7-430b-8b19-a28f269b77a3", "18f2065c-d36c-464a-a748-bcf909acb2e3", "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "7f2954d2-99c2-4d42-a065-ca36740f187b", "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "83314318-052a-4c90-a1ad-660ece38d276", "07743f65-7ec9-404a-a519-913db7118a8d", "f674e36a-4b91-431e-8aef-f8a96c2aca35", "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "555155a2-03bf-4fe7-af74-d176b3fdbe16", "df4dc653-1029-47ba-8231-3c44238cc0ae", "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "1547e27c-3974-43e2-a7d7-7f484fb928ec", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "fad91067-08c5-4d1a-8d8c-d96a21b37814", "a982fc9c-6333-4ffb-a51d-addb04e8b529", "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "90f342e1-1aaa-4e43-b092-39fda57ed11e", "02ee49e2-e294-4d0f-9278-f5b3212fc588", "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "0eb46774-f1ab-4a74-8238-1155855f2263", "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "c90362e0-2df3-4e61-94fe-b37615814cb1", "974515da-6cc5-4c95-ae65-f97f9150ec7f", "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "c420410f-c2d8-4010-856b-dffe21866437", "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "f37b4bce-49d0-4087-9f5b-58bffda77316", "9827ae57-3802-418f-994b-d5ecf5cd974b", "93d298a1-d28f-47f1-a468-d971e7796679", "46dd5308-4572-4d12-aa43-8938f0184d4f", "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "f742bde7-9528-42e5-bd82-84f51a8387d2", "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "8d85cf08-bf97-4260-ba49-986a2a65129c", "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "2ff692c2-4594-41ec-8fcb-46587de769e0", "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "b23818c7-e575-4d13-8012-332075ec0a2b", "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "160d2780-31f7-4922-8b3a-efce30e63e96", "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "ab567429-1dfb-4674-b6d2-979fd2f9d125", "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "cbf93e5d-ca6c-4722-8bea-e9119007c248", "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "275641a5-a492-45e2-a817-7c81e9d9d3e9", "961e33d1-4f86-4fcf-80ab-930a708b2f82", "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "ad89044a-8f49-4673-9a55-cbd88a1b374f", "086ae989-9ca6-4fe7-895a-759c5544f247", "5de03871-5d46-4539-a82d-3aa992a69a83", "28036918-04d3-423d-91c0-55ecf99fb892", "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "046218bd-e0d8-4113-a3c3-895a12b2b298", "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "a80f662f-022f-4429-9b8c-b1a41aaa6688", "612e47e9-8a59-43a6-b404-f48683f45bd6", "833ef470-fa01-4631-a79b-6f291c9ac498", "9d8f9bb8-01af-4e15-a3a2-349071530530", "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "5df86130-4e95-4a54-90f7-26541b40aec2", "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "f10ed525-97fe-4fed-be7c-2feecca941b1", "5f9db380-ea57-4d1e-beab-8a2d33397e93", "487bb375-12ef-41f6-baae-c6a1572b4dd1", "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "8218c875-90b9-42e2-b60d-0b0069816d10", "f2485272-a156-4773-82d7-1d178bc4905b", "724ea201-6514-4f38-9739-e5973c34f49a", "6c304b02-06e6-402d-8be4-d5833cdf8198", "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "4916a35e-bfc4-47d0-8e25-a003d7067061", "73a883d0-0348-4be4-a8d8-51031c2564f8", "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "d223b46b-5621-4037-88fe-fda32eead684", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "480421f9-417f-4d3b-9552-fd2728443ec8", "60936b49-fca0-4f32-993d-7415edcf9a5d", "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "6597be7b-ac61-4ac8-bef4-d3ec88174853", "5b872a46-3b90-45c1-8419-f675db8053aa", "092af964-4233-4373-b4ba-d86ea2890288", "b64a026b-8deb-4c1d-92fd-98893209dff1", "34aa0252-6039-40ff-951f-939fd6ce47d8", "63647769-326d-4dde-a419-b925cc0caf42", "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "9d15044a-7cfe-4d23-8085-6ebc11df7685", "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "976dd1f2-a484-45ec-aa1d-0e87e882262b", "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "944e8941-f6f6-4ee8-ac05-1c224e923c0e", "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "439957a7-ad86-4a8f-9705-a28131c6821b", "5a5152f1-463f-436b-b2f5-8eceb3964b42", "e0813366-0407-449a-9869-a2db1119dc41", "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "bf9e1387-b040-4393-9851-1598f8ecfae9", "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "9c226817-8dc9-46c2-a58d-66655aafd7dc", "7021255e-5db3-4946-a8b9-0ba7a4644a69", "36803969-5421-41ec-b92f-8500f79c23b0", "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "42205c73-75c8-4a63-9db1-e3782e06fda0", "41f6531d-af6e-4c6e-918f-b946f2b85a36", "e2482f8d-3443-4237-b906-cc145d87a076", "8b9606c9-28be-4a38-b146-0e313cc232c1", "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "4f281b83-0200-4b34-bf35-d24687ea57c2", "243380fa-11eb-4141-af92-e14925e77c1b", "baecf8fb-edbf-429f-9ade-31fc3f22b970", "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "0d7ceeef-3539-4392-8953-3dc664912714", "fc014922-5def-4da9-a0fc-28c973f41bfb", "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7"], "logsource.categories": ["registry_event", "registry_set"], "logsource.products": ["windows"]}, "EventType": {"refs": ["f663a6d9-9d1b-49b8-b2b1-0637914d199a", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "277efb8f-60be-4f10-b4d3-037802f37167", "41d1058a-aea7-4952-9293-29eaaf516465", "96f697b0-b499-4e5d-9908-a67bec11cdb6", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "acd74772-5f88-45c7-956b-6a7b36c294d2", "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "0cf2e1c6-8d10-4273-8059-738778f981ad", "cd277474-5c52-4423-a52b-ac2d7969902f", "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "53330955-dc52-487f-a3a2-da24dcff99b5", "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "9ace0707-b560-49b8-b6ca-5148b42f39fb", "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "9b0f8a61-91b2-464f-aceb-0527e0a45020", "1d218616-71b0-4c40-855b-9dbe75510f7f", "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "25ffa65d-76d8-4da5-a832-3f2b0136e133", "f50f3c09-557d-492d-81db-9064a8d4e211"], "logsource.categories": ["registry_event", "registry_delete", "registry_set", "registry_add"], "logsource.products": ["windows"]}, "EventID": {"refs": ["f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7"], "logsource.categories": ["registry_event"], "logsource.products": ["windows"]}, "Description": {"refs": ["092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "cbb56d62-4060-40f7-9466-d8aaf3123f83", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "754ed792-634f-40ae-b3bc-e0448d33f695", "145322e4-0fd3-486b-81ca-9addc75736d8", "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "52ff7941-8211-46f9-84f8-9903efb7077d", "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "b1876533-4ed5-4a83-90f3-b8645840a413", "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "758ff488-18d5-4cbe-8ec4-02b6285a434f", "d08a2711-ee8b-4323-bdec-b7d85e892b31", "46123129-1024-423e-9fae-43af4a0fa9a5", "6938366d-8954-4ddc-baff-c830b3ba8fcd", "0ba1da6d-b6ce-4366-828c-18826c9de23e", "9fbf5927-5261-4284-a71d-f681029ea574", "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "54773c5f-f1cc-4703-9126-2f797d96a69d", "d679950c-abb7-43a6-80fb-2a480c4fc450", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "03552375-cc2c-4883-bbe4-7958d5a980be", "87911521-7098-470b-a459-9a57fc80bdfd", "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "48a61b29-389f-4032-b317-b30de6b95314", "0b0cd537-fc77-4e6e-a973-e53495c1083d", "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "fca949cc-79ca-446e-8064-01aa7e52ece5", "e37db05d-d1f9-49c8-b464-cee1a4b11638", "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "9d5a1274-922a-49d0-87f3-8c653483b909", "7530cd3d-7671-43e3-b209-976966f6ea48", "41f407b5-3096-44ea-a74f-96d04fbc41be", "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "5722dff1-4bdd-4949-86ab-fbaf707e767a", "eb2d07d4-49cb-4523-801a-da002df36602", "811e0002-b13b-4a15-9d00-a613fce66e42", "762f2482-ff21-4970-8939-0aa317a886bb", "38646daa-e78f-4ace-9de0-55547b2d30da", "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "c4e49831-1496-40cf-8ce1-b53f942b02f9", "2c32b543-1058-4808-91c6-5b31b8bed6c5", "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "b52e84a3-029e-4529-b09b-71d19dd27e94", "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "198effb6-6c98-4d0c-9ea3-451fa143c45c", "d85873ef-a0f8-4c48-a53a-6b621f11729d", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "f38a82d2-fba3-4781-b549-525efbec8506", "57bff678-25d1-4d6c-8211-8ca106d12053", "037dcd71-33a8-4392-bb01-293c94663e5a", "afe52666-401e-4a02-b4ff-5d128990b8cb", "4ede543c-e098-43d9-a28f-dd784a13132f", "bb780e0c-16cf-4383-8383-1e5471db6cf9", "148431ce-4b70-403d-8525-fcc2993f29ea"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Hashes": {"refs": ["8cde342c-ba48-4b74-b615-172c330f2e93", "49329257-089d-46e6-af37-4afce4290685", "7aa7009a-28b9-4344-8c1f-159489a390df", "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "8d63dadf-b91b-4187-87b6-34a1114577ea", "e8d34729-86a4-4140-adfd-0a29c2106307", "ca621ba5-54ab-4035-9942-d378e6fcde3c", "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "d7654f02-e04b-4934-9838-65c46f187ebc", "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "6345b048-8441-43a7-9bed-541133633d7a", "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "68d37776-61db-42f5-bf54-27e87072d17e", "6bd75993-9888-4f91-9404-e1e4e4e34b77", "f4264e47-f522-4c38-a420-04525d5b880f", "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "729ce0ea-5d8f-4769-9762-e35de441586d", "222129f7-f4dc-4568-b0d2-22440a9639ba", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "74a12f18-505c-4114-8d0b-8448dd5485c6", "32410e29-5f94-4568-b6a3-d91a8adad863"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Product": {"refs": ["d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "9ef27c24-4903-4192-881a-3adde7ff92a5", "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "b37998de-a70b-4f33-b219-ec36bf433dc0", "26488ad0-f9fd-4536-876f-52fea846a2e4", "c625d754-6a3d-4f65-9c9a-536aea960d37", "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "24c77512-782b-448a-8950-eddb0785fc71", "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "e01fa958-6893-41d4-ae03-182477c5e77d", "a96970af-f126-420d-90e1-d37bf25e50e1", "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "0afbd410-de03-4078-8491-f132303cb67d", "37e8d358-6408-4853-82f4-98333fca7014", "ca387a8e-1c84-4da3-9993-028b45342d30", "4833155a-4053-4c9c-a997-777fcea0baa7", "88656cec-6c3b-487c-82c0-f73ebb805503", "cd764533-2e07-40d6-a718-cfeec7f2da7f"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "IntegrityLevel": {"refs": ["0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "3c05e90d-7eba-4324-9972-5d7f711a60a8", "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "3037d961-21e9-4732-b27a-637bcc7bf539", "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "40f9af16-589d-4984-b78d-8c2aec023197", "4cbef972-f347-4170-b62a-8253f6168e6d", "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "853e74f9-9392-4935-ad3b-2e8c040dae86", "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "89a9a0e0-f61a-42e5-8957-b1479565a658", "a743ceba-c771-4d75-97eb-8a90f7f4844c", "b697e69c-746f-4a86-9f59-7bfff8eab881", "7a01183d-71a2-46ad-ad5c-acd989ac1793", "224f140f-3553-4cd1-af78-13d81bf9f7cc", "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "80fc36aa-945e-4181-89f2-2f907ab6775d", "d937b75f-a665-4480-88a5-2f20e9f9b22a", "1ca6bd18-0ba0-44ca-851c-92ed89a61085"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "CurrentDirectory": {"refs": ["631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "95eadcb2-92e4-4ed1-9031-92547773a6db", "ed825c86-c009-4014-b413-b76003e33d35", "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "02b18447-ea83-4b1b-8805-714a8a34546a", "3a6586ad-127a-4d3b-a677-1e6eacdf8fde"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Provider_Name": {"refs": ["7dc2dedd-7603-461a-bc13-15803d132355"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "ParentUser": {"refs": ["590a5f4c-6c8c-4f10-8307-89afe9453a9d", "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "LogonId": {"refs": ["d21374ff-f574-44a7-9998-4a8c8bf33d7d", "178e615d-e666-498b-9630-9ed363038101"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}}}, "uberAgent 6.0": {"missing_field": {"TargetObject": {"refs": ["47e0852a-cf81-4494-a8e6-31864f8c86ed", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "295a59c1-7b79-4b47-a930-df12c15fc9c2", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "5aad0995-46ab-41bd-a9ff-724f41114971", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "4d431012-2ab5-4db7-a84e-b29809da2172", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "b3503044-60ce-4bf4-bbcb-e3db98788823", "a6b33c02-8305-488f-8585-03cb2a7763f2", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "55e29995-75e7-451a-bef0-6225e2f13597", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "b6d235fc-1d38-4b12-adbe-325f06728f37", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "6ea3bf32-9680-422d-9f50-e90716b12a66", "baca5663-583c-45f9-b5dc-ea96a22ce542", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "62120148-6b7a-42be-8b91-271c04e281a3", "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "92772523-d9c1-4c93-9547-b0ca500baba3", "790317c0-0a36-4a6a-a105-6e576bf99a14", "707e097c-e20f-4f67-8807-1f72ff4500d6", "396ae3eb-4174-4b9b-880e-dc0364d78a19", "e61e8a88-59a9-451c-874e-70fcc9740d67", "48437c39-9e5f-47fb-af95-3d663c3f2919", "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "509e84b9-a71a-40e0-834f-05470369bd1e", "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "7d9263bd-dc47-4a58-bc92-5474abab390c", "c5f6a85d-b647-40f7-bbad-c10b66bab038", "8ffc5407-52e3-478f-9596-0a7371eafe13", "bf344fea-d947-4ef4-9192-34d008315d3a", "5a93eb65-dffa-4543-b761-94aa60098fb6", "7c81fec3-1c1d-43b0-996a-46753041b1b6", "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "e3fdf743-f05b-4051-990a-b66919be1743", "6b6976a3-b0e6-4723-ac24-ae38a737af41", "f7997770-92c3-4ec9-b112-774c4ef96f96", "966315ef-c5e1-4767-ba25-fce9c8de3660", "e7b18879-676e-4a0e-ae18-27039185a8e7", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "8023f872-3f1d-4301-a384-801889917ab4", "44a22d59-b175-4f13-8c16-cbaef5b581ff", "fe20dda1-6f37-4379-bbe0-a98d400cae90", "b7916c2a-fa2f-4795-9477-32b731f70f11", "b86852fb-4c77-48f9-8519-eb1b2c308b59", "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "dc5c24af-6995-49b2-86eb-a9ff62199e82", "92b0b372-a939-44ed-a11b-5136cf680e27", "1c3121ed-041b-4d97-a075-07f54f20fb4a", "9df5f547-c86a-433e-b533-f2794357e242", "46490193-1b22-4c29-bdd6-5bf63907216f", "fa277e82-9b78-42dd-b05c-05555c7b6015", "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "91239011-fe3c-4b54-9f24-15c86bb65913", "2f78da12-f7c7-430b-8b19-a28f269b77a3", "18f2065c-d36c-464a-a748-bcf909acb2e3", "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "7f2954d2-99c2-4d42-a065-ca36740f187b", "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "83314318-052a-4c90-a1ad-660ece38d276", "07743f65-7ec9-404a-a519-913db7118a8d", "f674e36a-4b91-431e-8aef-f8a96c2aca35", "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "555155a2-03bf-4fe7-af74-d176b3fdbe16", "df4dc653-1029-47ba-8231-3c44238cc0ae", "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "1547e27c-3974-43e2-a7d7-7f484fb928ec", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "fad91067-08c5-4d1a-8d8c-d96a21b37814", "a982fc9c-6333-4ffb-a51d-addb04e8b529", "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "90f342e1-1aaa-4e43-b092-39fda57ed11e", "02ee49e2-e294-4d0f-9278-f5b3212fc588", "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "0eb46774-f1ab-4a74-8238-1155855f2263", "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "c90362e0-2df3-4e61-94fe-b37615814cb1", "974515da-6cc5-4c95-ae65-f97f9150ec7f", "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "c420410f-c2d8-4010-856b-dffe21866437", "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "f37b4bce-49d0-4087-9f5b-58bffda77316", "9827ae57-3802-418f-994b-d5ecf5cd974b", "93d298a1-d28f-47f1-a468-d971e7796679", "46dd5308-4572-4d12-aa43-8938f0184d4f", "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "f742bde7-9528-42e5-bd82-84f51a8387d2", "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "8d85cf08-bf97-4260-ba49-986a2a65129c", "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "2ff692c2-4594-41ec-8fcb-46587de769e0", "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "b23818c7-e575-4d13-8012-332075ec0a2b", "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "160d2780-31f7-4922-8b3a-efce30e63e96", "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "ab567429-1dfb-4674-b6d2-979fd2f9d125", "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "cbf93e5d-ca6c-4722-8bea-e9119007c248", "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "275641a5-a492-45e2-a817-7c81e9d9d3e9", "961e33d1-4f86-4fcf-80ab-930a708b2f82", "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "ad89044a-8f49-4673-9a55-cbd88a1b374f", "086ae989-9ca6-4fe7-895a-759c5544f247", "5de03871-5d46-4539-a82d-3aa992a69a83", "28036918-04d3-423d-91c0-55ecf99fb892", "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "046218bd-e0d8-4113-a3c3-895a12b2b298", "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "a80f662f-022f-4429-9b8c-b1a41aaa6688", "612e47e9-8a59-43a6-b404-f48683f45bd6", "833ef470-fa01-4631-a79b-6f291c9ac498", "9d8f9bb8-01af-4e15-a3a2-349071530530", "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "5df86130-4e95-4a54-90f7-26541b40aec2", "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "f10ed525-97fe-4fed-be7c-2feecca941b1", "5f9db380-ea57-4d1e-beab-8a2d33397e93", "487bb375-12ef-41f6-baae-c6a1572b4dd1", "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "8218c875-90b9-42e2-b60d-0b0069816d10", "f2485272-a156-4773-82d7-1d178bc4905b", "724ea201-6514-4f38-9739-e5973c34f49a", "6c304b02-06e6-402d-8be4-d5833cdf8198", "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "4916a35e-bfc4-47d0-8e25-a003d7067061", "73a883d0-0348-4be4-a8d8-51031c2564f8", "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "d223b46b-5621-4037-88fe-fda32eead684", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "480421f9-417f-4d3b-9552-fd2728443ec8", "60936b49-fca0-4f32-993d-7415edcf9a5d", "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "6597be7b-ac61-4ac8-bef4-d3ec88174853", "5b872a46-3b90-45c1-8419-f675db8053aa", "092af964-4233-4373-b4ba-d86ea2890288", "b64a026b-8deb-4c1d-92fd-98893209dff1", "34aa0252-6039-40ff-951f-939fd6ce47d8", "63647769-326d-4dde-a419-b925cc0caf42", "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "9d15044a-7cfe-4d23-8085-6ebc11df7685", "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "976dd1f2-a484-45ec-aa1d-0e87e882262b", "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "944e8941-f6f6-4ee8-ac05-1c224e923c0e", "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "439957a7-ad86-4a8f-9705-a28131c6821b", "5a5152f1-463f-436b-b2f5-8eceb3964b42", "e0813366-0407-449a-9869-a2db1119dc41", "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "bf9e1387-b040-4393-9851-1598f8ecfae9", "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "9c226817-8dc9-46c2-a58d-66655aafd7dc", "7021255e-5db3-4946-a8b9-0ba7a4644a69", "36803969-5421-41ec-b92f-8500f79c23b0", "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "42205c73-75c8-4a63-9db1-e3782e06fda0", "41f6531d-af6e-4c6e-918f-b946f2b85a36", "e2482f8d-3443-4237-b906-cc145d87a076", "8b9606c9-28be-4a38-b146-0e313cc232c1", "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "4f281b83-0200-4b34-bf35-d24687ea57c2", "243380fa-11eb-4141-af92-e14925e77c1b", "baecf8fb-edbf-429f-9ade-31fc3f22b970", "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "0d7ceeef-3539-4392-8953-3dc664912714", "fc014922-5def-4da9-a0fc-28c973f41bfb", "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7"], "logsource.categories": ["registry_event", "registry_set"], "logsource.products": ["windows"]}, "EventType": {"refs": ["f663a6d9-9d1b-49b8-b2b1-0637914d199a", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "277efb8f-60be-4f10-b4d3-037802f37167", "41d1058a-aea7-4952-9293-29eaaf516465", "96f697b0-b499-4e5d-9908-a67bec11cdb6", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "acd74772-5f88-45c7-956b-6a7b36c294d2", "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "0cf2e1c6-8d10-4273-8059-738778f981ad", "cd277474-5c52-4423-a52b-ac2d7969902f", "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "53330955-dc52-487f-a3a2-da24dcff99b5", "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "9ace0707-b560-49b8-b6ca-5148b42f39fb", "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "9b0f8a61-91b2-464f-aceb-0527e0a45020", "1d218616-71b0-4c40-855b-9dbe75510f7f", "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "25ffa65d-76d8-4da5-a832-3f2b0136e133", "f50f3c09-557d-492d-81db-9064a8d4e211"], "logsource.categories": ["registry_event", "registry_delete", "registry_set", "registry_add"], "logsource.products": ["windows"]}, "EventID": {"refs": ["f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7"], "logsource.categories": ["registry_event"], "logsource.products": ["windows"]}, "Signature": {"refs": ["d2451be2-b582-4e15-8701-4196ac180260"], "logsource.categories": ["image_load"], "logsource.products": ["windows"]}, "Signed": {"refs": ["bdc64095-d59a-42a2-8588-71fd9c9d9abc", "857c8db3-c89b-42fb-882b-f681c7cf4da2", "060d5ad4-3153-47bb-8382-43e5e29eda92", "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "ea5c131b-380d-49f9-aeb3-920694da4d4b", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "b5de0c9a-6f19-43e0-af4e-55ad01f550af", "273a8dd8-3742-4302-bcc7-7df5a80fe425"], "logsource.categories": ["image_load"], "logsource.products": ["windows"]}, "Description": {"refs": ["092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "cbb56d62-4060-40f7-9466-d8aaf3123f83", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "754ed792-634f-40ae-b3bc-e0448d33f695", "145322e4-0fd3-486b-81ca-9addc75736d8", "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "52ff7941-8211-46f9-84f8-9903efb7077d", "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "b1876533-4ed5-4a83-90f3-b8645840a413", "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "758ff488-18d5-4cbe-8ec4-02b6285a434f", "d08a2711-ee8b-4323-bdec-b7d85e892b31", "46123129-1024-423e-9fae-43af4a0fa9a5", "6938366d-8954-4ddc-baff-c830b3ba8fcd", "0ba1da6d-b6ce-4366-828c-18826c9de23e", "9fbf5927-5261-4284-a71d-f681029ea574", "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "54773c5f-f1cc-4703-9126-2f797d96a69d", "d679950c-abb7-43a6-80fb-2a480c4fc450", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "03552375-cc2c-4883-bbe4-7958d5a980be", "87911521-7098-470b-a459-9a57fc80bdfd", "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "48a61b29-389f-4032-b317-b30de6b95314", "0b0cd537-fc77-4e6e-a973-e53495c1083d", "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "fca949cc-79ca-446e-8064-01aa7e52ece5", "e37db05d-d1f9-49c8-b464-cee1a4b11638", "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "9d5a1274-922a-49d0-87f3-8c653483b909", "7530cd3d-7671-43e3-b209-976966f6ea48", "41f407b5-3096-44ea-a74f-96d04fbc41be", "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "5722dff1-4bdd-4949-86ab-fbaf707e767a", "eb2d07d4-49cb-4523-801a-da002df36602", "811e0002-b13b-4a15-9d00-a613fce66e42", "762f2482-ff21-4970-8939-0aa317a886bb", "38646daa-e78f-4ace-9de0-55547b2d30da", "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "c4e49831-1496-40cf-8ce1-b53f942b02f9", "2c32b543-1058-4808-91c6-5b31b8bed6c5", "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "b52e84a3-029e-4529-b09b-71d19dd27e94", "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "198effb6-6c98-4d0c-9ea3-451fa143c45c", "d85873ef-a0f8-4c48-a53a-6b621f11729d", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "f38a82d2-fba3-4781-b549-525efbec8506", "57bff678-25d1-4d6c-8211-8ca106d12053", "037dcd71-33a8-4392-bb01-293c94663e5a", "afe52666-401e-4a02-b4ff-5d128990b8cb", "4ede543c-e098-43d9-a28f-dd784a13132f", "bb780e0c-16cf-4383-8383-1e5471db6cf9", "148431ce-4b70-403d-8525-fcc2993f29ea"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Hashes": {"refs": ["8cde342c-ba48-4b74-b615-172c330f2e93", "49329257-089d-46e6-af37-4afce4290685", "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "d7654f02-e04b-4934-9838-65c46f187ebc", "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "6345b048-8441-43a7-9bed-541133633d7a", "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "68d37776-61db-42f5-bf54-27e87072d17e", "6bd75993-9888-4f91-9404-e1e4e4e34b77", "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "222129f7-f4dc-4568-b0d2-22440a9639ba", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "74a12f18-505c-4114-8d0b-8448dd5485c6", "32410e29-5f94-4568-b6a3-d91a8adad863"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Product": {"refs": ["d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "9ef27c24-4903-4192-881a-3adde7ff92a5", "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "b37998de-a70b-4f33-b219-ec36bf433dc0", "26488ad0-f9fd-4536-876f-52fea846a2e4", "c625d754-6a3d-4f65-9c9a-536aea960d37", "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "24c77512-782b-448a-8950-eddb0785fc71", "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "e01fa958-6893-41d4-ae03-182477c5e77d", "a96970af-f126-420d-90e1-d37bf25e50e1", "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "0afbd410-de03-4078-8491-f132303cb67d", "37e8d358-6408-4853-82f4-98333fca7014", "ca387a8e-1c84-4da3-9993-028b45342d30", "4833155a-4053-4c9c-a997-777fcea0baa7", "88656cec-6c3b-487c-82c0-f73ebb805503", "cd764533-2e07-40d6-a718-cfeec7f2da7f"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "SignatureStatus": {"refs": ["948a0953-f287-4806-bbcb-3b2e396df89f"], "logsource.categories": ["image_load"], "logsource.products": ["windows"]}, "IntegrityLevel": {"refs": ["0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "3c05e90d-7eba-4324-9972-5d7f711a60a8", "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "3037d961-21e9-4732-b27a-637bcc7bf539", "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "40f9af16-589d-4984-b78d-8c2aec023197", "4cbef972-f347-4170-b62a-8253f6168e6d", "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "853e74f9-9392-4935-ad3b-2e8c040dae86", "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "89a9a0e0-f61a-42e5-8957-b1479565a658", "a743ceba-c771-4d75-97eb-8a90f7f4844c", "b697e69c-746f-4a86-9f59-7bfff8eab881", "7a01183d-71a2-46ad-ad5c-acd989ac1793", "224f140f-3553-4cd1-af78-13d81bf9f7cc", "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "80fc36aa-945e-4181-89f2-2f907ab6775d", "d937b75f-a665-4480-88a5-2f20e9f9b22a", "1ca6bd18-0ba0-44ca-851c-92ed89a61085"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Imphash": {"refs": ["7aa7009a-28b9-4344-8c1f-159489a390df", "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "8d63dadf-b91b-4187-87b6-34a1114577ea", "e8d34729-86a4-4140-adfd-0a29c2106307", "ca621ba5-54ab-4035-9942-d378e6fcde3c", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "f4264e47-f522-4c38-a420-04525d5b880f", "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "729ce0ea-5d8f-4769-9762-e35de441586d"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "CurrentDirectory": {"refs": ["631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "95eadcb2-92e4-4ed1-9031-92547773a6db", "ed825c86-c009-4014-b413-b76003e33d35", "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "02b18447-ea83-4b1b-8805-714a8a34546a", "3a6586ad-127a-4d3b-a677-1e6eacdf8fde"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Provider_Name": {"refs": ["7dc2dedd-7603-461a-bc13-15803d132355"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "ParentUser": {"refs": ["590a5f4c-6c8c-4f10-8307-89afe9453a9d", "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "LogonId": {"refs": ["d21374ff-f574-44a7-9998-4a8c8bf33d7d", "178e615d-e666-498b-9630-9ed363038101"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}}}}} \ No newline at end of file +{"rules": [{"id": "7e4bfe58-4a47-4709-828d-d86c78b7cc1f", "title": "Cleartext Protocol Usage Via Netflow", "file": "../sigma/rules/compliance/netflow_cleartext_protocols.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": null}, {"id": "1a395cbc-a84a-463a-9086-ed8a70e573c7", "title": "Default Credentials Usage", "file": "../sigma/rules/compliance/default_credentials_usage.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "qualys"}, {"id": "6b2066c8-3dc7-4db7-9db0-6cc1d7b0dde9", "title": "Host Without Firewall", "file": "../sigma/rules/compliance/host_without_firewall.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "qualys"}, {"id": "fd435618-981e-4a7c-81f8-f78ce480d616", "title": "Django Framework Exceptions", "file": "../sigma/rules/application/django/appframework_django_exceptions.yml", "status": "stable", "level": "medium", "logsource.category": "application", "logsource.product": "django"}, {"id": "0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a", "title": "Ruby on Rails Framework Exceptions", "file": "../sigma/rules/application/ruby/appframework_ruby_on_rails_exceptions.yml", "status": "stable", "level": "medium", "logsource.category": "application", "logsource.product": "ruby_on_rails"}, {"id": "19aefed0-ffd4-47dc-a7fc-f8b1425e84f9", "title": "Python SQL Exceptions", "file": "../sigma/rules/application/python/app_python_sql_exceptions.yml", "status": "stable", "level": "medium", "logsource.category": "application", "logsource.product": "python"}, {"id": "8a670c6d-7189-4b1c-8017-a417ca84a086", "title": "Suspicious SQL Error Messages", "file": "../sigma/rules/application/sql/app_sqlinjection_errors.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "sql"}, {"id": "97661d9d-2beb-4630-b423-68985291a8af", "title": "Potential RCE Exploitation Attempt In NodeJS", "file": "../sigma/rules/application/nodejs/nodejs_rce_exploitation_attempt.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "nodejs"}, {"id": "e9edd087-89d8-48c9-b0b4-5b9bb10896b8", "title": "Potential SpEL Injection In Spring Framework", "file": "../sigma/rules/application/spring/spring_spel_injection.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "spring"}, {"id": "ae48ab93-45f7-4051-9dfe-5d30a3f78e33", "title": "Spring Framework Exceptions", "file": "../sigma/rules/application/spring/spring_application_exceptions.yml", "status": "stable", "level": "medium", "logsource.category": "application", "logsource.product": "spring"}, {"id": "68050b10-e477-4377-a99b-3721b422d6ef", "title": "Remote DCOM/WMI Lateral Movement", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_remote_dcom_or_wmi.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "b6ea3cc7-542f-43ef-bbe4-980fbed444c7", "title": "Remote Server Service Abuse", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_remote_server_service_abuse.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "6d580420-ff3f-4e0e-b6b0-41b90c787e28", "title": "SharpHound Recon Sessions", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_sharphound_recon_sessions.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "0a3ff354-93fc-4273-8a03-1078782de5b7", "title": "Recon Activity via SASec", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_sasec_recon.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "2053961f-44c7-4a64-b62d-f6e72800af0d", "title": "Remote Event Log Recon", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_eventlog_recon.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "65f77b1e-8e79-45bf-bb67-5988a8ce45a5", "title": "SharpHound Recon Account Discovery", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_sharphound_recon_account.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "56fda488-113e-4ce9-8076-afc2457922c3", "title": "Possible DCSync Attack", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_dcsync_attack.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d", "title": "Remote Schedule Task Lateral Movement via ITaskSchedulerService", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_lateral_movement.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "10018e73-06ec-46ec-8107-9172f1e04ff2", "title": "Remote Server Service Abuse for Lateral Movement", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_remote_service_lateral_movement.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "bc3a4b0c-e167-48e1-aa88-b3020950e560", "title": "Remote Printing Abuse for Lateral Movement", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_printing_lateral_movement.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "5f92fff9-82e2-48eb-8fc1-8b133556a551", "title": "Remote Encrypting File System Abuse", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_efs_abuse.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "0fcd1c79-4eeb-4746-aba9-1b458f7a79cb", "title": "Remote Schedule Task Lateral Movement via ATSvc", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_atsvc_lateral_movement.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "f177f2bc-5f3e-4453-b599-57eefce9a59c", "title": "Remote Schedule Task Recon via AtScv", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_atsvc_recon.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "35c55673-84ca-4e99-8d09-e334f3c29539", "title": "Remote Registry Lateral Movement", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_remote_registry_lateral_movement.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "aff229ab-f8cd-447b-b215-084d11e79eb0", "title": "Remote Schedule Task Lateral Movement via SASec", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_sasec_lateral_movement.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "d8ffe17e-04be-4886-beb9-c1dd1944b9a8", "title": "Remote Registry Recon", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_remote_registry_recon.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "7f7c49eb-2977-4ac8-8ab0-ab1bae14730e", "title": "Remote Schedule Task Recon via ITaskSchedulerService", "file": "../sigma/rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_recon.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "rpc_firewall"}, {"id": "bb0e9cec-d4da-46f5-997f-22efc59f3dca", "title": "Potential JNDI Injection Exploitation In JVM Based Application", "file": "../sigma/rules/application/jvm/java_jndi_injection_exploitation_attempt.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "jvm"}, {"id": "d65f37da-a26a-48f8-8159-3dde96680ad2", "title": "Process Execution Error In JVM Based Application", "file": "../sigma/rules/application/jvm/java_rce_exploitation_attempt.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "jvm"}, {"id": "e032f5bc-4563-4096-ae3b-064bab588685", "title": "Potential Local File Read Vulnerability In JVM Based Application", "file": "../sigma/rules/application/jvm/java_local_file_read.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "jvm"}, {"id": "4d0af518-828e-4a04-a751-a7d03f3046ad", "title": "Potential OGNL Injection Exploitation In JVM Based Application", "file": "../sigma/rules/application/jvm/java_ognl_injection_exploitation_attempt.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "jvm"}, {"id": "c4e06896-e27c-4583-95ac-91ce2279345d", "title": "Potential XXE Exploitation Attempt In JVM Based Application", "file": "../sigma/rules/application/jvm/java_xxe_exploitation_attempt.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "jvm"}, {"id": "16c86189-b556-4ee8-b4c7-7e350a195a4f", "title": "Potential Server Side Template Injection In Velocity", "file": "../sigma/rules/application/velocity/velocity_ssti_injection.yml", "status": "test", "level": "high", "logsource.category": "application", "logsource.product": "velocity"}, {"id": "3132570d-cab2-4561-9ea6-1743644b2290", "title": "Kubernetes Events Deleted", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_events_deleted.yml", "status": "experimental", "level": "medium", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "a80d927d-ac6e-443f-a867-e8d6e3897318", "title": "Creation Of Pod In System Namespace", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_pod_in_system_namespace.yml", "status": "experimental", "level": "medium", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "0c9b3bda-41a6-4442-9345-356ae86343dc", "title": "Kubernetes CronJob/Job Modification", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_cronjob_modification.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "kubernetes"}, {"id": "a1b0ca4e-7835-413e-8471-3ff2b8a66be6", "title": "Potential Remote Command Execution In Pod Container", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_exec_into_container.yml", "status": "experimental", "level": "medium", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "0d933542-1f1f-420d-97d4-21b2c3c492d9", "title": "Kubernetes Unauthorized or Unauthenticated Access", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_unauthorized_unauthenticated_actions.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "kubernetes"}, {"id": "84b777bd-c946-4d17-aa2e-c39f5a454325", "title": "RBAC Permission Enumeration Attempt", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_rbac_permisions_listing.yml", "status": "experimental", "level": "low", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "58d31a75-a4f8-4c40-985b-373d58162ca2", "title": "Kubernetes Secrets Modified or Deleted", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_secrets_modified_or_deleted.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "kubernetes"}, {"id": "eed82177-38f5-4299-8a76-098d50d225ab", "title": "Kubernetes Admission Controller Modification", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_change_admission_controller.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "kubernetes"}, {"id": "eeb3e9e1-b685-44e4-9232-6bb701f925b5", "title": "Kubernetes Secrets Enumeration", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_secrets_enumeration.yml", "status": "experimental", "level": "low", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "ad9012a6-e518-4432-9890-f3b82b8fc71f", "title": "Potential Sidecar Injection Into Running Deployment", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_sidecar_injection.yml", "status": "experimental", "level": "medium", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "402b955c-8fe0-4a8c-b635-622b4ac5f902", "title": "Container With A hostPath Mount Created", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_hostpath_mount.yml", "status": "experimental", "level": "low", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "40967487-139b-4811-81d9-c9767a92aa5a", "title": "Deployment Deleted From Kubernetes Cluster", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_deployment_deleted.yml", "status": "experimental", "level": "low", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "c5cd1b20-36bb-488d-8c05-486be3d0cb97", "title": "Privileged Container Deployed", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_privileged_pod_creation.yml", "status": "experimental", "level": "low", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "10b97915-ec8d-455f-a815-9a78926585f6", "title": "Kubernetes Rolebinding Modification", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_rolebinding_modification.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "kubernetes"}, {"id": "e31bae15-83ed-473e-bf31-faf4f8a17d36", "title": "New Kubernetes Service Account Created", "file": "../sigma/rules/application/kubernetes/audit/kubernetes_audit_serviceaccount_creation.yml", "status": "experimental", "level": "low", "logsource.category": "application", "logsource.product": "kubernetes"}, {"id": "e9856028-fd4e-46e6-b3d1-10f7ceb95078", "title": "OpenCanary - SNMP OID Request", "file": "../sigma/rules/application/opencanary/opencanary_snmp_cmd.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "547dfc53-ebf6-4afe-8d2e-793d9574975d", "title": "OpenCanary - REDIS Action Command Attempt", "file": "../sigma/rules/application/opencanary/opencanary_redis_command.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "512cff7a-683a-43ad-afe0-dd398e872f36", "title": "OpenCanary - Telnet Login Attempt", "file": "../sigma/rules/application/opencanary/opencanary_telnet_login_attempt.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "4fe17521-aef3-4e6a-9d6b-4a7c8de155a8", "title": "OpenCanary - GIT Clone Request", "file": "../sigma/rules/application/opencanary/opencanary_git_clone_request.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "af1ac430-df6b-4b38-b976-0b52f07a0252", "title": "OpenCanary - HTTP POST Login Attempt", "file": "../sigma/rules/application/opencanary/opencanary_http_post_login_attempt.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "6991bc2b-ae2e-447f-bc55-3a1ba04c14e5", "title": "OpenCanary - FTP Login Attempt", "file": "../sigma/rules/application/opencanary/opencanary_ftp_login_attempt.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "b4e6b016-a2ac-4759-ad85-8000b300d61e", "title": "OpenCanary - TFTP Request", "file": "../sigma/rules/application/opencanary/opencanary_tftp_request.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "22777c9e-873a-4b49-855f-6072ab861a52", "title": "OpenCanary - SMB File Open Request", "file": "../sigma/rules/application/opencanary/opencanary_smb_file_open.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "af6c3078-84cd-4c68-8842-08b76bd81b13", "title": "OpenCanary - HTTP GET Request", "file": "../sigma/rules/application/opencanary/opencanary_http_get.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "cd55f721-5623-4663-bd9b-5229cab5237d", "title": "OpenCanary - SSH New Connection Attempt", "file": "../sigma/rules/application/opencanary/opencanary_ssh_new_connection.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "ff7139bc-fdb1-4437-92f2-6afefe8884cb", "title": "OpenCanary - SSH Login Attempt", "file": "../sigma/rules/application/opencanary/opencanary_ssh_login_attempt.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "5498fc09-adc6-4804-b9d9-5cca1f0b8760", "title": "OpenCanary - HTTPPROXY Login Attempt", "file": "../sigma/rules/application/opencanary/opencanary_httpproxy_login_attempt.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "7cded4b3-f09e-405a-b96f-24248433ba44", "title": "OpenCanary - NTP Monlist Request", "file": "../sigma/rules/application/opencanary/opencanary_ntp_monlist.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "3ec9a16d-0b4f-4967-9542-ebf38ceac7dd", "title": "OpenCanary - MSSQL Login Attempt Via SQLAuth", "file": "../sigma/rules/application/opencanary/opencanary_mssql_login_sqlauth.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "9db5446c-b44a-4291-8b89-fcab5609c3b3", "title": "OpenCanary - VNC Connection Attempt", "file": "../sigma/rules/application/opencanary/opencanary_vnc_connection_attempt.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "e30de276-68ec-435c-ab99-ef3befec6c61", "title": "OpenCanary - SIP Request", "file": "../sigma/rules/application/opencanary/opencanary_sip_request.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "e7d79a1b-25ed-4956-bd56-bd344fa8fd06", "title": "OpenCanary - MySQL Login Attempt", "file": "../sigma/rules/application/opencanary/opencanary_mysql_login_attempt.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "6e78f90f-0043-4a01-ac41-f97681613a66", "title": "OpenCanary - MSSQL Login Attempt Via Windows Authentication", "file": "../sigma/rules/application/opencanary/opencanary_mssql_login_winauth.yml", "status": "experimental", "level": "high", "logsource.category": "application", "logsource.product": "opencanary"}, {"id": "dfe8b941-4e54-4242-b674-6b613d521962", "title": "Startup Item File Created - MacOS", "file": "../sigma/rules/macos/file_event/file_event_macos_susp_startup_item_created.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "macos"}, {"id": "23c43900-e732-45a4-8354-63e4a6c187ce", "title": "MacOS Emond Launch Daemon", "file": "../sigma/rules/macos/file_event/file_event_macos_emond_launch_daemon.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "macos"}, {"id": "47d65ac0-c06f-4ba2-a2e3-d263139d0f51", "title": "Potential XCSSET Malware Infection", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_xcsset_malware_infection.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "65d506d3-fcfe-4071-b4b2-bcefe721bbbb", "title": "Potential Persistence Via PlistBuddy", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_persistence_via_plistbuddy.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "5d0fdb62-f225-42fb-8402-3dfe64da468a", "title": "User Added To Admin Group Via DseditGroup", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_dseditgroup_add_to_admin_group.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "b743623c-2776-40e0-87b1-682b975d0ca5", "title": "User Added To Admin Group Via Dscl", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_dscl_add_user_to_admin_group.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "089dbdf6-b960-4bcc-90e3-ffc3480c20f6", "title": "File and Directory Discovery - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_file_and_directory_discovery.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "2d5e7a8b-f484-4a24-945d-7f0efd52eab0", "title": "System Information Discovery Using Ioreg", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "58800443-f9fc-4d55-ae0c-98a3966dfb97", "title": "System Network Discovery - macOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_susp_system_network_discovery.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "5de06a6f-673a-4fc0-8d48-bcfe3837b033", "title": "System Information Discovery Using sw_vers", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_swvers_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "1cf98dc2-fcb0-47c9-8aea-654c9284d1ae", "title": "Disk Image Creation Via Hdiutil - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "7ed2c9f7-c59d-4c82-a7e2-f859aa676099", "title": "Suspicious MacOS Firmware Activity", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_susp_macos_firmware_activity.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "b120b587-a4c2-4b94-875d-99c9807d6955", "title": "Credentials from Password Stores - Keychain", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_creds_from_keychain.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "7c3b43d8-d794-47d2-800a-d277715aa460", "title": "Scheduled Cron Task/Job - MacOs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_schedule_task_job_cron.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "9a7a0393-2144-4626-9bf1-7c2f5a7321db", "title": "System Network Connections Discovery - MacOs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_system_network_connections_discovery.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "2316929c-01aa-438c-970f-099145ab1ee6", "title": "JAMF MDM Potential Suspicious Child Process", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_jamf_susp_child.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "6d8a7cf1-8085-423b-b87d-7e880faabbdf", "title": "File Download Via Nscurl - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_nscurl_usage.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "2c95fa8a-8b8d-4787-afce-7117ceb8e3da", "title": "Time Machine Backup Disabled Via Tmutil - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "95361ce5-c891-4b0a-87ca-e24607884a96", "title": "Binary Padding - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_binary_padding.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "1bc2e6c5-0885-472b-bed6-be5ea8eace55", "title": "MacOS Scripting Interpreter AppleScript", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_applescript.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "acf61bd8-d814-4272-81f0-a7a269aa69aa", "title": "Indicator Removal on Host - Clear Mac System Logs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_clear_system_logs.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "ddf36b67-e872-4507-ab2e-46bda21b842c", "title": "Local System Accounts Discovery - MacOs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_local_account.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "bf241472-f014-4f01-a869-96f99330ca8c", "title": "Disk Image Mounting Via Hdiutil - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "e0cfaecd-602d-41af-988d-f6ccebb2af26", "title": "Suspicious Installer Package Child Process", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "69483748-1525-4a6c-95ca-90dc8d431b68", "title": "Suspicious Microsoft Office Child Process - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_office_susp_child_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "508a9374-ad52-4789-b568-fc358def2c65", "title": "Suspicious History File Operations", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_susp_histfile_operations.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "b9d9b652-d8ed-4697-89a2-a1186ee680ac", "title": "OSACompile Run-Only Execution", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_osacompile_runonly_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "f1408a58-0e94-4165-b80a-da9f96cf6fc3", "title": "JXA In-memory Execution Via OSAScript", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_jxa_in_memory_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "13db8d2e-7723-4c2c-93c1-a4d36994f7ef", "title": "Potential In-Memory Download And Compile Of Payloads", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_susp_in_memory_download_and_compile.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "be2e3a5c-9cc7-4d02-842a-68e9cb26ec49", "title": "JAMF MDM Execution", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_jamf_usage.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "84bae5d4-b518-4ae0-b331-6d4afd34d00f", "title": "MacOS Network Service Scanning", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_network_service_scanning.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "652c098d-dc11-4ba6-8566-c20e89042f2b", "title": "User Added To Admin Group Via Sysadminctl", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "0877ed01-da46-4c49-8476-d49cdd80dfa7", "title": "Screen Capture - macOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_screencapture.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "234dc5df-40b5-49d1-bf53-0d44ce778eca", "title": "Payload Decoded and Decrypted via Built-in Utilities", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_payload_decoded_and_decrypted.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "10227522-8429-47e6-a301-f2b2d014e7ad", "title": "Macos Remote System Discovery", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_remote_system_discovery.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "719c22d7-c11a-4f2c-93a6-2cfdd5412f68", "title": "Decode Base64 Encoded Text -MacOs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_base64_decode.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "a753a6af-3126-426d-8bd0-26ebbcb92254", "title": "Osacompile Execution By Potentially Suspicious Applet/Osascript", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_suspicious_applet_behaviour.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "0ed75b9c-c73b-424d-9e7d-496cd565fbe0", "title": "Security Software Discovery - MacOs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_security_software_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "51719bf5-e4fd-4e44-8ba8-b830e7ac0731", "title": "Creation Of A Local User Account", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_create_account.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "85de3a19-b675-4a51-bfc6-b11a5186c971", "title": "Potential Discovery Activity Using Find - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_susp_find_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "7794fa3c-edea-4cff-bec7-267dd4770fd7", "title": "Clipboard Data Collection Via OSAScript", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_clipboard_data_via_osascript.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "4809c683-059b-4935-879d-36835986f8cf", "title": "System Information Discovery Using System_Profiler", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "6ff08e55-ea53-4f27-94a1-eff92e6d9d5c", "title": "System Information Discovery Via Sysctl - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_sysctl_discovery.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "53821412-17b0-4147-ade0-14faae67d54b", "title": "System Integrity Protection (SIP) Enumeration", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_csrutil_status.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4", "title": "Suspicious Execution via macOS Script Editor", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_susp_execution_macos_script_editor.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "40b1fbe2-18ea-4ee7-be47-0294285811de", "title": "System Shutdown/Reboot - MacOs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_system_shutdown_reboot.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "b22a5b36-2431-493a-8be1-0bae56c28ef3", "title": "Hidden User Creation", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_create_hidden_account.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e", "title": "Launch Agent/Daemon Execution Via Launchctl", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_launchctl_execution.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "f5141b6d-9f42-41c6-a7bf-2a780678b29b", "title": "Gatekeeper Bypass via Xattr", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "89bb1f97-c7b9-40e8-b52b-7d6afbd67276", "title": "Local Groups Discovery - MacOs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_local_groups.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "adc9bcc4-c39c-4f6b-a711-1884017bf043", "title": "Network Sniffing - MacOs", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_network_sniffing.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "60f1ce20-484e-41bd-85f4-ac4afec2c541", "title": "GUI Input Capture - macOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_gui_input_capture.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "0250638a-2b28-4541-86fc-ea4c558fa0c6", "title": "Suspicious Browser Child Process - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_susp_browser_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "09a910bf-f71f-4737-9c40-88880ba5913d", "title": "Potential Base64 Decoded From Images", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_tail_base64_decode_from_image.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "821bcf4d-46c7-4b87-bc57-9509d3ba7c11", "title": "Root Account Enable Via Dsenableroot", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_dsenableroot_enable_root_account.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "9acf45ed-3a26-4062-bf08-56857613eb52", "title": "New File Exclusion Added To Time Machine Via Tmutil - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "ff39f1a6-84ac-476f-a1af-37fcdf53d7c0", "title": "Disable Security Tools", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_disable_security_tools.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe", "title": "Hidden Flag Set On File/Directory Via Chflags - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0", "title": "File Time Attribute Change", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_change_file_time_attr.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "3603f18a-ec15-43a1-9af2-d196c8a7fec6", "title": "System Integrity Protection (SIP) Disabled", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_csrutil_disable.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "f459ccb4-9805-41ea-b5b2-55e279e2424a", "title": "Remote Access Tool - Team Viewer Session Started On MacOS Host", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "452df256-da78-427a-866f-49fa04417d74", "title": "Time Machine Backup Deletion Attempt Via Tmutil - MacOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "7f2bb9d5-6395-4de5-969c-70c11fbe6b12", "title": "Split A File Into Pieces", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_split_file_into_pieces.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "53b1b378-9b06-4992-b972-dde6e423d2b4", "title": "Credentials In Files", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_find_cred_in_files.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "f68c4a4f-19ef-4817-952c-50dce331f4b0", "title": "Potential WizardUpdate Malware Infection", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_wizardupdate_malware_infection.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "b6e2a2e3-2d30-43b1-a4ea-071e36595690", "title": "Space After Filename - macOS", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_space_after_filename.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "d7329412-13bd-44ba-a072-3387f804a106", "title": "Guest Account Enabled Via Sysadminctl", "file": "../sigma/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "macos"}, {"id": "980a7598-1e7f-4962-9372-2d754c930d0e", "title": "Google Full Network Traffic Packet Capture", "file": "../sigma/rules/cloud/gcp/audit/gcp_full_network_traffic_packet_capture.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "6b67c12e-5e40-47c6-b3b0-1e6b571184cc", "title": "Google Cloud Service Account Modified", "file": "../sigma/rules/cloud/gcp/audit/gcp_service_account_modified.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "2f0bae2d-bf20-4465-be86-1311addebaa3", "title": "Google Cloud Kubernetes Secrets Modified or Deleted", "file": "../sigma/rules/cloud/gcp/audit/gcp_kubernetes_secrets_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "234f9f48-904b-4736-a34c-55d23919e4b7", "title": "Google Cloud Re-identifies Sensitive Information", "file": "../sigma/rules/cloud/gcp/audit/gcp_dlp_re_identifies_sensitive_information.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "cd3a808c-c7b7-4c50-a2f3-f4cfcd436435", "title": "Google Cloud Kubernetes CronJob", "file": "../sigma/rules/cloud/gcp/audit/gcp_kubernetes_cronjob.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "76737c19-66ee-4c07-b65a-a03301d1573d", "title": "GCP Break-glass Container Workload Deployed", "file": "../sigma/rules/cloud/gcp/audit/gcp_breakglass_container_workload_deployed.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "4d9f2ee2-c903-48ab-b9c1-8c0f474913d0", "title": "Google Cloud Storage Buckets Modified or Deleted", "file": "../sigma/rules/cloud/gcp/audit/gcp_bucket_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "6ad91e31-53df-4826-bd27-0166171c8040", "title": "Google Cloud Kubernetes Admission Controller", "file": "../sigma/rules/cloud/gcp/audit/gcp_kubernetes_admission_controller.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "f346bbd5-2c4e-4789-a221-72de7685090d", "title": "Google Cloud SQL Database Modified or Deleted", "file": "../sigma/rules/cloud/gcp/audit/gcp_sql_database_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "32438676-1dba-4ac7-bf69-b86cba995e05", "title": "GCP Access Policy Deleted", "file": "../sigma/rules/cloud/gcp/audit/gcp_access_policy_deleted.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "99980a85-3a61-43d3-ac0f-b68d6b4797b1", "title": "Google Cloud VPN Tunnel Modified or Deleted", "file": "../sigma/rules/cloud/gcp/audit/gcp_vpn_tunnel_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "28268a8f-191f-4c17-85b2-f5aa4fa829c3", "title": "Google Cloud DNS Zone Modified or Deleted", "file": "../sigma/rules/cloud/gcp/audit/gcp_dns_zone_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "fe513c69-734c-4d4a-8548-ac5f609be82b", "title": "Google Cloud Firewall Modified or Deleted", "file": "../sigma/rules/cloud/gcp/audit/gcp_firewall_rule_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "13f81a90-a69c-4fab-8f07-b5bb55416a9f", "title": "Google Cloud Service Account Disabled or Deleted", "file": "../sigma/rules/cloud/gcp/audit/gcp_service_account_disabled_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "0322d9f2-289a-47c2-b5e1-b63c90901a3e", "title": "Google Cloud Kubernetes RoleBinding", "file": "../sigma/rules/cloud/gcp/audit/gcp_kubernetes_rolebinding.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "e2feb918-4e77-4608-9697-990a1aaf74c3", "title": "Google Cloud Storage Buckets Enumeration", "file": "../sigma/rules/cloud/gcp/audit/gcp_bucket_enumeration.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "gcp"}, {"id": "780601d1-6376-4f2a-884e-b8d45599f78c", "title": "Google Workspace MFA Disabled", "file": "../sigma/rules/cloud/gcp/gworkspace/gcp_gworkspace_mfa_disabled.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "bf638ef7-4d2d-44bb-a1dc-a238252e6267", "title": "Google Workspace Role Privilege Deleted", "file": "../sigma/rules/cloud/gcp/gworkspace/gcp_gworkspace_role_privilege_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "04e2a23a-9b29-4a5c-be3a-3542e3f982ba", "title": "Google Workspace Granted Domain API Access", "file": "../sigma/rules/cloud/gcp/gworkspace/gcp_gworkspace_granted_domain_api_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "ee2803f0-71c8-4831-b48b-a1fc57601ee4", "title": "Google Workspace Application Removed", "file": "../sigma/rules/cloud/gcp/gworkspace/gcp_gworkspace_application_removed.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "6aef64e3-60c6-4782-8db3-8448759c714e", "title": "Google Workspace Role Modified or Deleted", "file": "../sigma/rules/cloud/gcp/gworkspace/gcp_gworkspace_role_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "2d1b83e4-17c6-4896-a37b-29140b40a788", "title": "Google Workspace User Granted Admin Privileges", "file": "../sigma/rules/cloud/gcp/gworkspace/gcp_gworkspace_user_granted_admin_privileges.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "22f2fb54-5312-435d-852f-7c74f81684ca", "title": "Google Workspace Application Access Level Modified", "file": "../sigma/rules/cloud/gcp/gworkspace/gcp_gworkspace_application_access_levels_modified.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "gcp"}, {"id": "a3501e8e-af9e-43c6-8cd6-9360bdaae498", "title": "Activity from Suspicious IP Addresses", "file": "../sigma/rules/cloud/m365/threat_detection/microsoft365_from_susp_ip_addresses.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "42127bdd-9133-474f-a6f1-97b6c08a4339", "title": "New Federated Domain Added - Exchange", "file": "../sigma/rules/cloud/m365/exchange/microsoft365_new_federated_domain_added_exchange.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "18b88d08-d73e-4f21-bc25-4b9892a4fdd0", "title": "PST Export Alert Using eDiscovery Alert", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_pst_export_alert.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "d7eab125-5f94-43df-8710-795b80fa1189", "title": "Microsoft 365 - Impossible Travel Activity", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_impossible_travel_activity.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "c191e2fa-f9d6-4ccf-82af-4f2aba08359f", "title": "Logon from a Risky IP Address", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_logon_from_risky_ip_address.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "6c220477-0b5b-4b25-bb90-66183b4089e8", "title": "Suspicious Inbox Forwarding", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_susp_inbox_forwarding.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "m365"}, {"id": "78a34b67-3c39-4886-8fb4-61c46dc18ecd", "title": "Microsoft 365 - Unusual Volume of File Deletion", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_unusual_volume_of_file_deletion.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "0f2468a2-5055-4212-a368-7321198ee706", "title": "Activity from Infrequent Country", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_activity_from_infrequent_country.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "bd132164-884a-48f1-aa2d-c6d646b04c69", "title": "Microsoft 365 - Potential Ransomware Activity", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_potential_ransomware_activity.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "2e669ed8-742e-4fe5-b3c4-5a59b486c2ee", "title": "Activity Performed by Terminated User", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_activity_by_terminated_user.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "ff246f56-7f24-402a-baca-b86540e3925c", "title": "Microsoft 365 - User Restricted from Sending Email", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_user_restricted_from_sending_email.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "6897cd82-6664-11ed-9022-0242ac120002", "title": "PST Export Alert Using New-ComplianceSearchAction", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_pst_export_alert_using_new_compliancesearchaction.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "2b669496-d215-47d8-bd9a-f4a45bf07cda", "title": "Data Exfiltration to Unsanctioned Apps", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_data_exfiltration_to_unsanctioned_app.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "d8b0a4fe-07a8-41be-bd39-b14afa025d95", "title": "Activity from Anonymous IP Addresses", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_activity_from_anonymous_ip_addresses.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "ee111937-1fe7-40f0-962a-0eb44d57d174", "title": "Suspicious OAuth App File Download Activities", "file": "../sigma/rules/cloud/m365/threat_management/microsoft365_susp_oauth_app_file_download_activities.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "58f88172-a73d-442b-94c9-95eaed3cbb36", "title": "New Federated Domain Added", "file": "../sigma/rules/cloud/m365/audit/microsoft365_new_federated_domain_added_audit.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "m365"}, {"id": "60de9b57-dc4d-48b9-a6a0-b39e0469f876", "title": "Disabling Multi Factor Authentication", "file": "../sigma/rules/cloud/m365/audit/microsoft365_disabling_mfa.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "m365"}, {"id": "a607e1fe-74bf-4440-a3ec-b059b9103157", "title": "AWS SecurityHub Findings Evasion", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_securityhub_finding_evasion.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "db014773-d9d9-4792-91e5-133337c0ffee", "title": "AWS IAM S3Browser User or AccessKey Creation", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_iam_s3browser_user_or_accesskey_creation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "db014773-7375-4f4e-b83b-133337c0ffee", "title": "AWS IAM S3Browser Templated S3 Bucket Policy Creation", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_iam_s3browser_templated_s3_bucket_policy_creation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "97fbabf8-8e1b-47a2-b7d5-a418d2b95e3d", "title": "AWS Attached Malicious Lambda Layer", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_attached_malicious_lambda_layer.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "33d50d03-20ec-4b74-a74e-1e65a38af1c0", "title": "AWS EKS Cluster Created or Deleted", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_eks_cluster_created_or_deleted.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "38e7f511-3f74-41d4-836e-f57dfa18eead", "title": "Potential Malicious Usage of CloudTrail System Manager", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_ssm_malicious_usage.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "a136ac98-b2bc-4189-a14d-f0d0388e57a7", "title": "AWS S3 Bucket Versioning Disable", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_disable_bucket_versioning.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e", "title": "AWS Suspicious SAML Activity", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_susp_saml_activity.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "14f3f1c8-02d5-43a2-a191-91ffb52d3015", "title": "RDS Database Security Group Modification", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_rds.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "07330162-dba1-4746-8121-a9647d49d297", "title": "AWS Config Disabling Channel/Recorder", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_config_disable_recording.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df", "title": "AWS EC2 Startup Shell Script Change", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_ec2_startup_script_change.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "20f754db-d025-4a8f-9d74-e0037e999a9a", "title": "SES Identity Has Been Deleted", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_delete_identity.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "8ad1600d-e9dc-4251-b0ee-a65268f29add", "title": "AWS Root Credentials", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_root_account_usage.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "16124c2d-e40b-4fcc-8f2c-5ab7870a2223", "title": "AWS EC2 Disable EBS Encryption", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_ec2_disable_encryption.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "78b3756a-7804-4ef7-8555-7b9024a02e2d", "title": "AWS S3 Data Management Tampering", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_s3_data_management_tampering.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "54b9a76a-3c71-4673-b4b3-2edb4566ea7b", "title": "AWS EC2 VM Export Failure", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_ec2_vm_export_failure.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "e1f7febb-7b94-4234-b5c6-00fb8500f5dd", "title": "New Network ACL Entry Added", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_new_acl_entries.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "b94bf91e-c2bf-4047-9c43-c6810f43baad", "title": "AWS ECS Task Definition That Queries The Credential Endpoint", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_ecs_task_definition_cred_endpoint_query.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "4ae68615-866f-4304-b24b-ba048dfa5ca7", "title": "AWS ElastiCache Security Group Created", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_elasticache_security_group_created.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "7a4409fc-f8ca-45f6-8006-127d779eaad9", "title": "LoadBalancer Security Group Modification", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_loadbalancer.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "905d389b-b853-46d0-9d3d-dea0d3a3cd49", "title": "AWS STS AssumeRole Misuse", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_sts_assumerole_misuse.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "8a63cdd4-6207-414a-85bc-7e032bd3c1a2", "title": "AWS RDS Master Password Change", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_rds_change_master_password.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "6a7ba45c-63d8-473e-9736-2eaabff79964", "title": "AWS EFS Fileshare Mount Modified or Deleted", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_efs_fileshare_mount_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "c3f265c7-ff03-4056-8ab2-d486227b4599", "title": "Restore Public AWS RDS Instance", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_rds_public_db_restore.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "b45ab1d2-712f-4f01-a751-df3826969807", "title": "AWS STS GetSessionToken Misuse", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_sts_getsessiontoken_misuse.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "6fb77778-040f-4015-9440-572aa9b6b580", "title": "Ingress/Egress Security Group Modification", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_ingress_egress.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "7c797da2-9cf2-4523-ba64-33b06339f0cc", "title": "AWS ElastiCache Security Group Modified or Deleted", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_elasticache_security_group_modified_or_deleted.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2", "title": "AWS IAM Backdoor Users Keys", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_iam_backdoor_users_keys.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "b056de1a-6e6e-4e40-a67e-97c9808cf41b", "title": "AWS Route 53 Domain Transferred to Another Account", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_route_53_domain_transferred_to_another_account.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "4990c2e3-f4b8-45e3-bc3c-30b14ff0ed26", "title": "AWS Glue Development Endpoint Activity", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_passed_role_to_glue_development_endpoint.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "db014773-b1d3-46bd-ba26-133337c0ffee", "title": "AWS IAM S3Browser LoginProfile Creation", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_iam_s3browser_loginprofile_creation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "d3adb3ef-b7e7-4003-9092-1924c797db35", "title": "AWS Identity Center Identity Provider Change", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_sso_idp_change.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "3940b5f1-3f46-44aa-b746-ebe615b879e0", "title": "AWS Route 53 Domain Transfer Lock Disabled", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_route_53_domain_transferred_lock_disabled.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "f8103686-e3e8-46f3-be72-65f7fcb4aa53", "title": "AWS Console GetSigninToken Potential Abuse", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_console_getsignintoken.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "6e61ee20-ce00-4f8d-8aee-bedd8216f7e3", "title": "AWS GuardDuty Important Change", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_guardduty_disruption.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "abae8fec-57bd-4f87-aff6-6e3db989843d", "title": "AWS Snapshot Backup Exfiltration", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_snapshot_backup_exfiltration.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "4db60cc0-36fb-42b7-9b58-a5b53019fb74", "title": "AWS CloudTrail Important Change", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_disable_logging.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "c803b2ce-c4a2-4836-beae-b112010390b1", "title": "New Network Route Added", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_new_route_added.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "f305fd62-beca-47da-ad95-7690a0620084", "title": "Potential Bucket Enumeration on AWS", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_enum_buckets.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "aws"}, {"id": "25cb1ba1-8a19-4a23-a198-d252664c8cef", "title": "AWS EFS Fileshare Modified or Deleted", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_efs_fileshare_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "aws"}, {"id": "352a918a-34d8-4882-8470-44830c507aa3", "title": "Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_imds_malicious_usage.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "055fb148-60f8-462d-ad16-26926ce050f1", "title": "AWS User Login Profile Was Modified", "file": "../sigma/rules/cloud/aws/cloudtrail/aws_update_login_profile.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "aws"}, {"id": "a717c561-d117-437e-b2d9-0118a7035d01", "title": "OneLogin User Account Locked", "file": "../sigma/rules/cloud/onelogin/onelogin_user_account_locked.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "onelogin"}, {"id": "62fff148-278d-497e-8ecd-ad6083231a35", "title": "OneLogin User Assumed Another User", "file": "../sigma/rules/cloud/onelogin/onelogin_assumed_another_user.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "onelogin"}, {"id": "6f7e1c10-2dc9-4312-adb6-9574ff09a5c8", "title": "Cisco Duo Successful MFA Authentication Via Bypass Code", "file": "../sigma/rules/cloud/cisco/duo/cisco_duo_mfa_bypass_via_bypass_code.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "cisco"}, {"id": "7899144b-e416-4c28-b0b5-ab8f9e0a541d", "title": "Okta Application Modified or Deleted", "file": "../sigma/rules/cloud/okta/okta_application_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "a0b38b70-3cb5-484b-a4eb-c4d8e7bcc0a9", "title": "Okta New Admin Console Behaviours", "file": "../sigma/rules/cloud/okta/okta_new_behaviours_admin_console.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "okta"}, {"id": "14701da0-4b0f-4ee6-9c95-2ffb4e73bb9a", "title": "Okta User Account Locked Out", "file": "../sigma/rules/cloud/okta/okta_user_account_locked_out.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "8f668cc4-c18e-45fe-ad00-624a981cf88a", "title": "Okta Application Sign-On Policy Modified or Deleted", "file": "../sigma/rules/cloud/okta/okta_application_sign_on_policy_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "b6c718dd-8f53-4b9f-98d8-93fdca966969", "title": "New Okta User Created", "file": "../sigma/rules/cloud/okta/okta_user_created.yml", "status": "test", "level": "informational", "logsource.category": null, "logsource.product": "okta"}, {"id": "139bdd4b-9cd7-49ba-a2f4-744d0a8f5d8c", "title": "Okta Admin Role Assignment Created", "file": "../sigma/rules/cloud/okta/okta_admin_role_assignment_created.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "6cc2b61b-d97e-42ef-a9dd-8aa8dc951657", "title": "Okta Unauthorized Access to App", "file": "../sigma/rules/cloud/okta/okta_unauthorized_access_to_app.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "cf1dbc6b-6205-41b4-9b88-a83980d2255b", "title": "Okta API Token Revoked", "file": "../sigma/rules/cloud/okta/okta_api_token_revoked.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "9f308120-69ed-4506-abde-ac6da81f4310", "title": "Okta Network Zone Deactivated or Deleted", "file": "../sigma/rules/cloud/okta/okta_network_zone_deactivated_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "19951c21-229d-4ccb-8774-b993c3ff3c5c", "title": "Okta API Token Created", "file": "../sigma/rules/cloud/okta/okta_api_token_created.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "5c82f0b9-3c6d-477f-a318-0e14a1df73e0", "title": "Okta Security Threat Detected", "file": "../sigma/rules/cloud/okta/okta_security_threat_detected.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "91b76b84-8589-47aa-9605-c837583b82a9", "title": "Potential Okta Password in AlternateID Field", "file": "../sigma/rules/cloud/okta/okta_password_in_alternateid_field.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "okta"}, {"id": "969c7590-8c19-4797-8c1b-23155de6e7ac", "title": "Okta Identity Provider Created", "file": "../sigma/rules/cloud/okta/okta_identity_provider_created.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "50e068d7-1e6b-4054-87e5-0a592c40c7e0", "title": "Okta MFA Reset or Deactivated", "file": "../sigma/rules/cloud/okta/okta_mfa_reset_or_deactivated.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e", "title": "Okta FastPass Phishing Detection", "file": "../sigma/rules/cloud/okta/okta_fastpass_phishing_detection.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "okta"}, {"id": "413d4a81-6c98-4479-9863-014785fd579c", "title": "Okta Admin Role Assigned to an User or Group", "file": "../sigma/rules/cloud/okta/okta_admin_role_assigned_to_user_or_group.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "9058ca8b-f397-4fd1-a9fa-2b7aad4d6309", "title": "Okta Admin Functions Access Through Proxy", "file": "../sigma/rules/cloud/okta/okta_admin_activity_from_proxy_query.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "1667a172-ed4c-463c-9969-efd92195319a", "title": "Okta Policy Modified or Deleted", "file": "../sigma/rules/cloud/okta/okta_policy_modified_or_deleted.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "okta"}, {"id": "bde30855-5c53-4c18-ae90-1ff79ebc9578", "title": "Okta User Session Start Via An Anonymising Proxy Service", "file": "../sigma/rules/cloud/okta/okta_user_session_start_via_anonymised_proxy.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "okta"}, {"id": "07e97cc6-aed1-43ae-9081-b3470d2367f1", "title": "Okta Suspicious Activity Reported by End-user", "file": "../sigma/rules/cloud/okta/okta_suspicious_activity_enduser_report.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "okta"}, {"id": "0c97c1d3-4057-45c9-b148-1de94b631931", "title": "Okta Policy Rule Modified or Deleted", "file": "../sigma/rules/cloud/okta/okta_policy_rule_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "okta"}, {"id": "16a71777-0b2e-4db7-9888-9d59cb75200b", "title": "Github Delete Action Invoked", "file": "../sigma/rules/cloud/github/github_delete_action_invoked.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "github"}, {"id": "3908d64a-3c06-4091-b503-b3a94424533b", "title": "New Github Organization Member Added", "file": "../sigma/rules/cloud/github/github_new_org_member.yml", "status": "test", "level": "informational", "logsource.category": null, "logsource.product": "github"}, {"id": "3883d9a0-fd0f-440f-afbb-445a2a799bb8", "title": "Github Secret Scanning Feature Disabled", "file": "../sigma/rules/cloud/github/github_secret_scanning_feature_disabled.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "github"}, {"id": "f9405037-bc97-4eb7-baba-167dad399b83", "title": "Github New Secret Created", "file": "../sigma/rules/cloud/github/github_new_secret_created.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "github"}, {"id": "8622c92d-c00e-463c-b09d-fd06166f6794", "title": "Github High Risk Configuration Disabled", "file": "../sigma/rules/cloud/github/github_disable_high_risk_configuration.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "github"}, {"id": "69b3bd1e-b38a-462f-9a23-fbdbf63d2294", "title": "Github Fork Private Repositories Setting Enabled/Cleared", "file": "../sigma/rules/cloud/github/github_fork_private_repos_enabled_or_cleared.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "github"}, {"id": "04ad83ef-1a37-4c10-b57a-81092164bf33", "title": "Github Repository/Organization Transferred", "file": "../sigma/rules/cloud/github/github_repo_or_org_transferred.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "github"}, {"id": "eaa9ac35-1730-441f-9587-25767bde99d7", "title": "Github Outside Collaborator Detected", "file": "../sigma/rules/cloud/github/github_outside_collaborator_detected.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "github"}, {"id": "2f575940-d85e-4ddc-af13-17dad6f1a0ef", "title": "Github SSH Certificate Configuration Changed", "file": "../sigma/rules/cloud/github/github_ssh_certificate_config_changed.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "github"}, {"id": "ccd55945-badd-4bae-936b-823a735d37dd", "title": "Github Push Protection Disabled", "file": "../sigma/rules/cloud/github/github_push_protection_disabled.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "github"}, {"id": "02cf536a-cf21-4876-8842-4159c8aee3cc", "title": "Github Push Protection Bypass Detected", "file": "../sigma/rules/cloud/github/github_push_protection_bypass_detected.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "github"}, {"id": "f8ed0e8f-7438-4b79-85eb-f358ef2fbebd", "title": "Github Self Hosted Runner Changes Detected", "file": "../sigma/rules/cloud/github/github_self_hosted_runner_changes_detected.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "github"}, {"id": "34e1c7d4-0cd5-419d-9f1b-1dad3f61018d", "title": "Outdated Dependency Or Vulnerability Alert Disabled", "file": "../sigma/rules/cloud/github/github_disabled_outdated_dependency_or_vulnerability.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "github"}, {"id": "adf9f4d2-559e-4f5c-95be-c28dff0b1476", "title": "New Country", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_new_coutry_region.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "53acd925-2003-440d-a1f3-71a5253fe237", "title": "Anonymous IP Address", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_address.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "19128e5e-4743-48dc-bd97-52e5775af817", "title": "Azure AD Account Credential Leaked", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_leaked_credentials.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "28ecba0a-c743-4690-ad29-9a8f6f25a6f9", "title": "Password Spray Activity", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_password_spray.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "e3393cba-31f0-4207-831e-aef90ab17a8c", "title": "SAML Token Issuer Anomaly", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_token_issuer_anomaly.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "1a41023f-1e70-4026-921a-4d9341a9038e", "title": "Atypical Travel", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_atypical_travel.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "821b4dc3-1295-41e7-b157-39ab212dd6bd", "title": "Sign-In From Malware Infected IP", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_malware_linked_ip.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "36440e1c-5c22-467a-889b-593e66498472", "title": "Malicious IP Address Sign-In Suspicious", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_malicious_ip_address_suspicious.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "a2cb56ff-4f46-437a-a0fa-ffa4d1303cba", "title": "Azure AD Threat Intelligence", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_threat_intel.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "944f6adb-7a99-4c69-80c1-b712579e93e6", "title": "Suspicious Browser Activity", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_suspicious_browser.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "128faeef-79dd-44ca-b43c-a9e236a60f49", "title": "Unfamiliar Sign-In Properties", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_unfamilar_sign_in.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "6555754e-5e7f-4a67-ad1c-4041c413a007", "title": "Anomalous Token", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_anomalous_token.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "a3f55ebd-0c01-4ed6-adc0-8fb76d8cd3cd", "title": "Malicious IP Address Sign-In Failure Rate", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_malicious_ip_address.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "be4d9c86-d702-4030-b52e-c7859110e5e8", "title": "Activity From Anonymous IP Address", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_activity.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "b2572bf9-e20a-4594-b528-40bde666525a", "title": "Impossible Travel", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_impossible_travel.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "ceb55fd0-726e-4656-bf4e-b585b7f7d572", "title": "Suspicious Inbox Manipulation Rules", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_inbox_manipulation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "27e4f1d6-ae72-4ea0-8a67-77a73a289c3d", "title": "Suspicious Inbox Forwarding Identity Protection", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_inbox_forwarding_rule.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "258b6593-215d-4a26-a141-c8e31c1299a6", "title": "Anomalous User Activity", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_anomalous_user.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "a84fc3b1-c9ce-4125-8e74-bdcdb24021f1", "title": "Primary Refresh Token Access Attempt", "file": "../sigma/rules/cloud/azure/identity_protection/azure_identity_protection_prt_access.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "7bbc309f-e2b1-4eb1-8369-131a367d67d3", "title": "Too Many Global Admins", "file": "../sigma/rules/cloud/azure/privileged_identity_management/azure_pim_too_many_global_admins.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "94a66f46-5b64-46ce-80b2-75dcbe627cc0", "title": "Roles Activation Doesn't Require MFA", "file": "../sigma/rules/cloud/azure/privileged_identity_management/azure_pim_role_no_mfa_required.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "58af08eb-f9e1-43c8-9805-3ad9b0482bd8", "title": "Invalid PIM License", "file": "../sigma/rules/cloud/azure/privileged_identity_management/azure_pim_invalid_license.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "e402c26a-267a-45bd-9615-bd9ceda6da85", "title": "Stale Accounts In A Privileged Role", "file": "../sigma/rules/cloud/azure/privileged_identity_management/azure_pim_account_stale.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "8c6ec464-4ae4-43ac-936a-291da66ed13d", "title": "Roles Are Not Being Used", "file": "../sigma/rules/cloud/azure/privileged_identity_management/azure_pim_role_not_used.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "645fd80d-6c07-435b-9e06-7bc1b5656cba", "title": "Roles Activated Too Frequently", "file": "../sigma/rules/cloud/azure/privileged_identity_management/azure_pim_role_frequent_activation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "b1bc08d1-8224-4758-a0e6-fbcfc98c73bb", "title": "Roles Assigned Outside PIM", "file": "../sigma/rules/cloud/azure/privileged_identity_management/azure_pim_role_assigned_outside_of_pim.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "8366030e-7216-476b-9927-271d79f13cf3", "title": "Azure Unusual Authentication Interruption", "file": "../sigma/rules/cloud/azure/signin_logs/azure_unusual_authentication_interruption.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "55695bc0-c8cf-461f-a379-2535f563c854", "title": "Applications That Are Using ROPC Authentication Flow", "file": "../sigma/rules/cloud/azure/signin_logs/azure_app_ropc_authentication.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "5496ff55-42ec-4369-81cb-00f417029e25", "title": "Multifactor Authentication Interrupted", "file": "../sigma/rules/cloud/azure/signin_logs/azure_mfa_interrupted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "248649b7-d64f-46f0-9fb2-a52774166fb5", "title": "Application Using Device Code Authentication Flow", "file": "../sigma/rules/cloud/azure/signin_logs/azure_app_device_code_authentication.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "28eea407-28d7-4e42-b0be-575d5ba60b2c", "title": "Azure AD Only Single Factor Authentication Required", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_only_single_factor_auth_required.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "azure"}, {"id": "4afac85c-224a-4dd7-b1af-8da40e1c60bd", "title": "Account Disabled or Blocked for Sign in Attempts", "file": "../sigma/rules/cloud/azure/signin_logs/azure_blocked_account_attempt.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "28870ae4-6a13-4616-bd1a-235a7fad7458", "title": "Failed Authentications From Countries You Do Not Operate Out Of", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_failed_auth_from_countries_you_do_not_operate_out_of.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "azure"}, {"id": "572b12d4-9062-11ed-a1eb-0242ac120002", "title": "Suspicious SignIns From A Non Registered Device", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "9a60e676-26ac-44c3-814b-0c2a8b977adf", "title": "User Access Blocked by Azure Conditional Access", "file": "../sigma/rules/cloud/azure/signin_logs/azure_user_login_blocked_by_conditional_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "60f6535a-760f-42a9-be3f-c9a0a025906e", "title": "Use of Legacy Authentication Protocols", "file": "../sigma/rules/cloud/azure/signin_logs/azure_legacy_authentication_protocols.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "908655e0-25cf-4ae1-b775-1c8ce9cf43d8", "title": "Login to Disabled Account", "file": "../sigma/rules/cloud/azure/signin_logs/azure_login_to_disabled_account.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "35b781cc-1a08-4a5a-80af-42fd7c315c6b", "title": "Discovery Using AzureHound", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_azurehound_discovery.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "4d136857-6a1a-432a-82fc-5dd497ee5e7c", "title": "Sign-ins by Unknown Devices", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_sign_ins_from_unknown_devices.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "azure"}, {"id": "5afa454e-030c-4ab4-9253-a90aa7fcc581", "title": "Device Registration or Join Without MFA", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_device_registration_or_join_without_mfa.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "67d5f8fc-8325-44e4-8f5f-7c0ac07cb5ae", "title": "Measurable Increase Of Successful Authentications", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_auth_sucess_increase.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "azure"}, {"id": "4f77e1d7-3982-4ee0-8489-abf2d6b75284", "title": "Sign-ins from Non-Compliant Devices", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_sign_ins_from_noncompliant_devices.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "b4a6d707-9430-4f5f-af68-0337f52d5c42", "title": "Sign-in Failure Due to Conditional Access Requirements Not Met", "file": "../sigma/rules/cloud/azure/signin_logs/azure_conditional_access_failure.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "e40f4962-b02b-4192-9bfe-245f7ece1f99", "title": "Multifactor Authentication Denied", "file": "../sigma/rules/cloud/azure/signin_logs/azure_mfa_denies.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "5f521e4b-0105-4b72-845b-2198a54487b9", "title": "Users Authenticating To Other Azure AD Tenants", "file": "../sigma/rules/cloud/azure/signin_logs/azure_users_authenticating_to_other_azure_ad_tenants.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "f272fb46-25f2-422c-b667-45837994980f", "title": "Authentications To Important Apps Using Single Factor Authentication", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_auth_to_important_apps_using_single_factor_auth.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "e1d02b53-c03c-4948-b11d-4d00cca49d03", "title": "Increased Failed Authentications Of Any Type", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_auth_failure_increase.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a", "title": "Account Lockout", "file": "../sigma/rules/cloud/azure/signin_logs/azure_account_lockout.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc", "title": "Potential MFA Bypass Using Legacy Client Authentication", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_suspicious_signin_bypassing_mfa.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "8c944ecb-6970-4541-8496-be554b8e2846", "title": "Successful Authentications From Countries You Do Not Operate Out Of", "file": "../sigma/rules/cloud/azure/signin_logs/azure_ad_authentications_from_countries_you_do_not_operate_out_of.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "11c767ae-500b-423b-bae3-b234450736ed", "title": "Users Added to Global or Device Admin Roles", "file": "../sigma/rules/cloud/azure/audit_logs/azure_ad_users_added_to_device_admin_roles.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "5aecf3d5-f8a0-48e7-99be-3a759df7358f", "title": "App Granted Privileged Delegated Or App Permissions", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_privileged_permissions.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "d4c7758e-9417-4f2e-9109-6125d66dabef", "title": "User Risk and MFA Registration Policy Updated", "file": "../sigma/rules/cloud/azure/audit_logs/azure_update_risk_and_mfa_registration_policy.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "4d78a000-ab52-4564-88a5-7ab5242b20c7", "title": "Change to Authentication Method", "file": "../sigma/rules/cloud/azure/audit_logs/azure_change_to_authentication_method.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "91c95675-1f27-46d0-bead-d1ae96b97cd3", "title": "User Added To Group With CA Policy Modification Access", "file": "../sigma/rules/cloud/azure/audit_logs/azure_group_user_addition_ca_modification.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "0922467f-db53-4348-b7bf-dee8d0d348c6", "title": "New CA Policy by Non-approved Actor", "file": "../sigma/rules/cloud/azure/audit_logs/azure_aad_secops_new_ca_policy_addedby_bad_actor.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "6f583da0-3a90-4566-a4ed-83c09fe18bbf", "title": "Account Created And Deleted Within A Close Time Frame", "file": "../sigma/rules/cloud/azure/audit_logs/azure_ad_account_created_deleted.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "a6355fbe-f36f-45d8-8efc-ab42465cbc52", "title": "Delegated Permissions Granted For All Users", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_delegated_permissions_all_users.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "c1d147ae-a951-48e5-8b41-dcd0170c7213", "title": "App Granted Microsoft Permissions", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_permissions_msft.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "9b2cc4c4-2ad4-416d-8e8e-ee6aa6f5035a", "title": "End User Consent", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_end_user_consent.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "azure"}, {"id": "102e11e3-2db5-4c9e-bc26-357d42585d21", "title": "Bulk Deletion Changes To Privileged Account Permissions", "file": "../sigma/rules/cloud/azure/audit_logs/azure_priviledged_role_assignment_bulk_change.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "9494bff8-959f-4440-bbce-fb87a208d517", "title": "Changes to Device Registration Policy", "file": "../sigma/rules/cloud/azure/audit_logs/azure_ad_device_registration_policy_changes.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "1b45b0d1-773f-4f23-aedc-814b759563b1", "title": "Application AppID Uri Configuration Changes", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_appid_uri_changes.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "26e7c5e2-6545-481e-b7e6-050143459635", "title": "CA Policy Removed by Non Approved Actor", "file": "../sigma/rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_removedby_bad_actor.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "50a3c7aa-ec29-44a4-92c1-fce229eef6fc", "title": "CA Policy Updated by Non Approved Actor", "file": "../sigma/rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_updatedby_bad_actor.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "f7b5b004-dece-46e4-a4a5-f6fd0e1c6947", "title": "Privileged Account Creation", "file": "../sigma/rules/cloud/azure/audit_logs/azure_privileged_account_creation.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "4bb80281-3756-4ec8-a88e-523c5a6fda9e", "title": "New Root Certificate Authority Added", "file": "../sigma/rules/cloud/azure/audit_logs/azure_ad_new_root_ca_added.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "a4b25073-8947-489c-a8dd-93b41c23f26d", "title": "Windows LAPS Credential Dump From Entra ID", "file": "../sigma/rules/cloud/azure/audit_logs/azure_auditlogs_laps_credential_dumping.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "039a7469-0296-4450-84c0-f6966b16dc6d", "title": "PIM Approvals And Deny Elevation", "file": "../sigma/rules/cloud/azure/audit_logs/azure_pim_activation_approve_deny.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "b18454c8-0be3-41f7-86bc-9c614611b839", "title": "Multi Factor Authentication Disabled For User Account", "file": "../sigma/rules/cloud/azure/audit_logs/azure_user_account_mfa_disable.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "7091372f-623c-4293-bc37-20c32b3492be", "title": "End User Consent Blocked", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_end_user_consent_blocked.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "0b4b72e3-4c53-4d5b-b198-2c58cfef39a9", "title": "Guest User Invited By Non Approved Inviters", "file": "../sigma/rules/cloud/azure/audit_logs/azure_guest_invite_failure.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "8dee7a0d-43fd-4b3c-8cd1-605e189d195e", "title": "User State Changed From Guest To Member", "file": "../sigma/rules/cloud/azure/audit_logs/azure_guest_to_member.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "352a54e1-74ba-4929-9d47-8193d67aba1e", "title": "Azure Domain Federation Settings Modified", "file": "../sigma/rules/cloud/azure/audit_logs/azure_federation_modified.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "665e2d43-70dc-4ccc-9d27-026c9dd7ed9c", "title": "User Removed From Group With CA Policy Modification Access", "file": "../sigma/rules/cloud/azure/audit_logs/azure_group_user_removal_ca_modification.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "74298991-9fc4-460e-a92e-511aa60baec1", "title": "Added Owner To Application", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_owner_added.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "fa84aaf5-8142-43cd-9ec2-78cfebf878ce", "title": "Temporary Access Pass Added To An Account", "file": "../sigma/rules/cloud/azure/audit_logs/azure_tap_added.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "ca9bf243-465e-494a-9e54-bf9fc239057d", "title": "Azure Subscription Permission Elevation Via AuditLogs", "file": "../sigma/rules/cloud/azure/audit_logs/azure_subscription_permissions_elevation_via_auditlogs.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "aeaef14c-e5bf-4690-a9c8-835caad458bd", "title": "PIM Alert Setting Changes To Disabled", "file": "../sigma/rules/cloud/azure/audit_logs/azure_pim_alerts_disabled.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "db6c06c4-bf3b-421c-aa88-15672b88c743", "title": "Changes To PIM Settings", "file": "../sigma/rules/cloud/azure/audit_logs/azure_pim_change_settings.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "4ad97bf5-a514-41a4-abd3-4f3455ad4865", "title": "Guest Users Invited To Tenant By Non Approved Inviters", "file": "../sigma/rules/cloud/azure/audit_logs/azure_ad_guest_users_invited_to_tenant_by_non_approved_inviters.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "c2496b41-16a9-4016-a776-b23f8910dc58", "title": "Certificate-Based Authentication Enabled", "file": "../sigma/rules/cloud/azure/audit_logs/azure_ad_certificate_based_authencation_enabled.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "b04934b2-0a68-4845-8a19-bdfed3a68a7a", "title": "App Role Added", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_role_added.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "0055ad1f-be85-4798-83cf-a6da17c993b3", "title": "Application URI Configuration Changes", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_uri_modifications.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "49a268a4-72f4-4e38-8a7b-885be690c5b5", "title": "User Added To Privilege Role", "file": "../sigma/rules/cloud/azure/audit_logs/azure_priviledged_role_assignment_add.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "a0413867-daf3-43dd-9245-734b3a787942", "title": "Bitlocker Key Retrieval", "file": "../sigma/rules/cloud/azure/audit_logs/azure_ad_bitlocker_key_retrieval.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "cbb67ecc-fb70-4467-9350-c910bdf7c628", "title": "Added Credentials to Existing Application", "file": "../sigma/rules/cloud/azure/audit_logs/azure_app_credential_added.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "340ee172-4b67-4fb4-832f-f961bdc1f3aa", "title": "Password Reset By User Account", "file": "../sigma/rules/cloud/azure/audit_logs/azure_user_password_change.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "b831353c-1971-477b-abb6-2828edc3bca1", "title": "Azure Keyvault Secrets Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_keyvault_secrets_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "7ea78478-a4f9-42a6-9dcd-f861816122bf", "title": "Disabled MFA to Bypass Authentication Mechanisms", "file": "../sigma/rules/cloud/azure/activity_logs/azure_mfa_disabled.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "410d2a41-1e6d-452f-85e5-abdd8257a823", "title": "Azure Application Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_application_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "b02f9591-12c3-4965-986a-88028629b2e1", "title": "Azure Kubernetes Pods Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_pods_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "93e0ef48-37c8-49ed-a02c-038aab23628e", "title": "Azure Container Registry Created or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_container_registry_created_or_deleted.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "azure"}, {"id": "15ef3fac-f0f0-4dc4-ada0-660aa72980b3", "title": "Azure Virtual Network Device Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_network_virtual_device_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "d9557b75-267b-4b43-922f-a775e2d1f792", "title": "Azure Point-to-site VPN Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_network_p2s_vpn_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "61171ffc-d79c-4ae5-8e10-9323dba19cd3", "title": "Azure VPN Connection Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_vpn_connection_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "512cf937-ea9b-4332-939c-4c2c94baadcd", "title": "Azure Firewall Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_firewall_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "1c71e254-6655-42c1-b2d6-5e4718d7fc0a", "title": "Azure Kubernetes CronJob", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_cronjob.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "48739819-8230-4ee3-a8ea-e0289d1fb0ff", "title": "Azure Active Directory Hybrid Health AD FS Service Delete", "file": "../sigma/rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_service_delete.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "a61a3c56-4ce2-4351-a079-88ae4cbd2b58", "title": "Azure Kubernetes Admission Controller", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_admission_controller.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "af6925b0-8826-47f1-9324-337507a0babd", "title": "Azure DNS Zone Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_dns_zone_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "448fd1ea-2116-4c62-9cde-a92d120e0f08", "title": "Azure Service Principal Removed", "file": "../sigma/rules/cloud/azure/activity_logs/azure_service_principal_removed.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "ebbeb024-5b1d-4e16-9c0c-917f86c708a7", "title": "User Added to an Administrator's Azure AD Role", "file": "../sigma/rules/cloud/azure/activity_logs/azure_ad_user_added_to_admin_role.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "d2d901db-7a75-45a1-bc39-0cbf00812192", "title": "Number Of Resource Creation Or Deployment Activities", "file": "../sigma/rules/cloud/azure/activity_logs/azure_creating_number_of_resources_detection.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "72af37e2-ec32-47dc-992b-bc288a2708cb", "title": "Azure New CloudShell Created", "file": "../sigma/rules/cloud/azure/activity_logs/azure_new_cloudshell_created.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "0ddcff6d-d262-40b0-804b-80eb592de8e3", "title": "Azure Service Principal Created", "file": "../sigma/rules/cloud/azure/activity_logs/azure_service_principal_created.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "d22b4df4-5a67-4859-a578-8c9a0b5af9df", "title": "Azure Network Security Configuration Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_network_security_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "92cc3e5d-eb57-419d-8c16-5c63f325a401", "title": "Azure Suppression Rule Created", "file": "../sigma/rules/cloud/azure/activity_logs/azure_suppression_rule_created.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "7ee0b4aa-d8d4-4088-b661-20efdf41a04c", "title": "Azure Kubernetes Secret or Config Object Access", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "9541f321-7cba-4b43-80fc-fbd1fb922808", "title": "Azure Kubernetes Cluster Created or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_cluster_created_or_deleted.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "azure"}, {"id": "ad87d14e-7599-4633-ba81-aeb60cfe8cd6", "title": "Azure Application Gateway Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_application_gateway_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "bcfcc962-0e4a-4fd9-84bb-a833e672df3f", "title": "Azure Virtual Network Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_virtual_network_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "835747f1-9329-40b5-9cc3-97d465754ce6", "title": "Azure Application Security Group Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_application_security_group_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "459a2970-bb84-4e6a-a32e-ff0fbd99448d", "title": "Azure Key Vault Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_keyvault_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "83c17918-746e-4bd9-920b-8e098bf88c23", "title": "Azure Network Firewall Policy Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_network_firewall_policy_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "542b9912-c01f-4e3f-89a8-014c48cdca7d", "title": "Azure Device No Longer Managed or Compliant", "file": "../sigma/rules/cloud/azure/activity_logs/azure_device_no_longer_managed_or_compliant.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "288a39fc-4914-4831-9ada-270e9dc12cb4", "title": "Azure Active Directory Hybrid Health AD FS New Server", "file": "../sigma/rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_new_server.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "25cb259b-bbdc-4b87-98b7-90d7c72f8743", "title": "Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_rolebinding_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "025c9fe7-db72-49f9-af0d-31341dd7dd57", "title": "Azure Firewall Rule Collection Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_firewall_rule_collection_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "2a7d64cf-81fa-4daf-ab1b-ab80b789c067", "title": "Azure Firewall Rule Configuration Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_network_firewall_rule_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "c1182e02-49a3-481c-b3de-0fadc4091488", "title": "Rare Subscription-level Operations In Azure", "file": "../sigma/rules/cloud/azure/activity_logs/azure_rare_operations.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "12d027c3-b48c-4d9d-8bb6-a732200034b2", "title": "Azure Kubernetes Service Account Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_service_account_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "818fee0c-e0ec-4e45-824e-83e4817b0887", "title": "Azure Kubernetes Sensitive Role Access", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_role_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "225d8b09-e714-479c-a0e4-55e6f29adf35", "title": "Azure Kubernetes Events Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_events_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "08d6ac24-c927-4469-b3b7-2e422d6e3c43", "title": "Azure Kubernetes Network Policy Change", "file": "../sigma/rules/cloud/azure/activity_logs/azure_kubernetes_network_policy_change.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "80eeab92-0979-4152-942d-96749e11df40", "title": "Azure Keyvault Key Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_keyvault_key_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "a622fcd2-4b5a-436a-b8a2-a4171161833c", "title": "Granting Of Permissions To An Account", "file": "../sigma/rules/cloud/azure/activity_logs/azure_granting_permission_detection.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "46530378-f9db-4af9-a9e5-889c177d3881", "title": "Azure Device or Configuration Modified or Deleted", "file": "../sigma/rules/cloud/azure/activity_logs/azure_device_or_configuration_modified_or_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "09438caa-07b1-4870-8405-1dbafe3dad95", "title": "Azure Subscription Permission Elevation Via ActivityLogs", "file": "../sigma/rules/cloud/azure/activity_logs/azure_subscription_permissions_elevation_via_activitylogs.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "azure"}, {"id": "cdeef967-f9a1-4375-90ee-6978c5f23974", "title": "Azure Application Credential Modified", "file": "../sigma/rules/cloud/azure/activity_logs/azure_app_credential_modification.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "636e30d5-3736-42ea-96b1-e6e2f8429fd6", "title": "Azure Owner Removed From Application or Service Principal", "file": "../sigma/rules/cloud/azure/activity_logs/azure_owner_removed_from_application_or_service_principal.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "azure"}, {"id": "87cc6698-3e07-4ba2-9b43-a85a73e151e2", "title": "Bitbucket User Permissions Export Attempt", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_user_permissions_export_attempt_detected.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "70ed1d26-0050-4b38-a599-92c53d57d45a", "title": "Bitbucket User Login Failure", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_user_login_failure_detected.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "aac6c4f4-87c7-4961-96ac-c3fd3a42c310", "title": "Bitbucket Global Permission Changed", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_global_permissions_change_detected.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05", "title": "Bitbucket Global Secret Scanning Rule Deleted", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_global_secret_scanning_rule_deleted.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "34d81081-03c9-4a7f-91c9-5e46af625cde", "title": "Bitbucket Unauthorized Full Data Export Triggered", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_unauthorized_full_data_export_triggered.yml", "status": "experimental", "level": "critical", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "5259cbf2-0a75-48bf-b57a-c54d6fabaef3", "title": "Bitbucket User Details Export Attempt Detected", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_user_details_export_attempt_detected.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "d3f90469-fb05-42ce-b67d-0fded91bbef3", "title": "Bitbucket User Login Failure Via SSH", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_user_login_failure_via_ssh_detected.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "ff91e3f0-ad15-459f-9a85-1556390c138d", "title": "Bitbucket Secret Scanning Rule Deleted", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_secret_scanning_rule_deleted.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "195e1b9d-bfc2-4ffa-ab4e-35aef69815f8", "title": "Bitbucket Full Data Export Triggered", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_full_data_export_triggered.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "16ab6143-510a-44e2-a615-bdb80b8317fc", "title": "Bitbucket Global SSH Settings Changed", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_global_ssh_settings_change_detected.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "42ccce6d-7bd3-4930-95cd-e4d83fa94a30", "title": "Bitbucket Project Secret Scanning Allowlist Added", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_project_secret_scanning_allowlist_added.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "b91e8d5e-0033-44fe-973f-b730316f23a1", "title": "Bitbucket Secret Scanning Exempt Repository Added", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_secret_scanning_exempt_repository_detected.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "7215374a-de4f-4b33-8ba5-70804c9251d3", "title": "Bitbucket Unauthorized Access To A Resource", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_unauthorized_access_detected.yml", "status": "experimental", "level": "critical", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "6aa12161-235a-4dfb-9c74-fe08df8d8da1", "title": "Bitbucket Audit Log Configuration Updated", "file": "../sigma/rules/cloud/bitbucket/audit/bitbucket_audit_log_configuration_update_detected.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "bitbucket"}, {"id": "d84c0ded-edd7-4123-80ed-348bb3ccc4d5", "title": "Suspicious SQL Query", "file": "../sigma/rules/category/database/db_anomalous_query.yml", "status": "test", "level": "medium", "logsource.category": "database", "logsource.product": null}, {"id": "fdf135a2-9241-4f96-a114-bb404948f736", "title": "Antivirus Web Shell Detection", "file": "../sigma/rules/category/antivirus/av_webshell.yml", "status": "test", "level": "high", "logsource.category": "antivirus", "logsource.product": null}, {"id": "c9a88268-0047-4824-ba6e-4d81ce0b907c", "title": "Antivirus Relevant File Paths Alerts", "file": "../sigma/rules/category/antivirus/av_relevant_files.yml", "status": "test", "level": "high", "logsource.category": "antivirus", "logsource.product": null}, {"id": "238527ad-3c2c-4e4f-a1f6-92fd63adb864", "title": "Antivirus Exploitation Framework Detection", "file": "../sigma/rules/category/antivirus/av_exploiting.yml", "status": "stable", "level": "critical", "logsource.category": "antivirus", "logsource.product": null}, {"id": "4c6ca276-d4d0-4a8c-9e4c-d69832f8671f", "title": "Antivirus Ransomware Detection", "file": "../sigma/rules/category/antivirus/av_ransomware.yml", "status": "test", "level": "critical", "logsource.category": "antivirus", "logsource.product": null}, {"id": "fa0c05b6-8ad3-468d-8231-c1cbccb64fba", "title": "Antivirus Hacktool Detection", "file": "../sigma/rules/category/antivirus/av_hacktool.yml", "status": "stable", "level": "high", "logsource.category": "antivirus", "logsource.product": null}, {"id": "78cc2dd2-7d20-4d32-93ff-057084c38b93", "title": "Antivirus Password Dumper Detection", "file": "../sigma/rules/category/antivirus/av_password_dumper.yml", "status": "stable", "level": "critical", "logsource.category": "antivirus", "logsource.product": null}, {"id": "d7fb8f0e-bd5f-45c2-b467-19571c490d7e", "title": "Cleartext Protocol Usage", "file": "../sigma/rules/network/firewall/net_firewall_cleartext_protocols.yml", "status": "stable", "level": "low", "logsource.category": "firewall", "logsource.product": null}, {"id": "a557ffe6-ac54-43d2-ae69-158027082350", "title": "Huawei BGP Authentication Failures", "file": "../sigma/rules/network/huawei/bgp/huawei_bgp_auth_failed.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "huawei"}, {"id": "6d844f0f-1c18-41af-8f19-33e7654edfc3", "title": "Cisco Local Accounts", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_local_accounts.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "cisco"}, {"id": "9705a6a1-6db6-4a16-a987-15b7151e299b", "title": "Cisco Discovery", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_discovery.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "cisco"}, {"id": "5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59", "title": "Cisco Stage Data", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_moving_data.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "cisco"}, {"id": "671ffc77-50a7-464f-9e3d-9ea2b493b26b", "title": "Cisco Modify Configuration", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_modify_config.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "cisco"}, {"id": "ceb407f6-8277-439b-951f-e4210e3ed956", "title": "Cisco Clear Logs", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_clear_logs.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "cisco"}, {"id": "d94a35f0-7a29-45f6-90a0-80df6159967c", "title": "Cisco Denial of Service", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_dos.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "cisco"}, {"id": "b9e1f193-d236-4451-aaae-2f3d2102120d", "title": "Cisco Sniffing", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_net_sniff.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "cisco"}, {"id": "1f978c6a-4415-47fb-aca5-736a44d7ca3d", "title": "Cisco Crypto Commands", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_crypto_actions.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "cisco"}, {"id": "cd072b25-a418-4f98-8ebc-5093fb38fe1a", "title": "Cisco Collect Data", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_collect_data.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "cisco"}, {"id": "71d65515-c436-43c0-841b-236b1f32c21e", "title": "Cisco File Deletion", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_file_deletion.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "cisco"}, {"id": "9e8f6035-88bf-4a63-96b6-b17c0508257e", "title": "Cisco Disabling Logging", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_disable_logging.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "cisco"}, {"id": "b094d9fb-b1ad-4650-9f1a-fb7be9f1d34b", "title": "Cisco Show Commands Input", "file": "../sigma/rules/network/cisco/aaa/cisco_cli_input_capture.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "cisco"}, {"id": "56fa3cd6-f8d6-4520-a8c7-607292971886", "title": "Cisco BGP Authentication Failures", "file": "../sigma/rules/network/cisco/bgp/cisco_bgp_md5_auth_failed.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "cisco"}, {"id": "50e606bf-04ce-4ca7-9d54-3449494bbd4b", "title": "Cisco LDP Authentication Failures", "file": "../sigma/rules/network/cisco/ldp/cisco_ldp_md5_auth_failed.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "cisco"}, {"id": "705072a5-bb6f-4ced-95b6-ecfa6602090b", "title": "WebDav Put Request", "file": "../sigma/rules/network/zeek/zeek_http_webdav_put_request.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "zeek"}, {"id": "b640c0b8-87f8-4daa-aef8-95a24261dd1d", "title": "MITRE BZAR Indicators for Execution", "file": "../sigma/rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "a8322756-015c-42e7-afb1-436e85ed3ff5", "title": "DNS TOR Proxies", "file": "../sigma/rules/network/zeek/zeek_dns_torproxy.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "2e69f167-47b5-4ae7-a390-47764529eff5", "title": "Transferring Files with Credential Data via Network Shares - Zeek", "file": "../sigma/rules/network/zeek/zeek_smb_converted_win_transferring_files_with_credential_data.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "ede05abc-2c9e-4624-9944-9ff17fdc0bf5", "title": "Suspicious DNS Z Flag Bit Set", "file": "../sigma/rules/network/zeek/zeek_dns_susp_zbit_flag.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "92dae1ed-1c9d-4eff-a567-33acbd95b00e", "title": "Possible Impacket SecretDump Remote Activity - Zeek", "file": "../sigma/rules/network/zeek/zeek_smb_converted_win_impacket_secretdump.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "zeek"}, {"id": "ab6b1a39-a9ee-4ab4-b075-e83acf6e346b", "title": "OMIGOD HTTP No Authentication RCE", "file": "../sigma/rules/network/zeek/zeek_http_omigod_no_auth_rce.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "zeek"}, {"id": "bf74135c-18e8-4a72-a926-0e4f47888c19", "title": "DNS Events Related To Mining Pools", "file": "../sigma/rules/network/zeek/zeek_dns_mining_pools.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "zeek"}, {"id": "aac2fd97-bcba-491b-ad66-a6edf89c71bf", "title": "Executable from Webdav", "file": "../sigma/rules/network/zeek/zeek_http_executable_download_from_webdav.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "53389db6-ba46-48e3-a94c-e0f2cefe1583", "title": "MITRE BZAR Indicators for Persistence", "file": "../sigma/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "f1b3a22a-45e6-4004-afb5-4291f9c21166", "title": "Suspicious PsExec Execution - Zeek", "file": "../sigma/rules/network/zeek/zeek_smb_converted_win_susp_psexec.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "zeek"}, {"id": "7100f7e3-92ce-4584-b7b7-01b40d3d4118", "title": "Default Cobalt Strike Certificate", "file": "../sigma/rules/network/zeek/zeek_default_cobalt_strike_certificate.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "zeek"}, {"id": "dde85b37-40cd-4a94-b00c-0b8794f956b5", "title": "Remote Task Creation via ATSVC Named Pipe - Zeek", "file": "../sigma/rules/network/zeek/zeek_smb_converted_win_atsvc_task.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "286b47ed-f6fe-40b3-b3a8-35129acd43bc", "title": "Suspicious Access to Sensitive File Extensions - Zeek", "file": "../sigma/rules/network/zeek/zeek_smb_converted_win_susp_raccess_sensitive_fext.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "021310d9-30a6-480a-84b7-eaa69aeb92bb", "title": "First Time Seen Remote Named Pipe - Zeek", "file": "../sigma/rules/network/zeek/zeek_smb_converted_win_lm_namedpipe.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "zeek"}, {"id": "bae2865c-5565-470d-b505-9496c87d0c30", "title": "SMB Spoolss Name Piped Usage", "file": "../sigma/rules/network/zeek/zeek_dce_rpc_smb_spoolss_named_pipe.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "503fe26e-b5f2-4944-a126-eab405cc06e5", "title": "Kerberos Network Traffic RC4 Ticket Encryption", "file": "../sigma/rules/network/zeek/zeek_susp_kerberos_rc4.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "7b33baef-2a75-4ca3-9da4-34f9a15382d8", "title": "Possible PrintNightmare Print Driver Install", "file": "../sigma/rules/network/zeek/zeek_dce_rpc_printnightmare_print_driver_install.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "4096842a-8f9f-4d36-92b4-d0b2a62f9b2a", "title": "Potential PetitPotam Attack Via EFS RPC Calls", "file": "../sigma/rules/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "zeek"}, {"id": "fa7703d6-0ee8-4949-889c-48c84bc15b6f", "title": "New Kind of Network (NKN) Detection", "file": "../sigma/rules/network/zeek/zeek_dns_nkn.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "zeek"}, {"id": "1fc0809e-06bf-4de3-ad52-25e5263b7623", "title": "Publicly Accessible RDP Service", "file": "../sigma/rules/network/zeek/zeek_rdp_public_listener.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "zeek"}, {"id": "a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43", "title": "Juniper BGP Missing MD5", "file": "../sigma/rules/network/juniper/bgp/juniper_bgp_missing_md5.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "juniper"}, {"id": "2975af79-28c4-4d2f-a951-9095f229df29", "title": "Cobalt Strike DNS Beaconing", "file": "../sigma/rules/network/dns/net_dns_mal_cobaltstrike.yml", "status": "test", "level": "critical", "logsource.category": "dns", "logsource.product": null}, {"id": "4153a907-2451-4e4f-a578-c52bb6881432", "title": "Suspicious DNS Query with B64 Encoded String", "file": "../sigma/rules/network/dns/net_dns_susp_b64_queries.yml", "status": "test", "level": "medium", "logsource.category": "dns", "logsource.product": null}, {"id": "8ae51330-899c-4641-8125-e39f2e07da72", "title": "DNS TXT Answer with Possible Execution Strings", "file": "../sigma/rules/network/dns/net_dns_susp_txt_exec_strings.yml", "status": "test", "level": "high", "logsource.category": "dns", "logsource.product": null}, {"id": "aff715fa-4dd5-497a-8db3-910bea555566", "title": "DNS Query to External Service Interaction Domains", "file": "../sigma/rules/network/dns/net_dns_external_service_interaction_domains.yml", "status": "test", "level": "high", "logsource.category": "dns", "logsource.product": null}, {"id": "3eaf6218-3bed-4d8a-8707-274096f12a18", "title": "Wannacry Killswitch Domain", "file": "../sigma/rules/network/dns/net_dns_wannacry_killswitch_domain.yml", "status": "test", "level": "high", "logsource.category": "dns", "logsource.product": null}, {"id": "c64c5175-5189-431b-a55e-6d9882158251", "title": "Telegram Bot API Request", "file": "../sigma/rules/network/dns/net_dns_susp_telegram_api.yml", "status": "test", "level": "medium", "logsource.category": "dns", "logsource.product": null}, {"id": "b593fd50-7335-4682-a36c-4edcb68e4641", "title": "Monero Crypto Coin Mining Pool Lookup", "file": "../sigma/rules/network/dns/net_dns_pua_cryptocoin_mining_xmr.yml", "status": "stable", "level": "high", "logsource.category": "dns", "logsource.product": null}, {"id": "ada3bc4f-f0fd-42b9-ba91-e105e8af7342", "title": "Server Side Template Injection Strings", "file": "../sigma/rules/web/webserver_generic/web_ssti_in_access_logs.yml", "status": "test", "level": "high", "logsource.category": "webserver", "logsource.product": null}, {"id": "7745c2ea-24a5-4290-b680-04359cb84b35", "title": "Path Traversal Exploitation Attempts", "file": "../sigma/rules/web/webserver_generic/web_path_traversal_exploitation_attempt.yml", "status": "test", "level": "medium", "logsource.category": "webserver", "logsource.product": null}, {"id": "65354b83-a2ea-4ea6-8414-3ab38be0d409", "title": "Cross Site Scripting Strings", "file": "../sigma/rules/web/webserver_generic/web_xss_in_access_logs.yml", "status": "test", "level": "high", "logsource.category": "webserver", "logsource.product": null}, {"id": "5513deaf-f49a-46c2-a6c8-3f111b5cb453", "title": "SQL Injection Strings In URI", "file": "../sigma/rules/web/webserver_generic/web_sql_injection_in_access_logs.yml", "status": "test", "level": "high", "logsource.category": "webserver", "logsource.product": null}, {"id": "412d55bc-7737-4d25-9542-5b396867ce55", "title": "JNDIExploit Pattern", "file": "../sigma/rules/web/webserver_generic/web_jndi_exploit.yml", "status": "test", "level": "high", "logsource.category": "webserver", "logsource.product": null}, {"id": "583aa0a2-30b1-4d62-8bf3-ab73689efe6c", "title": "Java Payload Strings", "file": "../sigma/rules/web/webserver_generic/web_java_payload_in_access_logs.yml", "status": "test", "level": "high", "logsource.category": "webserver", "logsource.product": null}, {"id": "19aa4f58-94ca-45ff-bc34-92e533c0994a", "title": "Suspicious User-Agents Related To Recon Tools", "file": "../sigma/rules/web/webserver_generic/web_susp_useragents.yml", "status": "test", "level": "medium", "logsource.category": "webserver", "logsource.product": null}, {"id": "7cb02516-6d95-4ffc-8eee-162075e111ac", "title": "Successful IIS Shortname Fuzzing Scan", "file": "../sigma/rules/web/webserver_generic/web_iis_tilt_shortname_scan.yml", "status": "test", "level": "medium", "logsource.category": "webserver", "logsource.product": null}, {"id": "953d460b-f810-420a-97a2-cfca4c98e602", "title": "Source Code Enumeration Detection by Keyword", "file": "../sigma/rules/web/webserver_generic/web_source_code_enumeration.yml", "status": "test", "level": "medium", "logsource.category": "webserver", "logsource.product": null}, {"id": "2ea44a60-cfda-11ea-87d0-0242ac130003", "title": "Webshell ReGeorg Detection Via Web Logs", "file": "../sigma/rules/web/webserver_generic/web_webshell_regeorg.yml", "status": "test", "level": "high", "logsource.category": "webserver", "logsource.product": null}, {"id": "9f6a34b4-2688-4eb7-a7f5-e39fef573d0e", "title": "Suspicious Windows Strings In URI", "file": "../sigma/rules/web/webserver_generic/web_susp_windows_path_uri.yml", "status": "test", "level": "high", "logsource.category": "webserver", "logsource.product": null}, {"id": "85254a62-22be-4239-b79c-2ec17e566c37", "title": "F5 BIG-IP iControl Rest API Command Execution - Webserver", "file": "../sigma/rules/web/webserver_generic/web_f5_tm_utility_bash_api_request.yml", "status": "test", "level": "medium", "logsource.category": "webserver", "logsource.product": null}, {"id": "7ff9db12-1b94-4a79-ba68-a2402c5d6729", "title": "Windows Webshell Strings", "file": "../sigma/rules/web/webserver_generic/web_win_webshells_in_access_logs.yml", "status": "test", "level": "high", "logsource.category": "webserver", "logsource.product": null}, {"id": "e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c", "title": "Apache Threading Error", "file": "../sigma/rules/web/product/apache/web_apache_threading_error.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": null}, {"id": "1da8ce0b-855d-4004-8860-7d64d42063b1", "title": "Apache Segmentation Fault", "file": "../sigma/rules/web/product/apache/web_apache_segfault.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": null}, {"id": "59ec40bb-322e-40ab-808d-84fa690d7e56", "title": "Nginx Core Dump", "file": "../sigma/rules/web/product/nginx/web_nginx_core_dump.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": null}, {"id": "fa935401-513b-467b-81f4-f9e77aa0dd78", "title": "Crypto Miner User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_cryptominer.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "195c1119-ef07-4909-bb12-e66f5e07bf3c", "title": "Download from Suspicious Dyndns Hosts", "file": "../sigma/rules/web/proxy_generic/proxy_download_susp_dyndns.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "00d0b5ab-1f55-4120-8e83-487c0a7baf19", "title": "Download From Suspicious TLD - Blacklist", "file": "../sigma/rules/web/proxy_generic/proxy_download_susp_tlds_blacklist.yml", "status": "test", "level": "low", "logsource.category": "proxy", "logsource.product": null}, {"id": "b5de2919-b74a-4805-91a7-5049accbaefe", "title": "Download From Suspicious TLD - Whitelist", "file": "../sigma/rules/web/proxy_generic/proxy_download_susp_tlds_whitelist.yml", "status": "test", "level": "low", "logsource.category": "proxy", "logsource.product": null}, {"id": "6ec820f2-e963-4801-9127-d8b2dce4d31b", "title": "APT User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_apt.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "1a9bb21a-1bb5-42d7-aa05-3219c7c8f47d", "title": "PUA - Advanced IP/Port Scanner Update Check", "file": "../sigma/rules/web/proxy_generic/proxy_pua_advanced_ip_scanner_update_check.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "304810ed-8853-437f-9e36-c4975c3dfd7e", "title": "HackTool - BabyShark Agent Default URL Pattern", "file": "../sigma/rules/web/proxy_generic/proxy_hktl_baby_shark_default_agent_url.yml", "status": "test", "level": "critical", "logsource.category": "proxy", "logsource.product": null}, {"id": "c8557060-9221-4448-8794-96320e6f3e74", "title": "Windows PowerShell User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_powershell.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "2c03648b-e081-41a5-b9fb-7d854a915091", "title": "Rclone Activity via Proxy", "file": "../sigma/rules/web/proxy_generic/proxy_ua_rclone.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "eb6c2004-1cef-427f-8885-9042974e5eb6", "title": "Suspicious Network Communication With IPFS", "file": "../sigma/rules/web/proxy_generic/proxy_susp_ipfs_cred_harvest.yml", "status": "test", "level": "low", "logsource.category": "proxy", "logsource.product": null}, {"id": "21e44d78-95e7-421b-a464-ffd8395659c4", "title": "HTTP Request With Empty User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_empty.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f", "title": "Exploit Framework User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_frameworks.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "b923f7d6-ac89-4a50-a71a-89fb846b4aa8", "title": "HackTool - Empire UserAgent URI Combo", "file": "../sigma/rules/web/proxy_generic/proxy_hktl_empire_ua_uri_patterns.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "b59c98c6-95e8-4d65-93ee-f594dfb96b17", "title": "F5 BIG-IP iControl Rest API Command Execution - Proxy", "file": "../sigma/rules/web/proxy_generic/proxy_f5_tm_utility_bash_api_request.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "4922a5dd-6743-4fc2-8e81-144374280997", "title": "Flash Player Update from Suspicious Location", "file": "../sigma/rules/web/proxy_generic/proxy_susp_flash_download_loc.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "8ccd35a2-1c7c-468b-b568-ac6cdf80eec3", "title": "Bitsadmin to Uncommon IP Server Address", "file": "../sigma/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_ip.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "7195a772-4b3f-43a4-a210-6a003d65caa1", "title": "Suspicious User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_susp.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "1ae64f96-72b6-48b3-ad3d-e71dff6c6398", "title": "Suspicious External WebDAV Execution", "file": "../sigma/rules/web/proxy_generic/proxy_webdav_external_execution.yml", "status": "experimental", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "9eb68894-7476-4cd6-8752-23b51f5883a7", "title": "Bitsadmin to Uncommon TLD", "file": "../sigma/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "5468045b-4fcc-4d1a-973c-c9c9578edacb", "title": "Raw Paste Service Access", "file": "../sigma/rules/web/proxy_generic/proxy_raw_paste_service_access.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "5c84856b-55a5-45f1-826f-13f37250cf4e", "title": "Malware User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_malware.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "894a8613-cf12-48b3-8e57-9085f54aa0c3", "title": "Potential Base64 Encoded User-Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_susp_base64.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "f3f21ce1-cdef-4bfc-8328-ed2e826f5fac", "title": "HackTool - CobaltStrike Malleable Profile Patterns - Proxy", "file": "../sigma/rules/web/proxy_generic/proxy_hktl_cobalt_strike_malleable_c2_requests.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "b494b165-6634-483d-8c47-2026a6c52372", "title": "Telegram API Access", "file": "../sigma/rules/web/proxy_generic/proxy_telegram_api.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "2b1ee7e4-89b6-4739-b7bb-b811b6607e5e", "title": "PwnDrp Access", "file": "../sigma/rules/web/proxy_generic/proxy_pwndrop.yml", "status": "test", "level": "critical", "logsource.category": "proxy", "logsource.product": null}, {"id": "d443095b-a221-4957-a2c4-cd1756c9b747", "title": "Suspicious Base64 Encoded User-Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_base64_encoded.yml", "status": "test", "level": "medium", "logsource.category": "proxy", "logsource.product": null}, {"id": "c42a3073-30fb-48ae-8c99-c23ada84b103", "title": "Hack Tool User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_ua_hacktool.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "e09aed7a-09e0-4c9a-90dd-f0d52507347e", "title": "Windows WebDAV User Agent", "file": "../sigma/rules/web/proxy_generic/proxy_downloadcradle_webdav.yml", "status": "test", "level": "high", "logsource.category": "proxy", "logsource.product": null}, {"id": "47e0852a-cf81-4494-a8e6-31864f8c86ed", "title": "Pandemic Registry Key", "file": "../sigma/rules/windows/registry/registry_event/registry_event_apt_pandemic.yml", "status": "test", "level": "critical", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "title": "HybridConnectionManager Service Installation - Registry", "file": "../sigma/rules/windows/registry/registry_event/registry_event_hybridconnectionmgr_svc_installation.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "title": "New DLL Added to AppInit_DLLs Registry Key", "file": "../sigma/rules/windows/registry/registry_event/registry_event_new_dll_added_to_appinit_dlls_registry_key.yml", "status": "test", "level": "medium", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "title": "Path To Screensaver Binary Modified", "file": "../sigma/rules/windows/registry/registry_event/registry_event_modify_screensaver_binary_path.yml", "status": "test", "level": "medium", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "295a59c1-7b79-4b47-a930-df12c15fc9c2", "title": "Windows Registry Trust Record Modification", "file": "../sigma/rules/windows/registry/registry_event/registry_event_office_trust_record_modification.yml", "status": "test", "level": "medium", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "title": "Suspicious Run Key from Download", "file": "../sigma/rules/windows/registry/registry_event/registry_event_susp_download_run_key.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "title": "Run Once Task Configuration in Registry", "file": "../sigma/rules/windows/registry/registry_event/registry_event_runonce_persistence.yml", "status": "test", "level": "medium", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "9577edbb-851f-4243-8c91-1d5b50c1a39b", "title": "Atbroker Registry Change", "file": "../sigma/rules/windows/registry/registry_event/registry_event_susp_atbroker_change.yml", "status": "test", "level": "medium", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "title": "NetNTLM Downgrade Attack - Registry", "file": "../sigma/rules/windows/registry/registry_event/registry_event_net_ntlm_downgrade.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "5aad0995-46ab-41bd-a9ff-724f41114971", "title": "Esentutl Volume Shadow Copy Service Keys", "file": "../sigma/rules/windows/registry/registry_event/registry_event_esentutl_volume_shadow_copy_service_keys.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "460479f3-80b7-42da-9c43-2cc1d54dbccd", "title": "Creation of a Local Hidden User Account by Registry", "file": "../sigma/rules/windows/registry/registry_event/registry_event_add_local_hidden_user.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "4d431012-2ab5-4db7-a84e-b29809da2172", "title": "Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback", "file": "../sigma/rules/windows/registry/registry_event/registry_set_enable_anonymous_connection.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "6aa1d992-5925-4e9f-a49b-845e51d1de01", "title": "New DLL Added to AppCertDlls Registry Key", "file": "../sigma/rules/windows/registry/registry_event/registry_event_new_dll_added_to_appcertdlls_registry_key.yml", "status": "test", "level": "medium", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "title": "Security Support Provider (SSP) Added to LSA Configuration", "file": "../sigma/rules/windows/registry/registry_event/registry_event_ssp_added_lsa_config.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "b3503044-60ce-4bf4-bbcb-e3db98788823", "title": "DLL Load via LSASS", "file": "../sigma/rules/windows/registry/registry_event/registry_event_susp_lsass_dll_load.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "a6b33c02-8305-488f-8585-03cb2a7763f2", "title": "Windows Credential Editor Registry", "file": "../sigma/rules/windows/registry/registry_event/registry_event_hack_wce_reg.yml", "status": "test", "level": "critical", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "a54f842a-3713-4b45-8c84-5f136fdebd3c", "title": "New PortProxy Registry Entry Added", "file": "../sigma/rules/windows/registry/registry_event/registry_event_portproxy_registry_key.yml", "status": "test", "level": "medium", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "title": "Office Application Startup - Office Test", "file": "../sigma/rules/windows/registry/registry_event/registry_event_office_test_regadd.yml", "status": "test", "level": "medium", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "f663a6d9-9d1b-49b8-b2b1-0637914d199a", "title": "Narrator's Feedback-Hub Persistence", "file": "../sigma/rules/windows/registry/registry_event/registry_event_narrator_feedback_persistance.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "55e29995-75e7-451a-bef0-6225e2f13597", "title": "Potential Credential Dumping Via LSASS SilentProcessExit Technique", "file": "../sigma/rules/windows/registry/registry_event/registry_event_silentprocessexit_lsass.yml", "status": "test", "level": "critical", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "title": "Wdigest CredGuard Registry Modification", "file": "../sigma/rules/windows/registry/registry_event/registry_event_disable_wdigest_credential_guard.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "1c8e96cd-2bed-487d-9de0-b46c90cade56", "title": "Potential Qakbot Registry Activity", "file": "../sigma/rules/windows/registry/registry_event/registry_event_malware_qakbot_registry.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "b6d235fc-1d38-4b12-adbe-325f06728f37", "title": "CMSTP Execution Registry Event", "file": "../sigma/rules/windows/registry/registry_event/registry_event_cmstp_execution_by_registry.yml", "status": "stable", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "title": "WINEKEY Registry Modification", "file": "../sigma/rules/windows/registry/registry_event/registry_event_runkey_winekey.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "6ea3bf32-9680-422d-9f50-e90716b12a66", "title": "UAC Bypass Via Wsreset", "file": "../sigma/rules/windows/registry/registry_event/registry_event_bypass_via_wsreset.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "baca5663-583c-45f9-b5dc-ea96a22ce542", "title": "Sticky Key Like Backdoor Usage - Registry", "file": "../sigma/rules/windows/registry/registry_event/registry_event_stickykey_like_backdoor.yml", "status": "test", "level": "critical", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "5b175490-b652-4b02-b1de-5b5b4083c5f8", "title": "RedMimicry Winnti Playbook Registry Manipulation", "file": "../sigma/rules/windows/registry/registry_event/registry_event_redmimicry_winnti_reg.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "62120148-6b7a-42be-8b91-271c04e281a3", "title": "Suspicious Camera and Microphone Access", "file": "../sigma/rules/windows/registry/registry_event/registry_event_susp_mic_cam_access.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "title": "Shell Open Registry Keys Manipulation", "file": "../sigma/rules/windows/registry/registry_event/registry_event_shell_open_keys_manipulation.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "277efb8f-60be-4f10-b4d3-037802f37167", "title": "Registry Persistence Mechanisms in Recycle Bin", "file": "../sigma/rules/windows/registry/registry_event/registry_event_persistence_recycle_bin.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "title": "PrinterNightmare Mimikatz Driver Name", "file": "../sigma/rules/windows/registry/registry_event/registry_event_mimikatz_printernightmare.yml", "status": "test", "level": "critical", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "title": "Disable Security Events Logging Adding Reg Key MiniNt", "file": "../sigma/rules/windows/registry/registry_event/registry_event_disable_security_events_logging_adding_reg_key_minint.yml", "status": "test", "level": "high", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7", "title": "Registry Entries For Azorult Malware", "file": "../sigma/rules/windows/registry/registry_event/registry_event_mal_azorult.yml", "status": "test", "level": "critical", "logsource.category": "registry_event", "logsource.product": "windows"}, {"id": "41d1058a-aea7-4952-9293-29eaaf516465", "title": "Removal Of AMSI Provider Registry Keys", "file": "../sigma/rules/windows/registry/registry_delete/registry_delete_removal_amsi_registry_key.yml", "status": "test", "level": "high", "logsource.category": "registry_delete", "logsource.product": "windows"}, {"id": "96f697b0-b499-4e5d-9908-a67bec11cdb6", "title": "Removal of Potential COM Hijacking Registry Keys", "file": "../sigma/rules/windows/registry/registry_delete/registry_delete_removal_com_hijacking_registry_key.yml", "status": "test", "level": "medium", "logsource.category": "registry_delete", "logsource.product": "windows"}, {"id": "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "title": "Folder Removed From Exploit Guard ProtectedFolders List - Registry", "file": "../sigma/rules/windows/registry/registry_delete/registry_delete_exploit_guard_protected_folders.yml", "status": "test", "level": "high", "logsource.category": "registry_delete", "logsource.product": "windows"}, {"id": "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "title": "Terminal Server Client Connection History Cleared - Registry", "file": "../sigma/rules/windows/registry/registry_delete/registry_delete_mstsc_history_cleared.yml", "status": "test", "level": "high", "logsource.category": "registry_delete", "logsource.product": "windows"}, {"id": "acd74772-5f88-45c7-956b-6a7b36c294d2", "title": "Removal Of SD Value to Hide Schedule Task - Registry", "file": "../sigma/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal.yml", "status": "test", "level": "medium", "logsource.category": "registry_delete", "logsource.product": "windows"}, {"id": "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "title": "Removal Of Index Value to Hide Schedule Task - Registry", "file": "../sigma/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_index_value_removal.yml", "status": "test", "level": "medium", "logsource.category": "registry_delete", "logsource.product": "windows"}, {"id": "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "title": "Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted", "file": "../sigma/rules/windows/registry/registry_delete/registry_delete_enable_windows_recall.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_delete", "logsource.product": "windows"}, {"id": "92772523-d9c1-4c93-9547-b0ca500baba3", "title": "Potential Persistence Via Mpnotify", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_mpnotify.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "790317c0-0a36-4a6a-a105-6e576bf99a14", "title": "COM Object Hijacking Via Modification Of Default System CLSID Default Value", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_com_hijacking_builtin.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "707e097c-e20f-4f67-8807-1f72ff4500d6", "title": "Potential Persistence Via App Paths Default Property", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_app_paths.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "396ae3eb-4174-4b9b-880e-dc0364d78a19", "title": "Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_outlook_enable_load_macro_provider_on_boot.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e61e8a88-59a9-451c-874e-70fcc9740d67", "title": "New DNS ServerLevelPluginDll Installed", "file": "../sigma/rules/windows/registry/registry_set/registry_set_dns_server_level_plugin_dll.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "48437c39-9e5f-47fb-af95-3d663c3f2919", "title": "UAC Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_uac_disable.yml", "status": "stable", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "title": "Outlook EnableUnsafeClientMailRules Setting Enabled - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_outlook_enable_unsafe_client_mail_rules.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "509e84b9-a71a-40e0-834f-05470369bd1e", "title": "Default RDP Port Changed to Non Standard Port", "file": "../sigma/rules/windows/registry/registry_set/registry_set_change_rdp_port.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "title": "DNS-over-HTTPS Enabled by Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_dns_over_https_enabled.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "7d9263bd-dc47-4a58-bc92-5474abab390c", "title": "Change Winevt Channel Access Permission Via Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_change_winevt_channelaccess.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "c5f6a85d-b647-40f7-bbad-c10b66bab038", "title": "UAC Notification Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_uac_disable_notification.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "8ffc5407-52e3-478f-9596-0a7371eafe13", "title": "Disable PUA Protection on Windows Defender", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disabled_pua_protection_on_microsoft_defender.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "bf344fea-d947-4ef4-9192-34d008315d3a", "title": "Suspicious Shim Database Patching Activity", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_shim_database_susp_application.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "5a93eb65-dffa-4543-b761-94aa60098fb6", "title": "Registry Hide Function from User", "file": "../sigma/rules/windows/registry/registry_set/registry_set_hide_function_user.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "7c81fec3-1c1d-43b0-996a-46753041b1b6", "title": "UAC Bypass via Event Viewer", "file": "../sigma/rules/windows/registry/registry_set/registry_set_uac_bypass_eventvwr.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "title": "Modification of IE Registry Settings", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_ie.yml", "status": "test", "level": "low", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e3fdf743-f05b-4051-990a-b66919be1743", "title": "Change User Account Associated with the FAX Service", "file": "../sigma/rules/windows/registry/registry_set/registry_set_fax_change_service_user.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "6b6976a3-b0e6-4723-ac24-ae38a737af41", "title": "Potential Persistence Via Shim Database In Uncommon Location", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_shim_database_uncommon_location.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "f7997770-92c3-4ec9-b112-774c4ef96f96", "title": "Winlogon AllowMultipleTSSessions Enable", "file": "../sigma/rules/windows/registry/registry_set/registry_set_winlogon_allow_multiple_tssessions.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "966315ef-c5e1-4767-ba25-fce9c8de3660", "title": "Suspicious Environment Variable Has Been Registered", "file": "../sigma/rules/windows/registry/registry_set/registry_set_suspicious_env_variables.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e7b18879-676e-4a0e-ae18-27039185a8e7", "title": "New Netsh Helper DLL Registered From A Suspicious Location", "file": "../sigma/rules/windows/registry/registry_set/registry_set_netsh_help_dll_persistence_susp_location.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "title": "Change the Fax Dll", "file": "../sigma/rules/windows/registry/registry_set/registry_set_fax_dll_persistance.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "title": "ClickOnce Trust Prompt Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_clickonce_trust_prompt.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "8023f872-3f1d-4301-a384-801889917ab4", "title": "Usage of Renamed Sysinternals Tools - RegistrySet", "file": "../sigma/rules/windows/registry/registry_set/registry_set_renamed_sysinternals_eula_accepted.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "44a22d59-b175-4f13-8c16-cbaef5b581ff", "title": "New File Association Using Exefile", "file": "../sigma/rules/windows/registry/registry_set/registry_set_file_association_exefile.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "fe20dda1-6f37-4379-bbe0-a98d400cae90", "title": "Potential Persistence Via Scrobj.dll COM Hijacking", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_scrobj_dll.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "b7916c2a-fa2f-4795-9477-32b731f70f11", "title": "Registry Persistence via Explorer Run Key", "file": "../sigma/rules/windows/registry/registry_set/registry_set_susp_reg_persist_explorer_run.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "0cf2e1c6-8d10-4273-8059-738778f981ad", "title": "Potential WerFault ReflectDebugger Registry Value Abuse", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_reflectdebugger.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "b86852fb-4c77-48f9-8519-eb1b2c308b59", "title": "Potential Persistence Via AppCompat RegisterAppRestart Layer", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_app_cpmpat_layer_registerapprestart.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "title": "Potential Persistence Via Outlook Home Page", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_outlook_homepage.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "dc5c24af-6995-49b2-86eb-a9ff62199e82", "title": "COM Hijacking via TreatAs", "file": "../sigma/rules/windows/registry/registry_set/registry_set_treatas_persistence.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "92b0b372-a939-44ed-a11b-5136cf680e27", "title": "Blue Mockingbird - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_mal_blue_mockingbird.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "1c3121ed-041b-4d97-a075-07f54f20fb4a", "title": "Registry Explorer Policy Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_set_nopolicies_user.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "cd277474-5c52-4423-a52b-ac2d7969902f", "title": "New BgInfo.EXE Custom WMI Query Registry Configuration", "file": "../sigma/rules/windows/registry/registry_set/registry_set_bginfo_custom_wmi_query.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "9df5f547-c86a-433e-b533-f2794357e242", "title": "Classes Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_classes.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "46490193-1b22-4c29-bdd6-5bf63907216f", "title": "VBScript Payload Stored in Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_vbs_payload_stored.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "fa277e82-9b78-42dd-b05c-05555c7b6015", "title": "Enable Local Manifest Installation With Winget", "file": "../sigma/rules/windows/registry/registry_set/registry_set_winget_enable_local_manifest.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "title": "Lsass Full Dump Request Via DumpType Registry Settings", "file": "../sigma/rules/windows/registry/registry_set/registry_set_lsass_usermode_dumping.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "91239011-fe3c-4b54-9f24-15c86bb65913", "title": "Office Macros Warning Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_vba_warnings_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "2f78da12-f7c7-430b-8b19-a28f269b77a3", "title": "Disable Windows Event Logging Via Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_winevt_logging.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "18f2065c-d36c-464a-a748-bcf909acb2e3", "title": "Wow6432Node Classes Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_classes.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "title": "Scheduled TaskCache Change by Uncommon Program", "file": "../sigma/rules/windows/registry/registry_set/registry_set_taskcache_entry.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "title": "Outlook Security Settings Updated - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_outlook_security_settings.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "title": "Hiding User Account Via SpecialAccounts Registry Key", "file": "../sigma/rules/windows/registry/registry_set/registry_set_special_accounts.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "title": "Custom File Open Handler Executes PowerShell", "file": "../sigma/rules/windows/registry/registry_set/registry_set_custom_file_open_handler_powershell_execution.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "title": "Service Binary in Suspicious Folder", "file": "../sigma/rules/windows/registry/registry_set/registry_set_creation_service_susp_folder.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "7f2954d2-99c2-4d42-a065-ca36740f187b", "title": "Hypervisor Enforced Paging Translation Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedpagingtranslation_disabled.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "title": "Common Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_common.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "title": "MaxMpxCt Registry Value Changed", "file": "../sigma/rules/windows/registry/registry_set/registry_set_optimize_file_sharing_network.yml", "status": "experimental", "level": "low", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "83314318-052a-4c90-a1ad-660ece38d276", "title": "Blackbyte Ransomware Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_blackbyte_ransomware.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "07743f65-7ec9-404a-a519-913db7118a8d", "title": "COM Hijack via Sdclt", "file": "../sigma/rules/windows/registry/registry_set/registry_set_comhijack_sdclt.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "f674e36a-4b91-431e-8aef-f8a96c2aca35", "title": "CurrentControlSet Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentcontrolset.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "title": "Potential Persistence Via Event Viewer Events.asp", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_event_viewer_events_asp.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "title": "Potential Persistence Via Shim Database Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_shim_database.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "555155a2-03bf-4fe7-af74-d176b3fdbe16", "title": "Driver Added To Disallowed Images In HVCI - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_hvci_disallowed_images.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "df4dc653-1029-47ba-8231-3c44238cc0ae", "title": "Potential Persistence Using DebugPath", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_appx_debugger.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "title": "Disable Windows Firewall by Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_windows_firewall.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "1547e27c-3974-43e2-a7d7-7f484fb928ec", "title": "Registry Persistence via Service in Safe Mode", "file": "../sigma/rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "title": "Bypass UAC Using Event Viewer", "file": "../sigma/rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "9d3436ef-9476-4c43-acca-90ce06bdf33a", "title": "DHCP Callout DLL Installation", "file": "../sigma/rules/windows/registry/registry_set/registry_set_dhcp_calloutdll.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "title": "Outlook Macro Execution Without Warning Setting Enabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_outlook_enable_macro_execution.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "fad91067-08c5-4d1a-8d8c-d96a21b37814", "title": "Potential PowerShell Execution Policy Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_powershell_execution_policy.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a982fc9c-6333-4ffb-a51d-addb04e8b529", "title": "Windows Defender Exclusions Added - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_defender_exclusions.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "title": "Directory Service Restore Mode(DSRM) Registry Value Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_dsrm_tampering.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "title": "Trust Access Disable For VBApplications", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_access_vbom_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "title": "Potentially Suspicious ODBC Driver Registered", "file": "../sigma/rules/windows/registry/registry_set/registry_set_odbc_driver_registered_susp.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "90f342e1-1aaa-4e43-b092-39fda57ed11e", "title": "ETW Logging Disabled For rpcrt4.dll", "file": "../sigma/rules/windows/registry/registry_set/registry_set_rpcrt4_etw_tamper.yml", "status": "test", "level": "low", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "02ee49e2-e294-4d0f-9278-f5b3212fc588", "title": "New RUN Key Pointing to Suspicious Folder", "file": "../sigma/rules/windows/registry/registry_set/registry_set_susp_run_key_img_folder.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "title": "RDP Sensitive Settings Changed to Zero", "file": "../sigma/rules/windows/registry/registry_set/registry_set_terminal_server_suspicious.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "0eb46774-f1ab-4a74-8238-1155855f2263", "title": "Disable Windows Defender Functionalities Via Registry Keys", "file": "../sigma/rules/windows/registry/registry_set/registry_set_windows_defender_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "title": "Python Function Execution Security Warning Disabled In Excel - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_disable_python_security_warnings.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "c90362e0-2df3-4e61-94fe-b37615814cb1", "title": "Potential Persistence Via Netsh Helper DLL - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_netsh_helper_dll_potential_persistence.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "974515da-6cc5-4c95-ae65-f97f9150ec7f", "title": "Disable Microsoft Defender Firewall via Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_defender_firewall.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "title": "ScreenSaver Registry Key Set", "file": "../sigma/rules/windows/registry/registry_set/registry_set_scr_file_executed_by_rundll32.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "c420410f-c2d8-4010-856b-dffe21866437", "title": "Enable LM Hash Storage", "file": "../sigma/rules/windows/registry/registry_set/registry_set_system_lsa_nolmhash.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "title": "System Scripts Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_system_scripts.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "f37b4bce-49d0-4087-9f5b-58bffda77316", "title": "Potential AutoLogger Sessions Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_autologger_sessions.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "9827ae57-3802-418f-994b-d5ecf5cd974b", "title": "Potential Registry Persistence Attempt Via DbgManagedDebugger", "file": "../sigma/rules/windows/registry/registry_set/registry_set_dbgmanageddebugger_persistence.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "93d298a1-d28f-47f1-a468-d971e7796679", "title": "Disable Tamper Protection on Windows Defender", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disabled_tamper_protection_on_microsoft_defender.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "46dd5308-4572-4d12-aa43-8938f0184d4f", "title": "Bypass UAC Using DelegateExecute", "file": "../sigma/rules/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "title": "Disable Windows Security Center Notifications", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_security_center_notifications.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "title": "Potential CobaltStrike Service Installations - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_cobaltstrike_service_installs.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "title": "New BgInfo.EXE Custom VBScript Registry Configuration", "file": "../sigma/rules/windows/registry/registry_set/registry_set_bginfo_custom_vbscript.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "f742bde7-9528-42e5-bd82-84f51a8387d2", "title": "Uncommon Microsoft Office Trusted Location Added", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_trusted_location_uncommon.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "title": "Scripted Diagnostics Turn Off Check Enabled - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_enabling_turnoffcheck.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "8d85cf08-bf97-4260-ba49-986a2a65129c", "title": "Suspicious Powershell In Registry Run Keys", "file": "../sigma/rules/windows/registry/registry_set/registry_set_powershell_in_run_keys.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "title": "Potential Persistence Via DLLPathOverride", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_natural_language.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "title": "Wdigest Enable UseLogonCredential", "file": "../sigma/rules/windows/registry/registry_set/registry_set_wdigest_enable_uselogoncredential.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "2ff692c2-4594-41ec-8fcb-46587de769e0", "title": "CrashControl CrashDump Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_crashdump_disabled.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "title": "Potential Attachment Manager Settings Associations Tamper", "file": "../sigma/rules/windows/registry/registry_set/registry_set_policies_associations_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "title": "Potentially Suspicious Desktop Background Change Via Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_desktop_background_change.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "b23818c7-e575-4d13-8012-332075ec0a2b", "title": "Register New IFiltre For Persistence", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_ifilter.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "title": "Potential Signing Bypass Via Windows Developer Features - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_turn_on_dev_features.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "160d2780-31f7-4922-8b3a-efce30e63e96", "title": "Potential AMSI COM Server Hijacking", "file": "../sigma/rules/windows/registry/registry_set/registry_set_amsi_com_hijack.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "title": "New TimeProviders Registered With Uncommon DLL Name", "file": "../sigma/rules/windows/registry/registry_set/registry_set_timeproviders_dllname.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "ab567429-1dfb-4674-b6d2-979fd2f9d125", "title": "Internet Explorer DisableFirstRunCustomize Enabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_internet_explorer_disable_first_run_customize.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "title": "New ODBC Driver Registered", "file": "../sigma/rules/windows/registry/registry_set/registry_set_odbc_driver_registered.yml", "status": "test", "level": "low", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "title": "Wow6432Node CurrentVersion Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "title": "Windows Defender Service Disabled - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_windows_defender_service.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "title": "Uncommon Extension In Keyboard Layout IME File Registry Value", "file": "../sigma/rules/windows/registry/registry_set/registry_set_ime_non_default_extension.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "cbf93e5d-ca6c-4722-8bea-e9119007c248", "title": "CurrentVersion NT Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion_nt.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "title": "Potential EventLog File Location Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_evtx_file_key_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "275641a5-a492-45e2-a817-7c81e9d9d3e9", "title": "Add DisallowRun Execution to Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disallowrun_execution.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "961e33d1-4f86-4fcf-80ab-930a708b2f82", "title": "Potential Persistence Via Excel Add-in - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_xll.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "title": "PowerShell as a Service in Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_powershell_as_service.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "ad89044a-8f49-4673-9a55-cbd88a1b374f", "title": "Enabling COR Profiler Environment Variables", "file": "../sigma/rules/windows/registry/registry_set/registry_set_enabling_cor_profiler_env_variables.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "086ae989-9ca6-4fe7-895a-759c5544f247", "title": "Potential Persistence Via TypedPaths", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_typed_paths.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "5de03871-5d46-4539-a82d-3aa992a69a83", "title": "Registry Disable System Restore", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_system_restore.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "28036918-04d3-423d-91c0-55ecf99fb892", "title": "NET NGenAssemblyUsageLog Registry Key Tamper", "file": "../sigma/rules/windows/registry/registry_set/registry_set_net_cli_ngenassemblyusagelog.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "title": "Disable Macro Runtime Scan Scope", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_macroruntimescanscope.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "title": "Hypervisor Enforced Code Integrity Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "title": "Hide Schedule Task Via Index Value Tamper", "file": "../sigma/rules/windows/registry/registry_set/registry_set_hide_scheduled_task_via_index_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "title": "Persistence Via New SIP Provider", "file": "../sigma/rules/windows/registry/registry_set/registry_set_sip_persistence.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "046218bd-e0d8-4113-a3c3-895a12b2b298", "title": "Session Manager Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_session_manager.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "title": "CurrentVersion Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "title": "Microsoft Office Protected View Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_disable_protected_view_features.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "title": "Potential Persistence Via Custom Protocol Handler", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_custom_protocol_handler.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a80f662f-022f-4429-9b8c-b1a41aaa6688", "title": "Internet Explorer Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_internet_explorer.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "612e47e9-8a59-43a6-b404-f48683f45bd6", "title": "ServiceDll Hijack", "file": "../sigma/rules/windows/registry/registry_set/registry_set_servicedll_hijack.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "833ef470-fa01-4631-a79b-6f291c9ac498", "title": "Add Debugger Entry To Hangs Key For Persistence", "file": "../sigma/rules/windows/registry/registry_set/registry_set_hangs_debugger_persistence.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "9d8f9bb8-01af-4e15-a3a2-349071530530", "title": "Suspicious Path In Keyboard Layout IME File Registry Value", "file": "../sigma/rules/windows/registry/registry_set/registry_set_ime_suspicious_paths.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "title": "Potential Credential Dumping Attempt Using New NetworkProvider - REG", "file": "../sigma/rules/windows/registry/registry_set/registry_set_new_network_provider.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "5df86130-4e95-4a54-90f7-26541b40aec2", "title": "Registry Modification to Hidden File Extension", "file": "../sigma/rules/windows/registry/registry_set/registry_set_hidden_extention.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "title": "Winget Admin Settings Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_winget_admin_settings_tampering.yml", "status": "test", "level": "low", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "f10ed525-97fe-4fed-be7c-2feecca941b1", "title": "Persistence Via Hhctrl.ocx", "file": "../sigma/rules/windows/registry/registry_set/registry_set_hhctrl_persistence.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "5f9db380-ea57-4d1e-beab-8a2d33397e93", "title": "UAC Bypass Using Windows Media Player - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_uac_bypass_wmp.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "487bb375-12ef-41f6-baae-c6a1572b4dd1", "title": "Potential Persistence Via Outlook Today Page", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_outlook_todaypage.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "title": "Allow RDP Remote Assistance Feature", "file": "../sigma/rules/windows/registry/registry_set/registry_set_allow_rdp_remote_assistance_feature.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "8218c875-90b9-42e2-b60d-0b0069816d10", "title": "PowerShell Script Execution Policy Enabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_powershell_enablescripts_enabled.yml", "status": "test", "level": "low", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "53330955-dc52-487f-a3a2-da24dcff99b5", "title": "New BgInfo.EXE Custom DB Path Registry Configuration", "file": "../sigma/rules/windows/registry/registry_set/registry_set_bginfo_custom_db.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "f2485272-a156-4773-82d7-1d178bc4905b", "title": "Suspicious Service Installed", "file": "../sigma/rules/windows/registry/registry_set/registry_set_susp_service_installed.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "724ea201-6514-4f38-9739-e5973c34f49a", "title": "Bypass UAC Using SilentCleanup Task", "file": "../sigma/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "6c304b02-06e6-402d-8be4-d5833cdf8198", "title": "Potential SentinelOne Shell Context Menu Scan Command Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_sentinelone_shell_context_tampering.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "title": "Tamper With Sophos AV Registry Keys", "file": "../sigma/rules/windows/registry/registry_set/registry_set_sophos_av_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "4916a35e-bfc4-47d0-8e25-a003d7067061", "title": "Sysmon Driver Altitude Change", "file": "../sigma/rules/windows/registry/registry_set/registry_set_change_sysmon_driver_altitude.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "73a883d0-0348-4be4-a8d8-51031c2564f8", "title": "Potential Registry Persistence Attempt Via Windows Telemetry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_telemetry_persistence.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "title": "ETW Logging Disabled In .NET Processes - Sysmon Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_dot_net_etw_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "d223b46b-5621-4037-88fe-fda32eead684", "title": "New Root or CA or AuthRoot Certificate to Store", "file": "../sigma/rules/windows/registry/registry_set/registry_set_install_root_or_ca_certificat.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "31e124fb-5dc4-42a0-83b3-44a69c77b271", "title": "Antivirus Filter Driver Disallowed On Dev Drive - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_devdrv_disallow_antivirus_filter.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "title": "Activate Suppression of Windows Security Center Notifications", "file": "../sigma/rules/windows/registry/registry_set/registry_set_suppress_defender_notifications.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "480421f9-417f-4d3b-9552-fd2728443ec8", "title": "Wow6432Node Windows NT CurrentVersion Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "60936b49-fca0-4f32-993d-7415edcf9a5d", "title": "New Application in AppCompat", "file": "../sigma/rules/windows/registry/registry_set/registry_set_new_application_appcompat.yml", "status": "test", "level": "informational", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "title": "RestrictedAdminMode Registry Value Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_lsa_disablerestrictedadmin.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "6597be7b-ac61-4ac8-bef4-d3ec88174853", "title": "UAC Bypass Abusing Winsat Path Parsing - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_uac_bypass_winsat.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "5b872a46-3b90-45c1-8419-f675db8053aa", "title": "UAC Bypass via Sdclt", "file": "../sigma/rules/windows/registry/registry_set/registry_set_uac_bypass_sdclt.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "092af964-4233-4373-b4ba-d86ea2890288", "title": "Add Debugger Entry To AeDebug For Persistence", "file": "../sigma/rules/windows/registry/registry_set/registry_set_aedebug_persistence.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "b64a026b-8deb-4c1d-92fd-98893209dff1", "title": "Running Chrome VPN Extensions via the Registry 2 VPN Extension", "file": "../sigma/rules/windows/registry/registry_set/registry_set_chrome_extension.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a7df0e9e-91a5-459a-a003-4cde67c2ff5d", "title": "Potentially Suspicious Command Executed Via Run Dialog Box - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_runmru_susp_command_execution.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "title": "Potential PendingFileRenameOperations Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_susp_pendingfilerenameoperations.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "34aa0252-6039-40ff-951f-939fd6ce47d8", "title": "Suspicious Keyboard Layout Load", "file": "../sigma/rules/windows/registry/registry_set/registry_set_susp_keyboard_layout_load.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "63647769-326d-4dde-a419-b925cc0caf42", "title": "Enable Microsoft Dynamic Data Exchange", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_enable_dde.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "title": "Macro Enabled In A Potentially Suspicious Document", "file": "../sigma/rules/windows/registry/registry_set/registry_set_office_trust_record_susp_location.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "title": "IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols", "file": "../sigma/rules/windows/registry/registry_set/registry_set_ie_security_zone_protocol_defaults_downgrade.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "title": "Potential Attachment Manager Settings Attachments Tamper", "file": "../sigma/rules/windows/registry/registry_set/registry_set_policies_attachments_tamper.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "9d15044a-7cfe-4d23-8085-6ebc11df7685", "title": "Potential Persistence Via Visual Studio Tools for Office", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_office_vsto.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "title": "Persistence Via Disk Cleanup Handler - Autorun", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disk_cleanup_handler_autorun_persistence.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "976dd1f2-a484-45ec-aa1d-0e87e882262b", "title": "Potential Persistence Via CHM Helper DLL", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_chm.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "title": "Windows Recall Feature Enabled - Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_enable_windows_recall.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "944e8941-f6f6-4ee8-ac05-1c224e923c0e", "title": "Add Port Monitor Persistence in Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_add_port_monitor.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "title": "Periodic Backup For System Registry Hives Enabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_enable_periodic_backup.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "439957a7-ad86-4a8f-9705-a28131c6821b", "title": "Old TLS1.0/TLS1.1 Protocol Version Enabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_tls_protocol_old_version_enabled.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "5a5152f1-463f-436b-b2f5-8eceb3964b42", "title": "Displaying Hidden Files Feature Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_hide_file.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e0813366-0407-449a-9869-a2db1119dc41", "title": "Suspicious Printer Driver Empty Manufacturer", "file": "../sigma/rules/windows/registry/registry_set/registry_set_susp_printer_driver.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "title": "WinSock2 Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_winsock2.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "title": "Lolbas OneDriveStandaloneUpdater.exe Proxy Download", "file": "../sigma/rules/windows/registry/registry_set/registry_set_lolbin_onedrivestandaloneupdater.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "bf9e1387-b040-4393-9851-1598f8ecfae9", "title": "Disable Exploit Guard Network Protection on Windows Defender", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disabled_exploit_guard_net_protection_on_ms_defender.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "title": "Potential Persistence Via MyComputer Registry Keys", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_mycomputer.yml", "status": "experimental", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "title": "Disable Administrative Share Creation at Startup", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_administrative_share.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "9c226817-8dc9-46c2-a58d-66655aafd7dc", "title": "Modify User Shell Folders Startup Value", "file": "../sigma/rules/windows/registry/registry_set/registry_set_susp_user_shell_folders.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "7021255e-5db3-4946-a8b9-0ba7a4644a69", "title": "Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG", "file": "../sigma/rules/windows/registry/registry_set/registry_set_provisioning_command_abuse.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "36803969-5421-41ec-b92f-8500f79c23b0", "title": "Potential Persistence Via GlobalFlags", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_globalflags.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "title": "Winlogon Notify Key Logon Persistence", "file": "../sigma/rules/windows/registry/registry_set/registry_set_winlogon_notify_key.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "title": "Disable Privacy Settings Experience in Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_privacy_settings_experience.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "42205c73-75c8-4a63-9db1-e3782e06fda0", "title": "Suspicious Application Allowed Through Exploit Guard", "file": "../sigma/rules/windows/registry/registry_set/registry_set_exploit_guard_susp_allowed_apps.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "41f6531d-af6e-4c6e-918f-b946f2b85a36", "title": "Potential Persistence Via LSA Extensions", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_lsa_extension.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e2482f8d-3443-4237-b906-cc145d87a076", "title": "Disable Internal Tools or Feature in Registry", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disable_function_user.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "8b9606c9-28be-4a38-b146-0e313cc232c1", "title": "Potential Ransomware Activity Using LegalNotice Message", "file": "../sigma/rules/windows/registry/registry_set/registry_set_legalnotice_susp_message.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "title": "IE Change Domain Zone", "file": "../sigma/rules/windows/registry/registry_set/registry_set_change_security_zones.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "title": "RDP Sensitive Settings Changed", "file": "../sigma/rules/windows/registry/registry_set/registry_set_terminal_server_tampering.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "4f281b83-0200-4b34-bf35-d24687ea57c2", "title": "ETW Logging Disabled For SCM", "file": "../sigma/rules/windows/registry/registry_set/registry_set_services_etw_tamper.yml", "status": "test", "level": "low", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "243380fa-11eb-4141-af92-e14925e77c1b", "title": "Potential PSFactoryBuffer COM Hijacking", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_comhijack_psfactorybuffer.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "baecf8fb-edbf-429f-9ade-31fc3f22b970", "title": "Office Autorun Keys Modification", "file": "../sigma/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_office.yml", "status": "test", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "title": "Disabled Windows Defender Eventlog", "file": "../sigma/rules/windows/registry/registry_set/registry_set_disabled_microsoft_defender_eventlog.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "0d7ceeef-3539-4392-8953-3dc664912714", "title": "UAC Secure Desktop Prompt Disabled", "file": "../sigma/rules/windows/registry/registry_set/registry_set_uac_disable_secure_desktop_prompt.yml", "status": "experimental", "level": "medium", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "fc014922-5def-4da9-a0fc-28c973f41bfb", "title": "Execution DLL of Choice Using WAB.EXE", "file": "../sigma/rules/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "title": "Potential Persistence Via AutodialDLL", "file": "../sigma/rules/windows/registry/registry_set/registry_set_persistence_autodial_dll.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7", "title": "PowerShell Logging Disabled Via Registry Key Tampering", "file": "../sigma/rules/windows/registry/registry_set/registry_set_powershell_logging_disabled.yml", "status": "test", "level": "high", "logsource.category": "registry_set", "logsource.product": "windows"}, {"id": "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "title": "Potential Persistence Via Disk Cleanup Handler - Registry", "file": "../sigma/rules/windows/registry/registry_add/registry_add_persistence_disk_cleanup_handler_entry.yml", "status": "test", "level": "medium", "logsource.category": "registry_add", "logsource.product": "windows"}, {"id": "9ace0707-b560-49b8-b6ca-5148b42f39fb", "title": "Potential Persistence Via Logon Scripts - Registry", "file": "../sigma/rules/windows/registry/registry_add/registry_add_persistence_logon_scripts_userinitmprlogonscript.yml", "status": "test", "level": "medium", "logsource.category": "registry_add", "logsource.product": "windows"}, {"id": "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "title": "PUA - Sysinternals Tools Execution - Registry", "file": "../sigma/rules/windows/registry/registry_add/registry_add_pua_sysinternals_susp_execution_via_eula.yml", "status": "test", "level": "medium", "logsource.category": "registry_add", "logsource.product": "windows"}, {"id": "9b0f8a61-91b2-464f-aceb-0527e0a45020", "title": "Potential COM Object Hijacking Via TreatAs Subkey - Registry", "file": "../sigma/rules/windows/registry/registry_add/registry_add_persistence_com_key_linking.yml", "status": "test", "level": "medium", "logsource.category": "registry_add", "logsource.product": "windows"}, {"id": "1d218616-71b0-4c40-855b-9dbe75510f7f", "title": "Potential NetWire RAT Activity - Registry", "file": "../sigma/rules/windows/registry/registry_add/registry_add_malware_netwire.yml", "status": "test", "level": "high", "logsource.category": "registry_add", "logsource.product": "windows"}, {"id": "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "title": "Potential Persistence Via New AMSI Providers - Registry", "file": "../sigma/rules/windows/registry/registry_add/registry_add_persistence_amsi_providers.yml", "status": "test", "level": "high", "logsource.category": "registry_add", "logsource.product": "windows"}, {"id": "25ffa65d-76d8-4da5-a832-3f2b0136e133", "title": "PUA - Sysinternal Tool Execution - Registry", "file": "../sigma/rules/windows/registry/registry_add/registry_add_pua_sysinternals_execution_via_eula.yml", "status": "test", "level": "low", "logsource.category": "registry_add", "logsource.product": "windows"}, {"id": "f50f3c09-557d-492d-81db-9064a8d4e211", "title": "Suspicious Execution Of Renamed Sysinternals Tools - Registry", "file": "../sigma/rules/windows/registry/registry_add/registry_add_pua_sysinternals_renamed_execution_via_eula.yml", "status": "test", "level": "high", "logsource.category": "registry_add", "logsource.product": "windows"}, {"id": "db809f10-56ce-4420-8c86-d6a7d793c79c", "title": "Potential Defense Evasion Via Raw Disk Access By Uncommon Tools", "file": "../sigma/rules/windows/raw_access_thread/raw_access_thread_susp_disk_access_using_uncommon_tools.yml", "status": "test", "level": "low", "logsource.category": "raw_access_thread", "logsource.product": "windows"}, {"id": "5ef9853e-4d0e-4a70-846f-a9ca37d876da", "title": "Potential Credential Dumping Activity Via LSASS", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_memdump.yml", "status": "experimental", "level": "medium", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "d0d2f720-d14f-448d-8242-51ff396a334e", "title": "HackTool - Generic Process Access", "file": "../sigma/rules/windows/process_access/proc_access_win_hktl_generic_access.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "a49fa4d5-11db-418c-8473-1e014a8dd462", "title": "Lsass Memory Dump via Comsvcs DLL", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_dump_comsvcs_dll.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9", "title": "Credential Dumping Activity By Python Based Tool", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_python_based_tool.yml", "status": "stable", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "9bd012ee-0dff-44d7-84a0-aa698cfd87a3", "title": "LSASS Memory Access by Tool With Dump Keyword In Name", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_dump_keyword_image.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "174afcfa-6e40-4ae9-af64-496546389294", "title": "Credential Dumping Attempt Via Svchost", "file": "../sigma/rules/windows/process_access/proc_access_win_svchost_credential_dumping.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "4be8b654-0c01-4c9d-a10c-6b28467fc651", "title": "LSASS Access From Potentially White-Listed Processes", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_whitelisted_process_names.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5", "title": "HackTool - HandleKatz Duplicating LSASS Handle", "file": "../sigma/rules/windows/process_access/proc_access_win_hktl_handlekatz_lsass_access.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "fb3722e4-1a06-46b6-b772-253e2e7db933", "title": "Function Call From Undocumented COM Interface EditionUpgradeManager", "file": "../sigma/rules/windows/process_access/proc_access_win_uac_bypass_editionupgrademanagerobj.yml", "status": "test", "level": "medium", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "472159c5-31b9-4f56-b794-b766faa8b0a7", "title": "Suspicious LSASS Access Via MalSecLogon", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_seclogon_access.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "166e9c50-8cd9-44af-815d-d1f0c0e90dde", "title": "Suspicious Svchost Process Access", "file": "../sigma/rules/windows/process_access/proc_access_win_svchost_susp_access_request.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "e5b33f7d-eb93-48b6-9851-09e1e610b6d7", "title": "Credential Dumping Attempt Via WerFault", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_werfault.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "aa35a627-33fb-4d04-a165-d33b4afca3e8", "title": "Remote LSASS Process Access Through Windows Remote Management", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_remote_access_trough_winrm.yml", "status": "stable", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "a24e5861-c6ca-4fde-a93c-ba9256feddf0", "title": "Uncommon Process Access Rights For Target Image", "file": "../sigma/rules/windows/process_access/proc_access_win_susp_all_access_uncommon_target.yml", "status": "experimental", "level": "low", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "4f6c43e2-f989-4ea5-bcd8-843b49a0317c", "title": "UAC Bypass Using WOW64 Logger DLL Hijack", "file": "../sigma/rules/windows/process_access/proc_access_win_uac_bypass_wow64_logger.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "3f3f3506-1895-401b-9cc3-e86b16e630d0", "title": "Potential Direct Syscall of NtOpenProcess", "file": "../sigma/rules/windows/process_access/proc_access_win_susp_direct_ntopenprocess_call.yml", "status": "test", "level": "medium", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "7bdde3bf-2a42-4c39-aa31-a92b3e17afac", "title": "HackTool - LittleCorporal Generated Maldoc Injection", "file": "../sigma/rules/windows/process_access/proc_access_win_hktl_littlecorporal_generated_maldoc.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "3b4b232a-af90-427c-a22f-30b0c0837b95", "title": "CMSTP Execution Process Access", "file": "../sigma/rules/windows/process_access/proc_access_win_cmstp_execution_by_access.yml", "status": "stable", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "a18dd26b-6450-46de-8c91-9659150cf088", "title": "Potentially Suspicious GrantedAccess Flags On LSASS", "file": "../sigma/rules/windows/process_access/proc_access_win_lsass_susp_access_flag.yml", "status": "test", "level": "medium", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "09706624-b7f6-455d-9d02-adee024cee1d", "title": "HackTool - CobaltStrike BOF Injection Pattern", "file": "../sigma/rules/windows/process_access/proc_access_win_hktl_cobaltstrike_bof_injection_pattern.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "d29ada0f-af45-4f27-8f32-f7b77c3dbc4e", "title": "HackTool - SysmonEnte Execution", "file": "../sigma/rules/windows/process_access/proc_access_win_hktl_sysmonente.yml", "status": "test", "level": "high", "logsource.category": "process_access", "logsource.product": "windows"}, {"id": "ec8c4047-fad9-416a-8c81-0f479353d7f6", "title": "Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE", "file": "../sigma/rules/windows/image_load/image_load_dll_sdiageng_load_by_msdt.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "title": "WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load", "file": "../sigma/rules/windows/image_load/image_load_scrcons_wmi_scripteventconsumer.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "title": "PowerShell Core DLL Loaded Via Office Application", "file": "../sigma/rules/windows/image_load/image_load_office_powershell_dll_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "d13c43f0-f66b-4279-8b2c-5912077c1780", "title": "CLR DLL Loaded Via Office Applications", "file": "../sigma/rules/windows/image_load/image_load_office_dotnet_clr_dll_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "d2451be2-b582-4e15-8701-4196ac180260", "title": "Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE", "file": "../sigma/rules/windows/image_load/image_load_side_load_keyscrambler.yml", "status": "experimental", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "f40017b3-cb2e-4335-ab5d-3babf679c1de", "title": "Remote DLL Load Via Rundll32.EXE", "file": "../sigma/rules/windows/image_load/image_load_rundll32_remote_share_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "title": "Microsoft VBA For Outlook Addin Loaded Via Outlook", "file": "../sigma/rules/windows/image_load/image_load_office_outlook_outlvba_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "title": "Suspicious Volume Shadow Copy Vssapi.dll Load", "file": "../sigma/rules/windows/image_load/image_load_dll_vssapi_susp_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "title": "Potential EACore.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_eacore.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "f354eba5-623b-450f-b073-0b5b2773b6aa", "title": "Potential DCOM InternetExplorer.Application DLL Hijack - Image Load", "file": "../sigma/rules/windows/image_load/image_load_iexplore_dcom_iertutil_dll_hijack.yml", "status": "test", "level": "critical", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "6414b5cd-b19d-447e-bb5e-9f03940b5784", "title": "Potential DLL Sideloading Of DBGHELP.DLL", "file": "../sigma/rules/windows/image_load/image_load_side_load_dbghelp.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94", "title": "Suspicious WSMAN Provider Image Loads", "file": "../sigma/rules/windows/image_load/image_load_wsman_provider_image_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "bdc64095-d59a-42a2-8588-71fd9c9d9abc", "title": "Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded", "file": "../sigma/rules/windows/image_load/image_load_dll_dbghelp_dbgcore_unsigned_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "1fbc0671-5596-4e17-8682-f020a0b995dc", "title": "Potential CCleanerDU.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_ccleaner_du.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "552b6b65-df37-4d3e-a258-f2fc4771ae54", "title": "Potential Antivirus Software DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_antivirus.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "title": "Microsoft Office DLL Sideload", "file": "../sigma/rules/windows/image_load/image_load_side_load_office_dlls.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "333cdbe8-27bb-4246-bf82-b41a0dca4b70", "title": "Suspicious Volume Shadow Copy VSS_PS.dll Load", "file": "../sigma/rules/windows/image_load/image_load_dll_vss_ps_susp_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "title": "WMIC Loading Scripting Libraries", "file": "../sigma/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "4c21b805-4dd7-469f-b47d-7383a8fcb437", "title": "Potential Iviewers.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_iviewers.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "title": "Potential Mpclient.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_windows_defender.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "title": "Potential Waveedit.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_waveedit.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "title": "Potential DLL Sideloading Of MsCorSvc.DLL", "file": "../sigma/rules/windows/image_load/image_load_side_load_mscorsvc.yml", "status": "experimental", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "4508a70e-97ef-4300-b62b-ff27992990ea", "title": "DotNet CLR DLL Loaded By Scripting Applications", "file": "../sigma/rules/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "857c8db3-c89b-42fb-882b-f681c7cf4da2", "title": "Unsigned Image Loaded Into LSASS Process", "file": "../sigma/rules/windows/image_load/image_load_lsass_unsigned_image_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "title": "WMI Persistence - Command Line Event Consumer", "file": "../sigma/rules/windows/image_load/image_load_wmi_persistence_commandline_event_consumer.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "3669afd2-9891-4534-a626-e5cf03810a61", "title": "Load Of RstrtMgr.DLL By An Uncommon Process", "file": "../sigma/rules/windows/image_load/image_load_dll_rstrtmgr_uncommon_load.yml", "status": "test", "level": "low", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "title": "Potential RjvPlatform.DLL Sideloading From Default Location", "file": "../sigma/rules/windows/image_load/image_load_side_load_rjvplatform_default_location.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "title": "DLL Load By System Process From Suspicious Locations", "file": "../sigma/rules/windows/image_load/image_load_susp_dll_load_system_process.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "7417e29e-c2e7-4cf6-a2e8-767228c64837", "title": "Active Directory Kerberos DLL Loaded Via Office Application", "file": "../sigma/rules/windows/image_load/image_load_office_kerberos_dll_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "72ca7c75-bf85-45cd-aca7-255d360e423c", "title": "Potential Chrome Frame Helper DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_chrome_frame_helper.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "060d5ad4-3153-47bb-8382-43e5e29eda92", "title": "Unsigned Module Loaded by ClickOnce Application", "file": "../sigma/rules/windows/image_load/image_load_susp_clickonce_unsigned_module_loaded.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "0e0bc253-07ed-43f1-816d-e1b220fe8971", "title": "Potential RjvPlatform.DLL Sideloading From Non-Default Location", "file": "../sigma/rules/windows/image_load/image_load_side_load_rjvplatform_non_default_location.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "6e78b74f-c762-4800-82ad-f66787f10c8a", "title": "Potential Rcdll.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_rcdll.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "84b0a8f3-680b-4096-a45b-e9a89221727c", "title": "PCRE.NET Package Image Load", "file": "../sigma/rules/windows/image_load/image_load_dll_pcre_dotnet_dll_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "90ae0469-0cee-4509-b67f-e5efcef040f7", "title": "Aruba Network Service Potential DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_aruba_networks_virtual_intranet_access.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "bf9808c4-d24f-44a2-8398-b65227d406b6", "title": "Potential Libvlc.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_libvlc.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "caa02837-f659-466f-bca6-48bde2826ab4", "title": "Potential DLL Sideloading Via ClassicExplorer32.dll", "file": "../sigma/rules/windows/image_load/image_load_side_load_classicexplorer32.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "title": "PowerShell Core DLL Loaded By Non PowerShell Process", "file": "../sigma/rules/windows/image_load/image_load_dll_system_management_automation_susp_load.yml", "status": "experimental", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "title": "Potential Goopdate.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_goopdate.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "4fc0deee-0057-4998-ab31-d24e46e0aba4", "title": "Potential System DLL Sideloading From Non System Locations", "file": "../sigma/rules/windows/image_load/image_load_side_load_from_non_system_location.yml", "status": "experimental", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "e2e01011-5910-4267-9c3b-4149ed5479cf", "title": "Potential WWlib.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_wwlib.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "title": "Potential Edputil.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_edputil.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "d2605a99-2218-4894-8fd3-2afb7946514d", "title": "Potential Mfdetours.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_mfdetours.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "title": "VMGuestLib DLL Sideload", "file": "../sigma/rules/windows/image_load/image_load_side_load_vmguestlib.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "a2a3b925-7bb0-433b-b508-db9003263cc4", "title": "Active Directory Parsing DLL Loaded Via Office Application", "file": "../sigma/rules/windows/image_load/image_load_office_dsparse_dll_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "68654bf0-4412-43d5-bfe8-5eaa393cd939", "title": "Potential DLL Sideloading Via JsSchHlp", "file": "../sigma/rules/windows/image_load/image_load_side_load_jsschhlp.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "title": "Potential RoboForm.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_robform.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "title": "Potential DLL Sideloading Using Coregen.exe", "file": "../sigma/rules/windows/image_load/image_load_side_load_coregen.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "952ed57c-8f99-453d-aee0-53a49c22f95d", "title": "Potential AVKkid.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_avkkid.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "title": "DLL Sideloading Of ShellChromeAPI.DLL", "file": "../sigma/rules/windows/image_load/image_load_side_load_shell_chrome_api.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "title": "Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE", "file": "../sigma/rules/windows/image_load/image_load_side_load_gup_libcurl.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "cbb56d62-4060-40f7-9466-d8aaf3123f83", "title": "Python Image Load By Non-Python Process", "file": "../sigma/rules/windows/image_load/image_load_susp_python_image_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "75e508f7-932d-4ebc-af77-269237a84ce1", "title": "DLL Loaded From Suspicious Location Via Cmspt.EXE", "file": "../sigma/rules/windows/image_load/image_load_cmstp_load_dll_from_susp_location.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "50f852e6-af22-4c78-9ede-42ef36aa3453", "title": "Potential Azure Browser SSO Abuse", "file": "../sigma/rules/windows/image_load/image_load_dll_azure_microsoft_account_token_provider_dll_load.yml", "status": "test", "level": "low", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "title": "HackTool - SILENTTRINITY Stager DLL Load", "file": "../sigma/rules/windows/image_load/image_load_hktl_silenttrinity_stager.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "8cde342c-ba48-4b74-b615-172c330f2e93", "title": "Suspicious Renamed Comsvcs DLL Loaded By Rundll32", "file": "../sigma/rules/windows/image_load/image_load_dll_comsvcs_load_renamed_version_by_rundll32.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "ea5c131b-380d-49f9-aeb3-920694da4d4b", "title": "Suspicious Unsigned Thor Scanner Execution", "file": "../sigma/rules/windows/image_load/image_load_thor_unsigned_execution.yml", "status": "stable", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "a2edbce1-95c8-4291-8676-0d45146862b3", "title": "Potential SolidPDFCreator.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_solidpdfcreator.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "844f8eb2-610b-42c8-89a4-47596e089663", "title": "Potential ShellDispatch.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_shelldispatch.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "6360757a-d460-456c-8b13-74cf0e60cceb", "title": "Potential DLL Sideloading Via comctl32.dll", "file": "../sigma/rules/windows/image_load/image_load_side_load_comctl32.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "24b6cf51-6122-469e-861a-22974e9c1e5b", "title": "Potential SmadHook.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_smadhook.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "6b98b92b-4f00-4f62-b4fe-4d1920215771", "title": "Potential DLL Sideloading Of Non-Existent DLLs From System Folders", "file": "../sigma/rules/windows/image_load/image_load_side_load_non_existent_dlls.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "9ed5959a-c43c-4c59-84e3-d28628429456", "title": "UAC Bypass Using Iscsicpl - ImageLoad", "file": "../sigma/rules/windows/image_load/image_load_uac_bypass_iscsicpl.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "title": "Potential 7za.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_7za.yml", "status": "test", "level": "low", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "title": "System Control Panel Item Loaded From Uncommon Location", "file": "../sigma/rules/windows/image_load/image_load_side_load_cpl_from_non_system_location.yml", "status": "experimental", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "b48492dc-c5ef-4572-8dff-32bc241c15c8", "title": "Load Of RstrtMgr.DLL By A Suspicious Process", "file": "../sigma/rules/windows/image_load/image_load_dll_rstrtmgr_suspicious_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "title": "Potential Python DLL SideLoading", "file": "../sigma/rules/windows/image_load/image_load_side_load_python.yml", "status": "experimental", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "title": "VMMap Signed Dbghelp.DLL Potential Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_vmmap_dbghelp_signed.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "b5de0c9a-6f19-43e0-af4e-55ad01f550af", "title": "Unsigned DLL Loaded by Windows Utility", "file": "../sigma/rules/windows/image_load/image_load_susp_unsigned_dll.yml", "status": "experimental", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "fef394cd-f44d-4040-9b18-95d92fe278c0", "title": "Potential DLL Sideloading Of DbgModel.DLL", "file": "../sigma/rules/windows/image_load/image_load_side_load_dbgmodel.yml", "status": "experimental", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "48bfd177-7cf2-412b-ad77-baf923489e82", "title": "Suspicious Volume Shadow Copy Vsstrace.dll Load", "file": "../sigma/rules/windows/image_load/image_load_dll_vsstrace_susp_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "2092cacb-d77b-4f98-ab0d-32b32f99a054", "title": "Potential Vivaldi_elf.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_vivaldi_elf.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "ff0f2b05-09db-4095-b96d-1b75ca24894a", "title": "DotNET Assembly DLL Loaded Via Office Application", "file": "../sigma/rules/windows/image_load/image_load_office_dotnet_assembly_dll_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "49329257-089d-46e6-af37-4afce4290685", "title": "HackTool - SharpEvtMute DLL Load", "file": "../sigma/rules/windows/image_load/image_load_hktl_sharpevtmute.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "7707a579-e0d8-4886-a853-ce47e4575aaa", "title": "Wmiprvse Wbemcomn DLL Hijack", "file": "../sigma/rules/windows/image_load/image_load_wmiprvse_wbemcomn_dll_hijack.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "ee6cea48-c5b6-4304-a332-10fc6446f484", "title": "Potential appverifUI.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_appverifui.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "9313dc13-d04c-46d8-af4a-a930cc55d93b", "title": "Potential DLL Sideloading Via VMware Xfer", "file": "../sigma/rules/windows/image_load/image_load_side_load_vmware_xfer.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "title": "VBA DLL Loaded Via Office Application", "file": "../sigma/rules/windows/image_load/image_load_office_vbadll_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "title": "Windows Spooler Service Suspicious Binary Load", "file": "../sigma/rules/windows/image_load/image_load_spoolsv_dll_load.yml", "status": "test", "level": "informational", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "title": "Potential Wazuh Security Platform DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_wazuh.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "e76c8240-d68f-4773-8880-5c6f63595aaf", "title": "Time Travel Debugging Utility Usage - Image", "file": "../sigma/rules/windows/image_load/image_load_dll_tttracer_module_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "828af599-4c53-4ed2-ba4a-a9f835c434ea", "title": "Fax Service DLL Search Order Hijack", "file": "../sigma/rules/windows/image_load/image_load_side_load_ualapi.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "title": "Third Party Software DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_third_party.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "title": "Potential DLL Sideloading Of MpSvc.DLL", "file": "../sigma/rules/windows/image_load/image_load_side_load_mpsvc.yml", "status": "experimental", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "af4c4609-5755-42fe-8075-4effb49f5d44", "title": "Microsoft Excel Add-In Loaded From Uncommon Location", "file": "../sigma/rules/windows/image_load/image_load_office_excel_xll_susp_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "9ca2bf31-0570-44d8-a543-534c47c33ed7", "title": "Potential DLL Sideloading Of DBGCORE.DLL", "file": "../sigma/rules/windows/image_load/image_load_side_load_dbgcore.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "title": "UAC Bypass With Fake DLL", "file": "../sigma/rules/windows/image_load/image_load_uac_bypass_via_dism.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "title": "CredUI.DLL Loaded By Uncommon Process", "file": "../sigma/rules/windows/image_load/image_load_dll_credui_uncommon_process_load.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "6ec86d9e-912e-4726-91a2-209359b999b9", "title": "Amsi.DLL Loaded Via LOLBIN Process", "file": "../sigma/rules/windows/image_load/image_load_dll_amsi_suspicious_process.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "273a8dd8-3742-4302-bcc7-7df5a80fe425", "title": "VMMap Unsigned Dbghelp.DLL Potential Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_vmmap_dbghelp_unsigned.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "90217a70-13fc-48e4-b3db-0d836c5824ac", "title": "GAC DLL Loaded Via Office Applications", "file": "../sigma/rules/windows/image_load/image_load_office_dotnet_gac_dll_load.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "3735d5ac-d770-4da0-99ff-156b180bc600", "title": "Potential CCleanerReactivator.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_ccleaner_reactivator.yml", "status": "test", "level": "medium", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "948a0953-f287-4806-bbcb-3b2e396df89f", "title": "Unsigned Mfdetours.DLL Sideloading", "file": "../sigma/rules/windows/image_load/image_load_side_load_mfdetours_unsigned.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "title": "Abusable DLL Potential Sideloading From Suspicious Location", "file": "../sigma/rules/windows/image_load/image_load_side_load_abused_dlls_susp_paths.yml", "status": "test", "level": "high", "logsource.category": "image_load", "logsource.product": "windows"}, {"id": "73e67340-0d25-11eb-adc1-0242ac120002", "title": "Invoke-Obfuscation CLIP+ Launcher - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_clip.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "3ceb2083-a27f-449a-be33-14ec1b7cc973", "title": "Silence.EDA Detection", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_apt_silence_eda.yml", "status": "test", "level": "critical", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "195626f3-5f1b-4403-93b7-e6cfd4d6a078", "title": "Suspicious SSL Connection", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_ssl_keyword.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "ca8b77a9-d499-4095-b793-5d5f330d450e", "title": "PowerShell Credential Prompt", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_prompt_credentials.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "99c49d9c-34ea-45f7-84a7-4751ae6b2cbc", "title": "Dump Credentials from Windows Credential Manager With PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_dump_password_windows_credential_manager.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "7b836d7f-179c-4ba4-90a7-a7e60afb48e6", "title": "Execute Invoke-command on Remote Host", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_command_remote.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "bde47d4b-9987-405c-94c7-b080410e8ea7", "title": "Clearing Windows Console History", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_clearing_windows_console_history.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "88f0884b-331d-403d-a3a1-b668cf035603", "title": "AD Groups Or Users Enumeration Using PowerShell - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_ad_group_reco.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "4fdc44df-bfe9-4fcc-b041-68f5a2d3031c", "title": "Powershell LocalAccount Manipulation", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_localuser.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "ddcd88cb-7f62-4ce5-86f9-1704190feb0a", "title": "Potential In-Memory Execution Using Reflection.Assembly", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_dotnet_assembly_from_file.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "8c521530-5169-495d-a199-0a3a881ad24e", "title": "NTFS Alternate Data Stream", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_ntfs_ads_access.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "3c7d1587-3b13-439f-9941-7d14313dbdfe", "title": "Potential COM Objects Download Cradles Usage - PS Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_download_com_cradles.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "c1337eb8-921a-4b59-855b-4ba188ddcc42", "title": "Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_win32_shadowcopy_deletion.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "95afc12e-3cbb-40c3-9340-84a032e596a3", "title": "Service Registry Permissions Weakness Check", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_get_acl_service.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "1c563233-030e-4a07-af8c-ee0490a66d3a", "title": "Suspicious New-PSDrive to Admin Share", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_new_psdrive.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "fbc5e92f-3044-4e73-a5c6-1c4359b539de", "title": "PowerShell Script With File Hostname Resolving Capabilities", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_resolve_list_of_ip_from_file.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e4f93c99-396f-47c8-bb0f-201b1fa69034", "title": "Potential Data Exfiltration Via Audio File", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_audio_exfiltration.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "f5d1def8-1de0-4a0e-9794-1f6f27dd605c", "title": "PowerShell Hotfix Enumeration", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_hotfix_enum.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "78aa1347-1517-4454-9982-b338d6df8343", "title": "Powershell MsXml COM Object", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_msxml_com.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "4368354e-1797-463c-bc39-a309effbe8d7", "title": "Powershell Add Name Resolution Policy Table Rule", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_add_dnsclient_rule.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "b7ec41a4-042c-4f31-a5db-d0fcde9fa5c5", "title": "PowerShell PSAttack", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_psattack.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "5947497f-1aa4-41dd-9693-c9848d58727d", "title": "Suspicious Unblock-File", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_unblock_file.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "d4a11f63-2390-411c-9adf-d791fd152830", "title": "Windows Screen Capture with CopyFromScreen", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_capture_screenshots.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "cae80281-ef23-44c5-873b-fd48d2666f49", "title": "PowerShell Script Change Permission Via Set-Acl - PsScript", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_set_acl.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "c1dda054-d638-4c16-afc8-53e007f3fbc5", "title": "Automated Collection Command PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_automated_collection.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "a861d835-af37-4930-bcd6-5b178bfb54df", "title": "Request A Single Ticket via PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_request_kerberos_ticket.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "851fd622-b675-4d26-b803-14bc7baa517a", "title": "HackTool - WinPwn Execution - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "b29a93fb-087c-4b5b-a84d-ee3309e69d08", "title": "Manipulation of User Computer or Group Security Principals Across AD", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_directoryservices_accountmanagement.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "a0edd39f-a0c6-4c17-8141-261f958e8d8f", "title": "PowerShell Remote Session Creation", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_remote_session_creation.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "da34e323-1e65-42db-83be-a6725ac2caa3", "title": "Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_packet_capture.yml", "status": "experimental", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "6c6c6282-7671-4fe9-a0ce-a2dcebdc342b", "title": "Powershell XML Execute Command", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_xml_iex.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "846c7a87-8e14-4569-9d49-ecfd4276a01c", "title": "DSInternals Suspicious PowerShell Cmdlets - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_dsinternals_cmdlets.yml", "status": "experimental", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "1883444f-084b-419b-ac62-e0d0c5b3693f", "title": "Suspicious Connection to Remote Account", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_networkcredential.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "db885529-903f-4c5d-9864-28fe199e6370", "title": "Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_computer_discovery_get_adcomputer.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "602f5669-6927-4688-84db-0d4b7afb2150", "title": "Disable Powershell Command History", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_disable_psreadline_command_history.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "851c506b-6b7c-4ce2-8802-c703009d03c0", "title": "Winlogon Helper DLL", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_winlogon_helper_dll.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "15b7abbb-8b40-4d01-9ee2-b51994b1d474", "title": "Suspicious PowerShell Mailbox SMTP Forward Rule", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_exchange_mailbox_smpt_forwarding_rule.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "63bf8794-9917-45bc-88dd-e1b5abc0ecfd", "title": "Powershell Install a DLL in System Directory", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_copy_item_system_directory.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "1f49f2ab-26bc-48b3-96cc-dcffbc93eadf", "title": "Potential Suspicious PowerShell Keywords", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_keywords.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "779c8c12-0eb1-11eb-adc1-0242ac120002", "title": "Invoke-Obfuscation STDIN+ Launcher - Powershell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_stdin.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "afd12fed-b0ec-45c9-a13d-aa86625dac81", "title": "Create Volume Shadow Copy with Powershell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_create_volume_shadow_copy.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "488b44e7-3781-4a71-888d-c95abfacf44d", "title": "Windows Firewall Profile Disabled", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_windows_firewall_profile_disabled.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "b26647de-4feb-4283-af6b-6117661283c5", "title": "Powershell Suspicious Win32_PnPEntity", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_win32_pnpentity.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "0f017df3-8f5a-414f-ad6b-24aff1128278", "title": "Suspicious Eventlog Clear", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_clear_eventlog.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "bd5971a7-626d-46ab-8176-ed643f694f68", "title": "Extracting Information with PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_extracting.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "f62176f3-8128-4faa-bf6c-83261322e5eb", "title": "Malicious PowerShell Keywords", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_malicious_keywords.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "f772cee9-b7c2-4cb2-8f07-49870adc02e0", "title": "Malicious Nishang PowerShell Commandlets", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_nishang_malicious_commandlets.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "8c3a6607-b7dc-4f0d-a646-ef38c00b76ee", "title": "Active Directory Group Enumeration With Get-AdGroup", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_get_adgroup.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "af4c87ce-bdda-4215-b998-15220772e993", "title": "Suspicious Process Discovery With Get-Process", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_get_process.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "42821614-9264-4761-acfc-5772c3286f76", "title": "Root Certificate Installed - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_root_certificate_installed.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "2837e152-93c8-43d2-85ba-c3cd3c2ae614", "title": "Powershell Local Email Collection", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_mail_acces.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "c6438007-e081-42ce-9483-b067fbef33c3", "title": "Powershell Timestomp", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_timestomp.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "bd33d2aa-497e-4651-9893-5c5364646595", "title": "Suspicious TCP Tunnel Via PowerShell Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_proxy_scripts.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "1139d2e2-84b1-4226-b445-354492eba8ba", "title": "Usage Of Web Request Commands And Cmdlets - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_web_request_cmd_and_cmdlets.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "4a241dea-235b-4a7e-8d76-50d817b146c4", "title": "Suspicious PowerShell Mailbox Export to Share - PS", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_mailboxexport_share.yml", "status": "test", "level": "critical", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "f3a98ce4-6164-4dd4-867c-4d83de7eca51", "title": "Powershell Token Obfuscation - Powershell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_token_obfuscation.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e54f5149-6ba3-49cf-b153-070d24679126", "title": "Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_var.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "fc028194-969d-4122-8abe-0470d5b8f12f", "title": "Access to Browser Login Data", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_access_to_browser_login_data.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "a699b30e-d010-46c8-bbd1-ee2e26765fe9", "title": "Powershell Store File In Alternate Data Stream", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_store_file_in_alternate_data_stream.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e6cb92b4-b470-4eb8-8a9d-d63e8583aae0", "title": "Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_rundll.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "b5522a23-82da-44e5-9c8b-e10ed8955f88", "title": "Powershell Execute Batch Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_execute_batch_script.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "243de76f-4725-4f2e-8225-a8a69b15ad61", "title": "PowerShell Create Local User", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_create_local_user.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "36bed6b2-e9a0-4fff-beeb-413a92b86138", "title": "Active Directory Computers Enumeration With Get-AdComputer", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_get_adcomputer.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "55c925c1-7195-426b-a136-a9396800e29b", "title": "Potential Suspicious Windows Feature Enabled", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_enable_susp_windows_optional_feature.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "c5ac6a1e-9407-45f5-a0ce-ca9a0806a287", "title": "Replace Desktop Wallpaper by Powershell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_wallpaper.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "ae2bdd58-0681-48ac-be7f-58ab4e593458", "title": "Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_rem_mp.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "c2993223-6da8-4b1a-88ee-668b8bf315e9", "title": "User Discovery And Export Via Get-ADUser Cmdlet - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_user_discovery_get_aduser.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "c1344fa2-323b-4d2e-9176-84b4d4821c88", "title": "Windows Defender Exclusions Added - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_win_defender_exclusions_added.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "03409c93-a7c7-49ba-9a4c-a00badf2a153", "title": "Troubleshooting Pack Cmdlet Execution", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_follina_execution.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "05b3e303-faf0-4f4a-9b30-46cc13e69152", "title": "Potential Persistence Via PowerShell User Profile Using Add-Content", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_user_profile_tampering.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "84c174ab-d3ef-481f-9c86-a50d0b8e3edb", "title": "PowerShell Get-Process LSASS in ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_getprocess_lsass.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "afd3df04-948d-46f6-ae44-25966c44b97f", "title": "PSAsyncShell - Asynchronous TCP Reverse Shell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_psasyncshell.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "1f6399cf-2c80-4924-ace1-6fcff3393480", "title": "DirectorySearcher Powershell Exploitation", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_directorysearcher.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "26b692dc-1722-49b2-b496-a8258aa6371d", "title": "Clear PowerShell History - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_clear_powershell_history.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "df69cb1d-b891-4cd9-90c7-d617d90100ce", "title": "Suspicious FromBase64String Usage On Gzip Archive - Ps Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_frombase64string_archive.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "b7a3c9a3-09ea-4934-8864-6a32cacd98d9", "title": "Zip A Folder With PowerShell For Staging In Temp - PowerShell Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_zip_compress.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "03d83090-8cba-44a0-b02f-0b756a050306", "title": "Potential WinAPI Calls Via PowerShell Scripts", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "16b37b70-6fcf-4814-a092-c36bd3aafcbd", "title": "PowerShell ShellCode", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_shellcode_b64.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "23590215-4702-4a70-8805-8dc9e58314a2", "title": "Registry-Free Process Scope COR_PROFILER", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_cor_profiler.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "402e1e1d-ad59-47b6-bf80-1ee44985b3a7", "title": "Malicious ShellIntel PowerShell Commandlets", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_shellintel_malicious_commandlets.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "3245cd30-e015-40ff-a31d-5cadd5f377ec", "title": "HackTool - Rubeus Execution - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_hktl_rubeus.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "91109523-17f0-4248-a800-f81d9e7c081d", "title": "PowerShell WMI Win32_Product Install MSI", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_win32_product_install_msi.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "189e3b02-82b2-4b90-9662-411eb64486d4", "title": "Potential Invoke-Mimikatz PowerShell Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_potential_invoke_mimikatz.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e2812b49-bae0-4b21-b366-7c142eafcde2", "title": "Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_win32_nteventlogfile_usage.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "115fdba9-f017-42e6-84cf-d5573bf2ddf8", "title": "Disable of ETW Trace - Powershell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_etw_trace_evasion.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "8028c2c3-e25a-46e3-827f-bbb5abf181d7", "title": "WMImplant Hack Tool", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_wmimplant.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "22d80745-6f2c-46da-826b-77adaededd74", "title": "Suspicious Service DACL Modification Via Set-Service Cmdlet - PS", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_service_dacl_modification_set_service.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e17121b4-ef2a-4418-8a59-12fb1631fa9e", "title": "Delete Volume Shadow Copies via WMI with PowerShell - PS Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_win32_shadowcopy.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "904e8e61-8edf-4350-b59c-b905fc8e810c", "title": "Security Software Discovery Via Powershell Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_get_process_security_software_discovery.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "91e69562-2426-42ce-a647-711b8152ced6", "title": "AADInternals PowerShell Cmdlets Execution - PsScript", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_aadinternals_cmdlets_execution.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "99c4658d-2c5e-4d87-828d-7c066ca537c3", "title": "Disable-WindowsOptionalFeature Command PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_disable_windows_optional_feature.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "95f0643a-ed40-467c-806b-aac9542ec5ab", "title": "Suspicious Get Information for SMB Share", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_smb_share_reco.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "14c71865-6cd3-44ae-adaa-1db923fae5f2", "title": "Tamper Windows Defender - ScriptBlockLogging", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_set_mp.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "b7216a7d-687e-4c8d-82b1-3080b2ad961f", "title": "Modify Group Policy Settings - ScriptBlockLogging", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_modify_group_policy_settings.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "42d36aa1-3240-4db0-8257-e0118dcdd9cd", "title": "Suspicious Hyper-V Cmdlets", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_hyper_v_condlet.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e8314f79-564d-4f79-bc13-fbc0bf2660d8", "title": "Potential PowerShell Obfuscation Using Character Join", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_alias_obfscuation.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "dddfebae-c46f-439c-af7a-fdb6bde90218", "title": "SyncAppvPublishingServer Execution to Bypass Powershell Restriction", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_syncappvpublishingserver_exe.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "0adfbc14-0ed1-11eb-adc1-0242ac120002", "title": "Invoke-Obfuscation VAR+ Launcher - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_var.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "060c3ef1-fd0a-4091-bf46-e7d625f60b73", "title": "Suspicious Get-ADReplAccount", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_get_adreplaccount.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "70ad982f-67c8-40e0-a955-b920c2fa05cb", "title": "Suspicious IO.FileStream", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_iofilestream.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "86b896ba-ffa1-4fea-83e3-ee28a4c915c7", "title": "Invoke-Obfuscation Via Stdin - Powershell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_stdin.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "96cd126d-f970-49c4-848a-da3a09f55c55", "title": "Potential PowerShell Obfuscation Using Alias Cmdlets", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_set_alias.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e0565f5d-d420-4e02-8a68-ac00d864f9cf", "title": "Automated Collection Bookmarks Using Get-ChildItem PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_get_childitem_bookmarks.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "cd185561-4760-45d6-a63e-a51325112cae", "title": "Live Memory Dump Using Powershell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_memorydump_getstoragediagnosticinfo.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "bf72941a-cba0-41ea-b18c-9aca3925690d", "title": "PowerShell ADRecon Execution", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_adrecon_execution.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "953945c5-22fe-4a92-9f8a-a9edc1e522da", "title": "Abuse of Service Permissions to Hide Services Via Set-Service - PS", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_using_set_service_to_hide_services.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "3bf1d859-3a7e-44cb-8809-a99e066d3478", "title": "PowerShell Set-Acl On Windows Folder - PsScript", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_set_acl_susp_location.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "29e1c216-6408-489d-8a06-ee9d151ef819", "title": "Suspicious Mount-DiskImage", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_mount_diskimage.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "48a45d45-8112-416b-8a67-46e03a4b2107", "title": "Remove Account From Domain Admin Group", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_remove_adgroupmember.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "ae7fbf8e-f3cb-49fd-8db4-5f3bed522c71", "title": "Suspicious PowerShell Invocations - Specific", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_invocation_specific.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "975b2262-9a49-439d-92a6-0709cccdf0b2", "title": "Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_install_unsigned_appx_packages.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "21f9162c-5f5d-4b01-89a8-b705bd7d10ab", "title": "Import PowerShell Modules From Suspicious Directories", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_import_module_susp_dirs.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "35f41cd7-c98e-469f-8a02-ec4ba0cc7a7e", "title": "PowerShell Write-EventLog Usage", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_write_eventlog.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "1b9dc62e-6e9e-42a3-8990-94d7a10007f7", "title": "Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_obfuscated_iex.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "eb2fd349-ec67-4caa-9143-d79c7fb34441", "title": "Suspicious GPO Discovery With Get-GPO", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_get_gpo.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "4c4af3cd-2115-479c-8193-6b8bfce9001c", "title": "PowerShell ICMP Exfiltration", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_icmp_exfiltration.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "9e620995-f2d8-4630-8430-4afd89f77604", "title": "Potential Active Directory Enumeration Using AD Module - PsScript", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_active_directory_module_dll_import.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "aa7a3fce-bef5-4311-9cc1-5f04bb8c308c", "title": "Certificate Exported Via PowerShell - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_export_certificate.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "d2e3f2f6-7e09-4bf2-bc5d-90186809e7fb", "title": "PowerShell Script With File Upload Capabilities", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_script_with_upload_capabilities.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "155c7fd5-47b4-49b2-bbeb-eb4fab335429", "title": "Add Windows Capability Via PowerShell Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_add_windows_capability.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e55a5195-4724-480e-a77e-3ebe64bd3759", "title": "Invoke-Obfuscation Via Use MSHTA - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_mhsta.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "403c2cc0-7f6b-4925-9423-bfa573bed7eb", "title": "Suspicious PowerShell Download - Powershell Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_download.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "cacef8fc-9d3d-41f7-956d-455c6e881bc5", "title": "Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_remotefxvgpudisablement_abuse.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "ed965133-513f-41d9-a441-e38076a0798f", "title": "Suspicious PowerShell Invocations - Generic", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_invocation_generic.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "2f77047c-e6e9-4c11-b088-a3de399524cd", "title": "Potential Persistence Via Security Descriptors - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_ace_tampering.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "2650dd1a-eb2a-412d-ac36-83f06c4f2282", "title": "Detected Windows Software Discovery - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_software_discovery.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "603c6630-5225-49c1-8047-26c964553e0e", "title": "Enumerate Credentials from Windows Credential Manager With PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_enumerate_password_windows_credential_manager.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "34f90d3c-c297-49e9-b26d-911b05a4866c", "title": "Powershell Keylogging", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_keylogging.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "20e5497e-331c-4cd5-8d36-935f6e2a9a07", "title": "Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_compress.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "d59d7842-9a21-4bc6-ba98-64bfe0091355", "title": "Powershell DNSExfiltration", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_dnsexfiltration.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "bbb9495b-58fc-4016-b9df-9a3a1b67ca82", "title": "Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_get_addefaultdomainpasswordpolicy.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "5f9c7f1a-7c21-4c39-b2f3-8d8006e0e51f", "title": "PowerShell Web Access Installation - PsScript", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_powershell_web_access_installation.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "db92dd33-a3ad-49cf-8c2c-608c3e30ace0", "title": "Invoke-Obfuscation Via Use Clip - Powershell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_clip.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "96c982fe-3d08-4df4-bed2-eb14e02f21c8", "title": "Get-ADUser Enumeration Using UserAccountControl Flags", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_as_rep_roasting.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "dcd74b95-3f36-4ed9-9598-0490951643aa", "title": "PowerView PowerShell Cmdlets - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_powerview_malicious_commandlets.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "fa6a5a45-3ee2-4529-aa14-ee5edc9e29cb", "title": "Suspicious Get Local Groups Information - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_local_group_reco.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "313fbb0a-a341-4682-848d-6d6f8c4fab7c", "title": "Suspicious PowerShell WindowStyle Option", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_windowstyle.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "66a4d409-451b-4151-94f4-a55d559c49b0", "title": "PowerShell Deleted Mounted Share", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_mounted_share_deletion.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "d93129cd-1ee0-479f-bc03-ca6f129882e3", "title": "Powershell Detect Virtualization Environment", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_detect_vm_env.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "991a9744-f2f0-44f2-bd33-9092eba17dc3", "title": "Enable Windows Remote Management", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_enable_psremoting.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "4096a49c-7de4-4da0-a230-c66ccd56ea5a", "title": "Suspicious PowerShell Get Current User", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_get_current_user.yml", "status": "test", "level": "low", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "fa2559c8-1197-471d-9cdd-05a0273d4522", "title": "Potential AMSI Bypass Script Using NULL Bits", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_amsi_null_bits_bypass.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "7d416556-6502-45b2-9bad-9d2f05f38997", "title": "Powershell Sensitive File Discovery", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_sensitive_file_discovery.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "09658312-bc27-4a3b-91c5-e49ab9046d1b", "title": "WMIC Unquoted Services Path Lookup - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_wmi_unquoted_service_search.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "a9723fcc-881c-424c-8709-fd61442ab3c3", "title": "Recon Information for Export with PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_recon_export.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "0718cd72-f316-4aa2-988f-838ea8533277", "title": "Suspicious Start-Process PassThru", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_start_process.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "e0d6c087-2d1c-47fd-8799-3904103c5a98", "title": "AMSI Bypass Pattern Assembly GetType", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_amsi_bypass_pattern_nov22.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "61d0475c-173f-4844-86f7-f3eebae1c66b", "title": "Change PowerShell Policies to an Insecure Level - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_set_policies_to_unsecure_level.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "36fbec91-fa1b-4d5d-8df1-8d8edcb632ad", "title": "Code Executed Via Office Add-in XLL File", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_office_comobject_registerxll.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "9e07f6e7-83aa-45c6-998e-0af26efd0a85", "title": "Powershell WMI Persistence", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_wmi_persistence.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "d4488827-73af-4f8d-9244-7b7662ef046e", "title": "Change User Agents with WebRequest", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_invoke_webrequest_useragent.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "976d6e6f-a04b-4900-9713-0134a353e38b", "title": "Veeam Backup Servers Credential Dumping Script Execution", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_veeam_credential_dumping_script.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "89819aa4-bbd6-46bc-88ec-c7f7fe30efa6", "title": "Malicious PowerShell Commandlets - ScriptBlock", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "a5a30a6e-75ca-4233-8b8c-42e0f2037d3b", "title": "Invoke-Obfuscation Via Use Rundll32 - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_rundll32.yml", "status": "test", "level": "high", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "902cedee-0398-4e3a-8183-6f3a89773a96", "title": "Suspicious Invoke-Item From Mount-DiskImage", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_run_from_mount_diskimage.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "965e2db9-eddb-4cf6-a986-7a967df651e4", "title": "Potential Keylogger Activity", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_keylogger_activity.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "162e69a7-7981-4344-84a9-0f1c9a217a52", "title": "Powershell Directory Enumeration", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_directory_enum.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "adf876b3-f1f8-4aa9-a4e4-a64106feec06", "title": "Testing Usage of Uncommonly Used Port", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_test_netconnection.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "504d63cb-0dba-4d02-8531-e72981aace2c", "title": "Suspicious X509Enrollment - Ps Script", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_x509enrollment.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "363eccc0-279a-4ccf-a3ab-24c2e63b11fb", "title": "Powershell Create Scheduled Task", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_cmdlet_scheduled_task.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "8bc063d5-3a3a-4f01-a140-bc15e55e8437", "title": "Suspicious GetTypeFromCLSID ShellExecute", "file": "../sigma/rules/windows/powershell/powershell_script/posh_ps_susp_gettypefromclsid.yml", "status": "test", "level": "medium", "logsource.category": "ps_script", "logsource.product": "windows"}, {"id": "9ac8b09b-45de-4a07-9da1-0de8c09304a3", "title": "Invoke-Obfuscation STDIN+ Launcher - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_stdin.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "815bfc17-7fc6-4908-a55e-2f37b98cedb4", "title": "AD Groups Or Users Enumeration Using PowerShell - PoshModule", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_ad_group_reco.yml", "status": "test", "level": "low", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "4cbd4f12-2e22-43e3-882f-bff3247ffb78", "title": "PowerShell Get Clipboard", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_get_clipboard.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "2f211361-7dce-442d-b78a-c04039677378", "title": "Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_obfuscated_iex.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "aff815cc-e400-4bf0-a47a-5d8a2407d4e1", "title": "Use Get-NetTCPConnection - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_get_nettcpconnection.yml", "status": "test", "level": "low", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "de41232e-12e8-49fa-86bc-c05c7e722df9", "title": "Suspicious PowerShell Download - PoshModule", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_download.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c", "title": "Malicious PowerShell Commandlets - PoshModule", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_malicious_commandlets.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "daf7eb81-35fd-410d-9d7a-657837e602bb", "title": "Zip A Folder With PowerShell For Staging In Temp - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_zip_compress.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "9fe55ea2-4cd6-4491-8a54-dd6871651b51", "title": "HackTool - Evil-WinRm Execution - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_hktl_evil_winrm_execution.yml", "status": "experimental", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "64e8e417-c19a-475a-8d19-98ea705394cc", "title": "Alternate PowerShell Hosts - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_alternate_powershell_hosts.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "cef24b90-dddc-4ae1-a09a-8764872f69fc", "title": "Suspicious Get Local Groups Information", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_local_group_reco.yml", "status": "test", "level": "low", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "1ddc1472-8e52-4f7d-9f11-eab14fc171f5", "title": "PowerShell Decompress Commands", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_decompress_commands.yml", "status": "test", "level": "informational", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "b140afd9-474b-4072-958e-2ebb435abd68", "title": "Suspicious Get-ADDBAccount Usage", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_get_addbaccount.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "6bfb8fa7-b2e7-4f6c-8d9d-824e5d06ea9e", "title": "Invoke-Obfuscation VAR+ Launcher - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_var.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "41025fd7-0466-4650-a813-574aaacbe7f4", "title": "Malicious PowerShell Scripts - PoshModule", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_exploit_scripts.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "c72aca44-8d52-45ad-8f81-f96c4d3c755e", "title": "Invoke-Obfuscation Via Stdin - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_stdin.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "6942bd25-5970-40ab-af49-944247103358", "title": "Suspicious Get Information for SMB Share - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_smb_share_reco.yml", "status": "test", "level": "low", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "07ad2ea8-6a55-4ac6-bf3e-91b8e59676eb", "title": "Invoke-Obfuscation Via Use MSHTA - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_mhsta.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "f99276ad-d122-4989-a09a-d00904a5f9d2", "title": "Clear PowerShell History - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_clear_powershell_history.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "fe5ce7eb-dad8-467c-84a9-31ec23bd644a", "title": "SyncAppvPublishingServer Bypass Powershell Restriction - PS Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_syncappvpublishingserver_exe.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "38a7625e-b2cb-485d-b83d-aff137d859f4", "title": "Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_remotefxvgpudisablement_abuse.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "8ff28fdd-e2fa-4dfa-aeda-ef3d61c62090", "title": "Suspicious PowerShell Invocations - Specific - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_invocation_specific.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "e3818659-5016-4811-a73c-dde4679169d2", "title": "Suspicious Computer Machine Password by PowerShell", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_reset_computermachinepassword.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "88a22f69-62f9-4b8a-aa00-6b0212f2f05a", "title": "Invoke-Obfuscation Via Use Rundll32 - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_rundll32.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "8d31a8ce-46b5-4dd6-bdc3-680931f1db86", "title": "Bad Opsec Powershell Code Artifacts", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_bad_opsec_artifacts.yml", "status": "test", "level": "critical", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "ebdf49d8-b89c-46c9-8fdf-2c308406f6bd", "title": "Invoke-Obfuscation Via Use Clip - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_clip.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "f3c89218-8c3d-4ba9-9974-f1d8e6a1b4a6", "title": "Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_var.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "96b9f619-aa91-478f-bacb-c3e50f8df575", "title": "Remote PowerShell Session (PS Module)", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_remote_powershell_session.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "a136cde0-61ad-4a61-9b82-8dc490e60dd2", "title": "Invoke-Obfuscation CLIP+ Launcher - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_clip.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "74176142-4684-4d8a-8b0a-713257e7df8e", "title": "Potential Active Directory Enumeration Using AD Module - PsModule", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_active_directory_module_dll_import.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "bbb80e91-5746-4fbe-8898-122e2cafdbf4", "title": "Suspicious PowerShell Invocations - Generic - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_susp_invocation_generic.yml", "status": "test", "level": "high", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "7034cbbb-cc55-4dc2-8dad-36c0b942e8f1", "title": "Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_compress.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "a23791fe-8846-485a-b16b-ca691e1b03d4", "title": "Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module", "file": "../sigma/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_rundll.yml", "status": "test", "level": "medium", "logsource.category": "ps_module", "logsource.product": "windows"}, {"id": "c5b20776-639a-49bf-94c7-84f912b91c15", "title": "Netcat The Powershell Version", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_powercat.yml", "status": "test", "level": "medium", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "3236fcd0-b7e3-4433-b4f8-86ad61a9af2d", "title": "Suspicious PowerShell Download", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_susp_download.yml", "status": "test", "level": "medium", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "f65e22f9-819e-4f96-9c7b-498364ae7a25", "title": "Potential RemoteFXvGPUDisablement.EXE Abuse", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_remotefxvgpudisablement_abuse.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "71ff406e-b633-4989-96ec-bc49d825a412", "title": "Zip A Folder With PowerShell For Staging In Temp - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_susp_zip_compress.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "812837bb-b17f-45e9-8bd0-0ec35d2e3bd6", "title": "Suspicious XOR Encoded PowerShell Command Line - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_xor_commandline.yml", "status": "test", "level": "medium", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "ec19ebab-72dc-40e1-9728-4c0b805d722c", "title": "Tamper Windows Defender - PSClassic", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_tamper_windows_defender_set_mp.yml", "status": "test", "level": "high", "logsource.category": "ps_classic_provider_start", "logsource.product": "windows"}, {"id": "30a8cb77-8eb3-4cfb-8e79-ad457c5a4592", "title": "Renamed Powershell Under Powershell Channel", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_renamed_powershell.yml", "status": "test", "level": "low", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "df9a0e0e-fedb-4d6c-8668-d765dfc92aa7", "title": "Suspicious Non PowerShell WSMAN COM Provider", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "999bff6d-dc15-44c9-9f5c-e1051bfc86e1", "title": "Nslookup PowerShell Download Cradle", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_abuse_nslookup_with_dns_records.yml", "status": "test", "level": "medium", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "c70e019b-1479-4b65-b0cc-cd0c6093a599", "title": "PowerShell Called from an Executable Version Mismatch", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_exe_calling_ps.yml", "status": "test", "level": "high", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "60167e5c-84b2-4c95-a7ac-86281f27c445", "title": "Remote PowerShell Session (PS Classic)", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_remote_powershell_session.yml", "status": "test", "level": "low", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "b366adb4-d63d-422d-8a2c-186463b5ded0", "title": "Use Get-NetTCPConnection", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_susp_get_nettcpconnection.yml", "status": "test", "level": "low", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "6331d09b-4785-4c13-980f-f96661356249", "title": "PowerShell Downgrade Attack - PowerShell", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_downgrade_attack.yml", "status": "test", "level": "medium", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "87df9ee1-5416-453a-8a08-e8d4a51e9ce1", "title": "Delete Volume Shadow Copies Via WMI With PowerShell", "file": "../sigma/rules/windows/powershell/powershell_classic/posh_pc_delete_volume_shadow_copies.yml", "status": "stable", "level": "high", "logsource.category": "ps_classic_start", "logsource.product": "windows"}, {"id": "a1d9eec5-33b2-4177-8d24-27fe754d0812", "title": "Cloudflared Tunnels Related DNS Requests", "file": "../sigma/rules/windows/dns_query/dns_query_win_cloudflared_communication.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "613c03ba-0779-4a53-8a1f-47f914a4ded3", "title": "DNS Query To MEGA Hosting Website", "file": "../sigma/rules/windows/dns_query/dns_query_win_mega_nz.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "f356a9c4-effd-4608-bbf8-408afd5cd006", "title": "Suspicious Cobalt Strike DNS Beaconing - Sysmon", "file": "../sigma/rules/windows/dns_query/dns_query_win_mal_cobaltstrike.yml", "status": "test", "level": "critical", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "a21bcd7e-38ec-49ad-b69a-9ea17e69509e", "title": "DNS Server Discovery Via LDAP Query", "file": "../sigma/rules/windows/dns_query/dns_query_win_dns_server_discovery_via_ldap_query.yml", "status": "test", "level": "low", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "df68f791-ad95-447f-a271-640a0dab9cf8", "title": "DNS Query Request To OneLaunch Update Service", "file": "../sigma/rules/windows/dns_query/dns_query_win_onelaunch_update_service.yml", "status": "experimental", "level": "low", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "e043f529-8514-4205-8ab0-7f7d2927b400", "title": "DNS Query To AzureWebsites.NET By Non-Browser Process", "file": "../sigma/rules/windows/dns_query/dns_query_win_domain_azurewebsites.yml", "status": "experimental", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "title": "DNS HybridConnectionManager Service Bus", "file": "../sigma/rules/windows/dns_query/dns_query_win_hybridconnectionmgr_servicebus.yml", "status": "test", "level": "high", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "065cceea-77ec-4030-9052-fc0affea7110", "title": "DNS Query for Anonfiles.com Domain - Sysmon", "file": "../sigma/rules/windows/dns_query/dns_query_win_anonymfiles_com.yml", "status": "test", "level": "high", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "title": "TeamViewer Domain Query By Non-TeamViewer Application", "file": "../sigma/rules/windows/dns_query/dns_query_win_teamviewer_domain_query_by_uncommon_app.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "title": "Suspicious DNS Query for IP Lookup Service APIs", "file": "../sigma/rules/windows/dns_query/dns_query_win_susp_external_ip_lookup.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "title": "DNS Query To Visual Studio Code Tunnels Domain", "file": "../sigma/rules/windows/dns_query/dns_query_win_vscode_tunnel_communication.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "36e037c4-c228-4866-b6a3-48eb292b9955", "title": "DNS Query Request By Regsvr32.EXE", "file": "../sigma/rules/windows/dns_query/dns_query_win_regsvr32_dns_query.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "title": "AppX Package Installation Attempts Via AppInstaller.EXE", "file": "../sigma/rules/windows/dns_query/dns_query_win_appinstaller.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "title": "DNS Query To Devtunnels Domain", "file": "../sigma/rules/windows/dns_query/dns_query_win_devtunnels_communication.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "title": "DNS Query Tor .Onion Address - Sysmon", "file": "../sigma/rules/windows/dns_query/dns_query_win_tor_onion_domain_query.yml", "status": "test", "level": "high", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "title": "DNS Query To Remote Access Software Domain From Non-Browser App", "file": "../sigma/rules/windows/dns_query/dns_query_win_remote_access_software_domains_non_browsers.yml", "status": "test", "level": "medium", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "title": "DNS Query To Ufile.io", "file": "../sigma/rules/windows/dns_query/dns_query_win_ufile_io_query.yml", "status": "test", "level": "low", "logsource.category": "dns_query", "logsource.product": "windows"}, {"id": "693a44e9-7f26-4cb6-b787-214867672d3a", "title": "Sysmon File Executable Creation Detected", "file": "../sigma/rules/windows/sysmon/sysmon_file_executable_detected.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "1f2b5353-573f-4880-8e33-7d04dcf97744", "title": "Sysmon Configuration Modification", "file": "../sigma/rules/windows/sysmon/sysmon_config_modification_status.yml", "status": "test", "level": "high", "logsource.category": "sysmon_status", "logsource.product": "windows"}, {"id": "8ac03a65-6c84-4116-acad-dc1558ff7a77", "title": "Sysmon Configuration Change", "file": "../sigma/rules/windows/sysmon/sysmon_config_modification.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "23b71bc5-953e-4971-be4c-c896cda73fc2", "title": "Sysmon Blocked Executable", "file": "../sigma/rules/windows/sysmon/sysmon_file_block_executable.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "815cd91b-7dbc-4247-841a-d7dd1392b0a8", "title": "Sysmon Configuration Error", "file": "../sigma/rules/windows/sysmon/sysmon_config_modification_error.yml", "status": "test", "level": "high", "logsource.category": "sysmon_error", "logsource.product": "windows"}, {"id": "c3e5c1b1-45e9-4632-b242-27939c170239", "title": "Sysmon Blocked File Shredding", "file": "../sigma/rules/windows/sysmon/sysmon_file_block_shredding.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "558eebe5-f2ba-4104-b339-36f7902bcc1a", "title": "File Creation Date Changed to Another Year", "file": "../sigma/rules/windows/file/file_change/file_change_win_2022_timestomping.yml", "status": "test", "level": "high", "logsource.category": "file_change", "logsource.product": "windows"}, {"id": "9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3", "title": "Unusual File Modification by dns.exe", "file": "../sigma/rules/windows/file/file_change/file_change_win_unusual_modification_by_dns_exe.yml", "status": "test", "level": "high", "logsource.category": "file_change", "logsource.product": "windows"}, {"id": "e3f673b3-65d1-4d80-9146-466f8b63fa99", "title": "Suspicious Appended Extension", "file": "../sigma/rules/windows/file/file_rename/file_rename_win_ransomware.yml", "status": "test", "level": "medium", "logsource.category": "file_rename", "logsource.product": "windows"}, {"id": "ab90dab8-c7da-4010-9193-563528cfa347", "title": "Potentially Suspicious Self Extraction Directive File Created", "file": "../sigma/rules/windows/file/file_executable_detected/file_executable_detected_win_susp_embeded_sed_file.yml", "status": "experimental", "level": "medium", "logsource.category": "file_executable_detected", "logsource.product": "windows"}, {"id": "270185ff-5f50-4d6d-a27f-24c3b8c9fef8", "title": "Tomcat WebServer Logs Deleted", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_tomcat_logs.yml", "status": "test", "level": "medium", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "5b2bbc47-dead-4ef7-8908-0cf73fcbecbf", "title": "Potential PrintNightmare Exploitation Attempt", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_cve_2021_1675_print_nightmare.yml", "status": "test", "level": "high", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0", "title": "Unusual File Deletion by Dns.exe", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_unusual_deletion_by_dns_exe.yml", "status": "test", "level": "high", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "06125661-3814-4e03-bfa2-1e4411c60ac3", "title": "Backup Files Deleted", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_backup_file.yml", "status": "test", "level": "medium", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "0a1f9d29-6465-4776-b091-7f43b26e4c89", "title": "Prefetch File Deleted", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_prefetch.yml", "status": "test", "level": "high", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "b1decb61-ed83-4339-8e95-53ea51901720", "title": "TeamViewer Log File Deleted", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_teamviewer_logs.yml", "status": "test", "level": "low", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "a55349d8-9588-4c5a-8e3b-1925fe2a4ffe", "title": "Exchange PowerShell Cmdlet History Deleted", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_exchange_powershell_logs.yml", "status": "test", "level": "high", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "63c779ba-f638-40a0-a593-ddd45e8b1ddc", "title": "EventLog EVTX File Deleted", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_event_log_files.yml", "status": "test", "level": "medium", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "ff301988-c231-4bd0-834c-ac9d73b86586", "title": "PowerShell Console History Logs Deleted", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_powershell_command_history.yml", "status": "test", "level": "medium", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "f01d1f70-cd41-42ec-9c0b-26dd9c22bf29", "title": "Process Deletion of Its Own Executable", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_own_image.yml", "status": "experimental", "level": "medium", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "3eb8c339-a765-48cc-a150-4364c04652bf", "title": "IIS WebServer Access Logs Deleted", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_delete_iis_access_logs.yml", "status": "test", "level": "medium", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "3109530e-ab47-4cc6-a953-cac5ebcc93ae", "title": "ADS Zone.Identifier Deleted By Uncommon Application", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_zone_identifier_ads_uncommon.yml", "status": "experimental", "level": "medium", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "6ddab845-b1b8-49c2-bbf7-1a11967f64bc", "title": "File Deleted Via Sysinternals SDelete", "file": "../sigma/rules/windows/file/file_delete/file_delete_win_sysinternals_sdelete_file_deletion.yml", "status": "test", "level": "medium", "logsource.category": "file_delete", "logsource.product": "windows"}, {"id": "407aecb1-e762-4acf-8c7b-d087bcff3bb6", "title": "Credential Manager Access By Uncommon Applications", "file": "../sigma/rules/windows/file/file_access/file_access_win_susp_credential_manager_access.yml", "status": "experimental", "level": "medium", "logsource.category": "file_access", "logsource.product": "windows"}, {"id": "7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2", "title": "Access To Windows Credential History File By Uncommon Applications", "file": "../sigma/rules/windows/file/file_access/file_access_win_susp_credhist.yml", "status": "experimental", "level": "medium", "logsource.category": "file_access", "logsource.product": "windows"}, {"id": "65744385-8541-44a6-8630-ffc824d7d4cc", "title": "Microsoft Teams Sensitive File Access By Uncommon Applications", "file": "../sigma/rules/windows/file/file_access/file_access_win_teams_sensitive_files.yml", "status": "experimental", "level": "medium", "logsource.category": "file_access", "logsource.product": "windows"}, {"id": "d51694fe-484a-46ac-92d6-969e76d60d10", "title": "Access To Potentially Sensitive Sysvol Files By Uncommon Applications", "file": "../sigma/rules/windows/file/file_access/file_access_win_susp_gpo_files.yml", "status": "experimental", "level": "medium", "logsource.category": "file_access", "logsource.product": "windows"}, {"id": "46612ae6-86be-4802-bc07-39b59feb1309", "title": "Access To Windows DPAPI Master Keys By Uncommon Applications", "file": "../sigma/rules/windows/file/file_access/file_access_win_susp_dpapi_master_key_access.yml", "status": "experimental", "level": "medium", "logsource.category": "file_access", "logsource.product": "windows"}, {"id": "f41b0311-44f9-44f0-816d-dd45e39d4bc8", "title": "Access To Crypto Currency Wallets By Uncommon Applications", "file": "../sigma/rules/windows/file/file_access/file_access_win_susp_crypto_currency_wallets.yml", "status": "experimental", "level": "medium", "logsource.category": "file_access", "logsource.product": "windows"}, {"id": "a5a2d357-1ab8-4675-a967-ef9990a59391", "title": "LSASS Process Memory Dump Files", "file": "../sigma/rules/windows/file/file_event/file_event_win_lsass_default_dump_file_names.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "02773bed-83bf-469f-b7ff-e676e7d78bab", "title": "BloodHound Collection Files", "file": "../sigma/rules/windows/file/file_event/file_event_win_bloodhound_collection.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "d353dac0-1b41-46c2-820c-d7d2561fc6ed", "title": "AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_winrm_awl_bypass.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "caf02a0a-1e1c-4552-9b48-5e070bd88d11", "title": "Suspicious Creation TXT File in User Desktop", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_desktop_txt.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "68578b43-65df-4f81-9a9b-92f32711a951", "title": "UAC Bypass Using Windows Media Player - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_wmp.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "13c02350-4177-4e45-ac17-cf7ca628ff5e", "title": "Files With System DLL Name In Unsuspected Locations", "file": "../sigma/rules/windows/file/file_event/file_event_win_creation_system_dll_files.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "b8fd0e93-ff58-4cbd-8f48-1c114e342e62", "title": "Windows Binaries Write Suspicious Extensions", "file": "../sigma/rules/windows/file/file_event/file_event_win_shell_write_susp_files_extensions.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "39f1f9f2-9636-45de-98f6-a4046aa8e4b9", "title": "Potential Webshell Creation On Static Website", "file": "../sigma/rules/windows/file/file_event/file_event_win_webshell_creation_detect.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "28a452f3-786c-4fd8-b8f2-bddbe9d616d1", "title": "Creation of an WerFault.exe in Unusual Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_werfault_dll_hijacking.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "74babdd6-a758-4549-9632-26535279e654", "title": "Suspicious Executable File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_executable_creation.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "fec96f39-988b-4586-b746-b93d59fd1922", "title": "ScreenConnect Temporary Installation Artefact", "file": "../sigma/rules/windows/file/file_event/file_event_win_remote_access_tools_screenconnect_artefact.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "847def9e-924d-4e90-b7c4-5f581395a2b4", "title": "HackTool - QuarksPwDump Dump File", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_quarkspw_filedump.yml", "status": "test", "level": "critical", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "ce7066a6-508a-42d3-995b-2952c65dc2ce", "title": "Drop Binaries Into Spool Drivers Color Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_spool_drivers_color_drop.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6", "title": "Potential Homoglyph Attack Using Lookalike Characters in Filename", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_homoglyph_filename.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "54127bd4-f541-4ac3-afdb-ea073f63f692", "title": "Potential Persistence Via Notepad++ Plugins", "file": "../sigma/rules/windows/file/file_event/file_event_win_notepad_plus_plus_persistence.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "002bdb95-0cf1-46a6-9e08-d38c128a6127", "title": "WScript or CScript Dropper - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_cscript_wscript_dropper.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "c7a74c80-ba5a-486e-9974-ab9e682bc5e4", "title": "File With Uncommon Extension Created By An Office Application", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_susp_file_extension.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "34746e8c-5fb8-415a-b135-0abc167e912a", "title": "WinSxS Executable File Creation By Non-System Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_winsxs_binary_creation.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "ee63c85c-6d51-4d12-ad09-04e25877a947", "title": "New Custom Shim Database Created", "file": "../sigma/rules/windows/file/file_event/file_event_win_creation_new_shim_database.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca", "title": "Suspicious File Creation Activity From Fake Recycle.Bin Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "1277f594-a7d1-4f28-a2d3-73af5cbeab43", "title": "Windows Shell/Scripting Application File Write to Suspicious Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_shell_write_susp_directory.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "63e4f530-65dc-49cc-8f80-ccfa95c69d43", "title": "UAC Bypass Using EventVwr", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_eventvwr.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c", "title": "Potential Initial Access via DLL Search Order Hijacking", "file": "../sigma/rules/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "2f7979ae-f82b-45af-ac1d-2b10e93b0baa", "title": "Potential DCOM InternetExplorer.Application DLL Hijack", "file": "../sigma/rules/windows/file/file_event/file_event_win_dcom_iertutil_dll_hijack.yml", "status": "test", "level": "critical", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "059c5af9-5131-4d8d-92b2-de4ad6146712", "title": "LiveKD Driver Creation By Uncommon Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_sysinternals_livekd_driver_susp_creation.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "7fd164ba-126a-4d9c-9392-0d4f7c243df0", "title": "OneNote Attachment File Dropped In Suspicious Location", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_onenote_files_in_susp_locations.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "15904280-565c-4b73-9303-3291f964e7f9", "title": "Potential Persistence Attempt Via ErrorHandler.Cmd", "file": "../sigma/rules/windows/file/file_event/file_event_win_errorhandler_persistence.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "6902955a-01b7-432c-b32a-6f5f81d8f625", "title": "LSASS Process Dump Artefact In CrashDumps Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_lsass_shtinkering.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "3ab79e90-9fab-4cdf-a7b2-6522bc742adb", "title": "HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_krbrelay_remote_ioc.yml", "status": "experimental", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "654fcc6d-840d-4844-9b07-2c3300e54a26", "title": "Legitimate Application Dropped Archive", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_archive.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "df6ecb8b-7822-4f4b-b412-08f524b4576c", "title": "Creation Of Non-Existent System DLL", "file": "../sigma/rules/windows/file/file_event/file_event_win_create_non_existent_dlls.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "cad1fe90-2406-44dc-bd03-59d0b58fe722", "title": "HackTool - NPPSpy Hacktool Usage", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_nppspy.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "1027d292-dd87-4a1a-8701-2abe04d7783c", "title": "PSScriptPolicyTest Creation By Uncommon Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_ps_script_policy_test_creation_by_uncommon_process.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "41bb431f-56d8-4691-bb56-ed34e390906f", "title": "UAC Bypass Using MSConfig Token Modification - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_msconfig_gui.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "de46c52b-0bf8-4936-a327-aace94f94ac6", "title": "Process Explorer Driver Creation By Non-Sysinternals Binary", "file": "../sigma/rules/windows/file/file_event/file_event_win_sysinternals_procexp_driver_susp_creation.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "576426ad-0131-4001-ae01-be175da0c108", "title": "PowerShell Script Dropped Via PowerShell.EXE", "file": "../sigma/rules/windows/file/file_event/file_event_win_powershell_drop_powershell.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "4e7050dd-e548-483f-b7d6-527ab4fa784d", "title": "NTDS.DIT Creation By Uncommon Parent Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_ntds_dit_uncommon_parent_process.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "3d2a2d59-929c-4b78-8c1a-145dfe9e07b1", "title": "Publisher Attachment File Dropped In Suspicious Location", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_publisher_files_in_susp_locations.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "7d604714-e071-49ff-8726-edeb95a70679", "title": "Legitimate Application Dropped Script", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_script.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "bdd8157d-8e85-4397-bb82-f06cc9c71dbb", "title": "UAC Bypass Using IEInstal - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_ieinstal.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "6b269392-9eba-40b5-acb6-55c882b20ba6", "title": "Suspicious File Drop by Exchange", "file": "../sigma/rules/windows/file/file_event/file_event_win_exchange_webshell_drop_suspicious.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "b6f91281-20aa-446a-b986-38a92813a18f", "title": "DLL Search Order Hijackig Via Additional Space in Path", "file": "../sigma/rules/windows/file/file_event/file_event_win_dll_sideloading_space_path.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "4aafb0fa-bff5-4b9d-b99e-8093e659c65f", "title": "Writing Local Admin Share", "file": "../sigma/rules/windows/file/file_event/file_event_win_writing_local_admin_share.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "3da70954-0f2c-4103-adff-b7440368f50e", "title": "Suspicious PROCEXP152.sys File Created In TMP", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "e36941d0-c0f0-443f-bc6f-cb2952eb69ea", "title": "PowerShell Module File Created", "file": "../sigma/rules/windows/file/file_event/file_event_win_powershell_module_creation.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "6e90ae7a-7cd3-473f-a035-4ebb72d961da", "title": "PCRE.NET Package Temp Files", "file": "../sigma/rules/windows/file/file_event/file_event_win_pcre_net_temp_file.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "814ddeca-3d31-4265-8e07-8cc54fb44903", "title": "LiveKD Kernel Memory Dump File Created", "file": "../sigma/rules/windows/file/file_event/file_event_win_sysinternals_livekd_default_dump_name.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "bd1212e5-78da-431e-95fa-c58e3237a8e6", "title": "Suspicious ASPX File Drop by Exchange", "file": "../sigma/rules/windows/file/file_event/file_event_win_exchange_webshell_drop.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "9e099d99-44c2-42b6-a6d8-54c3545cab29", "title": "HackTool - Mimikatz Kirbi File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_mimikatz_files.yml", "status": "test", "level": "critical", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "7280c9f3-a5af-45d0-916a-bc01cb4151c9", "title": "Suspicious MSExchangeMailboxReplication ASPX Write", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_exchange_aspx_write.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "75bf09fa-1dd7-4d18-9af9-dd9e492562eb", "title": "ADSI-Cache File Creation By Uncommon Tool", "file": "../sigma/rules/windows/file/file_event/file_event_win_adsi_cache_creation_by_uncommon_tool.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "8fbf3271-1ef6-4e94-8210-03c2317947f6", "title": "Cred Dump Tools Dropped Files", "file": "../sigma/rules/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "d102b8f5-61dc-4e68-bd83-9a3187c67377", "title": "Renamed VsCode Code Tunnel Execution - File Indicator", "file": "../sigma/rules/windows/file/file_event/file_event_win_vscode_tunnel_renamed_execution.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "81315b50-6b60-4d8f-9928-3466e1022515", "title": "Suspicious desktop.ini Action", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_desktop_ini.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "2d367498-5112-4ae5-a06a-96e7bc33a211", "title": "Suspicious Binary Writes Via AnyDesk", "file": "../sigma/rules/windows/file/file_event/file_event_win_anydesk_writing_susp_binaries.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "8e1cb247-6cf6-42fa-b440-3f27d57e9936", "title": "Potential Persistence Via Microsoft Office Add-In", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_addin_persistence.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "7047d730-036f-4f40-b9d8-1c63e36d5e62", "title": "Potential Binary Or Script Dropper Via PowerShell", "file": "../sigma/rules/windows/file/file_event/file_event_win_powershell_drop_binary_or_script.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "2aa0a6b4-a865-495b-ab51-c28249537b75", "title": "Startup Folder File Write", "file": "../sigma/rules/windows/file/file_event/file_event_win_startup_folder_file_write.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "65236ec7-ace0-4f0c-82fd-737b04fd4dcb", "title": "EVTX Created In Uncommon Location", "file": "../sigma/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations.yml", "status": "experimental", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "e4a74e34-ecde-4aab-b2fb-9112dd01aed0", "title": "Dynamic CSharp Compile Artefact", "file": "../sigma/rules/windows/file/file_event/file_event_win_csharp_compile_artefact.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "614a7e17-5643-4d89-b6fe-f9df1a79641c", "title": "Wmiprvse Wbemcomn DLL Hijack - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_wmiprvse_wbemcomn_dll_hijack.yml", "status": "test", "level": "critical", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "dca1b3e8-e043-4ec8-85d7-867f334b5724", "title": "Suspicious PFX File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_pfx_file_creation.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "0b9ad457-2554-44c1-82c2-d56a99c42377", "title": "Anydesk Temporary Artefact", "file": "../sigma/rules/windows/file/file_event/file_event_win_anydesk_artefact.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "8c31f563-f9a7-450c-bfa8-35f8f32f1f61", "title": "New Outlook Macro Created", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_outlook_macro_creation.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "9b64de98-9db3-4033-bd7a-f51430105f00", "title": "Windows Terminal Profile Settings Modification By Uncommon Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_windows_terminal_profile.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "aba15bdd-657f-422a-bab3-ac2d2a0d6f1c", "title": "Potentially Suspicious DMP/HDMP File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_dump_file_susp_creation.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "97aa2e88-555c-450d-85a6-229bcd87efb8", "title": "Suspicious Screensaver Binary File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_creation_scr_binary_file.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "304afd73-55a5-4bb9-8c21-0b1fc84ea9e4", "title": "PSEXEC Remote Execution File Artefact", "file": "../sigma/rules/windows/file/file_event/file_event_win_sysinternals_psexec_service_key.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "69ca12af-119d-44ed-b50f-a47af0ebc364", "title": "LSASS Process Memory Dump Creation Via Taskmgr.EXE", "file": "../sigma/rules/windows/file/file_event/file_event_win_taskmgr_lsass_dump.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "b1c50487-1967-4315-a026-6491686d860e", "title": "Office Macro File Creation From Suspicious Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_macro_files_from_susp_process.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "f0540f7e-2db3-4432-b9e0-3965486744bc", "title": "Legitimate Application Dropped Executable", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_exe.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "130c9e58-28ac-4f83-8574-0a4cc913b97e", "title": "Potential Winnti Dropper Activity", "file": "../sigma/rules/windows/file/file_event/file_event_win_redmimicry_winnti_filedrop.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "92fa78e7-4d39-45f1-91a3-8b23f3f1088d", "title": "Potential Startup Shortcut Persistence Via PowerShell.EXE", "file": "../sigma/rules/windows/file/file_event/file_event_win_powershell_startup_shortcuts.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "33f41cdd-35ac-4ba8-814b-c6a4244a1ad4", "title": "WMI Persistence - Script Event Consumer File Write", "file": "../sigma/rules/windows/file/file_event/file_event_win_wmi_persistence_script_event_consumer_write.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "0bcfabcb-7929-47f4-93d6-b33fb67d34d1", "title": "Adwind RAT / JRAT File Artifact", "file": "../sigma/rules/windows/file/file_event/file_event_win_mal_adwind.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "162ab1e4-6874-4564-853c-53ec3ab8be01", "title": "TeamViewer Remote Session", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_teamviewer_remote_session.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "11b1ed55-154d-4e82-8ad7-83739298f720", "title": "NTDS.DIT Creation By Uncommon Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_ntds_dit_uncommon_process.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "c61daa90-3c1e-4f18-af62-8f288b5c9aaf", "title": "Uncommon File Creation By Mysql Daemon Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_mysqld_uncommon_file_creation.yml", "status": "experimental", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "fcc6d700-68d9-4241-9a1a-06874d621b06", "title": "Suspicious File Created Via OneNote Application", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_onenote_susp_dropped_files.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "f92a6f1e-a512-4a15-9735-da09e78d7273", "title": "GatherNetworkInfo.VBS Reconnaissance Script Output", "file": "../sigma/rules/windows/file/file_event/file_event_win_lolbin_gather_network_info_script_output.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "7eff1a7f-dd45-4c20-877a-f21e342a7611", "title": "RemCom Service File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_remcom_service.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "0afecb6e-6223-4a82-99fb-bf5b981e92a5", "title": "Remote Access Tool - ScreenConnect Temporary File", "file": "../sigma/rules/windows/file/file_event/file_event_win_remote_access_tools_screenconnect_remote_file.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "f0e2b768-5220-47dd-b891-d57b96fc0ec1", "title": "CSExec Service File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_csexec_service.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "34986307-b7f4-49be-92f3-e7a4d01ac5db", "title": "Rclone Config File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_rclone_config_files.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "9711de76-5d4f-4c50-a94f-21e4e8f8384d", "title": "Installation of TeamViewer Desktop", "file": "../sigma/rules/windows/file/file_event/file_event_win_install_teamviewer_desktop.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "c3edc6a5-d9d4-48d8-930e-aab518390917", "title": "Potential Persistence Via Outlook Form", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_outlook_newform.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "d5866ddf-ce8f-4aea-b28e-d96485a20d3d", "title": "Files With System Process Name In Unsuspected Locations", "file": "../sigma/rules/windows/file/file_event/file_event_win_creation_system_file.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "259e5a6a-b8d2-4c38-86e2-26c5e651361d", "title": "PsExec Service File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_sysinternals_psexec_service.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "155dbf56-e0a4-4dd0-8905-8a98705045e8", "title": "UAC Bypass Abusing Winsat Path Parsing - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_winsat.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "7fff6773-2baa-46de-a24a-b6eec1aba2d1", "title": "UAC Bypass Using NTFS Reparse Point - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_ntfs_reparse_point.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f", "title": "UEFI Persistence Via Wpbbin - FileCreation", "file": "../sigma/rules/windows/file/file_event/file_event_win_wpbbin_persistence.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "0b8baa3f-575c-46ee-8715-d6f28cc7d33c", "title": "NTDS.DIT Created", "file": "../sigma/rules/windows/file/file_event/file_event_win_ntds_dit_creation.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "2f9356ae-bf43-41b8-b858-4496d83b2acb", "title": "ISO File Created Within Temp Folders", "file": "../sigma/rules/windows/file/file_event/file_event_win_iso_file_mount.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "a05baa88-e922-4001-bc4d-8738135f27de", "title": "Process Monitor Driver Creation By Non-Sysinternals Binary", "file": "../sigma/rules/windows/file/file_event/file_event_win_sysinternals_procmon_driver_susp_creation.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "5b40a734-99b6-4b98-a1d0-1cea51a08ab2", "title": "Suspicious Interactive PowerShell as SYSTEM", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_system_interactive_powershell.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "6e2a900a-ced9-4e4a-a9c2-13e706f9518a", "title": "HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_remote_cred_dump.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "91174a41-dc8f-401b-be89-7bfc140612a0", "title": "Office Macro File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_macro_files_created.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "8468111a-ef07-4654-903b-b863a80bbc95", "title": "VHD Image Download Via Browser", "file": "../sigma/rules/windows/file/file_event/file_event_win_vhd_download_via_browsers.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "c048f047-7e2a-4888-b302-55f509d4a91d", "title": "SCR File Write Event", "file": "../sigma/rules/windows/file/file_event/file_event_win_new_scr_file.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "52753ea4-b3a0-4365-910d-36cff487b789", "title": "Hijack Legit RDP Session to Move Laterally", "file": "../sigma/rules/windows/file/file_event/file_event_win_tsclient_filewrite_startup.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "fccfb43e-09a7-4bd2-8b37-a5a7df33386d", "title": ".RDP File Created By Uncommon Application", "file": "../sigma/rules/windows/file/file_event/file_event_win_rdp_file_susp_creation.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "5f87308a-0a5b-4623-ae15-d8fa1809bc60", "title": "Suspicious Files in Default GPO Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_default_gpo_dir_write.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b", "title": "Suspicious Get-Variable.exe Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_get_variable.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "a8f866e1-bdd4-425e-a27a-37619238d9c7", "title": "Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_hidden_dir_index_allocation.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "07a99744-56ac-40d2-97b7-2095967b0e03", "title": "Potential Privilege Escalation Attempt Via .Exe.Local Technique", "file": "../sigma/rules/windows/file/file_event/file_event_win_system32_local_folder_privilege_escalation.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "3a8da4e0-36c1-40d2-8b29-b3e890d5172a", "title": "NTDS Exfiltration Filename Patterns", "file": "../sigma/rules/windows/file/file_event/file_event_win_ntds_exfil_tools.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "0e29e3a7-1ad8-40aa-b691-9f82ecd33d66", "title": "Office Macro File Download", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_macro_files_downloaded.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "d7b50671-d1ad-4871-aa60-5aa5b331fe04", "title": "Suspicious File Creation In Uncommon AppData Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_new_files_in_uncommon_appdata_folder.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "409f8a98-4496-4aaa-818a-c931c0a8b832", "title": "Created Files by Microsoft Sync Center", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_creation_by_mobsync.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "a6976974-ea6f-4e97-818e-ea08625c52cb", "title": "Potential RipZip Attack on Startup Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_ripzip_attack.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "3a9fa2ec-30bc-4ebd-b49e-7c9cff225502", "title": "VsCode Powershell Profile Modification", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_vscode_powershell_profile.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "b4926b47-a9d7-434c-b3a0-adc3fa0bd13e", "title": "Suspicious Double Extension Files", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_double_extension.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "28208707-fe31-437f-9a7f-4b1108b94d2e", "title": "Suspicious Startup Folder Persistence", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_startup_folder_persistence.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "e15b518d-b4ce-4410-a9cd-501f23ce4a18", "title": "Suspicious Creation with Colorcpl", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_colorcpl.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "760e75d8-c3b5-409b-a9bf-6130b4c4603f", "title": "Self Extraction Directive File Created In Potentially Suspicious Location", "file": "../sigma/rules/windows/file/file_event/file_event_win_sed_file_creation.yml", "status": "experimental", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "e0b06658-7d1d-4cd3-bf15-03467507ff7c", "title": "Suspicious DotNET CLR Usage Log Artifact", "file": "../sigma/rules/windows/file/file_event/file_event_win_net_cli_artefact.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "4e87b8e2-2ee9-4b2a-a715-4727d297ece0", "title": "Potential SAM Database Dump", "file": "../sigma/rules/windows/file/file_event/file_event_win_sam_dump.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "bb09dd3e-2b78-4819-8e35-a7c1b874e449", "title": "HackTool - Inveigh Execution Artefacts", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_inveigh_artefacts.yml", "status": "test", "level": "critical", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "4c7f49ee-2638-43bb-b85b-ce676c30b260", "title": "Assembly DLL Creation Via AspNetCompiler", "file": "../sigma/rules/windows/file/file_event/file_event_win_aspnet_temp_files.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "4358e5a5-7542-4dcb-b9f3-87667371839b", "title": "ISO or Image Mount Indicator in Recent Files", "file": "../sigma/rules/windows/file/file_event/file_event_win_iso_file_recent.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "62ed5b55-f991-406a-85d9-e8e8fdf18789", "title": "UAC Bypass Using Consent and Comctl32 - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_consent_comctl32.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "e074832a-eada-4fd7-94a1-10642b130e16", "title": "HackTool - SafetyKatz Dump Indicator", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_safetykatz.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "16fe46bb-4f64-46aa-817d-ff7bec4a2352", "title": "LiveKD Driver Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_sysinternals_livekd_driver.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "8d5aca11-22b3-4f22-b7ba-90e60533e1fb", "title": "Wmiexec Default Output File", "file": "../sigma/rules/windows/file/file_event/file_event_win_wmiexec_default_filename.yml", "status": "test", "level": "critical", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "3d0ed417-3d94-4963-a562-4a92c940656a", "title": "Creation of a Diagcab", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_diagcab.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "7892ec59-c5bb-496d-8968-e5d210ca3ac4", "title": "DPAPI Backup Keys And Certificate Export Activity IOC", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_dpapi_backup_and_cert_export_ioc.yml", "status": "experimental", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "145095eb-e273-443b-83d0-f9b519b7867b", "title": "PDF File Created By RegEdit.EXE", "file": "../sigma/rules/windows/file/file_event/file_event_win_regedit_print_as_pdf.yml", "status": "experimental", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "5d756aee-ad3e-4306-ad95-cb1abec48de2", "title": "GoToAssist Temporary Installation Artefact", "file": "../sigma/rules/windows/file/file_event/file_event_win_gotoopener_artefact.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "48ea844d-19b1-4642-944e-fe39c2cc1fec", "title": "UAC Bypass Using IDiagnostic Profile - File", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_idiagnostic_profile.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9", "title": "Creation Exe for Service with Unquoted Path", "file": "../sigma/rules/windows/file/file_event/file_event_win_creation_unquoted_service_path.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "1908fcc1-1b92-4272-8214-0fbaf2fa5163", "title": "Malicious DLL File Dropped in the Teams or OneDrive Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_iphlpapi_dll_sideloading.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "a10a2c40-2c4d-49f8-b557-1a946bc55d9d", "title": "Uncommon File Created In Office Startup Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_uncommon_file_startup.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "736ffa74-5f6f-44ca-94ef-1c0df4f51d2a", "title": "HackTool - CrackMapExec File Indicators", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_crackmapexec_indicators.yml", "status": "experimental", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "bbb7e38c-0b41-4a11-b306-d2a457b7ac2b", "title": "Suspicious File Created In PerfLogs", "file": "../sigma/rules/windows/file/file_event/file_event_win_perflogs_susp_files.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "fed85bf9-e075-4280-9159-fbe8a023d6fa", "title": "Advanced IP Scanner - File Event", "file": "../sigma/rules/windows/file/file_event/file_event_win_advanced_ip_scanner.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "0e20c89d-2264-44ae-8238-aeeaba609ece", "title": "Potential Persistence Via Microsoft Office Startup Folder", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_startup_persistence.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "56e05d41-ce99-4ecd-912d-93f019ee0b71", "title": "Visual Studio Code Tunnel Remote File Creation", "file": "../sigma/rules/windows/file/file_event/file_event_win_vscode_tunnel_remote_creation_artefacts.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "b5b78988-486d-4a80-b991-930eff3ff8bf", "title": "PowerShell Profile Modification", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_powershell_profile.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "805c55d9-31e6-4846-9878-c34c75054fe9", "title": "Octopus Scanner Malware", "file": "../sigma/rules/windows/file/file_event/file_event_win_mal_octopus_scanner.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "80e1f67a-4596-4351-98f5-a9c3efabac95", "title": "Suspicious Scheduled Task Write to System32 Tasks", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_task_write.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "e3845023-ca9a-4024-b2b2-5422156d5527", "title": "PowerShell Module File Created By Non-PowerShell Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_powershell_module_uncommon_creation.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "e8a52bbd-bced-459f-bd93-64db45ce7657", "title": "Potential Suspicious PowerShell Module File Created", "file": "../sigma/rules/windows/file/file_event/file_event_win_powershell_module_susp_creation.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "fc4f4817-0c53-4683-a4ee-b17a64bc1039", "title": "Suspicious Desktopimgdownldr Target File", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_desktopimgdownldr_file.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "f748c45a-f8d3-4e6f-b617-fe176f695b8f", "title": ".RDP File Created by Outlook Process", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_outlook_rdp_file_creation.yml", "status": "experimental", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "6ea858a8-ba71-4a12-b2cc-5d83312404c7", "title": "HackTool - Typical HiveNightmare SAM File Export", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_hivenightmare_file_exports.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "93a19907-d4f9-4deb-9f91-aac4692776a6", "title": "UAC Bypass Using .NET Code Profiler on MMC", "file": "../sigma/rules/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "3215aa19-f060-4332-86d5-5602511f3ca8", "title": "Suspicious LNK Double Extension File Created", "file": "../sigma/rules/windows/file/file_event/file_event_win_susp_lnk_double_extension.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "117d3d3a-755c-4a61-b23e-9171146d094c", "title": "Suspicious Outlook Macro Created", "file": "../sigma/rules/windows/file/file_event/file_event_win_office_outlook_susp_macro_creation.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "93d94efc-d7ad-4161-ad7d-1638c4f908d8", "title": "HackTool - Dumpert Process Dumper Default File", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_dumpert.yml", "status": "test", "level": "critical", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "318557a5-150c-4c8d-b70e-a9910e199857", "title": "File Creation In Suspicious Directory By Msdt.EXE", "file": "../sigma/rules/windows/file/file_event/file_event_win_msdt_susp_directories.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "c3e76af5-4ce0-4a14-9c9a-25ceb8fda182", "title": "WerFault LSASS Process Memory Dump", "file": "../sigma/rules/windows/file/file_event/file_event_win_lsass_werfault_dump.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "f331aa1f-8c53-4fc3-b083-cc159bc971cb", "title": "Malicious PowerShell Scripts - FileCreation", "file": "../sigma/rules/windows/file/file_event/file_event_win_powershell_exploit_scripts.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "602a1f13-c640-4d73-b053-be9a2fa58b96", "title": "HackTool - Powerup Write Hijack DLL", "file": "../sigma/rules/windows/file/file_event/file_event_win_hktl_powerup_dllhijacking.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "windows"}, {"id": "0d7a9363-af70-4e7b-a3b7-1a176b7fbe84", "title": "Exports Registry Key To an Alternate Data Stream", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_regedit_export_to_ads.yml", "status": "test", "level": "high", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "19b041f6-e583-40dc-b842-d6fa8011493f", "title": "HackTool Named File Stream Created", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_hktl_generic_download.yml", "status": "test", "level": "high", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "b69888d4-380c-45ce-9cf9-d9ce46e67821", "title": "Hidden Executable In NTFS Alternate Data Stream", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_ads_executable.yml", "status": "test", "level": "medium", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "025bd229-fd1f-4fdb-97ab-20006e1a5368", "title": "Unusual File Download from Direct IP Address", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_susp_ip_domains.yml", "status": "test", "level": "high", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "52182dfb-afb7-41db-b4bc-5336cb29b464", "title": "Suspicious File Download From File Sharing Websites - File Stream", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_file_sharing_domains_download_susp_extension.yml", "status": "experimental", "level": "high", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "0bb4bbeb-fe52-4044-b40c-430a04577ebe", "title": "Potentially Suspicious File Download From ZIP TLD", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_zip_tld_download.yml", "status": "test", "level": "high", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "a3f5c081-e75b-43a0-9f5b-51f26fe5dba2", "title": "Potential Suspicious Winget Package Installation", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_winget_susp_package_source.yml", "status": "test", "level": "high", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "573df571-a223-43bc-846e-3f98da481eca", "title": "Creation Of a Suspicious ADS File Outside a Browser Download", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_creation_internet_file.yml", "status": "test", "level": "medium", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "ae02ed70-11aa-4a22-b397-c0d0e8f6ea99", "title": "Unusual File Download From File Sharing Websites - File Stream", "file": "../sigma/rules/windows/create_stream_hash/create_stream_hash_file_sharing_domains_download_unusual_extension.yml", "status": "experimental", "level": "medium", "logsource.category": "create_stream_hash", "logsource.product": "windows"}, {"id": "5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4", "title": "RDP Over Reverse SSH Tunnel", "file": "../sigma/rules/windows/network_connection/net_connection_win_rdp_reverse_tunnel.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "d58ba5c6-0ed7-4b9d-a433-6878379efda9", "title": "Remote Access Tool - AnyDesk Incoming Connection", "file": "../sigma/rules/windows/network_connection/net_connection_win_remote_access_tools_anydesk_incoming_connection.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "7610a4ea-c06d-495f-a2ac-0a696abcfd3b", "title": "Outbound Network Connection To Public IP Via Winlogon", "file": "../sigma/rules/windows/network_connection/net_connection_win_winlogon_net_connections.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "3ab65069-d82a-4d44-a759-466661a082d1", "title": "Communication To LocaltoNet Tunneling Service Initiated", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_localtonet_tunnel.yml", "status": "experimental", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "5c80b618-0dbb-46e6-acbb-03d90bcb6d83", "title": "Network Connection Initiated To AzureWebsites.NET By Non-Browser Process", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_azurewebsites.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "c539afac-c12a-46ed-b1bd-5a5567c9f045", "title": "Potential Remote PowerShell Session Initiated", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_remote_powershell_session.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "cdc8da7d-c303-42f8-b08c-b4ab47230263", "title": "Rundll32 Internet Connection", "file": "../sigma/rules/windows/network_connection/net_connection_win_rundll32_net_connections.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "3b5ba899-9842-4bc2-acc2-12308498bf42", "title": "Office Application Initiated Network Connection Over Uncommon Ports", "file": "../sigma/rules/windows/network_connection/net_connection_win_office_uncommon_ports.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4", "title": "Network Connection Initiated To DevTunnels Domain", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_devtunnels.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "8d7e392e-9b28-49e1-831d-5949c6281228", "title": "Network Connection Initiated By IMEWDBLD.EXE", "file": "../sigma/rules/windows/network_connection/net_connection_win_imewdbld.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "5205613d-2a63-4412-a895-3a2458b587b3", "title": "Network Connection Initiated By AddinUtil.EXE", "file": "../sigma/rules/windows/network_connection/net_connection_win_addinutil_initiated.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "9f2cc74d-78af-4eb2-bb64-9cd1d292b87b", "title": "Microsoft Sync Center Suspicious Network Connections", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_outbound_mobsync_connection.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "c3dbbc9f-ef1d-470a-a90a-d343448d5875", "title": "Suspicious Non-Browser Network Communication With Telegram API", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_telegram_api_non_browser_access.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "786cdae8-fefb-4eb2-9227-04e34060db01", "title": "Suspicious Wordpad Outbound Connections", "file": "../sigma/rules/windows/network_connection/net_connection_win_wordpad_uncommon_ports.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "b1e5da3b-ca8e-4adf-915c-9921f3d85481", "title": "RDP to HTTP or HTTPS Target Ports", "file": "../sigma/rules/windows/network_connection/net_connection_win_rdp_to_http.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97", "title": "Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_file_sharing_domains_susp_folders.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "b3ad3c0f-c949-47a1-a30e-b0491ccae876", "title": "Uncommon Connection to Active Directory Web Services", "file": "../sigma/rules/windows/network_connection/net_connection_win_adws_unusual_connection.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "edf3485d-dac4-4d50-90e4-b0e5813f7e60", "title": "Suspicious Network Connection to IP Lookup Service APIs", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_external_ip_lookup.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7", "title": "New Connection Initiated To Potential Dead Drop Resolver Domain", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_dead_drop_resolvers.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "18249279-932f-45e2-b37a-8925f2597670", "title": "Process Initiated Network Connection To Ngrok Domain", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_ngrok.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "50e54b8d-ad73-43f8-96a1-5191685b17a4", "title": "Silenttrinity Stager Msbuild Activity", "file": "../sigma/rules/windows/network_connection/net_connection_win_silenttrinity_stager_msbuild_activity.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "9e02c8ec-02b9-43e8-81eb-34a475ba7965", "title": "Network Connection Initiated To BTunnels Domains", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_btunnels.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "ed74fe75-7594-4b4b-ae38-e38e3fd2eb23", "title": "Outbound RDP Connections Over Non-Standard Tools", "file": "../sigma/rules/windows/network_connection/net_connection_win_rdp_outbound_over_non_standard_tools.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "08249dc0-a28d-4555-8ba5-9255a198e08c", "title": "Local Network Connection Initiated By Script Interpreter", "file": "../sigma/rules/windows/network_connection/net_connection_win_wscript_cscript_local_connection.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "7b434893-c57d-4f41-908d-6a17bf1ae98f", "title": "Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_initiated_uncommon_or_suspicious_locations.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "1d08ac94-400d-4469-a82f-daee9a908849", "title": "Communication To Ngrok Tunneling Service Initiated", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_ngrok_tunnel.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "7cd1dcdc-6edf-4896-86dc-d1f19ad64903", "title": "Network Connection Initiated To Cloudflared Tunnels Domains", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_cloudflared_communication.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "992a6cae-db6a-43c8-9cec-76d7195c96fc", "title": "Outbound Network Connection Initiated By Script Interpreter", "file": "../sigma/rules/windows/network_connection/net_connection_win_wscript_cscript_outbound_connection.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "4b657234-038e-4ad5-997c-4be42340bce4", "title": "Network Connection Initiated To Visual Studio Code Tunnels Domain", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_vscode_tunnel_connection.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "bef0bc5a-b9ae-425d-85c6-7b2d705980c6", "title": "Python Initiated Connection", "file": "../sigma/rules/windows/network_connection/net_connection_win_python.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "efafe0bf-4238-479e-af8f-797bd3490d2d", "title": "Outbound Network Connection Initiated By Cmstp.EXE", "file": "../sigma/rules/windows/network_connection/net_connection_win_cmstp_initiated_connection.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "7e9cf7b6-e827-11ed-a05b-15959c120003", "title": "Potentially Suspicious Network Connection To Notion API", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_notion_api_susp_communication.yml", "status": "test", "level": "low", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84", "title": "Office Application Initiated Network Connection To Non-Local IP", "file": "../sigma/rules/windows/network_connection/net_connection_win_office_outbound_non_local_ip.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "0531e43a-d77d-47c2-b89f-5fe50321c805", "title": "RegAsm.EXE Initiating Network Connection To Public IP", "file": "../sigma/rules/windows/network_connection/net_connection_win_regasm_network_activity.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "e54979bd-c5f9-4d6c-967b-a04b19ac4c74", "title": "Uncommon Outbound Kerberos Connection", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_outbound_kerberos_connection.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "fa5b1358-b040-4403-9868-15f7d9ab6329", "title": "Network Communication With Crypto Mining Pool", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_crypto_mining_pools.yml", "status": "stable", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "4b89abaa-99fe-4232-afdd-8f9aa4d20382", "title": "Potentially Suspicious Malware Callback Communication", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_malware_callback_port.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "07837ab9-60e1-481f-a74d-c31fb496a94c", "title": "Network Communication Initiated To Portmap.IO Domain", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_portmap.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "c7e91a02-d771-4a6d-a700-42587e0b1095", "title": "Network Connection Initiated By Regsvr32.EXE", "file": "../sigma/rules/windows/network_connection/net_connection_win_regsvr32_network_activity.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "c649a6c7-cd8c-4a78-9c04-000fc76df954", "title": "Potentially Suspicious Wuauclt Network Connection", "file": "../sigma/rules/windows/network_connection/net_connection_win_wuauclt_network_connection.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1", "title": "Outbound Network Connection Initiated By Microsoft Dialer", "file": "../sigma/rules/windows/network_connection/net_connection_win_dialer_initiated_connection.yml", "status": "experimental", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "e81528db-fc02-45e8-8e98-4e84aba1f10b", "title": "Network Connection Initiated Via Notepad.EXE", "file": "../sigma/rules/windows/network_connection/net_connection_win_notepad.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "0dba975d-a193-4ed1-a067-424df57570d1", "title": "Uncommon Network Connection Initiated By Certutil.EXE", "file": "../sigma/rules/windows/network_connection/net_connection_win_certutil_initiated_connection.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "9976fa64-2804-423c-8a5b-646ade840773", "title": "Suspicious Outbound SMTP Connections", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_outbound_smtp_connections.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "7e9cf7b6-e827-11ed-a05b-0242ac120003", "title": "Suspicious Non-Browser Network Communication With Google API", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_google_api_non_browser_access.yml", "status": "experimental", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "a66bc059-c370-472c-a0d7-f8fd1bf9d583", "title": "Network Connection Initiated By Eqnedt32.EXE", "file": "../sigma/rules/windows/network_connection/net_connection_win_eqnedt.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "20384606-a124-4fec-acbb-8bd373728613", "title": "Suspicious Network Connection Binary No CommandLine", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_binary_no_cmdline.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "25eabf56-22f0-4915-a1ed-056b8dae0a68", "title": "Suspicious Dropbox API Usage", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_dropbox_api.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "6d8c3d20-a5e1-494f-8412-4571d716cf5c", "title": "Communication To Uncommon Destination Ports", "file": "../sigma/rules/windows/network_connection/net_connection_win_susp_malware_callback_ports_uncommon.yml", "status": "test", "level": "medium", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4", "title": "Network Connection Initiated To Mega.nz", "file": "../sigma/rules/windows/network_connection/net_connection_win_domain_mega_nz.yml", "status": "test", "level": "low", "logsource.category": "network_connection", "logsource.product": "windows"}, {"id": "fe21810c-2a8c-478f-8dd3-5a287fb2a0e0", "title": "Suspicious Scripting in a WMI Consumer", "file": "../sigma/rules/windows/wmi_event/sysmon_wmi_susp_scripting.yml", "status": "test", "level": "high", "logsource.category": "wmi_event", "logsource.product": "windows"}, {"id": "83844185-1c5b-45bc-bcf3-b5bf3084ca5b", "title": "Suspicious Encoded Scripts in a WMI Consumer", "file": "../sigma/rules/windows/wmi_event/sysmon_wmi_susp_encoded_scripts.yml", "status": "test", "level": "high", "logsource.category": "wmi_event", "logsource.product": "windows"}, {"id": "0f06a3a5-6a09-413f-8743-e6cf35561297", "title": "WMI Event Subscription", "file": "../sigma/rules/windows/wmi_event/sysmon_wmi_event_subscription.yml", "status": "test", "level": "medium", "logsource.category": "wmi_event", "logsource.product": "windows"}, {"id": "961d0ba2-3eea-4303-a930-2cf78bbfcc5e", "title": "HackTool - Credential Dumping Tools Named Pipe Created", "file": "../sigma/rules/windows/pipe_created/pipe_created_hktl_generic_cred_dump_tools_pipes.yml", "status": "test", "level": "critical", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "493fb4ab-cdcc-4c4f-818c-0e363bd1e4bb", "title": "WMI Event Consumer Created Named Pipe", "file": "../sigma/rules/windows/pipe_created/pipe_created_scrcons_wmi_consumer_namedpipe.yml", "status": "test", "level": "medium", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "0e7163d4-9e19-4fa7-9be6-000c61aad77a", "title": "CobaltStrike Named Pipe Pattern Regex", "file": "../sigma/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_re.yml", "status": "test", "level": "critical", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "0adc67e0-a68f-4ffd-9c43-28905aad5d6a", "title": "HackTool - Koh Default Named Pipe", "file": "../sigma/rules/windows/pipe_created/pipe_created_hktl_koh_default_pipe.yml", "status": "test", "level": "critical", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "637f689e-b4a5-4a86-be0e-0100a0a33ba2", "title": "HackTool - EfsPotato Named Pipe Creation", "file": "../sigma/rules/windows/pipe_created/pipe_created_hktl_efspotato.yml", "status": "test", "level": "high", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "d5601f8c-b26f-4ab0-9035-69e11a8d4ad2", "title": "CobaltStrike Named Pipe", "file": "../sigma/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike.yml", "status": "test", "level": "critical", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3", "title": "ADFS Database Named Pipe Connection By Uncommon Tool", "file": "../sigma/rules/windows/pipe_created/pipe_created_adfs_namedpipe_connection_uncommon_tool.yml", "status": "test", "level": "medium", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "ac7102b4-9e1e-4802-9b4f-17c5524c015c", "title": "New PowerShell Instance Created", "file": "../sigma/rules/windows/pipe_created/pipe_created_powershell_execution_pipe.yml", "status": "test", "level": "informational", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7", "title": "CobaltStrike Named Pipe Patterns", "file": "../sigma/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_susp_pipe_patterns.yml", "status": "test", "level": "high", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "41504465-5e3a-4a5b-a5b4-2a0baadd4463", "title": "PsExec Tool Execution From Suspicious Locations - PipeName", "file": "../sigma/rules/windows/pipe_created/pipe_created_sysinternals_psexec_default_pipe_susp_location.yml", "status": "test", "level": "medium", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "4d0083b3-580b-40da-9bba-626c19fe4033", "title": "HackTool - CoercedPotato Named Pipe Creation", "file": "../sigma/rules/windows/pipe_created/pipe_created_hktl_coercedpotato.yml", "status": "test", "level": "high", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "58cb02d5-78ce-4692-b3e1-dce850aae41a", "title": "Alternate PowerShell Hosts Pipe", "file": "../sigma/rules/windows/pipe_created/pipe_created_powershell_alternate_host_pipe.yml", "status": "test", "level": "medium", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "1f7025a6-e747-4130-aac4-961eb47015f1", "title": "HackTool - DiagTrackEoP Default Named Pipe", "file": "../sigma/rules/windows/pipe_created/pipe_created_hktl_diagtrack_eop.yml", "status": "test", "level": "critical", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "d36f87ea-c403-44d2-aa79-1a0ac7c24456", "title": "PUA - RemCom Default Named Pipe", "file": "../sigma/rules/windows/pipe_created/pipe_created_pua_remcom_default_pipe.yml", "status": "test", "level": "medium", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "f6451de4-df0a-41fa-8d72-b39f54a08db5", "title": "PUA - PAExec Default Named Pipe", "file": "../sigma/rules/windows/pipe_created/pipe_created_pua_paexec_default_pipe.yml", "status": "test", "level": "medium", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "f318b911-ea88-43f4-9281-0de23ede628e", "title": "PUA - CSExec Default Named Pipe", "file": "../sigma/rules/windows/pipe_created/pipe_created_pua_csexec_default_pipe.yml", "status": "test", "level": "medium", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "fe3ac066-98bb-432a-b1e7-a5229cb39d4a", "title": "Malicious Named Pipe Created", "file": "../sigma/rules/windows/pipe_created/pipe_created_susp_malicious_namedpipes.yml", "status": "test", "level": "critical", "logsource.category": "pipe_created", "logsource.product": "windows"}, {"id": "67add051-9ee7-4ad3-93ba-42935615ae8d", "title": "PUA - Process Hacker Driver Load", "file": "../sigma/rules/windows/driver_load/driver_load_win_pua_process_hacker.yml", "status": "test", "level": "high", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "295c9289-acee-4503-a571-8eacaef36b28", "title": "Vulnerable HackSys Extreme Vulnerable Driver Load", "file": "../sigma/rules/windows/driver_load/driver_load_win_vuln_hevd_driver.yml", "status": "test", "level": "high", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "72cd00d6-490c-4650-86ff-1d11f491daa1", "title": "Vulnerable Driver Load By Name", "file": "../sigma/rules/windows/driver_load/driver_load_win_vuln_drivers_names.yml", "status": "test", "level": "low", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "05296024-fe8a-4baf-8f3d-9a5f5624ceb2", "title": "Malicious Driver Load", "file": "../sigma/rules/windows/driver_load/driver_load_win_mal_drivers.yml", "status": "test", "level": "high", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "1a42dfa6-6cb2-4df9-9b48-295be477e835", "title": "Vulnerable WinRing0 Driver Load", "file": "../sigma/rules/windows/driver_load/driver_load_win_vuln_winring0_driver.yml", "status": "test", "level": "high", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "10cb6535-b31d-4512-9962-513dcbc42cc1", "title": "PUA - System Informer Driver Load", "file": "../sigma/rules/windows/driver_load/driver_load_win_pua_system_informer.yml", "status": "test", "level": "medium", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8", "title": "Vulnerable Driver Load", "file": "../sigma/rules/windows/driver_load/driver_load_win_vuln_drivers.yml", "status": "test", "level": "high", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "679085d5-f427-4484-9f58-1dc30a7c426d", "title": "WinDivert Driver Load", "file": "../sigma/rules/windows/driver_load/driver_load_win_windivert.yml", "status": "test", "level": "high", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75", "title": "Driver Load From A Temporary Directory", "file": "../sigma/rules/windows/driver_load/driver_load_win_susp_temp_use.yml", "status": "test", "level": "high", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "39b64854-5497-4b57-a448-40977b8c9679", "title": "Malicious Driver Load By Name", "file": "../sigma/rules/windows/driver_load/driver_load_win_mal_drivers_names.yml", "status": "test", "level": "medium", "logsource.category": "driver_load", "logsource.product": "windows"}, {"id": "06d71506-7beb-4f22-8888-e2e5e2ca7fd8", "title": "Mimikatz Use", "file": "../sigma/rules/windows/builtin/win_alert_mimikatz_keywords.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "b7bc7038-638b-4ffd-880c-292c692209ef", "title": "Certificate Request Export to Exchange Webserver", "file": "../sigma/rules/windows/builtin/msexchange/win_exchange_proxyshell_certificate_generation.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "4fe151c2-ecf9-4fae-95ae-b88ec9c2fca6", "title": "MSExchange Transport Agent Installation - Builtin", "file": "../sigma/rules/windows/builtin/msexchange/win_exchange_transportagent.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "9db37458-4df2-46a5-95ab-307e7f29e675", "title": "Exchange Set OabVirtualDirectory ExternalUrl Property", "file": "../sigma/rules/windows/builtin/msexchange/win_exchange_set_oabvirtualdirectory_externalurl.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "09570ae5-889e-43ea-aac0-0e1221fb3d95", "title": "Remove Exported Mailbox from Exchange Webserver", "file": "../sigma/rules/windows/builtin/msexchange/win_exchange_proxyshell_remove_mailbox_export.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "550d3350-bb8a-4ff3-9533-2ba533f4a1c0", "title": "ProxyLogon MSExchange OabVirtualDirectory", "file": "../sigma/rules/windows/builtin/msexchange/win_exchange_proxylogon_oabvirtualdir.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "c7d16cae-aaf3-42e5-9c1c-fb8553faa6fa", "title": "Failed MSExchange Transport Agent Installation", "file": "../sigma/rules/windows/builtin/msexchange/win_exchange_transportagent_failed.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "516376b4-05cd-4122-bae0-ad7641c38d48", "title": "Mailbox Export to Exchange Webserver", "file": "../sigma/rules/windows/builtin/msexchange/win_exchange_proxyshell_mailbox_export.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "58c0bff0-40a0-46e8-b5e8-b734b84d2017", "title": "Certificate Exported From Local Certificate Store", "file": "../sigma/rules/windows/builtin/certificate_services_client_lifecycle_system/win_certificateservicesclient_lifecycle_system_cert_exported.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "898d5fc9-fbc3-43de-93ad-38e97237c344", "title": "Suspicious AppX Package Installation Attempt", "file": "../sigma/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_susp_appx_package_installation.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "09d3b48b-be17-47f5-bf4e-94e7e75d09ce", "title": "Potential Malicious AppX Package Installation Attempts", "file": "../sigma/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_mal_appx_names.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "c977cb50-3dff-4a9f-b873-9290f56132f1", "title": "Uncommon AppX Package Locations", "file": "../sigma/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_uncommon_package_locations.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "5cdeaf3d-1489-477c-95ab-c318559fc051", "title": "Suspicious AppX Package Locations", "file": "../sigma/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_susp_package_locations.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "e021bbb5-407f-41f5-9dc9-1864c45a7a51", "title": "Deployment Of The AppX Package Was Blocked By The Policy", "file": "../sigma/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_policy_block.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "6ae53108-c3a0-4bee-8f45-c7591a2c337f", "title": "Deployment AppX Package Was Blocked By AppLocker", "file": "../sigma/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_applocker_block.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "8b48ad89-10d8-4382-a546-50588c410f0d", "title": "Suspicious Remote AppX Package Locations", "file": "../sigma/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_susp_domains.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "b55d23e5-6821-44ff-8a6e-67218891e49f", "title": "HybridConnectionManager Service Running", "file": "../sigma/rules/windows/builtin/servicebus/win_hybridconnectionmgr_svc_running.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "6d444368-6da1-43fe-b2fc-44202430480e", "title": "Failed DNS Zone Transfer", "file": "../sigma/rules/windows/builtin/dns_server/win_dns_server_failed_dns_zone_transfer.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "cbe51394-cd93-4473-b555-edf0144952d9", "title": "DNS Server Error Failed Loading the ServerLevelPluginDLL", "file": "../sigma/rules/windows/builtin/dns_server/win_dns_server_susp_server_level_plugin_dll.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "8289bf8c-4aca-4f5a-9db3-dc3d7afe5c10", "title": "Unsigned Binary Loaded From Suspicious Location", "file": "../sigma/rules/windows/builtin/security_mitigations/win_security_mitigations_unsigned_dll_from_susp_location.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "0b0ea3cc-99c8-4730-9c53-45deee2a4c86", "title": "Microsoft Defender Blocked from Loading Unsigned DLL", "file": "../sigma/rules/windows/builtin/security_mitigations/win_security_mitigations_defender_load_unsigned_dll.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "c187c075-bb3e-4c62-b4fa-beae0ffc211f", "title": "A Rule Has Been Deleted From The Windows Firewall Exception List", "file": "../sigma/rules/windows/builtin/firewall_as/win_firewall_as_delete_rule.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "04b60639-39c0-412a-9fbe-e82499c881a3", "title": "Windows Defender Firewall Has Been Reset To Its Default Configuration", "file": "../sigma/rules/windows/builtin/firewall_as/win_firewall_as_reset_config.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "cde0a575-7d3d-4a49-9817-b8004a7bf105", "title": "Uncommon New Firewall Rule Added In Windows Firewall Exception List", "file": "../sigma/rules/windows/builtin/firewall_as/win_firewall_as_add_rule.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "9e2575e7-2cb9-4da1-adc8-ed94221dca5e", "title": "New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application", "file": "../sigma/rules/windows/builtin/firewall_as/win_firewall_as_add_rule_susp_folder.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "79609c82-a488-426e-abcf-9f341a39365d", "title": "All Rules Have Been Deleted From The Windows Firewall Configuration", "file": "../sigma/rules/windows/builtin/firewall_as/win_firewall_as_delete_all_rules.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "7ec15688-fd24-4177-ba43-1a950537ee39", "title": "The Windows Defender Firewall Service Failed To Load Group Policy", "file": "../sigma/rules/windows/builtin/firewall_as/win_firewall_as_failed_load_gpo.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "eca81e8d-09e1-4d04-8614-c91f44fd0519", "title": "New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE", "file": "../sigma/rules/windows/builtin/firewall_as/win_firewall_as_add_rule_wmiprvse.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "00bb5bd5-1379-4fcf-a965-a5b6f7478064", "title": "Windows Firewall Settings Have Been Changed", "file": "../sigma/rules/windows/builtin/firewall_as/win_firewall_as_setting_change.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "71886b70-d7b4-4dbf-acce-87d2ca135262", "title": "Suspicious Rejected SMB Guest Logon From IP", "file": "../sigma/rules/windows/builtin/smbclient/security/win_smbclient_security_susp_failed_guest_logon.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "e2b5163d-7deb-4566-9af3-40afea6858c3", "title": "Certificate Private Key Acquired", "file": "../sigma/rules/windows/builtin/capi2/win_capi2_acquire_certificate_private_key.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "90f138c1-f578-4ac3-8c49-eecfd847c8b7", "title": "BITS Transfer Job Download From Direct IP", "file": "../sigma/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_ip_address.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "fe3a2d49-f255-4d10-935c-bda7391108eb", "title": "New BITS Job Created Via PowerShell", "file": "../sigma/rules/windows/builtin/bits_client/win_bits_client_new_job_via_powershell.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "f8a56cb7-a363-44ed-a82f-5926bb44cd05", "title": "BITS Transfer Job Download To Potential Suspicious Folder", "file": "../sigma/rules/windows/builtin/bits_client/win_bits_client_new_trasnfer_susp_local_folder.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "b85e5894-9b19-4d86-8c87-a2f3b81f0521", "title": "BITS Transfer Job Downloading File Potential Suspicious Extension", "file": "../sigma/rules/windows/builtin/bits_client/win_bits_client_new_transfer_saving_susp_extensions.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "1ff315dc-2a3a-4b71-8dde-873818d25d39", "title": "New BITS Job Created Via Bitsadmin", "file": "../sigma/rules/windows/builtin/bits_client/win_bits_client_new_job_via_bitsadmin.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "d635249d-86b5-4dad-a8c7-d7272b788586", "title": "BITS Transfer Job Download From File Sharing Domains", "file": "../sigma/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_file_sharing_domains.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "6d44fb93-e7d2-475c-9d3d-54c9c1e33427", "title": "BITS Transfer Job With Uncommon Or Suspicious Remote TLD", "file": "../sigma/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_uncommon_tld.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "4d7f1827-1637-4def-8d8a-fd254f9454df", "title": "Sysmon Application Crashed", "file": "../sigma/rules/windows/builtin/system/application_popup/win_system_application_sysmon_crash.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "e6f81941-b1cd-4766-87db-9fc156f658ee", "title": "KDC RC4-HMAC Downgrade CVE-2022-37966", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_rc4_downgrade.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "993c2665-e6ef-40e3-a62a-e1a97686af79", "title": "Certificate Use With No Strong Mapping", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_cert_use_no_strong_mapping.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "b1e0b3f5-b62e-41be-886a-daffde446ad4", "title": "No Suitable Encryption Key Found For Generating Kerberos Ticket", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_tgs_no_suitable_encryption_key_found.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "e9d4ab66-a532-4ef7-a502-66a9e4a34f5d", "title": "NTLMv1 Logon Between Client and Server", "file": "../sigma/rules/windows/builtin/system/lsasrv/win_system_lsasrv_ntlmv1.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "52a85084-6989-40c3-8f32-091e12e17692", "title": "Suspicious Usage of CVE_2021_34484 or CVE 2022_21919", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_user_profiles_service/win_system_susp_vuln_cve_2022_21919_or_cve_2021_34484.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "175997c5-803c-4b08-8bb0-70b099f47595", "title": "Invoke-Obfuscation COMPRESS OBFUSCATION - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_compress_services.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "f7385ee2-0e0c-11eb-adc1-0242ac120002", "title": "Invoke-Obfuscation CLIP+ Launcher - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_clip_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "c4ff1eac-84ad-44dd-a6fb-d56a92fc43a9", "title": "ProcessHacker Privilege Elevation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_pua_proceshacker.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "d26ce60c-2151-403c-9a42-49420d87b5e4", "title": "HackTool Service Registration or Execution", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_hacktools.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "843544a7-56e0-4dcc-a44f-5cc266dd97d6", "title": "Meterpreter or Cobalt Strike Getsystem Service Installation - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "b98a10af-1e1e-44a7-bab2-4cc026917648", "title": "New PDQDeploy Service - Client Side", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_pdqdeploy_runner.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "25b9c01c-350d-4b95-bed1-836d04a4f324", "title": "Moriya Rootkit - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_moriya_rootkit.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "d6b5520d-3934-48b4-928c-2aa3f92d6963", "title": "Important Windows Service Terminated With Error", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_important.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "5a105d34-05fc-401e-8553-272b45c1522d", "title": "CobaltStrike Service Installations - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_cobaltstrike_service_installs.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "641a4bfb-c017-44f7-800c-2aee0184ce9b", "title": "Invoke-Obfuscation Via Use Rundll32 - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_rundll32_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "11b52f18-aaec-4d60-9143-5dd8cc4706b9", "title": "Invoke-Obfuscation RUNDLL LAUNCHER - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_rundll_services.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "71c276aa-49cd-43d2-b920-2dcd3e6962d5", "title": "Service Installed By Unusual Client - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_sups_unusal_client.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "530a6faa-ff3d-4022-b315-50828e77eef5", "title": "Anydesk Remote Access Software Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_anydesk.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "56abae0c-6212-4b97-adc0-0b559bb950c3", "title": "Important Windows Service Terminated Unexpectedly", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_unexpectedly.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1a31b18a-f00c-4061-9900-f735b96c99fc", "title": "Remote Access Tool Services Have Been Installed - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_remote_access_software.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "70f00d10-60b2-4f34-b9a0-dc3df3fe762a", "title": "Suspicious Service Installation Script", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_susp_service_installation_script.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "26481afe-db26-4228-b264-25a29fe6efc7", "title": "Uncommon Service Installation Image Path", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_uncommon.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "5e993621-67d4-488a-b9ae-b420d08b96cb", "title": "Service Installation in Suspicious Folder", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_susp_service_installation_folder.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "de7ce410-b3fb-4e8a-b38c-3b999e2c3420", "title": "PAExec Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_paexec.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "42c575ea-e41e-41f1-b248-8093c3e82a28", "title": "PsExec Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_sysinternals_psexec.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "14bcba49-a428-42d9-b943-e2ce0f0f7ae6", "title": "Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_var_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "2d510d8d-912b-45c5-b1df-36faa3d8c3f4", "title": "NetSupport Manager Service Install", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_netsupport_manager.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "4976aa50-8f41-45c6-8b15-ab3fc10e79ed", "title": "Credential Dumping Tools Service Execution - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_mal_creddumper.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "9e36ed87-4986-482e-8e3b-5c23ffff11bf", "title": "RemCom Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_remcom.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "6c0a7755-6d31-44fa-80e1-133e57752680", "title": "Windows Defender Threat Detection Service Disabled", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_defender_disabled.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "a27e5fa9-c35e-4e3d-b7e0-1ce2af66ad12", "title": "CSExec Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_csexecsvc.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "63e3365d-4824-42d8-8b82-e56810fefa0c", "title": "Invoke-Obfuscation Via Use Clip - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_clip_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "e97d9903-53b2-41fc-8cb9-889ed4093e80", "title": "KrbRelayUp Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_krbrelayup_service_installation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "31c51af6-e7aa-4da7-84d4-8f32cc580af2", "title": "Sliver C2 Default Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_sliver.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1d61f71d-59d2-479e-9562-4ff5f4ead16b", "title": "Suspicious Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_susp.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "ee9ca27c-9bd7-4cee-9b01-6e906be7cae3", "title": "New PDQDeploy Service - Server Side", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_pdqdeploy.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "e0d1ad53-c7eb-48ec-a87a-72393cc6cedc", "title": "Mesh Agent Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_mesh_agent.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "8ca7004b-e620-4ecb-870e-86129b5b8e75", "title": "Invoke-Obfuscation VAR+ Launcher - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_var_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1b2ae822-6fe1-43ba-aa7c-d1a3b3d1d5f2", "title": "Service Installation with Suspicious Folder Pattern", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_susp_service_installation_folder_pattern.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "51aa9387-1c53-4153-91cc-d73c59ae1ca9", "title": "Invoke-Obfuscation Obfuscated IEX Invocation - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_obfuscated_iex_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "8e4cf0e5-aa5d-4dc3-beff-dc26917744a9", "title": "Tap Driver Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_tap_driver.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "91c49341-e2ef-40c0-ac45-49ec5c3fe26c", "title": "RTCore Suspicious Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_susp_rtcore64_service_install.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "7e9c7999-0f9b-4d4a-a6ed-af6d553d4af4", "title": "Invoke-Obfuscation Via Use MSHTA - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_mshta_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "4bb79b62-ef12-4861-981d-2aab43fab642", "title": "TacticalRMM Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_tacticalrmm.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "487c7524-f892-4054-b263-8a0ace63fc25", "title": "Invoke-Obfuscation Via Stdin - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_stdin_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "72862bf2-0eb1-11eb-adc1-0242ac120002", "title": "Invoke-Obfuscation STDIN+ Launcher - System", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_stdin_services.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "a2e5019d-a658-4c6a-92bf-7197b54e2cae", "title": "PowerShell Scripts Installed as Services", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_powershell_script_installed_as_service.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "85cce894-dd8b-4427-a958-5cc47a4dc9b9", "title": "Remote Utilities Host Service Install", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_install_remote_utilities.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "acfa2210-0d71-4eeb-b477-afab494d596c", "title": "Windows Service Terminated With Error", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_generic.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "52a85084-6989-40c3-8f32-091e12e13f09", "title": "smbexec.py Service Installation", "file": "../sigma/rules/windows/builtin/system/service_control_manager/win_system_hack_smbexec.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "e80a0fee-1a62-4419-b31e-0d0db6e6013a", "title": "Potential CVE-2021-42287 Exploitation Attempt", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_directory_services_sam/win_system_exploit_cve_2021_42287.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "39f919f3-980b-4e6f-a975-8af7e507ef2b", "title": "Critical Hive In Suspicious Location Access Bits Cleared", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_kernel_general/win_system_susp_critical_hive_location_access_bits_cleared.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "994bfd6d-0a2e-481e-a861-934069fcf5f5", "title": "Active Directory Certificate Services Denied Certificate Enrollment Request", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_certification_authority/win_system_adcs_enrollment_request_denied.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "13cfeb75-9e33-4d04-b0f7-ab8faaa95a59", "title": "Windows Update Error", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_windows_update_client/win_system_susp_system_update_error.yml", "status": "stable", "level": "informational", "logsource.category": null, "logsource.product": "windows"}, {"id": "13fc89a9-971e-4ca6-b9dc-aa53a445bf40", "title": "DHCP Server Loaded the CallOut DLL", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "75edd3fd-7146-48e5-9848-3013d7f0282c", "title": "DHCP Server Error Failed Loading the CallOut DLL", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config_failed.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "f512acbf-e662-4903-843e-97ce4652b740", "title": "Volume Shadow Copy Mount", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_ntfs/win_system_volume_shadow_copy_mount.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "bc2e25ed-b92b-4daa-b074-b502bdd1982b", "title": "Local Privilege Escalation Indicator TabTip", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_distributed_com/win_system_lpe_indicators_tabtip.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "f14719ce-d3ab-4e25-9ce6-2899092260b0", "title": "NTFS Vulnerability Exploitation", "file": "../sigma/rules/windows/builtin/system/ntfs/win_system_ntfs_vuln_exploit.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "aaa5b30d-f418-420b-83a0-299cb6024885", "title": "Potential RDP Exploit CVE-2019-0708", "file": "../sigma/rules/windows/builtin/system/termdd/win_system_rdp_potential_cve_2019_0708.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "100ef69e-3327-481c-8e5c-6d80d9507556", "title": "Important Windows Eventlog Cleared", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_eventlog/win_system_susp_eventlog_cleared.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "a62b37e0-45d3-48d9-a517-90c1a1b0186b", "title": "Eventlog Cleared", "file": "../sigma/rules/windows/builtin/system/microsoft_windows_eventlog/win_system_eventlog_cleared.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "a0cb7110-edf0-47a4-9177-541a4083128a", "title": "Vulnerable Netlogon Secure Channel Connection Allowed", "file": "../sigma/rules/windows/builtin/system/netlogon/win_system_vul_cve_2020_1472.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "18f37338-b9bd-4117-a039-280c81f7a596", "title": "Zerologon Exploitation Using Well-known Tools", "file": "../sigma/rules/windows/builtin/system/netlogon/win_system_possible_zerologon_exploitation_using_wellknown_tools.yml", "status": "stable", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "7ac407cc-0f48-4328-aede-de1d2e6fef41", "title": "Standard User In High Privileged Group", "file": "../sigma/rules/windows/builtin/lsa_server/win_lsa_server_normal_user_admin.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "83c161b6-ca67-4f33-8ad0-644a0737cf07", "title": "Suspicious Application Installed", "file": "../sigma/rules/windows/builtin/shell_core/win_shell_core_susp_packages_installed.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "b4c8da4a-1c12-46b0-8a2b-0a8521d03442", "title": "Restricted Software Access By SRP", "file": "../sigma/rules/windows/builtin/application/microsoft_windows_software_restriction_policies/win_software_restriction_policies_block.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "545a5da6-f103-4919-a519-e9aec1026ee4", "title": "Microsoft Malware Protection Engine Crash", "file": "../sigma/rules/windows/builtin/application/application_error/win_application_msmpeng_crash_error.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "a18e0862-127b-43ca-be12-1a542c75c7c5", "title": "Potential Credential Dumping Via WER - Application", "file": "../sigma/rules/windows/builtin/application/application_error/win_werfault_susp_lsass_credential_dump.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "48d91a3a-2363-43ba-a456-ca71ac3da5c2", "title": "Audit CVE Event", "file": "../sigma/rules/windows/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "5d19eb78-5b5b-4ef2-a9f0-4bfa94d58a13", "title": "Remote Access Tool - ScreenConnect File Transfer", "file": "../sigma/rules/windows/builtin/application/screenconnect/win_app_remote_access_tools_screenconnect_file_transfer.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "076ebe48-cc05-4d8f-9d41-89245cd93a14", "title": "Remote Access Tool - ScreenConnect Command Execution", "file": "../sigma/rules/windows/builtin/application/screenconnect/win_app_remote_access_tools_screenconnect_command_exec.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "94dc4390-6b7c-4784-8ffc-335334404650", "title": "Dump Ntds.dit To Suspicious Location", "file": "../sigma/rules/windows/builtin/application/esent/win_esent_ntdsutil_abuse_susp_location.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "e6e88853-5f20-4c4a-8d26-cd469fd8d31f", "title": "Ntdsutil Abuse", "file": "../sigma/rules/windows/builtin/application/esent/win_esent_ntdsutil_abuse.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "78bc5783-81d9-4d73-ac97-59f6db4f72a8", "title": "Relevant Anti-Virus Signature Keywords In Application Log", "file": "../sigma/rules/windows/builtin/application/Other/win_av_relevant_match.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "08200f85-2678-463e-9c32-88dce2f073d1", "title": "MSSQL Add Account To Sysadmin Role", "file": "../sigma/rules/windows/builtin/application/mssqlserver/win_mssql_add_sysadmin_account.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "b3d57a5c-c92e-4b48-9a79-5f124b7cf964", "title": "MSSQL SPProcoption Set", "file": "../sigma/rules/windows/builtin/application/mssqlserver/win_mssql_sp_procoption_set.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "d08dd86f-681e-4a00-a92c-1db218754417", "title": "MSSQL XPCmdshell Option Change", "file": "../sigma/rules/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_change.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "350dfb37-3706-4cdc-9e2e-5e24bc3a46df", "title": "MSSQL Disable Audit Settings", "file": "../sigma/rules/windows/builtin/application/mssqlserver/win_mssql_disable_audit_settings.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "7f103213-a04e-4d59-8261-213dddf22314", "title": "MSSQL XPCmdshell Suspicious Execution", "file": "../sigma/rules/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_audit_log.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "218d2855-2bba-4f61-9c85-81d0ea63ac71", "title": "MSSQL Server Failed Logon", "file": "../sigma/rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d", "title": "MSSQL Server Failed Logon From External Network", "file": "../sigma/rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon_from_external_network.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "9703792d-fd9a-456d-a672-ff92efe4806a", "title": "Backup Catalog Deleted", "file": "../sigma/rules/windows/builtin/application/microsoft_windows_backup/win_susp_backup_delete.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "87261fb2-69d0-42fe-b9de-88c6b5f65a43", "title": "Atera Agent Installation", "file": "../sigma/rules/windows/builtin/application/msiinstaller/win_software_atera_rmm_agent_install.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "570ae5ec-33dc-427c-b815-db86228ad43e", "title": "Application Uninstalled", "file": "../sigma/rules/windows/builtin/application/msiinstaller/win_builtin_remove_application.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "c7c8aa1c-5aff-408e-828b-998e3620b341", "title": "MSI Installation From Suspicious Locations", "file": "../sigma/rules/windows/builtin/application/msiinstaller/win_msi_install_from_susp_locations.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "5594e67a-7f92-4a04-b65d-1a42fd824a60", "title": "MSI Installation From Web", "file": "../sigma/rules/windows/builtin/application/msiinstaller/win_msi_install_from_web.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "6c82cf5c-090d-4d57-9188-533577631108", "title": "Microsoft Malware Protection Engine Crash - WER", "file": "../sigma/rules/windows/builtin/application/windows_error_reporting/win_application_msmpeng_crash_wer.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "9c8acf1a-cbf9-4db6-b63c-74baabe03e59", "title": "NTLM Brute Force", "file": "../sigma/rules/windows/builtin/ntlm/win_susp_ntlm_brute_force.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "ce5678bb-b9aa-4fb5-be4b-e57f686256ad", "title": "Potential Remote Desktop Connection to Non-Domain Host", "file": "../sigma/rules/windows/builtin/ntlm/win_susp_ntlm_rdp.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "98c3bcf1-56f2-49dc-9d8d-c66cf190238b", "title": "NTLM Logon", "file": "../sigma/rules/windows/builtin/ntlm/win_susp_ntlm_auth.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "31d68132-4038-47c7-8f8e-635a39a7c174", "title": "Potential Active Directory Reconnaissance/Enumeration Via LDAP", "file": "../sigma/rules/windows/builtin/ldap/win_ldap_recon.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "686c0b4b-9dd3-4847-9077-d6c1bbe36fcb", "title": "Windows Defender Virus Scanning Feature Disabled", "file": "../sigma/rules/windows/builtin/windefend/win_defender_virus_scan_disabled.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "360a1340-398a-46b6-8d06-99b905dc69d2", "title": "Windows Defender Grace Period Expired", "file": "../sigma/rules/windows/builtin/windefend/win_defender_antimalware_platform_expired.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "dd80db93-6ec2-4f4c-a017-ad40da6ffe81", "title": "Windows Defender Real-Time Protection Failure/Restart", "file": "../sigma/rules/windows/builtin/windefend/win_defender_real_time_protection_errors.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "2afe6582-e149-11ea-87d0-0242ac130003", "title": "Windows Defender Malware Detection History Deletion", "file": "../sigma/rules/windows/builtin/windefend/win_defender_history_delete.yml", "status": "test", "level": "informational", "logsource.category": null, "logsource.product": "windows"}, {"id": "b28e58e4-2a72-4fae-bdee-0fbe904db642", "title": "Windows Defender Real-time Protection Disabled", "file": "../sigma/rules/windows/builtin/windefend/win_defender_real_time_protection_disabled.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "a0a278fe-2c0e-4de2-ac3c-c68b08a9ba98", "title": "LSASS Access Detected via Attack Surface Reduction", "file": "../sigma/rules/windows/builtin/windefend/win_defender_asr_lsass_access.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "91903aba-1088-42ee-b680-d6d94fe002b0", "title": "Windows Defender Submit Sample Feature Disabled", "file": "../sigma/rules/windows/builtin/windefend/win_defender_config_change_sample_submission_consent.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "49e5bc24-8b86-49f1-b743-535f332c2856", "title": "Microsoft Defender Tamper Protection Trigger", "file": "../sigma/rules/windows/builtin/windefend/win_defender_tamper_protection_trigger.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "57b649ef-ff42-4fb0-8bf6-62da243a1708", "title": "Windows Defender Threat Detected", "file": "../sigma/rules/windows/builtin/windefend/win_defender_threat.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "97b9ce1e-c5ab-11ea-87d0-0242ac130003", "title": "PSExec and WMI Process Creations Block", "file": "../sigma/rules/windows/builtin/windefend/win_defender_asr_psexec_wmi.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "ea9bf0fa-edec-4fb8-8b78-b119f2528186", "title": "Windows Defender AMSI Trigger Detected", "file": "../sigma/rules/windows/builtin/windefend/win_defender_malware_detected_amsi_source.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "a3ab73f1-bd46-4319-8f06-4b20d0617886", "title": "Windows Defender Exploit Guard Tamper", "file": "../sigma/rules/windows/builtin/windefend/win_defender_config_change_exploit_guard_tamper.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "801bd44f-ceed-4eb6-887c-11544633c0aa", "title": "Windows Defender Configuration Changes", "file": "../sigma/rules/windows/builtin/windefend/win_defender_suspicious_features_tampering.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "bc275be9-0bec-4d77-8c8f-281a2df6710f", "title": "Windows Defender Malware And PUA Scanning Disabled", "file": "../sigma/rules/windows/builtin/windefend/win_defender_malware_and_pua_scan_disabled.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "bc92ca75-cd42-4d61-9a37-9d5aa259c88b", "title": "Win Defender Restored Quarantine File", "file": "../sigma/rules/windows/builtin/windefend/win_defender_restored_quarantine_file.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1321dc4e-a1fe-481d-a016-52c45f0c8b4f", "title": "Windows Defender Exclusions Added", "file": "../sigma/rules/windows/builtin/windefend/win_defender_config_change_exclusion_added.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "401e5d00-b944-11ea-8f9a-00163ecd60ae", "title": "File Was Not Allowed To Run", "file": "../sigma/rules/windows/builtin/applocker/win_applocker_file_was_not_allowed_to_run.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781", "title": "OpenSSH Server Listening On Socket", "file": "../sigma/rules/windows/builtin/openssh/win_sshd_openssh_server_listening_on_socket.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "9e3cb244-bdb8-4632-8c90-6079c8f4f16d", "title": "Important Scheduled Task Deleted", "file": "../sigma/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "424273ea-7cf8-43a6-b712-375f925e481f", "title": "Scheduled Task Executed From A Suspicious Location", "file": "../sigma/rules/windows/builtin/taskscheduler/win_taskscheduler_execution_from_susp_locations.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "f0767f15-0fb3-44b9-851e-e8d9a6d0005d", "title": "Scheduled Task Executed Uncommon LOLBIN", "file": "../sigma/rules/windows/builtin/taskscheduler/win_taskscheduler_lolbin_execution_via_task_scheduler.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "d29a20b2-be4b-4827-81f2-3d8a59eab5fc", "title": "Sysinternals Tools AppX Versions Execution", "file": "../sigma/rules/windows/builtin/appmodel_runtime/win_appmodel_runtime_sysinternals_tools_appx_execution.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "8e5c03fa-b7f0-11ea-b242-07e0576828d9", "title": "Denied Access To Remote Desktop", "file": "../sigma/rules/windows/builtin/security/win_security_not_allowed_rdp_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "f7644214-0eb0-4ace-9455-331ec4c09253", "title": "Kerberos Manipulation", "file": "../sigma/rules/windows/builtin/security/win_security_susp_kerberos_manipulation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "586a8d6b-6bfe-4ad9-9d78-888cd2fe50c3", "title": "Remote Service Activity via SVCCTL Named Pipe", "file": "../sigma/rules/windows/builtin/security/win_security_svcctl_remote_service.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "dcf2db1f-f091-425b-a821-c05875b8925a", "title": "Invoke-Obfuscation VAR+ Launcher - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_var_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc", "title": "Sysmon Channel Reference Deletion", "file": "../sigma/rules/windows/builtin/security/win_security_sysmon_channel_reference_deletion.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "f6de9536-0441-4b3f-a646-f4e00f300ffd", "title": "Weak Encryption Enabled and Kerberoast", "file": "../sigma/rules/windows/builtin/security/win_security_alert_enable_weak_encryption.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "571498c8-908e-40b4-910b-d2369159a3da", "title": "Password Protected ZIP File Opened (Email Attachment)", "file": "../sigma/rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_outlook.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "7a922f1b-2635-4d6c-91ef-af228b198ad3", "title": "Invoke-Obfuscation COMPRESS OBFUSCATION - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_via_compress_services_security.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "f241cf1b-3a6b-4e1a-b4f9-133c00dd95ca", "title": "Invoke-Obfuscation RUNDLL LAUNCHER - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_via_rundll_services_security.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "54f0434b-726f-48a1-b2aa-067df14516e4", "title": "Password Protected ZIP File Opened (Suspicious Filenames)", "file": "../sigma/rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_filename.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "311b6ce2-7890-4383-a8c2-663a9f6b43cd", "title": "Enabled User Right in AD to Control User Objects", "file": "../sigma/rules/windows/builtin/security/win_security_alert_active_directory_user_control.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "12ba6a38-adb3-4d6b-91ba-a7fb248e3199", "title": "Password Policy Enumerated", "file": "../sigma/rules/windows/builtin/security/win_security_password_policy_enumerated.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "dae8171c-5ec6-4396-b210-8466585b53e9", "title": "SCM Database Privileged Operation", "file": "../sigma/rules/windows/builtin/security/win_security_scm_database_privileged_operation.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "0badd08f-c6a3-4630-90d3-6875cca440be", "title": "User Logoff Event", "file": "../sigma/rules/windows/builtin/security/win_security_user_logoff.yml", "status": "test", "level": "informational", "logsource.category": null, "logsource.product": "windows"}, {"id": "1a0a2ff1-611b-4dac-8216-8a7b47c618a6", "title": "Invoke-Obfuscation Via Use Clip - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_clip_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "098d7118-55bc-4912-a836-dc6483a8d150", "title": "Access To ADMIN$ Network Share", "file": "../sigma/rules/windows/builtin/security/win_security_admin_share_access.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "80b708f3-d034-40e4-a6c8-d23b7a7db3d1", "title": "Invoke-Obfuscation Via Stdin - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_via_stdin_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "ff151c33-45fa-475d-af4f-c2f93571f4fe", "title": "Azure AD Health Monitoring Agent Registry Keys Access", "file": "../sigma/rules/windows/builtin/security/win_security_aadhealth_mon_agent_regkey_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "496a0e47-0a33-4dca-b009-9e6ca3591f39", "title": "Suspicious Kerberos RC4 Ticket Encryption", "file": "../sigma/rules/windows/builtin/security/win_security_susp_rc4_kerberos.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "45545954-4016-43c6-855e-eae8f1c369dc", "title": "Protected Storage Service Access", "file": "../sigma/rules/windows/builtin/security/win_security_protected_storage_service_access.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "6fb63b40-e02a-403e-9ffd-3bcc1d749442", "title": "Metasploit Or Impacket Service Installation Via SMB PsExec", "file": "../sigma/rules/windows/builtin/security/win_security_metasploit_or_impacket_smb_psexec_service_install.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "4c54ba8f-73d2-4d40-8890-d9cf1dca3d30", "title": "Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_via_var_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "a4c90ea1-2634-4ca0-adbb-35eae169b6fc", "title": "ETW Logging Disabled In .NET Processes - Registry", "file": "../sigma/rules/windows/builtin/security/win_security_dot_net_etw_tamper.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1d2ab8ac-1a01-423b-9c39-001510eae8e8", "title": "Azure AD Health Service Agents Registry Keys Access", "file": "../sigma/rules/windows/builtin/security/win_security_aadhealth_svc_agent_regkey_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "faa031b5-21ed-4e02-8881-2591f98d82ed", "title": "Unauthorized System Time Modification", "file": "../sigma/rules/windows/builtin/security/win_security_susp_time_modification.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "214e8f95-100a-4e04-bb31-ef6cba8ce07e", "title": "DCERPC SMB Spoolss Named Pipe", "file": "../sigma/rules/windows/builtin/security/win_security_dce_rpc_smb_spoolss_named_pipe.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "98054878-5eab-434c-85d4-72d4e5a3361b", "title": "HackTool - EDRSilencer Execution - Filter Added", "file": "../sigma/rules/windows/builtin/security/win_security_hktl_edr_silencer.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "ecbc5e16-58e0-4521-9c60-eb9a7ea4ad34", "title": "Meterpreter or Cobalt Strike Getsystem Service Installation - Security", "file": "../sigma/rules/windows/builtin/security/win_security_meterpreter_or_cobaltstrike_getsystem_service_install.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "f8748f2c-89dc-4d95-afb0-5a2dfdbad332", "title": "SAM Registry Hive Handle Request", "file": "../sigma/rules/windows/builtin/security/win_security_sam_registry_hive_handle_request.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "f63508a0-c809-4435-b3be-ed819394d612", "title": "Potential Privileged System Service Operation - SeLoadDriverPrivilege", "file": "../sigma/rules/windows/builtin/security/win_security_user_driver_loaded.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "a33f8808-2812-4373-ae95-8cfb82134978", "title": "Windows Defender Exclusion Deleted", "file": "../sigma/rules/windows/builtin/security/win_security_windows_defender_exclusions_write_deleted.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "24549159-ac1b-479c-8175-d42aea947cae", "title": "Hacktool Ruler", "file": "../sigma/rules/windows/builtin/security/win_security_alert_ruler.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "ab6bffca-beff-4baa-af11-6733f296d57a", "title": "Potential AD User Enumeration From Non-Machine Account", "file": "../sigma/rules/windows/builtin/security/win_security_ad_user_enumeration.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "f0d1feba-4344-4ca9-8121-a6c97bd6df52", "title": "Credential Dumping Tools Service Execution - Security", "file": "../sigma/rules/windows/builtin/security/win_security_mal_creddumper.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "53ad8e36-f573-46bf-97e4-15ba5bf4bb51", "title": "Password Change on Directory Service Restore Mode (DSRM) Account", "file": "../sigma/rules/windows/builtin/security/win_security_susp_dsrm_password_change.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "11d00fff-5dc3-428c-8184-801f292faec0", "title": "Service Registry Key Read Access Request", "file": "../sigma/rules/windows/builtin/security/win_security_registry_permissions_weakness_check.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "c462f537-a1e3-41a6-b5fc-b2c2cef9bf82", "title": "Suspicious PsExec Execution", "file": "../sigma/rules/windows/builtin/security/win_security_susp_psexec.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "46a68649-f218-4f86-aea1-16a759d81820", "title": "Windows Defender Exclusion List Modified", "file": "../sigma/rules/windows/builtin/security/win_security_windows_defender_exclusions_registry_modified.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "e9c8808f-4cfb-4ba9-97d4-e5f3beaa244d", "title": "Windows Defender Exclusion Registry Key - Write Access Requested", "file": "../sigma/rules/windows/builtin/security/win_security_windows_defender_exclusions_write_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "35bc7e28-ee6b-492f-ab04-da58fcf6402e", "title": "Windows Network Access Suspicious desktop.ini Action", "file": "../sigma/rules/windows/builtin/security/win_security_net_share_obj_susp_desktop_ini.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "1c480e10-7ee1-46d4-8ed2-85f9789e3ce4", "title": "Group Policy Abuse for Privilege Addition", "file": "../sigma/rules/windows/builtin/security/win_security_susp_group_policy_abuse_privilege_addition.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "c9eb55c3-b468-40ab-9089-db2862e42137", "title": "Device Installation Blocked", "file": "../sigma/rules/windows/builtin/security/win_security_device_installation_blocked.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "0c718a5e-4284-4fb9-b4d9-b9a50b3a1974", "title": "Invoke-Obfuscation STDIN+ Launcher - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_stdin_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "941e5c45-cda7-4864-8cea-bbb7458d194a", "title": "Suspicious Remote Logon with Explicit Credentials", "file": "../sigma/rules/windows/builtin/security/win_security_susp_logon_explicit_credentials.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "470ec5fa-7b4e-4071-b200-4c753100f49b", "title": "Failed Code Integrity Checks", "file": "../sigma/rules/windows/builtin/security/win_security_codeintegrity_check_failure.yml", "status": "stable", "level": "informational", "logsource.category": null, "logsource.product": "windows"}, {"id": "aa1697b7-d611-4f9a-9cb2-5125b4ccfd5c", "title": "Password Dumper Activity on LSASS", "file": "../sigma/rules/windows/builtin/security/win_security_susp_lsass_dump.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "7b687634-ab20-11ea-bb37-0242ac130002", "title": "Windows Pcap Drivers", "file": "../sigma/rules/windows/builtin/security/win_security_pcap_drivers.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "12e6d621-194f-4f59-90cc-1959e21e69f7", "title": "Register new Logon Process by Rubeus", "file": "../sigma/rules/windows/builtin/security/win_security_register_new_logon_process_by_rubeus.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "35ba1d85-724d-42a3-889f-2e2362bcaf23", "title": "AD Privileged Users or Groups Reconnaissance", "file": "../sigma/rules/windows/builtin/security/win_security_account_discovery.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "123e4e6d-b123-48f8-b261-7214938acaf0", "title": "Startup/Logon Script Added to Group Policy Object", "file": "../sigma/rules/windows/builtin/security/win_security_susp_group_policy_startup_script_added_to_gpo.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "9eb99343-d336-4020-a3cd-67f3819e68ee", "title": "Account Tampering - Suspicious Failed Logon Reasons", "file": "../sigma/rules/windows/builtin/security/win_security_susp_failed_logon_reasons.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "f6de6525-4509-495a-8a82-1f8b0ed73a00", "title": "Remote Task Creation via ATSVC Named Pipe", "file": "../sigma/rules/windows/builtin/security/win_security_atsvc_task.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "910ab938-668b-401b-b08c-b596e80fdca5", "title": "Transferring Files with Credential Data via Network Shares", "file": "../sigma/rules/windows/builtin/security/win_security_transf_files_with_cred_data_via_network_shares.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "4edf51e1-cb83-4e1a-bc39-800e396068e3", "title": "Invoke-Obfuscation CLIP+ Launcher - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_clip_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "2632954e-db1c-49cb-9936-67d1ef1d17d2", "title": "Addition of SID History to Active Directory Object", "file": "../sigma/rules/windows/builtin/security/win_security_susp_add_sid_history.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "300bac00-e041-4ee2-9c36-e262656a6ecc", "title": "Active Directory User Backdoors", "file": "../sigma/rules/windows/builtin/security/win_security_alert_ad_user_backdoors.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "9b8d9203-4e0f-4cd9-bb06-4cc4ea6d0e9a", "title": "Invoke-Obfuscation Via Use MSHTA - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_mshta_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "66b6be3d-55d0-4f47-9855-d69df21740ea", "title": "Local User Creation", "file": "../sigma/rules/windows/builtin/security/win_security_user_creation.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "8cd538a4-62d5-4e83-810b-12d41e428d6e", "title": "Processes Accessing the Microphone and Webcam", "file": "../sigma/rules/windows/builtin/security/win_security_camera_microphone_access.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "c265cf08-3f99-46c1-8d59-328247057d57", "title": "User Added to Local Administrator Group", "file": "../sigma/rules/windows/builtin/security/win_security_user_added_to_local_administrators.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "bfbd3291-de87-4b7c-88a2-d6a5deb28668", "title": "ADCS Certificate Template Configuration Vulnerability with Risky EKU", "file": "../sigma/rules/windows/builtin/security/win_security_adcs_certificate_template_configuration_vulnerability_eku.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "028c7842-4243-41cd-be6f-12f3cf1a26c7", "title": "AD Object WriteDAC Access", "file": "../sigma/rules/windows/builtin/security/win_security_ad_object_writedac_access.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "3a734d25-df5c-4b99-8034-af1ddb5883a4", "title": "Suspicious Scheduled Task Creation", "file": "../sigma/rules/windows/builtin/security/win_security_susp_scheduled_task_creation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "d7a95147-145f-4678-b85d-d1ff4a3bb3f6", "title": "CobaltStrike Service Installations - Security", "file": "../sigma/rules/windows/builtin/security/win_security_cobaltstrike_service_installs.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "f598ea0c-c25a-4f72-a219-50c44411c791", "title": "Possible Shadow Credentials Added", "file": "../sigma/rules/windows/builtin/security/win_security_susp_possible_shadow_credentials_added.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "6daac7fc-77d1-449a-a71a-e6b4d59a0e54", "title": "User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'", "file": "../sigma/rules/windows/builtin/security/win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "13addce7-47b2-4ca0-a98f-1de964d1d669", "title": "SCM Database Handle Failure", "file": "../sigma/rules/windows/builtin/security/win_security_scm_database_handle_failure.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "6a53d871-682d-40b6-83e0-b7c1a6c4e3a5", "title": "PetitPotam Suspicious Kerberos TGT Request", "file": "../sigma/rules/windows/builtin/security/win_security_petitpotam_susp_tgt_request.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "5bed80b6-b3e8-428e-a3ae-d3c757589e41", "title": "RDP over Reverse SSH Tunnel WFP", "file": "../sigma/rules/windows/builtin/security/win_security_rdp_reverse_tunnel.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "13acf386-b8c6-4fe0-9a6e-c4756b974698", "title": "Remote PowerShell Sessions Network Connections (WinRM)", "file": "../sigma/rules/windows/builtin/security/win_security_remote_powershell_session.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "c8b00925-926c-47e3-beea-298fd563728e", "title": "Remote Access Tool Services Have Been Installed - Security", "file": "../sigma/rules/windows/builtin/security/win_security_service_install_remote_access_software.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "d04ae2b8-ad54-4de0-bd87-4bc1da66aa59", "title": "Kerberoasting Activity - Initial Query", "file": "../sigma/rules/windows/builtin/security/win_security_kerberoasting_activity.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "7b14c76a-c602-4ae6-9717-eff868153fc0", "title": "HackTool - NoFilter Execution", "file": "../sigma/rules/windows/builtin/security/win_security_hktl_nofilter.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "39698b3f-da92-4bc6-bfb5-645a98386e45", "title": "Win Susp Computer Name Containing Samtheadmin", "file": "../sigma/rules/windows/builtin/security/win_security_susp_computer_name.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "32e19d25-4aed-4860-a55a-be99cb0bf7ed", "title": "Possible DC Shadow Attack", "file": "../sigma/rules/windows/builtin/security/win_security_possible_dc_shadow.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "d3abac66-f11c-4ed0-8acb-50cc29c97eed", "title": "NetNTLM Downgrade Attack", "file": "../sigma/rules/windows/builtin/security/win_security_net_ntlm_downgrade.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "91c945bc-2ad1-4799-a591-4d00198a1215", "title": "Suspicious Access to Sensitive File Extensions", "file": "../sigma/rules/windows/builtin/security/win_security_susp_raccess_sensitive_fext.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "17d619c1-e020-4347-957e-1d1207455c93", "title": "Active Directory Replication from Non Machine Account", "file": "../sigma/rules/windows/builtin/security/win_security_ad_replication_non_machine_account.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "2a926e6a-4b81-4011-8a96-e36cc8c04302", "title": "PowerShell Scripts Installed as Services - Security", "file": "../sigma/rules/windows/builtin/security/win_security_powershell_script_installed_as_service.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1bbf25b9-8038-4154-a50b-118f2a32be27", "title": "Suspicious Windows ANONYMOUS LOGON Local Account Created", "file": "../sigma/rules/windows/builtin/security/win_security_susp_local_anon_logon_created.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "0ee4d8a5-4e67-4faf-acfa-62a78457d1f2", "title": "HybridConnectionManager Service Installation", "file": "../sigma/rules/windows/builtin/security/win_security_hybridconnectionmgr_svc_installation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "2c99737c-585d-4431-b61a-c911d86ff32f", "title": "Powerview Add-DomainObjectAcl DCSync AD Extend Right", "file": "../sigma/rules/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "c39f0c81-7348-4965-ab27-2fde35a1b641", "title": "DCOM InternetExplorer.Application Iertutil DLL Hijack - Security", "file": "../sigma/rules/windows/builtin/security/win_security_dcom_iertutil_dll_hijack.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "4ac1f50b-3bd0-4968-902d-868b4647937e", "title": "DPAPI Domain Backup Key Extraction", "file": "../sigma/rules/windows/builtin/security/win_security_dpapi_domain_backupkey_extraction.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "411742ad-89b0-49cb-a7b0-3971b5c1e0a4", "title": "Locked Workstation", "file": "../sigma/rules/windows/builtin/security/win_security_workstation_was_locked.yml", "status": "stable", "level": "informational", "logsource.category": null, "logsource.product": "windows"}, {"id": "25cde13e-8e20-4c29-b949-4e795b76f16f", "title": "Suspicious Teams Application Related ObjectAcess Event", "file": "../sigma/rules/windows/builtin/security/win_security_teams_suspicious_objectaccess.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "69aeb277-f15f-4d2d-b32a-55e883609563", "title": "Windows Event Auditing Disabled", "file": "../sigma/rules/windows/builtin/security/win_security_disable_event_auditing.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "cfeed607-6aa4-4bbd-9627-b637deb723c8", "title": "New or Renamed User Account with '$' Character", "file": "../sigma/rules/windows/builtin/security/win_security_new_or_renamed_user_account_with_dollar_sign.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "eca91c7c-9214-47b9-b4c5-cb1d7e4f2350", "title": "Uncommon Outbound Kerberos Connection - Security", "file": "../sigma/rules/windows/builtin/security/win_security_susp_outbound_kerberos_connection.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "9c8afa4d-0022-48f0-9456-3712466f9701", "title": "Tap Driver Installation - Security", "file": "../sigma/rules/windows/builtin/security/win_security_tap_driver_installation.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "39a80702-d7ca-4a83-b776-525b1f86a36d", "title": "Secure Deletion with SDelete", "file": "../sigma/rules/windows/builtin/security/win_security_susp_sdelete.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "f69a87ea-955e-4fb4-adb2-bb9fd6685632", "title": "External Disk Drive Or USB Storage Device Was Recognized By The System", "file": "../sigma/rules/windows/builtin/security/win_security_external_device.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "9a4ff3b8-6187-4fd2-8e8b-e0eae1129495", "title": "SysKey Registry Keys Access", "file": "../sigma/rules/windows/builtin/security/win_security_syskey_registry_access.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "72124974-a68b-4366-b990-d30e0b2a190d", "title": "Metasploit SMB Authentication", "file": "../sigma/rules/windows/builtin/security/win_security_metasploit_authentication.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "d00a9a72-2c09-4459-ad03-5e0a23351e36", "title": "Suspicious LDAP-Attributes Used", "file": "../sigma/rules/windows/builtin/security/win_security_susp_ldap_dataexchange.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "32d56ea1-417f-44ff-822b-882873f5f43b", "title": "Impacket PsExec Execution", "file": "../sigma/rules/windows/builtin/security/win_security_impacket_psexec.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76", "title": "Potentially Suspicious AccessMask Requested From LSASS", "file": "../sigma/rules/windows/builtin/security/win_security_susp_lsass_dump_generic.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "20d96d95-5a20-4cf1-a483-f3bda8a7c037", "title": "Add or Remove Computer from DC", "file": "../sigma/rules/windows/builtin/security/win_security_add_remove_computer.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "f6c68d5f-e101-4b86-8c84-7d96851fd65c", "title": "T1047 Wmiprvse Wbemcomn DLL Hijack", "file": "../sigma/rules/windows/builtin/security/win_security_wmiprvse_wbemcomn_dll_hijack.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "968eef52-9cff-4454-8992-1e74b9cbad6c", "title": "Reconnaissance Activity", "file": "../sigma/rules/windows/builtin/security/win_security_susp_net_recon_activity.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "a8f29a7b-b137-4446-80a0-b804272f3da2", "title": "Persistence and Execution at Scale via GPO Scheduled Task", "file": "../sigma/rules/windows/builtin/security/win_security_gpo_scheduledtasks.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "39a94fd1-8c9a-4ff6-bf22-c058762f8014", "title": "DPAPI Domain Master Key Backup Attempt", "file": "../sigma/rules/windows/builtin/security/win_security_dpapi_domain_masterkey_backup_attempt.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "00ba9da1-b510-4f6b-b258-8d338836180f", "title": "Password Protected ZIP File Opened", "file": "../sigma/rules/windows/builtin/security/win_security_susp_opened_encrypted_zip.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "5ee3a654-372f-11ec-8d3d-0242ac130003", "title": "ADCS Certificate Template Configuration Vulnerability", "file": "../sigma/rules/windows/builtin/security/win_security_adcs_certificate_template_configuration_vulnerability.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "611eab06-a145-4dfa-a295-3ccc5c20f59a", "title": "Mimikatz DC Sync", "file": "../sigma/rules/windows/builtin/security/win_security_dcsync.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "cd0f7229-d16f-42de-8fe3-fba365fbcb3a", "title": "Invoke-Obfuscation Via Use Rundll32 - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_rundll32_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "7595ba94-cf3b-4471-aa03-4f6baa9e5fad", "title": "Important Scheduled Task Deleted/Disabled", "file": "../sigma/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "962fe167-e48d-4fd6-9974-11e5b9a5d6d1", "title": "LSASS Access From Non System Account", "file": "../sigma/rules/windows/builtin/security/win_security_lsass_access_non_system_account.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "c4e92a97-a9ff-4392-9d2d-7a4c642768ca", "title": "Service Installed By Unusual Client - Security", "file": "../sigma/rules/windows/builtin/security/win_security_service_installation_by_unusal_client.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "52d8b0c6-53d6-439a-9e41-52ad442ad9ad", "title": "First Time Seen Remote Named Pipe", "file": "../sigma/rules/windows/builtin/security/win_security_lm_namedpipe.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "614cf376-6651-47c4-9dcc-6b9527f749f4", "title": "Suspicious Scheduled Task Update", "file": "../sigma/rules/windows/builtin/security/win_security_susp_scheduled_task_update.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "0255a820-e564-4e40-af2b-6ac61160335c", "title": "A New Trust Was Created To A Domain", "file": "../sigma/rules/windows/builtin/security/win_security_susp_add_domain_trust.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "b210394c-ba12-4f89-9117-44a2464b9511", "title": "SMB Create Remote File Admin Share", "file": "../sigma/rules/windows/builtin/security/win_security_smb_file_creation_admin_shares.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "e9faba72-4974-4ab2-a4c5-46e25ad59e9b", "title": "VSSAudit Security Event Source Registration", "file": "../sigma/rules/windows/builtin/security/win_security_vssaudit_secevent_source_registration.yml", "status": "test", "level": "informational", "logsource.category": null, "logsource.product": "windows"}, {"id": "ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1", "title": "Important Windows Event Auditing Disabled", "file": "../sigma/rules/windows/builtin/security/win_security_disable_event_auditing_critical.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1de68c67-af5c-4097-9c85-fe5578e09e67", "title": "WCE wceaux.dll Access", "file": "../sigma/rules/windows/builtin/security/win_security_mal_wceaux_dll.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "fd0f5778-d3cb-4c9a-9695-66759d04702a", "title": "Invoke-Obfuscation Obfuscated IEX Invocation - Security", "file": "../sigma/rules/windows/builtin/security/win_security_invoke_obfuscation_obfuscated_iex_services_security.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "f033f3f3-fd24-4995-97d8-a3bb17550a88", "title": "WMI Persistence - Security", "file": "../sigma/rules/windows/builtin/security/win_security_wmi_persistence.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "7b449a5e-1db5-4dd0-a2dc-4e3a67282538", "title": "Hidden Local User Creation", "file": "../sigma/rules/windows/builtin/security/win_security_hidden_user_creation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "d99b79d2-0a6f-4f46-ad8b-260b6e17f982", "title": "Security Eventlog Cleared", "file": "../sigma/rules/windows/builtin/security/win_security_audit_log_cleared.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "5a44727c-3b85-4713-8c44-4401d5499629", "title": "Replay Attack Detected", "file": "../sigma/rules/windows/builtin/security/win_security_replay_attack_detected.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "252902e3-5830-4cf6-bf21-c22083dfd5cf", "title": "Possible Impacket SecretDump Remote Activity", "file": "../sigma/rules/windows/builtin/security/win_security_impacket_secretdump.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1ce8c8a3-2723-48ed-8246-906ac91061a6", "title": "Possible PetitPotam Coerce Authentication Attempt", "file": "../sigma/rules/windows/builtin/security/win_security_petitpotam_network_share.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "0248a7bc-8a9a-4cd8-a57e-3ae8e073a073", "title": "ISO Image Mounted", "file": "../sigma/rules/windows/builtin/security/win_security_iso_mount.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "f88e112a-21aa-44bd-9b01-6ee2a2bbbed1", "title": "Failed Logon From Public IP", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_susp_failed_logon_source.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "8eef149c-bd26-49f2-9e5a-9b00e3af499b", "title": "Pass the Hash Activity 2", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_pass_the_hash_2.yml", "status": "stable", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "02c39d30-02b5-45d2-b435-8aebfe5a8629", "title": "A Member Was Removed From a Security-Enabled Global Group", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_member_removed_security_enabled_global_group.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "def8b624-e08f-4ae1-8612-1ba21190da6b", "title": "Outgoing Logon with New Credentials", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_susp_logon_newcredentials.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "0f63e1ef-1eb9-4226-9d54-8927ca08520a", "title": "Admin User Remote Logon", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_admin_rdp_login.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "192a0330-c20b-4356-90b6-7b7049ae0b87", "title": "Successful Overpass the Hash Attempt", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_overpass_the_hash.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "259a9cdf-c4dd-4fa2-b243-2269e5ab18a2", "title": "External Remote RDP Logon from Public IP", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_successful_external_remote_rdp_login.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "8400629e-79a9-4737-b387-5db940ab2367", "title": "Scanner PoC for CVE-2019-0708 RDP RCE Vuln", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_rdp_bluekeep_poc_scanner.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "16f5d8ca-44bd-47c8-acbe-6fc95a16c12f", "title": "RottenPotato Like Attack Pattern", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_susp_rottenpotato.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "51e33403-2a37-4d66-a574-1fda1782cc31", "title": "RDP Login from Localhost", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_rdp_localhost_login.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "c43c26be-2e87-46c7-8661-284588c5a53e", "title": "A Member Was Added to a Security-Enabled Global Group", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_member_added_security_enabled_global_group.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "b237c54b-0f15-4612-a819-44b735e0de27", "title": "A Security-Enabled Global Group Was Deleted", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_security_enabled_global_group_deleted.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "02f7c9c1-1ae8-4c6a-8add-04693807f92f", "title": "Potential Access Token Abuse", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_access_token_abuse.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "749c9f5e-b353-4b90-a9c1-05243357ca4b", "title": "Potential Privilege Escalation via Local Kerberos Relay over LDAP", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_susp_privesc_kerberos_relay_over_ldap.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "2111118f-7e46-4fc8-974a-59fd8ec95196", "title": "DiagTrackEoP Default Login Username", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_diagtrack_eop_default_login_username.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "78d5cab4-557e-454f-9fb9-a222bd0d5edc", "title": "External Remote SMB Logon from Public IP", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "5af54681-df95-4c26-854f-2565e13cfab0", "title": "Successful Account Login Via WMI", "file": "../sigma/rules/windows/builtin/security/account_management/win_security_susp_wmi_login.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "bacf58c6-e199-4040-a94f-95dea0f1e45a", "title": "Windows Filtering Platform Blocked Connection From EDR Agent Binary", "file": "../sigma/rules/windows/builtin/security/object_access/win_security_wfp_endpoint_agent_blocked.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "dd857d3e-0c6e-457b-9b48-e82ae7f86bd7", "title": "New Module Module Added To IIS Server", "file": "../sigma/rules/windows/builtin/iis-configuration/win_iis_module_added.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f", "title": "Previously Installed IIS Module Was Removed", "file": "../sigma/rules/windows/builtin/iis-configuration/win_iis_module_removed.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "e8ebd53a-30c2-45bd-81bb-74befba07bdb", "title": "HTTP Logging Disabled On IIS Server", "file": "../sigma/rules/windows/builtin/iis-configuration/win_iis_logging_http_disabled.yml", "status": "experimental", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "a5b40a90-baf5-4bf7-a6f7-373494881d22", "title": "ETW Logging/Processing Option Disabled On IIS Server", "file": "../sigma/rules/windows/builtin/iis-configuration/win_iis_logging_etw_disabled.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "64d51a51-32a6-49f0-9f3d-17e34d640272", "title": "Ngrok Usage with Remote Desktop Service", "file": "../sigma/rules/windows/builtin/terminalservices/win_terminalservices_rdp_ngrok.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "1a4bd6e3-4c6e-405d-a9a3-53a116e341d4", "title": "USB Device Plugged", "file": "../sigma/rules/windows/builtin/driverframeworks/win_usb_device_plugged.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "0b7889b4-5577-4521-a60a-3376ee7f9f7b", "title": "WMI Persistence", "file": "../sigma/rules/windows/builtin/wmi/win_wmi_persistence.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "b5aa7d60-c17e-4538-97de-09029d6cd76b", "title": "Suspicious Digital Signature Of AppX Package", "file": "../sigma/rules/windows/builtin/appxpackaging_om/win_appxpackaging_om_sups_appx_signature.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "50cb47b8-2c33-4b23-a2e9-4600657d9746", "title": "Loading Diagcab Package From Remote Path", "file": "../sigma/rules/windows/builtin/diagnosis/scripted/win_diagnosis_scripted_load_remote_diagcab.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "0d18728b-f5bf-4381-9dcf-915539fff6c2", "title": "Suspicious Cobalt Strike DNS Beaconing - DNS Client", "file": "../sigma/rules/windows/builtin/dns_client/win_dns_client__mal_cobaltstrike.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "windows"}, {"id": "66474410-b883-415f-9f8d-75345a0a66a6", "title": "DNS Query To MEGA Hosting Website - DNS Client", "file": "../sigma/rules/windows/builtin/dns_client/win_dns_client_mega_nz.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "29f171d7-aa47-42c7-9c7b-3c87938164d9", "title": "DNS Query for Anonfiles.com Domain - DNS Client", "file": "../sigma/rules/windows/builtin/dns_client/win_dns_client_anonymfiles_com.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "8b69fd42-9dad-4674-abef-7fdef43ef92a", "title": "DNS Query To Put.io - DNS Client", "file": "../sigma/rules/windows/builtin/dns_client/win_dns_client_put_io.yml", "status": "experimental", "level": "medium", "logsource.category": null, "logsource.product": "windows"}, {"id": "090ffaad-c01a-4879-850c-6d57da98452d", "title": "DNS Query To Ufile.io - DNS Client", "file": "../sigma/rules/windows/builtin/dns_client/win_dns_client_ufile_io.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "8384bd26-bde6-4da9-8e5d-4174a7a47ca2", "title": "Query Tor Onion Address - DNS Client", "file": "../sigma/rules/windows/builtin/dns_client/win_dns_client_tor_onion.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "6f156c48-3894-4952-baf0-16193e9067d2", "title": "CodeIntegrity - Blocked Image Load With Revoked Certificate", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_image_blocked.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "881b7725-47cc-4055-8000-425823344c59", "title": "CodeIntegrity - Revoked Image Loaded", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_image_loaded.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "e4be5675-4a53-426a-8c81-a8bb2387e947", "title": "CodeIntegrity - Blocked Image/Driver Load For Policy Violation", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_enforced_policy_block.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "9b72b82d-f1c5-4632-b589-187159bc6ec1", "title": "CodeIntegrity - Blocked Driver Load With Revoked Certificate", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_blocked.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "320fccbf-5e32-4101-82b8-2679c5f007c6", "title": "CodeIntegrity - Revoked Kernel Driver Loaded", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_loaded.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "2f8cd7a0-9d5a-4f62-9f8b-2c951aa0dd1f", "title": "CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_whql_failure.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "c92c24e7-f595-493f-9c98-53d5142f5c18", "title": "CodeIntegrity - Unsigned Image Loaded", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_unsigned_image_loaded.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "f8931561-97f5-4c46-907f-0a4a592e47a7", "title": "CodeIntegrity - Unmet Signing Level Requirements By File Under Validation", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_attempted_dll_load.yml", "status": "experimental", "level": "low", "logsource.category": null, "logsource.product": "windows"}, {"id": "5daf11c3-022b-4969-adb9-365e6c078c7c", "title": "CodeIntegrity - Disallowed File For Protected Processes Has Been Blocked", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_blocked_protected_process_file.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "951f8d29-f2f6-48a7-859f-0673ff105e6f", "title": "CodeIntegrity - Unsigned Kernel Module Loaded", "file": "../sigma/rules/windows/builtin/code_integrity/win_codeintegrity_unsigned_driver_loaded.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "windows"}, {"id": "c4b890e5-8d8c-4496-8c66-c805753817cd", "title": "Potential Process Hollowing Activity", "file": "../sigma/rules/windows/process_tampering/proc_tampering_susp_process_hollowing.yml", "status": "test", "level": "medium", "logsource.category": "process_tampering", "logsource.product": "windows"}, {"id": "2e4e488a-6164-4811-9ea1-f960c7359c40", "title": "HackTool - CACTUSTORCH Remote Thread Creation", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_hktl_cactustorch.yml", "status": "test", "level": "high", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "66d31e5f-52d6-40a4-9615-002d3789a119", "title": "Remote Thread Creation By Uncommon Source Image", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_source_image.yml", "status": "experimental", "level": "medium", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "02d1d718-dd13-41af-989d-ea85c7fab93f", "title": "Rare Remote Thread Creation By Uncommon Source Image", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_susp_relevant_source_image.yml", "status": "experimental", "level": "high", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "99b97608-3e21-4bfe-8217-2a127c396a0e", "title": "Remote Thread Creation Via PowerShell In Uncommon Target", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_powershell_susp_targets.yml", "status": "test", "level": "medium", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "c15e99a3-c474-48ab-b9a7-84549a7a9d16", "title": "Remote Thread Creation Ttdinject.exe Proxy", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_ttdinjec.yml", "status": "test", "level": "high", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "a1a144b7-5c9b-4853-a559-2172be8d4a03", "title": "Remote Thread Creation In Uncommon Target Image", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_target_image.yml", "status": "experimental", "level": "medium", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "c0aac16a-b1e7-4330-bab0-3c27bb4987c7", "title": "Remote Thread Creation In Mstsc.Exe From Suspicious Location", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_mstsc_susp_location.yml", "status": "experimental", "level": "high", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f", "title": "Remote Thread Created In Shell Application", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_susp_target_shell_application.yml", "status": "experimental", "level": "medium", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "fb656378-f909-47c1-8747-278bf09f4f4f", "title": "Potential Credential Dumping Attempt Via PowerShell Remote Thread", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_powershell_lsass.yml", "status": "test", "level": "high", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "77564cc2-7382-438b-a7f6-395c2ae53b9a", "title": "Remote Thread Created In KeePass.EXE", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_keepass.yml", "status": "test", "level": "high", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "6309645e-122d-4c5b-bb2b-22e4f9c2fa42", "title": "HackTool - Potential CobaltStrike Process Injection", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_hktl_cobaltstrike.yml", "status": "test", "level": "high", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "f239b326-2f41-4d6b-9dfa-c846a60ef505", "title": "Password Dumper Remote Thread in LSASS", "file": "../sigma/rules/windows/create_remote_thread/create_remote_thread_win_susp_password_dumper_lsass.yml", "status": "stable", "level": "high", "logsource.category": "create_remote_thread", "logsource.product": "windows"}, {"id": "caa06de8-fdef-4c91-826a-7f9e163eef4b", "title": "RunDLL32 Spawning Explorer", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_spawn_explorer.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "title": "Suspicious VBoxDrvInst.exe Parameters", "file": "../sigma/rules/windows/process_creation/proc_creation_win_virtualbox_vboxdrvinst_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "754ed792-634f-40ae-b3bc-e0448d33f695", "title": "Suspicious PowerShell Parent Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_susp_parent_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2158f96f-43c2-43cb-952a-ab4580f32382", "title": "Screen Capture Activity Via Psr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_psr_capture_screenshots.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "title": "Service Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_service.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d797268e-28a9-49a7-b9a8-2f5039011c5c", "title": "Bypass UAC via WSReset.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "title": "Suspicious Serv-U Process Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_servu_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f426547a-e0f7-441a-b63e-854ac5bdf54d", "title": "Perl Inline Command Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_perl_inline_command_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "title": "UAC Bypass Using Windows Media Player - Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_wmp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "title": "Audio Capture via PowerShell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_audio_capture.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6d3a3952-6530-44a3-8554-cf17c116c615", "title": "Potentially Suspicious JWT Token Search Via CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_jwt_token_search.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "title": "New Virtual Smart Card Created Via TpmVscMgr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_tpmvscmgr_add_virtual_smartcard.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4c0aaedc-154c-4427-ada0-d80ef9c9deb6", "title": "Process Access via TrolleyExpress Exclusion", "file": "../sigma/rules/windows/process_creation/proc_creation_win_citrix_trolleyexpress_procdump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "title": "Suspicious Download from Office Domain", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_download_office_domain.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a4824fca-976f-4964-b334-0621379e84c4", "title": "Potential File Overwrite Via Sysinternals SDelete", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_sdelete.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "title": "File Download And Execution Via IEExec.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ieexec_download.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "92a974db-ab84-457f-9ec0-55db83d7a825", "title": "Potential AMSI Bypass Using NULL Bits", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_amsi_null_bits_bypass.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f9578658-9e71-4711-b634-3f9b50cd3c06", "title": "Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_3.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "title": "Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_2.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "title": "Uncommon Link.EXE Parent Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_link_uncommon_parent_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "title": "XBAP Execution From Uncommon Locations Via PresentationHost.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_presentationhost_uncommon_location_exec.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "title": "UAC Bypass via Windows Firewall Snap-In Hijack", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_hijacking_firwall_snap_in.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f5240972-3938-4e56-8e4b-e33893176c1f", "title": "Suspicious Query of MachineGUID", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_machineguid.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fff9d2b7-e11c-4a69-93d3-40ef66189767", "title": "Suspicious Copy From or To System Directory", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_copy_system_dir.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cc9d3712-6310-4320-b2df-7cb408274d53", "title": "Rebuild Performance Counter Values Via Lodctr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lodctr_performance_counter_tampering.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "title": "Renamed PsExec Service Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_psexec_service.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "title": "HackTool - SharpChisel Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharp_chisel.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "327ff235-94eb-4f06-b9de-aaee571324be", "title": "Regsvr32 Execution From Highly Suspicious Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_susp_exec_path_2.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "42a993dd-bb3e-48c8-b372-4d6684c4106c", "title": "HackTool - CrackMapExec Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "title": "New User Created Via Net.EXE With Never Expire Option", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_user_add_never_expire.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "36210e0d-5b19-485d-a087-c096088885f0", "title": "Suspicious PowerShell Parameter Substring", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1723e720-616d-4ddc-ab02-f7e3685a4713", "title": "Rundll32 Spawned Via Explorer.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_parent_explorer.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "90fb5e62-ca1f-4e22-b42e-cc521874c938", "title": "Suspicious Shells Spawn by Java Utility Keytool", "file": "../sigma/rules/windows/process_creation/proc_creation_win_java_keytool_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "title": "Ruby Inline Command Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ruby_inline_command_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "57c4bf16-227f-4394-8ec7-1b745ee061c3", "title": "Firewall Disabled via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_fw_disable.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "title": "Suspicious Where Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_where_browser_data_recon.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0ea52357-cd59-4340-9981-c46c7e900428", "title": "Potentially Suspicious Rundll32.EXE Execution of UDL File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_udl_exec.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7aa7009a-28b9-4344-8c1f-159489a390df", "title": "HackTool - Windows Credential Editor (WCE) Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_wce.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "title": "MMC Spawning Windows Shell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9719a8aa-401c-41af-8108-ced7ec9cd75c", "title": "Windows Defender Definition Files Removed", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mpcmdrun_remove_windows_defender_definition.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "title": "Powershell Inline Execution From A File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_exec_data_file.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "title": "Time Travel Debugging Utility Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_tttracer_mod_load.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "title": "HackTool - Impersonate Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_impersonate.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "title": "Suspicious Splwow64 Without Params", "file": "../sigma/rules/windows/process_creation/proc_creation_win_splwow64_cli_anomaly.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "title": "Potential Script Proxy Execution Via CL_Mutexverifiers.ps1", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_cl_mutexverifiers.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "title": "Process Creation Using Sysnative Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_sysnative.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "title": "Suspicious Scheduled Task Creation Involving Temp Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_creation_temp_folder.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "145322e4-0fd3-486b-81ca-9addc75736d8", "title": "Use of UltraVNC Remote Access Software", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ultravnc.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "587254ee-a24b-4335-b3cd-065c0f1f4baa", "title": "Remote File Download Via Findstr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_download.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "98b53e78-ebaf-46f8-be06-421aafd176d9", "title": "HackTool - winPEAS Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_winpeas.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "title": "WMI Backdoor Exchange Transport Agent", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmi_backdoor_exchange_transport_agent.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b5746143-59d6-4603-8d06-acbd60e166ee", "title": "Uncommon Child Process Of AddinUtil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c09dad97-1c78-4f71-b127-7edb2b8e491a", "title": "Execution of Suspicious File Type Extension", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_non_exe_image.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "551d9c1f-816c-445b-a7a6-7a3864720d60", "title": "Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_excel_dcom_lateral_movement.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e31033fc-33f0-4020-9a16-faf9b31cbf08", "title": "PUA - Netcat Suspicious Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_netcat.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "title": "HackTool - UACMe Akagi Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_uacme.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "title": "Csc.EXE Execution Form Potentially Suspicious Parent", "file": "../sigma/rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "title": "Renamed ProcDump Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_procdump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "title": "Msiexec Quiet Installation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msiexec_install_quiet.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8e3c7994-131e-4ba5-b6ea-804d49113a26", "title": "Uncommon Child Process Spawned By Odbcconf.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_odbcconf_uncommon_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "title": "Remote CHM File Download/Execution Via HH.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hh_chm_remote_download_or_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e32d4572-9826-4738-b651-95fa63747e8a", "title": "Base64 Encoded PowerShell Command Detected", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_frombase64string.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "043c4b8b-3a54-4780-9682-081cb6b8185c", "title": "Suspicious IIS Module Registration", "file": "../sigma/rules/windows/process_creation/proc_creation_win_iis_susp_module_registration.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "title": "Potential Arbitrary Command Execution Via FTP.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ftp_arbitrary_command_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c363385c-f75d-4753-a108-c1a8e28bdbda", "title": "Potential Manage-bde.wsf Abuse To Proxy Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_manage_bde.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5cb299fc-5fb1-4d07-b989-0644c68b6043", "title": "Suspicious File Download From IP Via Curl.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_susp_extensions.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "title": "Exports Registry Key To a File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regedit_export_keys.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "811f459f-9231-45d4-959a-0266c6311987", "title": "Suspicious Child Process Of BgInfo.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bginfo_suspicious_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "title": "Uncommon Child Process Of Appvlp.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_appvlp_uncommon_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7d6d30b8-5b91-4b90-a891-46cccaf29598", "title": "Program Executed Using Proxy/Local Command Via SSH.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ssh_proxy_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "title": "Suspicious Workstation Locking via Rundll32", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_user32_dll.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "title": "Suspicious Parent Double Extension File Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_double_extension_parent.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "title": "File Decoded From Base64/Hex Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_decode.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "title": "Query Usage To Exfil Data", "file": "../sigma/rules/windows/process_creation/proc_creation_win_query_session_exfil.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "title": "Potential WinAPI Calls Via CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_inline_win_api_access.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "087790e3-3287-436c-bccf-cbd0184a7db1", "title": "Potential CommandLine Path Traversal Via Cmd.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_path_traversal.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "title": "HackTool - Bloodhound/Sharphound Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_bloodhound_sharphound.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6812a10b-60ea-420c-832f-dfcc33b646ba", "title": "Potential PowerShell Execution Via DLL", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_powershell_execution_via_dll.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "84b14121-9d14-416e-800b-f3b829c5a14d", "title": "Suspicious CustomShellHost Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_customshellhost.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "32e280f1-8ad4-46ef-9e80-910657611fbc", "title": "Potential Homoglyph Attack Using Lookalike Characters", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_homoglyph_cyrillic_lookalikes.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1444443e-6757-43e4-9ea4-c8fc705f79a2", "title": "Boot Configuration Tampering Via Bcdedit.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bcdedit_boot_conf_tamper.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "title": "Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bcdedit_susp_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "title": "7Zip Compressing Dump Files", "file": "../sigma/rules/windows/process_creation/proc_creation_win_7zip_exfil_dmp_files.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9cfc00b6-bfb7-49ce-9781-ef78503154bb", "title": "Wlrmdr.EXE Uncommon Argument Or Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wlrmdr_uncommon_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "title": "Winrar Compressing Dump Files", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winrar_exfil_dmp_files.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3f5491e2-8db8-496b-9e95-1029fce852d4", "title": "Driver/DLL Installation Via Odbcconf.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_odbcconf_driver_install.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "title": "Suspicious Execution From Outlook Temporary Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_outlook_execution_from_temp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "02030f2f-6199-49ec-b258-ea71b07e03dc", "title": "Malicious PowerShell Commandlets - ProcessCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_malicious_cmdlets.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "74403157-20f5-415d-89a7-c505779585cf", "title": "ConvertTo-SecureString Cmdlet Usage Via CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_cmdline_convertto_securestring.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "52ff7941-8211-46f9-84f8-9903efb7077d", "title": "HackTool - PPID Spoofing SelectMyParent Tool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_selectmyparent.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "title": "LSA PPL Protection Disabled Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_lsa_ppl_protection_disabled.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4d7cda18-1b12-4e52-b45c-d28653210df8", "title": "Sysmon Driver Unloaded Via Fltmc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_fltmc_unload_driver_sysmon.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "title": "Mavinject Inject DLL Into Running Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "title": "Service Registry Key Deleted Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_delete_services.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c9783e20-4793-4164-ba96-d9ee483992c4", "title": "Logged-On User Password Change Via Ksetup.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ksetup_password_change_user.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "title": "File Encryption Using Gpg4win", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gpg4win_encryption.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "title": "Potential RDP Tunneling Via Plink", "file": "../sigma/rules/windows/process_creation/proc_creation_win_plink_susp_tunneling.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "94771a71-ba41-4b6e-a757-b531372eaab6", "title": "File Download From Browser Process Via Inline URL", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_inline_file_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2f869d59-7f6a-4931-992c-cce556ff2d53", "title": "Potential Adplus.EXE Abuse", "file": "../sigma/rules/windows/process_creation/proc_creation_win_adplus_memory_dump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "title": "Suspicious AddinUtil.EXE CommandLine Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_addinutil_suspicious_cmdline.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "title": "Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dotnet_arbitrary_dll_csproj_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "title": "Suspicious Rundll32 Invoking Inline VBScript", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_inline_vbs.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "title": "File Download Via Bitsadmin To An Uncommon Target Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bitsadmin_download_uncommon_targetfolder.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "title": "Potential Download/Upload Activity Using Type Command", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_type_arbitrary_file_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1775e15e-b61b-4d14-a1a3-80981298085a", "title": "Rundll32 Execution Without CommandLine Parameters", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_no_params.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "title": "HackTool - Impacket Tools Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_impacket_tools.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "42b1a5b8-353f-4f10-b256-39de4467faff", "title": "Harvesting Of Wifi Credentials Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_wifi_credential_harvesting.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "title": "New Root Certificate Installed Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_certificate_installation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9292293b-8496-4715-9db6-37028dcda4b3", "title": "Replace.exe Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_replace.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b1876533-4ed5-4a83-90f3-b8645840a413", "title": "HackTool - SafetyKatz Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_safetykatz.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "52788a70-f1da-40dd-8fbd-73b5865d6568", "title": "JScript Compiler Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_jsc_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "349d891d-fef0-4fe4-bc53-eee623a15969", "title": "Use Short Name Path in Command Line", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_cli.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "title": "Suspicious File Encoded To Base64 Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "title": "Sysprep on AppData Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysprep_appdata.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6f3e2987-db24-4c78-a860-b4f4095a7095", "title": "Files Added To An Archive Using Rar.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rar_compress_data.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1ec65a5f-9473-4f12-97da-622044d6df21", "title": "Powershell Defender Disable Scan Feature", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_defender_disable_feature.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d042284c-a296-4988-9be5-f424fadcc28c", "title": "Suspicious Execution of InstallUtil Without Log", "file": "../sigma/rules/windows/process_creation/proc_creation_win_instalutil_no_log_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "title": "Mshtml.DLL RunHTMLApplication Suspicious Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_mshtml_runhtmlapplication.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "title": "Suspicious Driver Install by pnputil.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_susp_driver_installed_by_pnputil.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1327381e-6ab0-4f38-b583-4c1b8346a56b", "title": "Potential Command Line Path Traversal Evasion Attempt", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_commandline_path_traversal_evasion.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "title": "HackTool - Stracciatella Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_stracciatella_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9ef27c24-4903-4192-881a-3adde7ff92a5", "title": "Renamed Remote Utilities RAT (RURAT) Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_rurat.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "title": "Shell Process Spawned by Java.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_java_susp_child_process_2.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "title": "HackTool - SysmonEOP Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sysmoneop.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9ec9fb1b-e059-4489-9642-f270c207923d", "title": "Hiding User Account Via SpecialAccounts Registry Key - CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_special_accounts_hide_user.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "058f4380-962d-40a5-afce-50207d36d7e2", "title": "HackTool - CrackMapExec Execution Patterns", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution_patterns.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fe63010f-8823-4864-a96b-a7b4a0f7b929", "title": "LSASS Process Reconnaissance Via Findstr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_lsass.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "title": "Webshell Hacking Activity Patterns", "file": "../sigma/rules/windows/process_creation/proc_creation_win_webshell_hacking.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "title": "Malicious Base64 Encoded PowerShell Keywords in Command Lines", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_hidden_flag.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "title": "Suspicious Process Masquerading As SvcHost.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "title": "Potentially Suspicious Regsvr32 HTTP IP Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_http_ip_pattern.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "758ff488-18d5-4cbe-8ec4-02b6285a434f", "title": "Remote Access Tool - NetSupport Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_netsupport.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c86133ad-4725-4bd0-8170-210788e0a7ba", "title": "Net WebClient Casing Anomalies", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_webclient_casing.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d08a2711-ee8b-4323-bdec-b7d85e892b31", "title": "PUA - CsExec Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_csexec.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f5d19838-41b5-476c-98d8-ba8af4929ee2", "title": "LOL-Binary Copied From System Directory", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_copy_system_dir_lolbin.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "title": "Remote Access Tool - Team Viewer Session Started On Windows Host", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_teamviewer_incoming_connection.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "82880171-b475-4201-b811-e9c826cd5eaa", "title": "Exports Critical Registry Keys To a File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regedit_export_critical_keys.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "023c654f-8f16-44d9-bb2b-00ff36a62af9", "title": "Python Function Execution Security Warning Disabled In Excel", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_office_disable_python_security_warnings.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d557dc06-62e8-4468-a8e8-7984124908ce", "title": "HackTool - WinPwn Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_winpwn.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "title": "CobaltStrike Load by Rundll32", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_load_by_rundll32.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "title": "Persistence Via Sticky Key Backdoor", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_sticky_keys_replace.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "title": "Use of VisualUiaVerifyNative.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_visualuiaverifynative.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a642964e-bead-4bed-8910-1bb4d63e3b4d", "title": "HackTool - Mimikatz Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_mimikatz_command_line.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "title": "HackTool - CreateMiniDump Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_createminidump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e4a6b256-3e47-40fc-89d2-7a477edd6915", "title": "System File Execution Location Anomaly", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "title": "Suspicious File Downloaded From Direct IP Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "title": "HackTool - SharpLDAPmonitor Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharp_ldap_monitor.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "title": "PrintBrm ZIP Creation of Extraction", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_printbrm.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "46123129-1024-423e-9fae-43af4a0fa9a5", "title": "File Download Via Windows Defender MpCmpRun.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mpcmdrun_download_arbitrary_file.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9fff585c-c33e-4a86-b3cd-39312079a65f", "title": "Taskmgr as LOCAL_SYSTEM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_taskmgr_localsystem.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "title": "Procdump Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_procdump.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fa00b701-44c6-4679-994d-5a18afa8a707", "title": "PUA - AdvancedRun Suspicious Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "title": "Suspicious WebDav Client Execution Via Rundll32.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_webdav_client_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "313d6012-51a0-4d93-8dfc-de8553239e25", "title": "Install New Package Via Winget Local Manifest", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "title": "Group Membership Reconnaissance Via Whoami.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_whoami_groups_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "title": "XSL Script Execution Via WMIC.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8d63dadf-b91b-4187-87b6-34a1114577ea", "title": "Potential SquiblyTwo Technique Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "title": "Potential Commandline Obfuscation Using Escape Characters", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_escape_char.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b36d01a3-ddaf-4804-be18-18a6247adfcd", "title": "Add Windows Capability Via PowerShell Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_add_windows_capability.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aaf46cdc-934e-4284-b329-34aa701e3771", "title": "Uncommon Child Process Of BgInfo.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bginfo_uncommon_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "575dce0c-8139-4e30-9295-1ee75969f7fe", "title": "Potential Reconnaissance Activity Via GatherNetworkInfo.VBS", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "title": "All Backups Deleted Via Wbadmin.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wbadmin_delete_all_backups.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "title": "PUA - Nmap/Zenmap Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_nmap_zenmap.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a1473adb-5338-4a20-b4c3-126763e2d3d3", "title": "Suspicious Advpack Call Via Rundll32.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_advpack_obfuscated_ordinal_call.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "title": "Renamed NirCmd.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_nircmd.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "title": "HackTool - TruffleSnout Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_trufflesnout.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "241e802a-b65e-484f-88cd-c2dc10f9206d", "title": "Read Contents From Stdin Via Cmd.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_stdin_redirect.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fd877b94-9bb5-4191-bb25-d79cbd93c167", "title": "Dumping of Sensitive Hives Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_dumping_sensitive_hives.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d047726b-c71c-4048-a99b-2e2f50dc107d", "title": "Kavremover Dropped Binary LOLBIN Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_kavremover_uncommon_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "40b95d31-1afc-469e-8d34-9a3a667d058e", "title": "Suspicious Csi.exe Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_csi_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "title": "UAC Bypass via ICMLuaUtil", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_icmluautil.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e6c54d94-498c-4562-a37c-b469d8e9a275", "title": "Suspicious PowerShell Download and Execute Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_susp_download_patterns.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "64760eef-87f7-4ed3-93fd-655668ea9420", "title": "Use of Scriptrunner.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_scriptrunner.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "title": "Suspicious Msiexec Quiet Install From Remote Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msiexec_install_remote.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "da2738f2-fadb-4394-afa7-0a0674885afa", "title": "Sdclt Child Processes", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sdclt_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6938366d-8954-4ddc-baff-c830b3ba8fcd", "title": "HackTool - Certipy Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_certipy.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "88872991-7445-4a22-90b2-a3adadb0e827", "title": "Stop Windows Service Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_stop_service.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f576a613-2392-4067-9d1a-9345fb58d8d1", "title": "Automated Collection Command Prompt", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_automated_collection.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "431a1fdb-4799-4f3b-91c3-a683b003fc49", "title": "New Kernel Driver Via SC.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_new_kernel_driver.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "title": "HackTool - Hashcat Password Cracker Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_hashcat.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4931188c-178e-4ee7-a348-39e8a7a56821", "title": "Filter Driver Unloaded Via Fltmc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_fltmc_unload_driver.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "85ff530b-261d-48c6-a441-facaa2e81e48", "title": "New Service Creation Using Sc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_create_service.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "title": "WMI Persistence - Script Event Consumer", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmi_persistence_script_event_consumer.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "title": "Suspicious Use of CSharp Interactive Console", "file": "../sigma/rules/windows/process_creation/proc_creation_win_csi_use_of_csharp_console.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8cbc9475-8d05-4e27-9c32-df960716c701", "title": "Potentially Suspicious Desktop Background Change Using Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_desktop_background_change.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "378a05d8-963c-46c9-bcce-13c7657eac99", "title": "Potentially Suspicious Electron Application CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_electron_execution_proxy.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e8d34729-86a4-4140-adfd-0a29c2106307", "title": "HackTool - CoercedPotato Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_coercedpotato.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "title": "ETW Trace Evasion Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "title": "Potential RDP Tunneling Via SSH", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ssh_rdp_tunneling.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e568650b-5dcd-4658-8f34-ded0b1e13992", "title": "Potential Product Class Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_product_class.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f208d6d8-d83a-4c2c-960d-877c37da84e5", "title": "Process Launched Without Image Name", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_no_image_name.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "514e4c3a-c77d-4cde-a00f-046425e2301e", "title": "Abuse of Service Permissions to Hide Services Via Set-Service", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_hide_services_via_set_service.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "title": "Suspicious Diantz Alternate Data Stream Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "01aeb693-138d-49d2-9403-c4f52d7d3d62", "title": "RDP Connection Allowed Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_fw_allow_rdp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "title": "New Firewall Rule Added Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_fw_add_rule.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "83865853-59aa-449e-9600-74b9d89a6d6e", "title": "Audio Capture via SoundRecorder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_soundrecorder_audio_capture.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "title": "Disabled IE Security Features", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_disable_ie_features.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "title": "Raccine Uninstall", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_disable_raccine.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "title": "File Download Via InstallUtil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_installutil_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0ba1da6d-b6ce-4366-828c-18826c9de23e", "title": "Potential Defense Evasion Via Rename Of Highly Relevant Binaries", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "title": "Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_4.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b53317a0-8acf-4fd1-8de8-a5401e776b96", "title": "Application Removed Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_uninstall_application.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "title": "Suspicious Scheduled Task Name As GUID", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_guid_task_name.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "title": "Suspicious Group And Account Reconnaissance Activity Using Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_groups_and_accounts_recon.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "10344bb3-7f65-46c2-b915-2d00d47be5b0", "title": "IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_ie_security_zone_protocol_defaults_downgrade.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "title": "PUA - Mouse Lock Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_mouselock_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "185d7418-f250-42d0-b72e-0c8b70661e93", "title": "Suspicious Diantz Download and Compress Into a CAB File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_diantz_remote_cab.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "379fa130-190e-4c3f-b7bc-6c8e834485f3", "title": "File Deletion Via Del", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_del_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "title": "Suspicious File Download From File Sharing Domain Via Curl.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e83e8899-c9b2-483b-b355-5decc942b959", "title": "Interesting Service Enumeration Via Sc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_query_interesting_services.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "title": "LOLBIN Execution From Abnormal Drive", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_lolbin_exec_from_non_c_drive.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6385697e-9f1b-40bd-8817-f4a91f40508e", "title": "PowerShell Base64 Encoded Invoke Keyword", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_invoke.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "title": "UAC Bypass Using MSConfig Token Modification - Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_msconfig_gui.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3c05e90d-7eba-4324-9972-5d7f711a60a8", "title": "UAC Bypass Tools Using ComputerDefaults", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_computerdefaults.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "24357373-078f-44ed-9ac4-6d334a668a11", "title": "Direct Autorun Keys Modification", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_direct_asep_registry_keys_modification.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "15619216-e993-4721-b590-4c520615a67d", "title": "Potential Meterpreter/CobaltStrike Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_meterpreter_getsystem.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d2eb17db-1d39-41dc-b57f-301f6512fa75", "title": "Potentially Suspicious Command Targeting Teams Sensitive Files", "file": "../sigma/rules/windows/process_creation/proc_creation_win_teams_suspicious_command_line_cred_access.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5a6e1e16-07de-48d8-8aae-faa766c05e88", "title": "Potential Cookies Session Hijacking", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_cookie_hijacking.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9fbf5927-5261-4284-a71d-f681029ea574", "title": "Compress Data and Lock With Password for Exfiltration With 7-ZIP", "file": "../sigma/rules/windows/process_creation/proc_creation_win_7zip_password_compression.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5a3164f2-b373-4152-93cf-090b13c12d27", "title": "Potentially Suspicious Child Process Of VsCode", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vscode_child_processes_anomalies.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "title": "File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cbec226f-63d9-4eca-9f52-dfb6652f24df", "title": "Suspicious Process Parents", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_parents.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5b768e71-86f2-4879-b448-81061cbae951", "title": "Suspicious Manipulation Of Default Accounts Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_user_default_accounts_manipulation.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ca621ba5-54ab-4035-9942-d378e6fcde3c", "title": "HackTool - HandleKatz LSASS Dumper Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_handlekatz.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "98767d61-b2e8-4d71-b661-e36783ee24c1", "title": "Gzip Archive Decode Via PowerShell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_decode_gzip.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a85ffc3a-e8fd-4040-93bf-78aff284d801", "title": "Use Of The SFTP.EXE Binary As A LOLBIN", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_sftp.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "88f46b67-14d4-4f45-ac2c-d66984f22191", "title": "Renamed Microsoft Teams Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_msteams.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "83809e84-4475-4b69-bc3e-4aad8568612f", "title": "MSExchange Transport Agent Installation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_msexchange_transport_agent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ce72ef99-22f1-43d4-8695-419dcb5d9330", "title": "Suspicious Windows Service Tampering", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_service_tamper.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "add64136-62e5-48ea-807e-88638d02df1e", "title": "Fsutil Suspicious Invocation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_fsutil_usage.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "04936b66-3915-43ad-a8e5-809eadfd1141", "title": "Insensitive Subfolder Search Via Findstr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "title": "Remote Access Tool - GoToAssist Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_gotoopener.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "847d5ff3-8a31-4737-a970-aeae8fe21765", "title": "Potential Tampering With Security Products Via WMIC", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_uninstall_security_products.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2fdefcb3-dbda-401e-ae23-f0db027628bc", "title": "Sticky Key Like Backdoor Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_sticky_key_like_backdoor_execution.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c49c5062-0966-4170-9efd-9968c913a6cf", "title": "Stop Windows Service Via PowerShell Stop-Service", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_stop_service.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "title": "Delete Important Scheduled Task", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_delete.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "title": "Renamed ZOHO Dctask64 Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_dctask64.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "title": "HackTool - SharpLdapWhoami Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharpldapwhoami.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "title": "Local File Read Using Curl.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_local_file_read.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "850d55f9-6eeb-4492-ad69-a72338f65ba4", "title": "C# IL Code Compilation Via Ilasm.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ilasm_il_code_compilation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d87bd452-6da1-456e-8155-7dc988157b7d", "title": "Suspicious Usage Of ShellExec_RunDLL", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_susp_shellexec_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5bb68627-3198-40ca-b458-49f973db8752", "title": "Rundll32 Execution Without Parameters", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_without_parameters.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "title": "Execution of Powershell Script in Public Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_public_folder.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "title": "Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_fw_allow_program_in_susp_location.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "caf201a9-c2ce-4a26-9c3a-2b9525413711", "title": "Potentially Suspicious Call To Win32_NTEventlogFile Class", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_nteventlogfile_usage.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4e762605-34a8-406d-b72e-c1a089313320", "title": "Potential Fake Instance Of Hxtsr.EXE Executed", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hxtsr_masquerading.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d3c3861d-c504-4c77-ba55-224ba82d0118", "title": "New Network Trace Capture Started Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_packet_capture.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2ddef153-167b-4e89-86b6-757a9e65dcac", "title": "File Download Via Bitsadmin To A Suspicious Target Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "title": "Cloudflared Tunnel Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cloudflared_tunnel_run.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "54773c5f-f1cc-4703-9126-2f797d96a69d", "title": "PUA - Advanced Port Scanner Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "title": "Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8a582fe2-0882-4b89-a82a-da6b2dc32937", "title": "Suspicious WmiPrvSE Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmiprvse_susp_child_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "title": "Use NTFS Short Name in Command Line", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_cli.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "title": "HackTool - Covenant PowerShell Launcher", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_covenant.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f35c5d71-b489-4e22-a115-f003df287317", "title": "Potential CobaltStrike Process Patterns", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_process_patterns.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fbd7c32d-db2a-4418-b92c-566eb8911133", "title": "SyncAppvPublishingServer Execute Arbitrary PowerShell Code", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_execute_psh.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "87a476dc-0079-4583-a985-dee7a20a03de", "title": "Enumeration for 3rd Party Creds From CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_enumeration_for_credentials_cli.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "title": "Potentially Suspicious DLL Registered Via Odbcconf.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr_susp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "title": "Suspicious Modification Of Scheduled Tasks", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_change.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "38879043-7e1e-47a9-8d46-6bec88e201df", "title": "Potential Persistence Attempt Via Existing Service Tampering", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_service_tamper_for_persistence.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "title": "Certificate Exported Via PowerShell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_export_certificate.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f9999590-1f94-4a34-a91e-951e47bedefd", "title": "Suspicious Provlaunch.EXE Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_provlaunch_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "title": "Regsvr32 DLL Execution With Suspicious File Extension", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_susp_extensions.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "title": "Potential PowerShell Obfuscation Via Reversed Commands", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_cmdline_reversed_strings.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "title": "Suspicious RASdial Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rasdial_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "title": "Uncommon FileSystem Load Attempt By Format.com", "file": "../sigma/rules/windows/process_creation/proc_creation_win_format_uncommon_filesystem_load.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "title": "HackTool - KrbRelay Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_krbrelay.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4eddc365-79b4-43ff-a9d7-99422dc34b93", "title": "Use of Remote.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_remote.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "title": "Deletion of Volume Shadow Copies via WMI with PowerShell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_shadowcopy_deletion.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "220457c1-1c9f-4c2e-afe6-9598926222c1", "title": "Delete All Scheduled Tasks", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_delete_all.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bf361876-6620-407a-812f-bfe11e51e924", "title": "Compressed File Extraction Via Tar.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_tar_extraction.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "title": "Curl Download And Execute Combination", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_curl_download_exec_combo.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c79da740-5030-45ec-a2e0-479e824a562c", "title": "System Disk And Volume Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_volume.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d7662ff6-9e97-4596-a61d-9839e32dee8d", "title": "Add SafeBoot Keys Via Reg Utility", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_add_safeboot.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a197e378-d31b-41c0-9635-cfdf1c1bb423", "title": "HackTool - WinRM Access Via Evil-WinRM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_evil_winrm.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "737e618a-a410-49b5-bec3-9e55ff7fbc15", "title": "Suspicious Calculator Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_calc_uncommon_exec.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "title": "Scripting/CommandLine Process Spawned Regsvr32", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_susp_parent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "30edb182-aa75-42c0-b0a9-e998bb29067c", "title": "Potential AMSI Bypass Via .NET Reflection", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_amsi_init_failed_bypass.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ff23ffbc-3378-435e-992f-0624dcf93ab4", "title": "HackTool - PurpleSharp Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_purplesharp_indicators.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "eb1c4225-1c23-4241-8dd4-051389fde4ce", "title": "Suspicious DumpMinitool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dumpminitool_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "title": "Xwizard.EXE Execution From Non-Default Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_xwizard_execution_non_default_location.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "title": "Dumping Process via Sqldumper.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_susp_sqldumper_activity.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e312efd0-35a1-407f-8439-b8d434b438a6", "title": "Potential PowerShell Obfuscation Via WCHAR", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_obfuscation_via_utf8.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "title": "Unusual Parent Process For Cmd.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_unusual_parent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d679950c-abb7-43a6-80fb-2a480c4fc450", "title": "PDQ Deploy Remote Adminstartion Tool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pdqdeploy_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ba42babc-0666-4393-a4f7-ceaf5a69191e", "title": "Uncommon Child Processes Of SndVol.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sndvol_susp_child_processes.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c27515df-97a9-4162-8a60-dc0eeb51b775", "title": "Suspicious Microsoft OneNote Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_onenote_susp_child_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "title": "Potential Password Spraying Attempt Using Dsacls.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dsacls_password_spray.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "title": "Suspicious Use of PsLogList", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_psloglist.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0f6da907-5854-4be6-859a-e9958747b0aa", "title": "Potential DLL Injection Via AccCheckConsole", "file": "../sigma/rules/windows/process_creation/proc_creation_win_acccheckconsole_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "title": "New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dnscmd_install_new_server_level_plugin_dll.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5edc2273-c26f-406c-83f3-f4d948e740dd", "title": "Indirect Inline Command Execution Via Bash.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bash_command_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "95eadcb2-92e4-4ed1-9031-92547773a6db", "title": "Suspicious PowerShell Invocation From Script Engines", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_script_engine_parent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "title": "OpenWith.exe Executes Specified Binary", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_openwith.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "title": "PowerShell Download Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_download_patterns.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0f0450f3-8b47-441e-a31b-15a91dc243e2", "title": "Potential DLL File Download Via PowerShell Invoke-WebRequest", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_download_dll.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "title": "Suspicious Download Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "817f252c-5143-4dae-b418-48c3e9f63728", "title": "Windows Recall Feature Enabled Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_enable_windows_recall.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "title": "HackTool - Rubeus Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_rubeus.yml", "status": "stable", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "title": "Arbitrary File Download Via MSOHTMED.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msohtmed_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "title": "PUA - WebBrowserPassView Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_webbrowserpassview.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "07e3cb2c-0608-410d-be4b-1511cb1a0448", "title": "Tamper Windows Defender Remove-MpPreference", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_remove_mppreference.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "138d3531-8793-4f50-a2cd-f291b2863d78", "title": "Suspicious Service Path Modification", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_service_path_modification.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "title": "DSInternals Suspicious PowerShell Cmdlets", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_dsinternals_cmdlets.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ddeff553-5233-4ae9-bbab-d64d2bd634be", "title": "Data Copied To Clipboard Via Clip.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_clip_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "03552375-cc2c-4883-bbe4-7958d5a980be", "title": "HackTool - SILENTTRINITY Stager Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_silenttrinity_stager.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e212d415-0e93-435f-9e1a-f29005bb4723", "title": "Suspicious Remote Child Process From Outlook", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes_remote.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "55f0a3a1-846e-40eb-8273-677371b8d912", "title": "Outlook EnableUnsafeClientMailRules Setting Enabled", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "title": "Disable Windows IIS HTTP Logging", "file": "../sigma/rules/windows/process_creation/proc_creation_win_iis_appcmd_http_logging.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "title": "UAC Bypass Using NTFS Reparse Point - Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_ntfs_reparse_point.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "title": "Changing Existing Service ImagePath Value Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_service_imagepath_change.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "title": "Ping Hex IP", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ping_hex_ip.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "87911521-7098-470b-a459-9a57fc80bdfd", "title": "Sysmon Configuration Update", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_sysmon_config_update.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "title": "Change Default File Association Via Assoc", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_assoc_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e7888eb1-13b0-4616-bd99-4bc0c2b054b9", "title": "Dllhost.EXE Execution Anomaly", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dllhost_no_cli_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6ba5a05f-b095-4f0a-8654-b825f4f16334", "title": "Potential MSTSC Shadowing Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mstsc_rdp_hijack_shadowing.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "title": "Unmount Share Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_share_unmount.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "title": "Renamed Jusched.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_jusched.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "title": "Always Install Elevated Windows Installer", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_always_install_elevated_windows_installer.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "title": "Suspicious Response File Execution Via Odbcconf.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_odbcconf_response_file_susp.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7cce6fc8-a07f-4d84-a53e-96e1879843c9", "title": "Potential Binary Impersonating Sysinternals Tools", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_tools_masquerading.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "45d3a03d-f441-458c-8883-df101a3bb146", "title": "Launch-VsDevShell.PS1 Proxy Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_launch_vsdevshell.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "871b9555-69ca-4993-99d3-35a59f9f3599", "title": "Suspicious UltraVNC Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ultravnc_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f2c64357-b1d2-41b7-849f-34d2682c0fad", "title": "Suspicious Command Patterns In Scheduled Task Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_susp_pattern.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "title": "PUA - Adidnsdump Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_python_adidnsdump.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "12fbff88-16b5-4b42-9754-cd001a789fb3", "title": "CodePage Modification Via MODE.COM To Russian Language", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mode_codepage_russian.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "title": "WebDav Client Execution Via Rundll32.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_webdav_client_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0403d67d-6227-4ea8-8145-4e72db7da120", "title": "UtilityFunctions.ps1 Proxy Dll", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_utilityfunctions.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "title": "Execute From Alternate Data Streams", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bd1c6866-65fc-44b2-be51-5588fcff82b9", "title": "Renamed Msdt.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_msdt.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "title": "Potential SPN Enumeration Via Setspn.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_setspn_spn_enumeration.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1114e048-b69c-4f41-bc20-657245ae6e3f", "title": "User Discovery And Export Via Get-ADUser Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_user_discovery_get_aduser.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "title": "Suspicious Obfuscated PowerShell Code", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_encoded_obfusc.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "title": "Suspicious File Characteristics Due to Missing Fields", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_file_characteristics.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "title": "Suspicious SYSTEM User Process Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "27aec9c9-dbb0-4939-8422-1742242471d0", "title": "Invoke-Obfuscation VAR+ Launcher", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_var.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "727454c0-d851-48b0-8b89-385611ab0704", "title": "Lolbin Unregmp2.exe Use As Proxy", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_unregmp2.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "title": "Potential Recon Activity Via Nltest.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_nltest_recon.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d20ee2f4-822c-4827-9e15-41500b1fff10", "title": "Potential Amazon SSM Agent Hijacking", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ssm_agent_abuse.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "title": "Allow Service Access Using Security Descriptor Tampering Via Sc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_sdset_allow_service_changes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "title": "Potential Arbitrary File Download Using Office Application", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_arbitrary_cli_download.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "efec536f-72e8-4656-8960-5e85d091345b", "title": "Set Suspicious Files as System Files Using Attrib.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_attrib_system_susp_paths.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6f4191bb-912b-48a8-9ce7-682769541e6d", "title": "Suspicious Msiexec Execute Arbitrary DLL", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msiexec_execute_dll.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "title": "Potentially Suspicious Child Process Of DiskShadow.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_diskshadow_child_process_susp.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "517490a7-115a-48c6-8862-1a481504d5a8", "title": "Potential Shim Database Persistence via Sdbinst.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sdbinst_shim_persistence.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "title": "Use of VSIISExeLauncher.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_vsiisexelauncher.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "49d9671b-0a0a-4c09-8280-d215bfd30662", "title": "Application Terminated Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_terminate_application.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "05f3c945-dcc8-4393-9f3d-af65077a8f86", "title": "Suspicious SYSVOL Domain Group Policy Access", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_sysvol_access.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3037d961-21e9-4732-b27a-637bcc7bf539", "title": "Suspicious High IntegrityLevel Conhost Legacy Option", "file": "../sigma/rules/windows/process_creation/proc_creation_win_conhost_legacy_option.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "title": "Invoke-Obfuscation COMPRESS OBFUSCATION", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_compress.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "title": "PUA - Radmin Viewer Utility Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_radmin.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "title": "CreateDump Process Dump", "file": "../sigma/rules/windows/process_creation/proc_creation_win_createdump_lolbin_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "title": "Potential Regsvr32 Commandline Flag Anomaly", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_flags_anomaly.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "554601fb-9b71-4bcc-abf4-21a611be4fde", "title": "Suspicious Recursive Takeown", "file": "../sigma/rules/windows/process_creation/proc_creation_win_takeown_recursive_own.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "title": "Portable Gpg.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gpg4win_portable_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7b10f171-7f04-47c7-9fa2-5be43c76e535", "title": "Visual Basic Command Line Compiler Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_visual_basic_compiler.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "45239e6a-b035-4aaf-b339-8ad379fcb67e", "title": "Process Proxy Execution Via Squirrel.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_squirrel_proxy_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "24e3e58a-646b-4b50-adef-02ef935b9fc8", "title": "Hacktool Execution - Imphash", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_execution_via_imphashes.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "title": "Potential Privilege Escalation via Service Permissions Weakness", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_privilege_escalation_via_service_key.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "40f9af16-589d-4984-b78d-8c2aec023197", "title": "Potential UAC Bypass Via Sdclt.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_sdclt.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7679d464-4f74-45e2-9e01-ac66c5eb041a", "title": "HackTool - SecurityXploded Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_secutyxploded.yml", "status": "stable", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "title": "Renamed Whoami Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_whoami.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7be5fb68-f9ef-476d-8b51-0256ebece19e", "title": "Suspicious Execution of Hostname", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hostname_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6e22722b-dfb1-4508-a911-49ac840b40f8", "title": "Suspicious Mstsc.EXE Execution With Local RDP File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mstsc_run_local_rdp_file_susp_location.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9ccba514-7cb6-4c5c-b377-700758f2f120", "title": "Suspicious Child Process of AspNetCompiler", "file": "../sigma/rules/windows/process_creation/proc_creation_win_aspnet_compiler_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "title": "Renamed Plink Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_plink.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7a74da6b-ea76-47db-92cc-874ad90df734", "title": "Suspicious MSDT Parent Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msdt_susp_parent.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b37998de-a70b-4f33-b219-ec36bf433dc0", "title": "PUA - PingCastle Execution From Potentially Suspicious Parent", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_pingcastle_script_parent.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f11f2808-adb4-46c0-802a-8660db50fa99", "title": "ImagingDevices Unusual Parent/Child Processes", "file": "../sigma/rules/windows/process_creation/proc_creation_win_imagingdevices_unusual_parents.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "43e32da2-fdd0-4156-90de-50dfd62636f9", "title": "Dism Remove Online Package", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dism_remove.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "title": "Change Default File Association To Executable Via Assoc", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_assoc_tamper_exe_file_association.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a20def93-0709-4eae-9bd2-31206e21e6b2", "title": "DriverQuery.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_driverquery_usage.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "title": "Suspicious Process Execution From Fake Recycle.Bin Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_recycle_bin_fake_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "title": "Computer System Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_computersystem.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6004abd0-afa4-4557-ba90-49d172e0a299", "title": "Execute Pcwrun.EXE To Leverage Follina", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_pcwrun_follina.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "title": "Node Process Executions", "file": "../sigma/rules/windows/process_creation/proc_creation_win_node_adobe_creative_cloud_abuse.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "970823b7-273b-460a-8afc-3a6811998529", "title": "Uncommon One Time Only Scheduled Task At 00:00", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_one_time_only_midnight_task.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "title": "Compress Data and Lock With Password for Exfiltration With WINZIP", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winzip_password_compression.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "15b75071-74cc-47e0-b4c6-b43744a62a2b", "title": "Suspicious Process Start Locations", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_run_locations.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "title": "Suspicious Eventlog Clearing or Configuration Change Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_eventlog_clear.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "title": "AddinUtil.EXE Execution From Uncommon Directory", "file": "../sigma/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_dir_exec.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "title": "WMIC Remote Command Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_remote_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4cbef972-f347-4170-b62a-8253f6168e6d", "title": "UAC Bypass Using IDiagnostic Profile", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_idiagnostic_profile.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "title": "Copying Sensitive Files with Credential Data", "file": "../sigma/rules/windows/process_creation/proc_creation_win_esentutl_sensitive_file_copy.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f99abdf0-6283-4e71-bd2b-b5c048a94743", "title": "Potentially Suspicious Office Document Executed From Trusted Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_exec_from_trusted_locations.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "48a61b29-389f-4032-b317-b30de6b95314", "title": "Suspicious Plink Port Forwarding", "file": "../sigma/rules/windows/process_creation/proc_creation_win_plink_port_forwarding.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0a13e132-651d-11eb-ae93-0242ac130002", "title": "Audit Policy Tampering Via Auditpol", "file": "../sigma/rules/windows/process_creation/proc_creation_win_auditpol_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "title": "Potentially Suspicious EventLog Recon Activity Using Log Query Utilities", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_eventlog_content_recon.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e9f55347-2928-4c06-88e5-1a7f8169942e", "title": "Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_var.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "title": "Potentially Suspicious Child Process Of ClickOnce Application", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dfsvc_suspicious_child_processes.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6a69f62d-ce75-4b57-8dce-6351eb55b362", "title": "Esentutl Steals Browser Information", "file": "../sigma/rules/windows/process_creation/proc_creation_win_esentutl_webcache.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8b0e12da-d3c3-49db-bb4f-256703f380e5", "title": "PUA - Chisel Tunneling Tool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_chisel.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7dc2dedd-7603-461a-bc13-15803d132355", "title": "Uncommon Child Process Of Conhost.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "title": "Suspicious Certreq Command to Download", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_susp_certreq_download.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "98a96a5a-64a0-4c42-92c5-489da3866cb0", "title": "DNS Exfiltration and Tunneling Tools Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dns_exfiltration_tools_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "47e4bab7-c626-47dc-967b-255608c9a920", "title": "Permission Misconfiguration Reconnaissance Via Findstr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_recon_everyone.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "title": "Potential Windows Defender Tampering Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_namespace_defender.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "40b19fa6-d835-400c-b301-41f3a2baacaf", "title": "VolumeShadowCopy Symlink Creation Via Mklink", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_mklink_shadow_copies_access_symlink.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "71158e3f-df67-472b-930e-7d287acaa3e1", "title": "Execution Of Non-Existing File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_image_missing.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f44800ac-38ec-471f-936e-3fa7d9c53100", "title": "PUA - CleanWipe Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_cleanwipe.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "title": "Suspicious Spool Service Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_spoolsv_susp_child_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "title": "Visual Studio Code Tunnel Shell Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vscode_tunnel_remote_shell_.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "24c8392b-aa3c-46b7-a545-43f71657fe98", "title": "Suspicious Schtasks Schedule Types", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_schedule_type.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "88f680b8-070e-402c-ae11-d2914f2257f1", "title": "PowerShell Base64 Encoded IEX Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_iex.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "15434e33-5027-4914-88d5-3d4145ec25a9", "title": "Potential Product Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_product.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b98d0db6-511d-45de-ad02-e82a98729620", "title": "Remotely Hosted HTA File Executed Via Mshta.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mshta_http.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "title": "Remote PowerShell Session Host Process (WinRM)", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winrm_remote_powershell_session_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0bbc6369-43e3-453d-9944-cae58821c173", "title": "Execution via WorkFolders.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_workfolders.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "title": "Potential Defense Evasion Via Binary Rename", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_binary.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "title": "Suspicious Electron Application Child Processes", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_electron_app_children.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b7966f4a-b333-455b-8370-8ca53c229762", "title": "Dropping Of Password Filter DLL", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_credential_access_via_password_filter.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "43fa5350-db63-4b8f-9a01-789a427074e1", "title": "Potential Obfuscated Ordinal Call Via Rundll32", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_obfuscated_ordinal_call.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "title": "Audit Policy Tampering Via NT Resource Kit Auditpol", "file": "../sigma/rules/windows/process_creation/proc_creation_win_auditpol_nt_resource_kit_usage.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ec290c06-9b6b-4338-8b6b-095c0f284f10", "title": "Suspicious Execution of Shutdown to Log Out", "file": "../sigma/rules/windows/process_creation/proc_creation_win_shutdown_logoff.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "title": "Enumeration for Credentials in Registry", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_enumeration_for_credentials_in_registry.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "title": "Process Memory Dump Via Dotnet-Dump", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dotnetdump_memory_dump.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "title": "Assembly Loading Via CL_LoadAssembly.ps1", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_cl_loadassembly.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "title": "Suspicious Schtasks Execution AppData Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_appdata_local_system.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0b0cd537-fc77-4e6e-a973-e53495c1083d", "title": "Renamed Office Binary Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_office_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "title": "PUA - DefenderCheck Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_defendercheck.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fca949cc-79ca-446e-8064-01aa7e52ece5", "title": "HackTool - PCHunter Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d4498716-1d52-438f-8084-4a603157d131", "title": "Password Provided In Command Line Of Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_use_password_plaintext.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b222df08-0e07-11eb-adc1-0242ac120002", "title": "Invoke-Obfuscation CLIP+ Launcher", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_clip.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e1693bc8-7168-4eab-8718-cdcaa68a1738", "title": "Suspicious WMIC Execution Via Office Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_susp_execution_via_office_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "title": "Potential Mftrace.EXE Abuse", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mftrace_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d3b70aad-097e-409c-9df2-450f80dc476b", "title": "PUA - DIT Snapshot Viewer", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_ditsnap.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "title": "Suspicious Reg Add Open Command", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_open_command.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "312d0384-401c-4b8b-abdf-685ffba9a332", "title": "Email Exifiltration Via Powershell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_email_exfil.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cc368ed0-2411-45dc-a222-510ace303cb2", "title": "Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regasm_regsvcs_uncommon_location_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "42333b2c-b425-441c-b70e-99404a17170f", "title": "HackTool - Sliver C2 Implant Activity Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sliver_c2_execution_pattern.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0e4164da-94bc-450d-a7be-a4b176179f1f", "title": "Firewall Configuration Discovery Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_fw_rules_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "title": "HackTool - XORDump Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_xordump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "title": "HackTool - RedMimicry Winnti Playbook Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_redmimicry_winnti_playbook.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ebef4391-1a81-4761-a40a-1db446c0e625", "title": "New ActiveScriptEventConsumer Created Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f26307d8-14cd-47e3-a26b-4b4769f24af6", "title": "HackTool - CrackMapExec Process Patterns", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_patterns.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "03cc0c25-389f-4bf8-b48d-11878079f1ca", "title": "Suspicious MSHTA Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mshta_susp_child_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8834e2f7-6b4b-4f09-8906-d2276470ee23", "title": "PsExec/PAExec Escalation to LOCAL SYSTEM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_psexec_paexec_escalate_system.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7090adee-82e2-4269-bd59-80691e7c6338", "title": "Console CodePage Lookup Via CHCP", "file": "../sigma/rules/windows/process_creation/proc_creation_win_chcp_codepage_lookup.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c74c0390-3e20-41fd-a69a-128f0275a5ea", "title": "Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wusa_cab_files_extraction_from_susp_paths.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b6457d63-d2a2-4e29-859d-4e7affc153d1", "title": "Potential Discovery Activity Via Dnscmd.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dnscmd_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "title": "File And SubFolder Enumeration Via Dir Command", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_dir_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5f6a601c-2ecb-498b-9c33-660362323afa", "title": "Root Certificate Installed From Susp Locations", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_import_cert_susp_locations.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aa8e035d-7be4-48d3-a944-102aec04400d", "title": "Suspicious Extrac32 Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_extrac32.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b243b280-65fe-48df-ba07-6ddea7646427", "title": "Discovery of a System Time", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_time_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "236d8e89-ed95-4789-a982-36f4643738ba", "title": "Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence_susp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "277a4393-446c-449a-b0ed-7fdc7795244c", "title": "Renamed FTP.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_ftp.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4fe074b4-b833-4081-8f24-7dcfeca72b42", "title": "Security Tools Keyword Lookup Via Findstr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "853e74f9-9392-4935-ad3b-2e8c040dae86", "title": "UAC Bypass Using DismHost", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_dismhost.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "68bcd73b-37ef-49cb-95fc-edc809730be6", "title": "Potential Unquoted Service Path Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_unquoted_service_search.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "86588b36-c6d3-465f-9cee-8f9093e07798", "title": "Scheduled Task Executing Payload from Registry", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_reg_loader.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "502b42de-4306-40b4-9596-6f590c81f073", "title": "Local Accounts Discovery", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_local_system_owner_account_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0a99eb3e-1617-41bd-b095-13dc767f3def", "title": "HackTool - Jlaive In-Memory Assembly Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_jlaive_batch_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "title": "HTML Help HH.EXE Suspicious Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "07f8bdc2-c9b3-472a-9817-5a670b872f53", "title": "Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmdkey_recon.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "title": "HackTool - SharpImpersonation Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharp_impersonation.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "28ac00d6-22d9-4a3c-927f-bbd770104573", "title": "RestrictedAdminMode Registry Value Tampering - ProcCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_lsa_disable_restricted_admin.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "452bce90-6fb0-43cc-97a5-affc283139b3", "title": "Suspicious Windows Defender Registry Key Tampering Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_windows_defender_tamper.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "title": "Potentially Suspicious Execution From Parent Process In Public Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_execution_from_public_folder_as_parent.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "title": "PowerShell Set-Acl On Windows Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_set_acl_susp_location.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ce7cf472-6fcc-490a-9481-3786840b5d9b", "title": "InfDefaultInstall.exe .inf Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_infdefaultinstall_execute_sct_scripts.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c6fb44c6-71f5-49e6-9462-1425d328aee3", "title": "Powershell Base64 Encoded MpPreference Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_mppreference.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9c0295ce-d60d-40bd-bd74-84673b7592b1", "title": "Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load_obfusc.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0a4f6091-223b-41f6-8743-f322ec84930b", "title": "Suspicious GUP Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gup_suspicious_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "98c5aeef-32d5-492f-b174-64a691896d25", "title": "Service Security Descriptor Tampering Via Sc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_sdset_modification.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6fe4aa1e-0531-4510-8be2-782154b73b48", "title": "File Recovery From Backup Via Wbadmin.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wbadmin_restore_file.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "title": "Suspicious AgentExecutor PowerShell Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_agentexecutor_susp_usage.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "title": "Windows Hotfix Updates Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_hotfix.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d78b5d61-187d-44b6-bf02-93486a80de5a", "title": "HackTool - DInjector PowerShell Cradle Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_dinjector.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e9b61244-893f-427c-b287-3e708f321c6b", "title": "Potential Privilege Escalation Using Symlink Between Osk and Cmd", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "70bc5215-526f-4477-963c-a47a5c9ebd12", "title": "Potential Active Directory Enumeration Using AD Module - ProcCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_active_directory_module_dll_import.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b6e04788-29e1-4557-bb14-77f761848ab8", "title": "Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_download_susp_file_sharing_domains.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "title": "Shadow Copies Creation Using Operating Systems Utilities", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_creation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0685b176-c816-4837-8e7b-1216f346636b", "title": "HackTool - Quarks PwDump Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_quarks_pwdump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e84d89c4-f544-41ca-a6af-4b92fd38b023", "title": "Arbitrary File Download Via MSEDGE_PROXY.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msedge_proxy_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "title": "Potentially Suspicious Windows App Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_appx_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "title": "Potential Network Sniffing Activity Using Network Tools", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_network_sniffing.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "023394c4-29d5-46ab-92b8-6a534c6f447b", "title": "Suspicious HWP Sub Processes", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hwp_exploits.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "title": "New Service Creation Using PowerShell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_create_service.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ebea773c-a8f1-42ad-a856-00cb221966e8", "title": "DLL Sideloading by VMware Xfer Utility", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dll_sideload_vmware_xfer.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0b7163dc-7eee-4960-af17-c0cd517f92da", "title": "Service Started/Stopped Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_service_manipulation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "98dedfdd-8333-49d4-9f23-d7018cccae53", "title": "Enable LM Hash Storage - ProcCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_nolmhash.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "title": "Potential Data Exfiltration Activity Via CommandLine Tools", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_data_exfiltration_via_cli.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "title": "HackTool - SharpView Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharpview.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f24bcaea-0cd1-11eb-adc1-0242ac120002", "title": "Uncommon Assistive Technology Applications Execution Via AtBroker.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_atbroker_uncommon_ats_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ccb5742c-c248-4982-8c5c-5571b9275ad3", "title": "Recon Command Output Piped To Findstr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_recon_pipe_output.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "title": "MSHTA Suspicious Execution 01", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mshta_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4abc0ec4-db5a-412f-9632-26659cddf145", "title": "UEFI Persistence Via Wpbbin - ProcessCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wpbbin_potential_persistence.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "title": "Import LDAP Data Interchange Format File Via Ldifde.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ldifde_file_load.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "title": "Suspicious Download From File-Sharing Website Via Bitsadmin", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bitsadmin_download_file_sharing_domains.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5cddf373-ef00-4112-ad72-960ac29bac34", "title": "HackTool - Koadic Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_koadic.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "37db85d1-b089-490a-a59a-c7b6f984f480", "title": "Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_sysmon_discovery_via_default_altitude.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "title": "File Download Via Bitsadmin", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "title": "Potential Browser Data Stealing", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_copy_browser_data.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f1edd233-30b5-4823-9e6a-c4171b24d316", "title": "Rundll32 Registered COM Objects", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_registered_com_objects.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e92a4287-e072-4a40-9739-370c106bb750", "title": "HackTool - SOAPHound Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_soaphound_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "title": "Disabled Volume Snapshots", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_volsnap_disable.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "title": "Potentially Suspicious ASP.NET Compilation Via AspNetCompiler", "file": "../sigma/rules/windows/process_creation/proc_creation_win_aspnet_compiler_susp_paths.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8bc64091-6875-4881-aaf9-7bd25b5dda08", "title": "Suspicious Process Patterns NTDS.DIT Exfil", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_ntds.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "56c217c3-2de2-479b-990f-5c109ba8458f", "title": "HackTool - Default PowerSploit/Empire Scheduled Task Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_powersploit_empire_default_schtasks.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "eee00933-a761-4cd0-be70-c42fe91731e7", "title": "Arbitrary File Download Via GfxDownloadWrapper.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gfxdownloadwrapper_arbitrary_file_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bab049ca-7471-4828-9024-38279a4c04da", "title": "Detect Virtualbox Driver Installation OR Starting Of VMs", "file": "../sigma/rules/windows/process_creation/proc_creation_win_virtualbox_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c3a99af4-35a9-4668-879e-c09aeb4f2bdf", "title": "Rundll32 Execution With Uncommon DLL Extension", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_uncommon_dll_extension.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d7654f02-e04b-4934-9838-65c46f187ebc", "title": "PUA- IOX Tunneling Tool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_iox.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2a072a96-a086-49fa-bcb5-15cc5a619093", "title": "Start Windows Service Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_start_service.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "883faa95-175a-4e22-8181-e5761aeb373c", "title": "Suspicious Service Binary Directory", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_service_dir.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "title": "Change PowerShell Policies to an Insecure Level", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_set_policies_to_unsecure_level.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "title": "MMC20 Lateral Movement", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mmc_mmc20_lateral_movement.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "63d1ccc0-2a43-4f4b-9289-361b308991ff", "title": "Wab/Wabmig Unusual Parent Or Child Processes", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wab_unusual_parents.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4f154fb6-27d1-4813-a759-78b93e0b9c48", "title": "Operator Bloopers Cobalt Strike Modules", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_bloopers_modules.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "title": "Suspicious Execution Location Of Wermgr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wermgr_susp_exec_location.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "title": "HackTool - Empire PowerShell Launch Parameters", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_empire_powershell_launch.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "title": "Potential Binary Proxy Execution Via Cdb.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cdb_arbitrary_command_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "26488ad0-f9fd-4536-876f-52fea846a2e4", "title": "HackTool - SharPersist Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharpersist.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "title": "Python Spawning Pretty TTY on Windows", "file": "../sigma/rules/windows/process_creation/proc_creation_win_python_pty_spawn.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "33be4333-2c6b-44f4-ae28-102cdbde0a31", "title": "Suspicious Msbuild Execution By Uncommon Parent Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msbuild_susp_parent_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e37db05d-d1f9-49c8-b464-cee1a4b11638", "title": "PUA - Rclone Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_rclone_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "395907ee-96e5-4666-af2e-2ca91688e151", "title": "Wab Execution From Non Default Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wab_execution_from_non_default_location.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "title": "Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_download_file_sharing_domains.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b0ce780f-10bd-496d-9067-066d23dc3aa5", "title": "HackTool - SharpWSUS/WSUSpendu Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharpwsus_wsuspendu_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "title": "Suspicious Driver/DLL Installation Via Odbcconf.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_odbcconf_driver_install_susp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "title": "Loaded Module Enumeration Via Tasklist.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_tasklist_module_enumeration.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "title": "PUA - Wsudo Suspicious Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_wsudo_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "title": "Suspicious ZipExec Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_zipexec.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "79b06761-465f-4f88-9ef2-150e24d3d737", "title": "Potential SysInternals ProcDump Evasion", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_procdump_evasion.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "title": "HackTool - SharpDPAPI Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharp_dpapi_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c615d676-f655-46b9-b913-78729021e5d7", "title": "Data Export From MSSQL Table Via BCP.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bcp_export_data.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b19146a3-25d4-41b4-928b-1e2a92641b1b", "title": "Remote Access Tool - ScreenConnect Server Web Shell Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_webshell.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "title": "HackTool - GMER Rootkit Detector and Remover Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_gmer.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "title": "Potential Data Stealing Via Chromium Headless Debugging", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_debugging.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e6474a1b-5390-49cd-ab41-8d88655f7394", "title": "Renamed Mavinject.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_mavinject.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "692f0bec-83ba-4d04-af7e-e884a96059b6", "title": "Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmiprvse_spawns_powershell.yml", "status": "stable", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "93671f99-04eb-4ab4-a161-70d446a84003", "title": "Capture Credentials with Rpcping.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rpcping_credential_capture.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0d5675be-bc88-4172-86d3-1e96a4476536", "title": "Potential Tampering With RDP Related Registry Keys Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_rdp_keys_tamper.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "title": "PsExec Service Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_psexesvc.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4281cb20-2994-4580-aa63-c8b86d019934", "title": "Hiding Files with Attrib.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_attrib_hiding_files.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "title": "Malicious PE Execution by Microsoft Visual Studio Debugger", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_use_of_vsjitdebugger_bin.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "title": "Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "title": "Potentially Suspicious Execution Of PDQDeployRunner", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pdqdeploy_runner_susp_children.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "title": "Unusual Child Process of dns.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dns_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a34f79a3-8e5f-4cc3-b765-de00695452c2", "title": "HackTool - PowerTool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_powertool.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "title": "Chopper Webshell Process Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_webshell_chopper.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5589ab4f-a767-433c-961d-c91f3f704db1", "title": "Potential SMB Relay Attack Tool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_relay_attacks_tools.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "title": "UAC Bypass Using ChangePK and SLUI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_changepk_slui.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e8a95b5e-c891-46e2-b33a-93937d3abc31", "title": "Suspicious HH.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hh_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c86500e9-a645-4680-98d7-f882c70c1ea3", "title": "AADInternals PowerShell Cmdlets Execution - ProccessCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_aadinternals_cmdlets_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "58f50261-c53b-4c88-bd12-1d71f12eda4c", "title": "Windows Credential Manager Access via VaultCmd", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vaultcmd_list_creds.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "34ebb878-1b15-4895-b352-ca2eeb99b274", "title": "Suspicious Execution of Shutdown", "file": "../sigma/rules/windows/process_creation/proc_creation_win_shutdown_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7a02e22e-b885-4404-b38b-1ddc7e65258a", "title": "Suspicious Schtasks Schedule Type With High Privileges", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_schedule_type_system.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "title": "Hardware Model Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_csproduct.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "24de4f3b-804c-4165-b442-5a06a2302c7e", "title": "Arbitrary Shell Command Execution Via Settingcontent-Ms", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_arbitrary_shell_execution_via_settingcontent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "731231b9-0b5d-4219-94dd-abb6959aa7ea", "title": "Suspicious Rundll32 Activity Invoking Sys File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_sys.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "title": "Mstsc.EXE Execution With Local RDP File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mstsc_run_local_rdp_file.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "title": "Obfuscated PowerShell OneLiner Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_download_cradle_obfuscated.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "title": "Potential LethalHTA Technique Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mshta_lethalhta_technique.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d7bcd677-645d-4691-a8d4-7a5602b780d1", "title": "Potential PowerShell Command Line Obfuscation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_cmdline_special_characters.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "title": "Abusing Print Executable", "file": "../sigma/rules/windows/process_creation/proc_creation_win_print_remote_file_copy.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "title": "PktMon.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pktmon_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "title": "Phishing Pattern ISO in Archive", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_archiver_iso_phishing.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "title": "Invoke-Obfuscation Via Use Clip", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_clip.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6e897651-f157-4d8f-aaeb-df8151488385", "title": "PowerShell Web Download", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_download_cradles.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "title": "Privilege Escalation via Named Pipe Impersonation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_priv_escalation_via_named_pipe.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9847f263-4a81-424f-970c-875dab15b79b", "title": "Suspicious TSCON Start as SYSTEM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_tscon_localsystem.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "title": "User Added to Remote Desktop Users Group", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_add_user_remote_desktop_group.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "title": "Obfuscated IP Download Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "title": "New User Created Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_user_add.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "title": "HackTool - Inveigh Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_inveigh.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4b046706-5789-4673-b111-66f25fe99534", "title": "Deleted Data Overwritten Via Cipher.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "73bba97f-a82d-42ce-b315-9182e76c57b1", "title": "Imports Registry Key From a File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regedit_import_keys.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "646bc99f-6682-4b47-a73a-17b1b64c9d34", "title": "Execute Files with Msdeploy.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_msdeploy.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6c96fc76-0eb1-11eb-adc1-0242ac120002", "title": "Invoke-Obfuscation STDIN+ Launcher", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_stdin.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7050bba1-1aed-454e-8f73-3f46f09ce56a", "title": "Cloudflared Tunnel Connections Cleanup", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cloudflared_tunnel_cleanup.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9d5a1274-922a-49d0-87f3-8c653483b909", "title": "Uncommon System Information Discovery Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_system_info_uncommon.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "744a188b-0415-4792-896f-11ddb0588dbc", "title": "Potential Process Injection Via Msra.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msra_process_injection.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "title": "Conhost Spawned By Uncommon Parent Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_conhost_uncommon_parent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "faa48cae-6b25-4f00-a094-08947fef582f", "title": "Rar Usage with Password and Compression Level", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rar_compression_with_password.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "70ad0861-d1fe-491c-a45f-fa48148a300d", "title": "File Download via CertOC.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certoc_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a16980c2-0c56-4de0-9a79-17971979efdd", "title": "Cmd.EXE Missing Space Characters Execution Anomaly", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_no_space_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "title": "Mstsc.EXE Execution From Uncommon Parent", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mstsc_run_local_rpd_file_susp_parent.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "954f0af7-62dd-418f-b3df-a84bc2c7a774", "title": "New Remote Desktop Connection Initiated Via Mstsc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mstsc_remote_connection.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a7ee1722-c3c5-aeff-3212-c777e4733217", "title": "Disable Windows Defender AV Security Monitoring", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_disable_defender_av_security_monitoring.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1dde5376-a648-492e-9e54-4241dd9b0c7f", "title": "Diskshadow Script Mode - Uncommon Script Extension Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_ext.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "title": "Suspicious SysAidServer Child", "file": "../sigma/rules/windows/process_creation/proc_creation_win_java_sysaidserver_susp_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "10c14723-61c7-4c75-92ca-9af245723ad2", "title": "HackTool - Potential Impacket Lateral Movement Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_impacket_lateral_movement.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "title": "Potential PowerShell Execution Policy Tampering - ProcCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_set_unsecure_powershell_policy.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "title": "Import PowerShell Modules From Suspicious Directories - ProcCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_import_module_susp_dirs.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "title": "Suspicious Double Extension File Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_double_extension.yml", "status": "stable", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "41421f44-58f9-455d-838a-c398859841d4", "title": "ETW Logging Tamper In .NET Processes Via CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_etw_modification_cmdline.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ae9b0bd7-8888-4606-b444-0ed7410cb728", "title": "Writing Of Malicious Files To The Fonts Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_hiding_malware_in_fonts_folder.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8de1cbe8-d6f5-496d-8237-5f44a721c7a0", "title": "Whoami.EXE Execution Anomaly", "file": "../sigma/rules/windows/process_creation/proc_creation_win_whoami_parent_anomaly.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "title": "NtdllPipe Like Activity Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_ntdllpipe_redirect.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "43103702-5886-11ed-9b6a-0242ac120002", "title": "Suspicious Vsls-Agent Command With AgentExtensionPath Load", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vslsagent_agentextensionpath_load.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "16905e21-66ee-42fe-b256-1318ada2d770", "title": "Start of NT Virtual DOS Machine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_16bit_application.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7530cd3d-7671-43e3-b209-976966f6ea48", "title": "Renamed CURL.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_curl.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "title": "Renamed BOINC Client Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_boinc.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a7c3d773-caef-227e-a7e7-c2f13c622329", "title": "Bad Opsec Defaults Sacrificial Processes With Improper Arguments", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_bad_opsec_sacrificial_processes.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "214641c2-c579-4ecb-8427-0cf19df6842e", "title": "Remote File Download Via Desktopimgdownldr Utility", "file": "../sigma/rules/windows/process_creation/proc_creation_win_desktopimgdownldr_remote_file_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "title": "AgentExecutor PowerShell Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_agentexecutor_potential_abuse.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "07aa184a-870d-413d-893a-157f317f6f58", "title": "Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "title": "Use of TTDInject.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_ttdinject.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "title": "Malicious Windows Script Components File Execution by TAEF Detection", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_use_of_te_bin.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f548a603-c9f2-4c89-b511-b089f7e94549", "title": "Potential Persistence Via Microsoft Compatibility Appraiser", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_persistence_windows_telemetry.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "93199800-b52a-4dec-b762-75212c196542", "title": "PUA - RunXCmd Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_runxcmd.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "526be59f-a573-4eea-b5f7-f0973207634d", "title": "New Process Created Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_process_creation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6345b048-8441-43a7-9bed-541133633d7a", "title": "ManageEngine Endpoint Central Dctask64.EXE Potential Abuse", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dctask64_arbitrary_command_and_dll_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "title": "SQL Client Tools PowerShell Session Detection", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mssql_sqltoolsps_susp_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "25676e10-2121-446e-80a4-71ff8506af47", "title": "Exchange PowerShell Snap-Ins Usage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_snapins_hafnium.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "title": "Forfiles Command Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_forfiles_proxy_execution_.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ac1c92b4-ac81-405a-9978-4604d78cc47e", "title": "Potential Binary Proxy Execution Via VSDiagnostics.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vsdiagnostics_execution_proxy.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "title": "Potential Arbitrary Code Execution Via Node.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_node_abuse.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bdeb2cff-af74-4094-8426-724dc937f20a", "title": "PowerShell Script Change Permission Via Set-Acl", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_set_acl.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "41f407b5-3096-44ea-a74f-96d04fbc41be", "title": "Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_revoked_cert.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "title": "Renamed MegaSync Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_megasync.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a383dec4-deec-4e6e-913b-ed9249670848", "title": "Potential Signing Bypass Via Windows Developer Features", "file": "../sigma/rules/windows/process_creation/proc_creation_win_systemsettingsadminflows_turn_on_dev_features.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "title": "HackTool - SharpEvtMute Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharpevtmute.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "title": "Sysinternals PsSuspend Suspicious Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_pssuspend_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ac20ae82-8758-4f38-958e-b44a3140ca88", "title": "Invoke-Obfuscation Via Use MSHTA", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "54786ddc-5b8a-11ed-9b6a-0242ac120002", "title": "Suspicious Ping/Del Command Combination", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_ping_del_combined_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "41ca393d-538c-408a-ac27-cf1e038be80c", "title": "Directory Removal Via Rmdir", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_rmdir_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "title": "Potentially Suspicious CMD Shell Output Redirect", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_redirection_susp_folder.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cd71385d-fd9b-4691-9b98-2b1f7e508714", "title": "Lolbin Runexehelper Use As Proxy", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_runexehelper.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c625d754-6a3d-4f65-9c9a-536aea960d37", "title": "Permission Check Via Accesschk.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_accesschk_check_permissions.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c8a180d6-47a3-4345-a609-53f9c3d834fc", "title": "Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_get_localgroup_member_recon.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "title": "CMSTP UAC Bypass via COM Object Access", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp_com_object_access.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "044ba588-dff4-4918-9808-3f95e8160606", "title": "Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_copy_dmp_from_share.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1af57a4b-460a-4738-9034-db68b880c665", "title": "PowerShell SAM Copy", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_sam_access.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "title": "Run PowerShell Script from ADS", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_run_script_from_ads.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1dd05363-104e-4b4a-b963-196a534b03a1", "title": "Potential Suspicious Mofcomp Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mofcomp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "title": "Non-privileged Usage of Reg or Powershell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_non_priv_reg_or_ps.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "title": "Potential Renamed Rundll32 Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_rundll32_dllregisterserver.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "title": "Suspicious Service DACL Modification Via Set-Service Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_service_dacl_modification_set_service.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "84b1ecf9-6eff-4004-bafb-bae5c0e251b2", "title": "Potentially Suspicious GoogleUpdate Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_googleupdate_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "204b17ae-4007-471b-917b-b917b315c5db", "title": "Greedy File Deletion Using Del", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_del_greedy_deletion.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "title": "PUA - PingCastle Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_pingcastle.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "50d66fb0-03f8-4da0-8add-84e77d12a020", "title": "Suspicious RunAs-Like Flag Combination", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_privilege_escalation_cli_patterns.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "title": "Tasks Folder Evasion", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_task_folder_evasion.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c2b86e67-b880-4eec-b045-50bc98ef4844", "title": "HackTool - LaZagne Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_lazagne.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "title": "SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "title": "PowerShell Get-Process LSASS", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_getprocess_lsass.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "title": "Suspicious Child Process Of Wermgr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wermgr_susp_child_process.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5722dff1-4bdd-4949-86ab-fbaf707e767a", "title": "PUA - System Informer Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_system_informer.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "title": "Potential Powershell ReverseShell Connection", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_reverse_shell_connection.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "eb2d07d4-49cb-4523-801a-da002df36602", "title": "HackTool - EDRSilencer Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_edrsilencer.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e593cf51-88db-4ee1-b920-37e89012a3c9", "title": "Potentially Suspicious Rundll32 Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "90d6bd71-dffb-4989-8d86-a827fedd6624", "title": "Visual Studio Code Tunnel Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vscode_tunnel_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "89a9a0e0-f61a-42e5-8957-b1479565a658", "title": "UAC Bypass WSReset", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset_integrity_level.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8202070f-edeb-4d31-a010-a26c72ac5600", "title": "Suspicious Process By Web Server Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_webshell_susp_process_spawned_from_webserver.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "title": "Security Privileges Enumeration Via Whoami.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_whoami_priv_discovery.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3268b746-88d8-4cd3-bffc-30077d02c787", "title": "HackTool - Empire PowerShell UAC Bypass", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_empire_powershell_uac_bypass.yml", "status": "stable", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "811e0002-b13b-4a15-9d00-a613fce66e42", "title": "PUA - Process Hacker Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_process_hacker.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "18988e1b-9087-4f8a-82fe-0414dce49878", "title": "Execute Code with Pester.bat as Parent", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_pester.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "title": "Suspicious Powercfg Execution To Change Lock Screen Timeout", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powercfg_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f53714ec-5077-420e-ad20-907ff9bb2958", "title": "Forfiles.EXE Child Process Masquerading", "file": "../sigma/rules/windows/process_creation/proc_creation_win_forfiles_child_process_masquerading.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f117933c-980c-4f78-b384-e3d838111165", "title": "Windows Share Mount Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_use_mount_share.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "title": "Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_zip_compress.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a29c1813-ab1f-4dde-b489-330b952e91ae", "title": "Suspicious Network Command", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_network_command.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "title": "Tor Client/Browser Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_tor_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b655a06a-31c0-477a-95c2-3726b83d649d", "title": "Suspicious Userinit Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_userinit_child.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "21d856f9-9281-4ded-9377-51a1a6e2a432", "title": "Potential Persistence Via Logon Scripts - CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_logon_script.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b66474aa-bd92-4333-a16c-298155b120df", "title": "Potential Persistence Via Powershell Search Order Hijacking - Task", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_powershell_persistence.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b2309017-4235-44fe-b5af-b15363011957", "title": "Uncommon Child Process Of Defaultpack.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_defaultpack_uncommon_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "title": "Renamed AutoHotkey.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_autohotkey.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "title": "Devtoolslauncher.exe Executes Specified Binary", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_devtoolslauncher.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "62510e69-616b-4078-b371-847da438cc03", "title": "Share And Session Enumeration Using Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_view_share_and_sessions_enum.yml", "status": "stable", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "title": "Copy From Or To Admin Share Or Sysvol Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_copy_lateral_movement.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "title": "Unsigned AppX Installation Attempt Using Add-AppxPackage", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_install_unsigned_appx_packages.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a743ceba-c771-4d75-97eb-8a90f7f4844c", "title": "UAC Bypass Using PkgMgr and DISM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_pkgmgr_dism.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "title": "Browser Execution In Headless Mode", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_exec.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "title": "Nslookup PowerShell Download Cradle - ProcessCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_nslookup_poweshell_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "title": "Insecure Transfer Via Curl.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_insecure_connection.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "285b85b1-a555-4095-8652-a8a4106af63f", "title": "Suspicious Rundll32 Setupapi.dll Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_setupapi_installhinfsection.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "84f52741-8834-4a8c-a413-2eb2269aa6c8", "title": "DllUnregisterServer Function Call Via Msiexec.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msiexec_dll.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "762f2482-ff21-4970-8939-0aa317a886bb", "title": "HackTool - Certify Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_certify.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "title": "Suspicious Encoded PowerShell Command Line", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "title": "Renamed BrowserCore.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_browsercore.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "be344333-921d-4c4d-8bb8-e584cf584780", "title": "Potentially Suspicious Event Viewer Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_eventvwr_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "title": "Indirect Command Execution By Program Compatibility Wizard", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_pcwrun.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "title": "Potential COM Objects Download Cradles Usage - Process Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_download_com_cradles.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fb843269-508c-4b76-8b8d-88679db22ce7", "title": "Suspicious Execution of Powershell with Base64", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_encode.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "title": "Script Event Consumer Spawning Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_scrcons_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "de587dce-915e-4218-aac4-835ca6af6f70", "title": "Potential Persistence Attempt Via Run Keys Using Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_add_run_key.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c7942406-33dd-4377-a564-0f62db0593a3", "title": "Suspicious CodePage Switch Via CHCP", "file": "../sigma/rules/windows/process_creation/proc_creation_win_chcp_codepage_switch.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ab9e3b40-0c85-4ba1-aede-455d226fd124", "title": "Suspicious Redirection to Local Admin Share", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_redirect_local_admin_share.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ef61af62-bc74-4f58-b49b-626448227652", "title": "Suspicious Active Directory Database Snapshot Via ADExplorer", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_adexplorer_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a20391f8-76fb-437b-abc0-dba2df1952c6", "title": "Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pressanykey_lolbin_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "899133d5-4d7c-4a7f-94ee-27355c879d90", "title": "Python Inline Command Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "24c77512-782b-448a-8950-eddb0785fc71", "title": "SQLite Chromium Profile Data DB Access", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sqlite_chromium_profile_data.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1ac8666b-046f-4201-8aba-1951aaec03a3", "title": "Command Line Execution with Suspicious URL and AppData Strings", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_http_appdata.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1c67a717-32ba-409b-a45d-0fb704a73a81", "title": "System Network Connections Discovery Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_use_network_connections_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "title": "SafeBoot Registry Key Deleted Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_delete_safeboot.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "title": "Remote Code Execute via Winrm.vbs", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winrm_execution_via_scripting_api_winrm_vbs.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "eca49c87-8a75-4f13-9c73-a5a29e845f03", "title": "Suspicious Runscripthelper.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_runscripthelper.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "435e10e4-992a-4281-96f3-38b11106adde", "title": "Computer Discovery And Export Via Get-ADComputer Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_computer_discovery_get_adcomputer.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b3512211-c67e-4707-bedc-66efc7848863", "title": "Potential PowerShell Downgrade Attack", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_downgrade_attack.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c15a46a0-07d4-4c87-b4b6-89207835a83b", "title": "Add Potential Suspicious New Download Source To Winget", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winget_add_susp_custom_source.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "title": "Kernel Memory Dump Via LiveKD", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_livekd_kernel_memory_dump.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "title": "PowerShell DownloadFile", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_susp_ps_downloadfile.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "title": "Suspicious Kernel Dump Using Dtrace", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dtrace_kernel_dump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1f0f6176-6482-4027-b151-00071af39d7e", "title": "Arbitrary File Download Via ConfigSecurityPolicy.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_configsecuritypolicy_download_file.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "title": "Compressed File Creation Via Tar.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_tar_compression.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "title": "Potentially Suspicious WebDAV LNK Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_webdav_lnk_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "title": "Potential Provlaunch.EXE Binary Proxy Execution Abuse", "file": "../sigma/rules/windows/process_creation/proc_creation_win_provlaunch_potential_abuse.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9257c05b-4a4a-48e5-a670-b7b073cf401b", "title": "Binary Proxy Execution Via Dotnet-Trace.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dotnet_trace_lolbin_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "title": "Add New Download Source To Winget", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winget_add_custom_source.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "title": "Write Protect For Storage Disabled", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_write_protect_for_storage_disabled.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "title": "File Encoded To Base64 Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_encode.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "99793437-3e16-439b-be0f-078782cf953d", "title": "Tap Installer Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_tapinstall_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "title": "Suspicious File Download From IP Via Wget.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wget_download_direct_ip.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "title": "Potential Credential Dumping Attempt Using New NetworkProvider - CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_new_network_provider.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "title": "Wusa.EXE Executed By Parent Process Located In Suspicious Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wusa_susp_parent_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ac175779-025a-4f12-98b0-acdaeb77ea85", "title": "PowerShell Script Run in AppData", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_susp_ps_appdata.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "title": "Fsutil Drive Enumeration", "file": "../sigma/rules/windows/process_creation/proc_creation_win_fsutil_drive_enumeration.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "90d50722-0483-4065-8e35-57efaadd354d", "title": "Arbitrary MSI Download Via Devinit.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_devinit_lolbin_usage.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "180c7c5c-d64b-4a63-86e9-68910451bc8b", "title": "Potential File Download Via MS-AppInstaller Protocol Handler", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_ms_appinstaller_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d55b793d-f847-4eea-b59a-5ab09908ac90", "title": "Suspicious Child Process Of Veeam Dabatase", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mssql_veaam_susp_child_processes.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aef9d1f1-7396-4e92-a927-4567c7a495c1", "title": "Suspicious Git Clone", "file": "../sigma/rules/windows/process_creation/proc_creation_win_git_susp_clone.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ed825c86-c009-4014-b413-b76003e33d35", "title": "Windows Binary Executed From WSL", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wsl_windows_binaries_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6c6d9280-e6d0-4b9d-80ac-254701b64916", "title": "Potential NTLM Coercion Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_ntlm_coercion.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "title": "Suspicious Control Panel DLL Load", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_susp_control_dll_load.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9212f354-7775-4e28-9c9f-8f0a4544e664", "title": "Active Directory Database Snapshot Via ADExplorer", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_adexplorer_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b697e69c-746f-4a86-9f59-7bfff8eab881", "title": "UAC Bypass Using Disk Cleanup", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_cleanmgr.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "title": "Suspicious Invoke-WebRequest Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_invoke_webrequest_download.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ffa6861c-4461-4f59-8a41-578c39f3f23e", "title": "LSASS Dump Keyword In CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_lsass_dmp_cli_keywords.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a0459f02-ac51-4c09-b511-b8c9203fc429", "title": "Potential Process Execution Proxy Via CL_Invocation.ps1", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_cl_invocation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "title": "PsExec Service Child Process Execution as LOCAL SYSTEM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_psexesvc_as_system.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "title": "HackTool - Htran/NATBypass Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_htran_or_natbypass.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "title": "Registry Modification Via Regini.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regini_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "534f2ef7-e8a2-4433-816d-c91bccde289b", "title": "Explorer NOUACCHECK Flag", "file": "../sigma/rules/windows/process_creation/proc_creation_win_explorer_nouaccheck.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "title": "New Port Forwarding Rule Added Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_port_forwarding.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "590a5f4c-6c8c-4f10-8307-89afe9453a9d", "title": "Suspicious Child Process Created as System", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_child_process_as_system_.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "84232095-ecca-4015-b0d7-7726507ee793", "title": "Suspicious DLL Loaded via CertOC.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certoc_load_dll_susp_locations.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "38646daa-e78f-4ace-9de0-55547b2d30da", "title": "PUA - Seatbelt Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_seatbelt.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4e2ed651-1906-4a59-a78a-18220fca1b22", "title": "PUA - NirCmd Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_nircmd.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "96036718-71cc-4027-a538-d1587e0006a7", "title": "Windows Processes Suspicious Parent Directory", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_proc_wrong_parent.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d21374ff-f574-44a7-9998-4a8c8bf33d7d", "title": "WmiPrvSE Spawned A Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmiprvse_spawning_process.yml", "status": "stable", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "60f16a96-db70-42eb-8f76-16763e333590", "title": "New Capture Session Launched Via DXCap.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dxcap_arbitrary_binary_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5afee48e-67dd-4e03-a783-f74259dcf998", "title": "Potential LSASS Process Dump Via Procdump", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_procdump_lsass.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "title": "Suspicious Processes Spawned by Java.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_java_susp_child_process.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "771d1eb5-9587-4568-95fb-9ec44153a012", "title": "PUA - NSudo Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_nsudo.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "title": "Uninstall Sysinternals Sysmon", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_sysmon_uninstall.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "title": "PowerShell Web Access Feature Enabled Via DISM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dism_enable_powershell_web_access_feature.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e28a5a99-da44-436d-b7a0-2afc20a5f413", "title": "Whoami Utility Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_whoami_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "title": "Potential Memory Dumping Activity Via LiveKD", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_livekd_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "title": "HackTool - F-Secure C3 Load by Rundll32", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_c3_rundll32_pattern.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "68d37776-61db-42f5-bf54-27e87072d17e", "title": "PUA - NPS Tunneling Tool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_nps.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c4e49831-1496-40cf-8ce1-b53f942b02f9", "title": "Renamed PAExec Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_paexec.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "title": "Fsutil Behavior Set SymlinkEvaluation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_fsutil_symlinkevaluation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "title": "Base64 MZ Header In CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_inline_base64_mz_header.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "title": "Suspicious Rundll32 Execution With Image Extension", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_susp_execution_with_image_extension.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2c32b543-1058-4808-91c6-5b31b8bed6c5", "title": "PUA - Crassus Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_crassus.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "title": "Schtasks From Suspicious Folders", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_folder_combos.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d2b749ee-4225-417e-b20e-a8d2193cbb84", "title": "PUA - AdvancedRun Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_advancedrun.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1193d960-2369-499f-a158-7b50a31df682", "title": "Potential Suspicious Browser Launch From Document Reader Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_browser_launch_from_document_reader_process.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6b65c28e-11f3-46cb-902a-68f2cafaf474", "title": "Odbcconf.EXE Suspicious DLL Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_odbcconf_exec_susp_locations.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "242301bc-f92f-4476-8718-78004a6efd9f", "title": "DLL Loaded via CertOC.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certoc_load_dll.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "title": "Diskshadow Script Mode - Execution From Potential Suspicious Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_location.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "title": "Monitoring For Persistence Via BITS", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "52d097e2-063e-4c9c-8fbb-855c8948d135", "title": "Suspicious Windows Update Agent Empty Cmdline", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wuauclt_no_cli_flags_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "title": "Process Memory Dump via RdrLeakDiag.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "647c7b9e-d784-4fda-b9a0-45c565a7b729", "title": "Operator Bloopers Cobalt Strike Commands", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_bloopers_cmd.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "title": "Suspicious Mshta.EXE Execution Patterns", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mshta_susp_pattern.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "title": "Potential Encoded PowerShell Patterns In CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_encoding_patterns.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bb76d96b-821c-47cf-944b-7ce377864492", "title": "Suspicious NTLM Authentication on the Printer Spooler Service", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_ntlmrelay.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "title": "Detection of PowerShell Execution via Sqlps.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mssql_sqlps_susp_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1816994b-42e1-4fb1-afd2-134d88184f71", "title": "PowerShell Base64 Encoded WMI Classes", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_wmi_classes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "12827a56-61a4-476a-a9cb-f3068f191073", "title": "HackTool - KrbRelayUp Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_krbrelayup.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "32b96012-7892-429e-b26c-ac2bf46066ff", "title": "Shell32 DLL Execution in Suspicious Directory", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_shell32_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "title": "Potential Mpclient.DLL Sideloading Via Defender Binaries", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mpcmdrun_dll_sideload_defender.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f4bbd493-b796-416e-bbf2-121235348529", "title": "Non Interactive PowerShell Process Spawned", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_non_interactive_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "title": "PUA - Advanced IP Scanner Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "title": "Persistence Via TypedPaths - CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_typed_paths_persistence.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d06be4b9-8045-428b-a567-740a26d9db25", "title": "Verclsid.exe Runs COM Object", "file": "../sigma/rules/windows/process_creation/proc_creation_win_verclsid_runs_com.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "title": "Remote Access Tool - AnyDesk Silent Installation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_silent_install.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "title": "Suspicious FromBase64String Usage On Gzip Archive - Process Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_frombase64string_archive.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7a01183d-71a2-46ad-ad5c-acd989ac1793", "title": "UAC Bypass Abusing Winsat Path Parsing - Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_winsat.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "65c3ca2c-525f-4ced-968e-246a713d164f", "title": "Visual Studio NodejsTools PressAnyKey Renamed Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_pressanykey.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "347906f3-e207-4d18-ae5b-a9403d6bcdef", "title": "Netsh Allow Group Policy on Microsoft Defender Firewall", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_fw_enable_group_rule.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a29808fd-ef50-49ff-9c7a-59a9b040b404", "title": "HackTool - Pypykatz Credentials Dumping Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_pypykatz.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e66779cc-383e-4224-a3a4-267eeb585c40", "title": "Bypass UAC via CMSTP", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "85c312b7-f44d-4a51-a024-d671c40b49fc", "title": "Service StartupType Change Via Sc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_disable_service.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6da2c9f5-7c53-401b-aacb-92c040ce1215", "title": "Use of W32tm as Timer", "file": "../sigma/rules/windows/process_creation/proc_creation_win_w32tm.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6bd75993-9888-4f91-9404-e1e4e4e34b77", "title": "HackTool - LocalPotato Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_localpotato.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "title": "Potential MsiExec Masquerading", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msiexec_masquerading.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ff992eac-6449-4c60-8c1d-91c9722a1d48", "title": "New Root Certificate Installed Via CertMgr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certmgr_certificate_installation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "title": "Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_1.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "208748f7-881d-47ac-a29c-07ea84bf691d", "title": "Suspicious Outlook Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "89ca78fd-b37c-4310-b3d3-81a023f83936", "title": "Schtasks Creation Or Modification With SYSTEM Privileges", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_system.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a2910908-e86f-4687-aeba-76a5f996e652", "title": "DLL Execution Via Register-cimprovider.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_cimprovider_dll_load.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "title": "Php Inline Command Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_php_inline_command_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9c14c9fa-1a63-4a64-8e57-d19280559490", "title": "Invoke-Obfuscation Via Stdin", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_stdin.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "221b251a-357a-49a9-920a-271802777cc0", "title": "Process Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "50919691-7302-437f-8e10-1fe088afa145", "title": "Regsvr32 DLL Execution With Uncommon Extension", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_uncommon_extension.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "title": "Windows Internet Hosted WebDav Share Mount Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_use_mount_internet_share.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "title": "File Download From IP Based URL Via CertOC.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certoc_download_direct_ip.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f14e169e-9978-4c69-acb3-1cff8200bc36", "title": "Suspicious GrpConv Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_susp_grpconv.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "title": "Copy From VolumeShadowCopy Via Cmd.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_shadowcopy_access.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "title": "Potential ReflectDebugger Content Execution Via WerFault.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_werfault_reflect_debugger_exec.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1c8774a0-44d4-4db0-91f8-e792359c70bd", "title": "REGISTER_APP.VBS Proxy Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_register_app.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "title": "Run PowerShell Script from Redirected Input Stream", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_run_script_from_input_stream.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9fc3072c-dc8f-4bf7-b231-18950000fadd", "title": "Potential Recon Activity Using DriverQuery.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_driverquery_recon.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "title": "Potentially Suspicious Ping/Copy Command Combination", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_ping_copy_combined_execution.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ada4b0c4-758b-46ac-9033-9004613a150d", "title": "Modify Group Policy Settings", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_modify_group_policy_settings.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "584bca0f-3608-4402-80fd-4075ff6072e3", "title": "Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_unicode_img.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9a132afa-654e-11eb-ae93-0242ac130002", "title": "PUA - AdFind Suspicious Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "title": "Suspicious Process Created Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_susp_process_creation.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a70dcb37-3bee-453a-99df-d0c683151be6", "title": "Firewall Rule Update Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_fw_set_rule.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "85b0b087-eddf-4a2b-b033-d771fa2b9775", "title": "PowerShell Download and Execution Cradles", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_download_iex.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2267fe65-0681-42ad-9a6d-46553d3f3480", "title": "WSL Child Process Anomaly", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wsl_child_processes_anomalies.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "28c8f68b-098d-45af-8d43-8089f3e35403", "title": "Potential Register_App.Vbs LOLScript Abuse", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolscript_register_app.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cd8c163e-a19b-402e-bdd5-419ff5859f12", "title": "HackTool - ADCSPwn Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_adcspwn.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "title": "Sensitive File Access Via Volume Shadow Copy Backup", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_sensitive_file_access_shadowcopy.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "title": "Control Panel Items", "file": "../sigma/rules/windows/process_creation/proc_creation_win_control_panel_item.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2c28c248-7f50-417a-9186-a85b223010ee", "title": "Wscript Shell Run In CommandLine", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mshta_inline_vbscript.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "84972c80-251c-4c3a-9079-4f00aad93938", "title": "Sensitive File Recovery From Backup Via Wbadmin.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wbadmin_restore_sensitive_files.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "224f140f-3553-4cd1-af78-13d81bf9f7cc", "title": "Potential RDP Session Hijacking Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_tscon_rdp_session_hijacking.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "434c08ba-8406-4d15-8b24-782cb071a691", "title": "PowerShell Execution With Potential Decryption Capabilities", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_decrypt_pattern.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bed2a484-9348-4143-8a8a-b801c979301c", "title": "Webshell Detection With Command Line Keywords", "file": "../sigma/rules/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a0d7e4d2-bede-4141-8896-bc6e237e977c", "title": "Suspicious File Download From File Sharing Domain Via Wget.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wget_download_susp_file_sharing_domains.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "title": "Dynamic .NET Compilation Via Csc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_csc_susp_dynamic_compilation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1c526788-0abe-4713-862f-b520da5e5316", "title": "Chromium Browser Headless Execution To Mockbin Like Site", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_chromium_mockbin_abuse.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "title": "RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_remotefxvgpudisablement_abuse.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "title": "Disable Important Scheduled Task", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_disable.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9f107a84-532c-41af-b005-8d12a607639f", "title": "Potentially Suspicious Cabinet File Expansion", "file": "../sigma/rules/windows/process_creation/proc_creation_win_expand_cabinet_files.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3", "title": "Potential Credential Dumping Via WER", "file": "../sigma/rules/windows/process_creation/proc_creation_win_werfault_lsass_shtinkering.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "455b9d50-15a1-4b99-853f-8d37655a4c1b", "title": "PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dee0a7a3-f200-4112-a99b-952196d81e42", "title": "DumpMinitool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dumpminitool_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "title": "Remote Access Tool - Anydesk Execution From Suspicious Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_susp_exec.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "79ce34ca-af29-4d0e-b832-fc1b377020db", "title": "Whoami.EXE Execution From Privileged Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_whoami_execution_from_high_priv_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2afafd61-6aae-4df4-baed-139fa1f4c345", "title": "Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ntdsutil_usage.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b52e84a3-029e-4529-b09b-71d19dd27e94", "title": "Remote Access Tool - AnyDesk Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "title": "CMSTP Execution Process Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmstp_execution_by_creation.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f0507c0f-a3a2-40f5-acc6-7f543c334993", "title": "Suspicious File Execution From Internet Hosted WebDav Share", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_net_use_and_exec_combo.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "970007b7-ce32-49d0-a4a4-fbef016950bd", "title": "Potential Configuration And Service Reconnaissance Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_query_registry.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "title": "Potential Provisioning Registry Key Abuse For Binary Proxy Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_provlaunch_provisioning_command.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f4264e47-f522-4c38-a420-04525d5b880f", "title": "Renamed AutoIt Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_autoit.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b2ddd389-f676-4ac4-845a-e00781a48e5f", "title": "Using SettingSyncHost.exe as LOLBin", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_settingsynchost.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "title": "Uncommon Child Process Of Setres.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_setres_uncommon_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4a6713f6-3331-11ed-a261-0242ac120002", "title": "Taskkill Symantec Endpoint Protection", "file": "../sigma/rules/windows/process_creation/proc_creation_win_taskkill_sep.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "title": "Windows Kernel Debugger Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_kd_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "title": "Renamed AdFind Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_adfind.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5cc2cda8-f261-4d88-a2de-e9e193c86716", "title": "Suspicious Processes Spawned by WinRM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winrm_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2d22a514-e024-4428-9dba-41505bd63a5b", "title": "Indirect Command Execution From Script File Via Bash.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bash_file_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "title": "Ie4uinit Lolbin Use From Invalid Path", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_ie4uinit.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "01c42d3c-242d-4655-85b2-34f1739632f7", "title": "Potentially Over Permissive Permissions Granted Using Dsacls.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dsacls_abuse_permissions.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "title": "Suspicious Scheduled Task Creation via Masqueraded XML File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_schedule_via_masqueraded_xml_file.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "77946e79-97f1-45a2-84b4-f37b5c0d8682", "title": "Suspicious Registry Modification From ADS Via Regini.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regini_ads.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "27ba3207-dd30-4812-abbf-5d20c57d474e", "title": "Suspicious Chromium Browser Instance Executed With Custom Extension", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "title": "Pubprn.vbs Proxy Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_pubprn.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "title": "HackTool - SharpMove Tool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharpmove.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1228c958-e64e-4e71-92ad-7d429f4138ba", "title": "Script Interpreter Execution From Suspicious Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_script_exec_from_env_folder.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "title": "BitLockerTogo.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bitlockertogo_execution.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "title": "Suspicious WindowsTerminal Child Processes", "file": "../sigma/rules/windows/process_creation/proc_creation_win_windows_terminal_susp_children.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b1377339-fda6-477a-b455-ac0923f9ec2c", "title": "Remote Access Tool - AnyDesk Piped Password Via CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_piped_password_via_cli.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "44143844-0631-49ab-97a0-96387d6b2d7c", "title": "File Download Using Notepad++ GUP Utility", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gup_download.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "title": "PUA - Potential PE Metadata Tamper Using Rcedit", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "title": "Potential Crypto Mining Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_crypto_mining_monero.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "85de1f22-d189-44e4-8239-dc276b45379b", "title": "Curl Web Request With Potential Custom User-Agent", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_custom_user_agent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "92626ddd-662c-49e3-ac59-f6535f12d189", "title": "Scheduled Task Creation Via Schtasks.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_creation.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "title": "Hidden Powershell in Link File Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_embed_exe_lnk.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "title": "Potential Suspicious Windows Feature Enabled - ProcCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_enable_susp_windows_optional_feature.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "title": "Chromium Browser Instance Executed With Custom Extension", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_chromium_load_extension.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e56d3073-83ff-4021-90fe-c658e0709e72", "title": "Gpresult Display Group Policy Information", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gpresult_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "deb9b646-a508-44ee-b7c9-d8965921c6b6", "title": "Powershell Token Obfuscation - Process Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_token_obfuscation.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "title": "Suspicious Extrac32 Alternate Data Stream Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cea2b7ea-792b-405f-95a1-b903ea06458f", "title": "Suspicious Child Process Of Manage Engine ServiceDesk", "file": "../sigma/rules/windows/process_creation/proc_creation_win_java_manageengine_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "title": "Suspicious Binary In User Directory Spawned From Office Application", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_spawn_exe_from_users_directory.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "title": "Remote Access Tool - ScreenConnect Installation Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_installation_cli_param.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "730fc21b-eaff-474b-ad23-90fd265d4988", "title": "Psexec Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_psexec_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "title": "HackTool - Wmiexec Default Powershell Command", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_wmiexec_default_powershell.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "title": "HackTool - RemoteKrbRelay Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_krbrelay_remote.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "title": "Rundll32 InstallScreenSaver Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_installscreensaver.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "48917adc-a28e-4f5d-b729-11e75da8941f", "title": "Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_defender_exclusion.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "title": "Suspicious Scan Loop Network", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_network_scan_loop.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0900463c-b33b-49a8-be1d-552a3b553dae", "title": "Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_hidden_dir_index_allocation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "82a6714f-4899-4f16-9c1e-9a333544d4c3", "title": "File In Suspicious Location Encoded To Base64 Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "title": "Add Insecure Download Source To Winget", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winget_add_insecure_custom_source.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1e59c230-6670-45bf-83b0-98903780607e", "title": "Gpscript Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_gpscript.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "title": "HackTool - CrackMapExec PowerShell Obfuscation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_powershell_obfuscation.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5687f942-867b-4578-ade7-1e341c46e99a", "title": "VMToolsd Suspicious Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vmware_vmtoolsd_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "258fc8ce-8352-443a-9120-8a11e4857fa5", "title": "Potential Arbitrary Command Execution Using Msdt.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msdt_arbitrary_command_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "title": "Renamed CreateDump Utility Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_createdump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "title": "HH.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hh_chm_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "title": "File Download Using ProtocolHandler.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_protocolhandler_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4ae81040-fc1c-4249-bfa3-938d260214d9", "title": "Use Icacls to Hide File to Everyone", "file": "../sigma/rules/windows/process_creation/proc_creation_win_icacls_deny.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aa2efee7-34dd-446e-8a37-40790a66efd7", "title": "Recon Information for Export with Command Prompt", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_recon.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "title": "New Generic Credentials Added Via Cmdkey.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmdkey_adding_generic_creds.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "title": "Suspicious RDP Redirect Using TSCON", "file": "../sigma/rules/windows/process_creation/proc_creation_win_tscon_rdp_redirect.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "title": "File Encryption/Decryption Via Gpg4win From Suspicious Locations", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gpg4win_susp_location.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ae215552-081e-44c7-805f-be16f975c8a2", "title": "Suspicious Debugger Registration Cmdline", "file": "../sigma/rules/windows/process_creation/proc_creation_win_registry_install_reg_debugger_backdoor.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "30bf1789-379d-4fdc-900f-55cd0a90a801", "title": "Visual Studio Code Tunnel Service Installation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vscode_tunnel_service_install.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "title": "COM Object Execution via Xwizard.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_xwizard_runwizard_com_object_exec.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "198effb6-6c98-4d0c-9ea3-451fa143c45c", "title": "Run Once Task Execution as Configured in Registry", "file": "../sigma/rules/windows/process_creation/proc_creation_win_runonce_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4f7a6757-ff79-46db-9687-66501a02d9ec", "title": "Active Directory Structure Export Via Ldifde.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ldifde_export.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e01fa958-6893-41d4-ae03-182477c5e77d", "title": "Remote Access Tool - RURAT Execution From Unusual Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_rurat_non_default_location.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "129966c9-de17-4334-a123-8b58172e664d", "title": "Potential Windows Defender AV Bypass Via Dump64.EXE Rename", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dump64_defender_av_bypass_rename.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "696bfb54-227e-4602-ac5b-30d9d2053312", "title": "Veeam Backup Database Suspicious Query", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sqlcmd_veeam_db_recon.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d85873ef-a0f8-4c48-a53a-6b621f11729d", "title": "Remote Access Tool - LogMeIn Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_logmein.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "title": "RDP Port Forwarding Rule Added Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_port_forwarding_3389.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7df1713a-1a5b-4a4b-a071-dc83b144a101", "title": "Esentutl Gather Credentials", "file": "../sigma/rules/windows/process_creation/proc_creation_win_esentutl_params.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a96970af-f126-420d-90e1-d37bf25e50e1", "title": "Use Short Name Path in Image", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_image.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "title": "Renamed Cloudflared.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_cloudflared.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "title": "Potential Execution of Sysinternals Tools", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_eula_accepted.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "814c95cc-8192-4378-a70a-f1aafd877af1", "title": "Use of OpenConsole", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_openconsole.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "title": "File With Suspicious Extension Downloaded Via Bitsadmin", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "99c840f2-2012-46fd-9141-c761987550ef", "title": "Suspicious Download From Direct IP Via Bitsadmin", "file": "../sigma/rules/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "02b18447-ea83-4b1b-8805-714a8a34546a", "title": "Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_offlinescannershell_mpclient_sideloading.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "title": "File Download with Headless Browser", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "de16d92c-c446-4d53-8938-10aeef41c8b6", "title": "Computer Password Change Via Ksetup.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ksetup_password_change_computer.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "056c7317-9a09-4bd4-9067-d051312752ea", "title": "Powershell Executed From Headless ConHost Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_conhost_headless_powershell.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "60fc936d-2eb0-4543-8a13-911c750a1dfc", "title": "Interactive AT Job", "file": "../sigma/rules/windows/process_creation/proc_creation_win_at_interactive_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "title": "Suspicious Curl.EXE Download", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_susp_download.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "title": "Reg Add Suspicious Paths", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_susp_paths.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "114de787-4eb2-48cc-abdb-c0b449f93ea4", "title": "Suspicious X509Enrollment - Process Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_x509enrollment.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "207b0396-3689-42d9-8399-4222658efc99", "title": "Potential Privilege Escalation To LOCAL SYSTEM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_susp_psexec_paexec_flags.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "title": "Execute Code with Pester.bat", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_pester_1.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9248c7e1-2bf3-4661-a22c-600a8040b446", "title": "Potential Rundll32 Execution With DLL Stored In ADS", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_ads_stored_dll_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "146aace8-9bd6-42ba-be7a-0070d8027b76", "title": "Potentially Suspicious Child Process Of WinRAR.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winrar_susp_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3d7679bd-0c00-440c-97b0-3f204273e6c7", "title": "New Process Created Via Taskmgr.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_taskmgr_susp_child_process.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ea011323-7045-460b-b2d7-0f7442ea6b38", "title": "Potential PsExec Remote Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_psexec_remote_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "title": "Suspicious Regsvr32 Execution From Remote Share", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_remote_share.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e290b10b-1023-4452-a4a9-eb31a9013b3a", "title": "LOLBAS Data Exfiltration by DataSvcUtil.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_data_exfiltration_by_using_datasvcutil.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ca5583e9-8f80-46ac-ab91-7f314d13b984", "title": "Potentially Suspicious Child Process of KeyScrambler.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_keyscrambler_susp_child_process.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "80fc36aa-945e-4181-89f2-2f907ab6775d", "title": "UAC Bypass Using IEInstal - Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_ieinstal.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cd3d1298-eb3b-476c-ac67-12847de55813", "title": "DLL Execution via Rasautou.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_rasautou_dll_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0afbd410-de03-4078-8491-f132303cb67d", "title": "Renamed NetSupport RAT Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_netsupport_rat.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "867356ee-9352-41c9-a8f2-1be690d78216", "title": "Potentially Suspicious Regsvr32 HTTP/FTP Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_network_pattern.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "67f113fa-e23d-4271-befa-30113b3e08b1", "title": "Suspicious JavaScript Execution Via Mshta.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mshta_javascript.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "title": "Arbitrary File Download Via MSPUB.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mspub_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "title": "Use of Wfc.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_wfc.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "title": "Insecure Proxy/DOH Transfer Via Curl.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_insecure_porxy_or_doh.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "62b20d44-1546-4e61-afce-8e175eb9473c", "title": "Service StartupType Change Via PowerShell Set-Service", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_set_service_disabled.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "title": "Suspicious Execution of Systeminfo", "file": "../sigma/rules/windows/process_creation/proc_creation_win_systeminfo_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "title": "User Added to Local Administrators Group", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_add_user_local_admin_group.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "37e8d358-6408-4853-82f4-98333fca7014", "title": "Remote Access Tool - NetSupport Execution From Unusual Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_netsupport_susp_exec.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "title": "Explorer Process Tree Break", "file": "../sigma/rules/windows/process_creation/proc_creation_win_explorer_break_process_tree.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "title": "Active Directory Structure Export Via Csvde.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_csvde_export.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b6676963-0353-4f88-90f5-36c20d443c6a", "title": "Cscript/Wscript Potentially Suspicious Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wscript_cscript_susp_child_processes.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "99cf1e02-00fb-4c0d-8375-563f978dfd37", "title": "Deny Service Access Using Security Descriptor Tampering Via Sc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_sdset_deny_service_access.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "903076ff-f442-475a-b667-4f246bcc203b", "title": "Nltest.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_nltest_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a77c1610-fc73-4019-8e29-0f51efc04a51", "title": "Potential Dosfuscation Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmd_dosfuscation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "title": "PowerShell Base64 Encoded FromBase64String Cmdlet", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_frombase64string.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "title": "Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_iexpress_susp_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cea72823-df4d-4567-950c-0b579eaf0846", "title": "Potential Dropper Script Execution Via WScript/CScript", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wscript_cscript_dropper.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "74a2b202-73e0-4693-9a3a-9d36146d0775", "title": "Remote Access Tool - MeshAgent Command Execution via MeshCentral", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_meshagent_exec.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5fc297ae-25b6-488a-8f25-cc12ac29b744", "title": "Potentially Suspicious Usage Of Qemu", "file": "../sigma/rules/windows/process_creation/proc_creation_win_qemu_suspicious_execution.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "12f6b752-042d-483e-bf9c-915a6d06ad75", "title": "Windows Firewall Disabled via PowerShell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_disable_firewall.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "title": "Code Execution via Pcwutl.dll", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_pcwutl.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c1d867fe-8d95-4487-aab4-e53f2d339f90", "title": "Renamed Sysinternals Sdelete Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_sdelete.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e13f668e-7f95-443d-98d2-1816a7648a7b", "title": "Detected Windows Software Discovery", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_software_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "863218bd-c7d0-4c52-80cd-0a96c09f54af", "title": "Arbitrary File Download Via IMEWDBLD.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_imewbdld_download.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "title": "Sensitive File Dump Via Wbadmin.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wbadmin_dump_sensitive_files.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9c8c7000-3065-44a8-a555-79bcba5d9955", "title": "Execute MSDT Via Answer File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_msdt_answer_file.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "title": "Cloudflared Portable Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cloudflared_portable_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ee5e119b-1f75-4b34-add8-3be976961e39", "title": "Conhost.exe CommandLine Path Traversal", "file": "../sigma/rules/windows/process_creation/proc_creation_win_conhost_path_traversal.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "33339be3-148b-4e16-af56-ad16ec6c7e7b", "title": "Findstr Launching .lnk File", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_lnk.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "title": "Potentially Suspicious Child Process Of Regsvr32", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "01d2e2a1-5f09-44f7-9fc1-24faa7479b6d", "title": "Uncommon Svchost Parent Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_svchost_uncommon_parent_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d937b75f-a665-4480-88a5-2f20e9f9b22a", "title": "Possible Privilege Escalation via Weak Service Permissions", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_change_sevice_image_path_by_non_admin.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "title": "PUA - Ngrok Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_ngrok.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "646ea171-dded-4578-8a4d-65e9822892e3", "title": "Process Memory Dump Via Comsvcs.DLL", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_process_dump_via_comsvcs.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ca387a8e-1c84-4da3-9993-028b45342d30", "title": "PUA - SoftPerfect Netscan Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_netscan.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "84b1706c-932a-44c4-ae28-892b28a25b94", "title": "OneNote.EXE Execution of Malicious Embedded Scripts", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_onenote_embedded_script_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "title": "Arbitrary File Download Via Squirrel.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_squirrel_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "title": "Always Install Elevated MSI Spawned Cmd And Powershell", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_elavated_msi_spawned_shell.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1012f107-b8f1-4271-af30-5aed2de89b39", "title": "Terminal Service Process Spawn", "file": "../sigma/rules/windows/process_creation/proc_creation_win_svchost_termserv_proc_spawn.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "074e0ded-6ced-4ebd-8b4d-53f55908119d", "title": "AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winrm_awl_bypass.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "title": "Firewall Rule Deleted Via Netsh.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_fw_delete_rule.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "title": "Whoami.EXE Execution With Output Option", "file": "../sigma/rules/windows/process_creation/proc_creation_win_whoami_output.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "title": "Certificate Exported Via Certutil.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_certutil_export_pfx.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1ca6bd18-0ba0-44ca-851c-92ed89a61085", "title": "UAC Bypass Using Consent and Comctl32 - Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_consent_comctl32.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "af491bca-e752-4b44-9c86-df5680533dbc", "title": "Finger.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_finger_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "title": "Suspicious Desktopimgdownldr Command", "file": "../sigma/rules/windows/process_creation/proc_creation_win_desktopimgdownldr_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "title": "Use NTFS Short Name in Image", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_image.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f0f7be61-9cf5-43be-9836-99d6ef448a18", "title": "Uninstall Crowdstrike Falcon Sensor", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uninstall_crowdstrike_falcon.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b1f73849-6329-4069-bc8f-78a604bb8b23", "title": "Remote Access Tool - ScreenConnect Remote Command Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "title": "Suspicious PowerShell Encoded Command Patterns", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd_patterns.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "title": "HackTool - SharpUp PrivEsc Tool Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_sharpup.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "title": "User Added To Highly Privileged Group", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_add_user_privileged_group.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "title": "Potential ShellDispatch.DLL Functionality Abuse", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_shelldispatch_potential_abuse.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "title": "Stop Windows Service Via Sc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_stop_service.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "title": "Potential Credential Dumping Via LSASS Process Clone", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lsass_process_clone.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "title": "Use of Pcalua For Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_pcalua.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3a6586ad-127a-4d3b-a677-1e6eacdf8fde", "title": "Windows Shell/Scripting Processes Spawning Suspicious Programs", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_shell_spawn_susp_program.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "title": "Usage Of Web Request Commands And Cmdlets", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_web_request_cmd_and_cmdlets.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f38a82d2-fba3-4781-b549-525efbec8506", "title": "PUA - 3Proxy Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_3proxy_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "title": "Msxsl.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msxsl_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4833155a-4053-4c9c-a997-777fcea0baa7", "title": "SQLite Firefox Profile Data DB Access", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sqlite_firefox_gecko_profile_data.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0b80ade5-6997-4b1d-99a1-71701778ea61", "title": "Imports Registry Key From an ADS", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "81ebd28b-9607-4478-bf06-974ed9d53ed7", "title": "Potential Application Whitelisting Bypass via Dnx.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dnx_execute_csharp_code.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "dc4576d4-7467-424f-9eee-fd2b02855fe0", "title": "Suspicious Cabinet File Execution Via Msdt.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msdt_susp_cab_options.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "title": "Weak or Abused Passwords In CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_weak_or_abused_passwords.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e9142d84-fbe0-401d-ac50-3e519fb00c89", "title": "WhoAmI as Parameter", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_whoami_as_param.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b4dc61f5-6cce-468e-a608-b48b469feaa2", "title": "DirLister Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dirlister_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e6313acd-208c-44fc-a0ff-db85d572e90e", "title": "Network Reconnaissance Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_nslookup_domain_discovery.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f3d39c45-de1a-4486-a687-ab126124f744", "title": "Sdiagnhost Calling Suspicious Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sdiagnhost_susp_child.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "97dbf6e2-e436-44d8-abee-4261b24d3e41", "title": "Microsoft IIS Connection Strings Decryption", "file": "../sigma/rules/windows/process_creation/proc_creation_win_iis_connection_strings_decryption.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "729ce0ea-5d8f-4769-9762-e35de441586d", "title": "MpiExec Lolbin", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_mpiexec.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0fc35fc3-efe6-4898-8a37-0b233339524f", "title": "Suspicious ScreenSave Change by Reg.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_screensaver.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c947b146-0abc-4c87-9c64-b17e9d7274a2", "title": "Shadow Copies Deletion Using Operating Systems Utilities", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "91a2c315-9ee6-4052-a853-6f6a8238f90d", "title": "Findstr GPP Passwords", "file": "../sigma/rules/windows/process_creation/proc_creation_win_findstr_gpp_passwords.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9525dc73-0327-438c-8c04-13c0e037e9da", "title": "Regsvr32 Execution From Potential Suspicious Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regsvr32_susp_exec_path_1.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a4694263-59a8-4608-a3a0-6f8d3a51664c", "title": "Suspicious Key Manager Access", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_keymgr.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f37aba28-a9e6-4045-882c-d5004043b337", "title": "Potential Arbitrary File Download Via Cmdl32.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cmdl32_arbitrary_file_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5e95028c-5229-4214-afae-d653d573d0ec", "title": "Security Service Disabled Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_disable_sec_services.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "88656cec-6c3b-487c-82c0-f73ebb805503", "title": "Remote Access Tool - UltraViewer Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_ultraviewer.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "title": "New DLL Registered Via Odbcconf.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "title": "Suspicious IIS URL GlobalRules Rewrite Via AppCmd", "file": "../sigma/rules/windows/process_creation/proc_creation_win_iis_appcmd_susp_rewrite_rule.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "title": "Suspicious Child Process Of SQL Server", "file": "../sigma/rules/windows/process_creation/proc_creation_win_mssql_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "title": "Suspicious Program Names", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_progname.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f7375e28-5c14-432f-b8d1-1db26c832df3", "title": "Potential Arbitrary DLL Load Using Winword", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_winword_dll_load.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0e0255bf-2548-47b8-9582-c0955c9283f5", "title": "Suspicious Reg Add BitLocker", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_bitlocker.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "title": "Cscript/Wscript Uncommon Script Extension Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wscript_cscript_uncommon_extension_exec.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "57bff678-25d1-4d6c-8211-8ca106d12053", "title": "Remote Access Tool - ScreenConnect Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d65aee4d-2292-4cea-b832-83accd6cfa43", "title": "Arbitrary Binary Execution Using GUP Utility", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gup_arbitrary_binary_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "title": "Scheduled Task Executing Encoded Payload from Registry", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_reg_loader_encoded.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "889719ef-dd62-43df-86c3-768fb08dc7c0", "title": "Suspicious PowerShell Mailbox Export to Share", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_mailboxexport_share.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "037dcd71-33a8-4392-bb01-293c94663e5a", "title": "File Decryption Using Gpg4win", "file": "../sigma/rules/windows/process_creation/proc_creation_win_gpg4win_decryption.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "18ee686c-38a3-4f65-9f44-48a077141f42", "title": "Uncommon Extension Shim Database Installation Via Sdbinst.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sdbinst_susp_extension.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "af77cf95-c469-471c-b6a0-946c685c4798", "title": "Proxy Execution Via Wuauclt.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wuauclt_dll_loading.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "title": "Uncommon AddinUtil.EXE CommandLine Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "title": "Renamed Gpg.EXE Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_gpg4win.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4bf943c6-5146-4273-98dd-e958fd1e3abf", "title": "Invoke-Obfuscation Obfuscated IEX Invocation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7f741dcf-fc22-4759-87b4-9ae8376676a2", "title": "Bypass UAC via Fodhelper.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_fodhelper.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8a3038e8-9c9d-46f8-b184-66234a160f6f", "title": "Potential Remote Desktop Tunneling", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_remote_desktop_tunneling.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7d4aaec2-08ed-4430-8b96-28420e030e04", "title": "Uncommon Sigverif.EXE Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sigverif_uncommon_child_process.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "75d0a94e-6252-448d-a7be-d953dff527bb", "title": "Remote XSL Execution Via Msxsl.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msxsl_remote_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "327f48c1-a6db-4eb8-875a-f6981f1b0183", "title": "Port Forwarding Activity Via SSH.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ssh_port_forward.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5f03babb-12db-4eec-8c82-7b4cb5580868", "title": "Response File Execution Via Odbcconf.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_odbcconf_response_file.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "title": "Windows Backup Deleted Via Wbadmin.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wbadmin_delete_backups.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "title": "MsiExec Web Install", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msiexec_web_install.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cd1f961e-0b96-436b-b7c6-38da4583ec00", "title": "Suspicious Windows Trace ETW Session Tamper Via Logman.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_logman_disable_eventlog.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "7b4f794b-590a-4ad4-ba18-7964a2832205", "title": "Renamed Vmnat.exe Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_vmnat.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "438025f9-5856-4663-83f7-52f878a70a50", "title": "Suspicious Microsoft Office Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_office_susp_child_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "title": "IIS Native-Code Module Command Line Installation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_iis_appcmd_susp_module_install.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "213d6a77-3d55-4ce8-ba74-fcfef741974e", "title": "Private Keys Reconnaissance Via CommandLine Tools", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_private_keys_recon.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "aaafa146-074c-11eb-adc1-0242ac120002", "title": "HackTool - Hydra Password Bruteforce Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_hydra.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2433a154-bb3d-42e4-86c3-a26bdac91c45", "title": "Renamed PingCastle Binary Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_pingcastle.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "178e615d-e666-498b-9630-9ed363038101", "title": "Elevated System Shell Spawned From Uncommon Parent Location", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_elevated_system_shell_uncommon_parent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "title": "Remote Access Tool - Simple Help Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_remote_access_tools_simple_help.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4f647cfa-b598-4e12-ad69-c68dd16caef8", "title": "DumpStack.log Defender Evasion", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_dumpstack_log_evasion.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "16c37b52-b141-42a5-a3ea-bbe098444397", "title": "Suspect Svchost Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_svchost_execution_with_no_cli_flags.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "title": "Execution via stordiag.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_stordiag_susp_child_process.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "cd764533-2e07-40d6-a718-cfeec7f2da7f", "title": "Renamed SysInternals DebugView Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_debugview.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "17769c90-230e-488b-a463-e05c08e9d48f", "title": "Powershell Defender Exclusion", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_defender_exclusion.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "222129f7-f4dc-4568-b0d2-22440a9639ba", "title": "Cloudflared Quick Tunnel Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_cloudflared_quicktunnel_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2704ab9e-afe2-4854-a3b1-0c0706d03578", "title": "HackTool - Dumpert Process Dumper Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_dumpert.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "afe52666-401e-4a02-b4ff-5d128990b8cb", "title": "Suspicious Greedy Compression Using Rar.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rar_susp_greedy_compression.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4ede543c-e098-43d9-a28f-dd784a13132f", "title": "Winrar Execution in Non-Standard Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_winrar_uncommon_folder_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e173ad47-4388-4012-ae62-bd13f71c18a8", "title": "Potential DLL Sideloading Via DeviceEnroller.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_deviceenroller_dll_sideloading.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "48bbc537-b652-4b4e-bd1d-281172df448f", "title": "Sysinternals PsSuspend Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_pssuspend_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "1edff897-9146-48d2-9066-52e8d8f80a2f", "title": "Suspicious Invoke-WebRequest Execution With DirectIP", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_invoke_webrequest_direct_ip.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c248c896-e412-4279-8c15-1c558067b6fa", "title": "Enumerate All Information With Whoami.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_whoami_all_execution.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "title": "Arbitrary File Download Via PresentationHost.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_presentationhost_download.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "title": "Microsoft IIS Service Account Password Dumped", "file": "../sigma/rules/windows/process_creation/proc_creation_win_iis_appcmd_service_account_password_dumped.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "title": "Potential Defense Evasion Via Right-to-Left Override", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_right_to_left_override.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "2cf29f11-e356-4f61-98c0-1bdb9393d6da", "title": "Renamed Visual Studio Code Tunnel Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_vscode_tunnel_renamed_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d522eca2-2973-4391-a3e0-ef0374321dae", "title": "Abused Debug Privilege by Arbitrary Parent Processes", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_abusing_debug_privilege.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "62e0298b-e994-4189-bc87-bc699aa62d97", "title": "Potential Suspicious Registry File Imported Via Reg.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_reg_import_from_suspicious_paths.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "title": "PowerShell Base64 Encoded Reflective Assembly Load", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "title": "Suspicious New Service Creation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_service_creation.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "title": "Java Running with Remote Debugging", "file": "../sigma/rules/windows/process_creation/proc_creation_win_java_remote_debugging.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a537cfc3-4297-4789-92b5-345bfd845ad0", "title": "Service DACL Abuse To Hide Services Via Sc.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sc_sdset_hide_sevices.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "74a12f18-505c-4114-8d0b-8448dd5485c6", "title": "PUA - Nimgrab Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_nimgrab.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "bb780e0c-16cf-4383-8383-1e5471db6cf9", "title": "Suspicious XOR Encoded PowerShell Command", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_xor_commandline.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4a2a2c3e-209f-4d01-b513-4155a540b469", "title": "Suspicious MsiExec Embedding Parent", "file": "../sigma/rules/windows/process_creation/proc_creation_win_msiexec_embedding.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "32410e29-5f94-4568-b6a3-d91a8adad863", "title": "PUA - Fast Reverse Proxy (FRP) Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_frp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "f64e5c19-879c-4bae-b471-6d84c8339677", "title": "Webshell Tool Reconnaissance Activity", "file": "../sigma/rules/windows/process_creation/proc_creation_win_webshell_tool_recon.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "title": "Process Execution From A Potentially Suspicious Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_execution_path.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "title": "File Download From IP URL Via Curl.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_exec.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "536e2947-3729-478c-9903-745aaffe60d2", "title": "Suspicious PowerShell Invocations - Specific - ProcessCreation", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_invocation_specific.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "40aa399c-7b02-4715-8e5f-73572b493f33", "title": "Suspicious File Download From IP Via Wget.EXE - Paths", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wget_download_susp_locations.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "883835a7-df45-43e4-bf1d-4268768afda4", "title": "Regedit as Trusted Installer", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regedit_trustedinstaller.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "title": "UAC Bypass Using Event Viewer RecentViews", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_eventvwr_recentviews.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "title": "AspNetCompiler Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_aspnet_compiler_exectuion.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "title": "Sysinternals PsService Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sysinternals_psservice.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b57ba453-b384-4ab9-9f40-1038086b4e53", "title": "VeeamBackup Database Credentials Dump Via Sqlcmd.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_sqlcmd_veeam_dump.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "title": "Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension", "file": "../sigma/rules/windows/process_creation/proc_creation_win_regasm_regsvcs_uncommon_extension_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "148431ce-4b70-403d-8525-fcc2993f29ea", "title": "Potential DLL Injection Or Execution Using Tracker.exe", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_tracker.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3bad990e-4848-4a78-9530-b427d854aac0", "title": "Domain Trust Discovery Via Dsquery", "file": "../sigma/rules/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "title": "PowerShell Get-Clipboard Cmdlet Via CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_get_clipboard.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "title": "DeviceCredentialDeployment Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_lolbin_device_credential_deployment.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "09576804-7a05-458e-a817-eb718ca91f54", "title": "Suspicious PowerShell IEX Execution Patterns", "file": "../sigma/rules/windows/process_creation/proc_creation_win_powershell_iex_patterns.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "title": "Potential Suspicious Activity Using SeCEdit", "file": "../sigma/rules/windows/process_creation/proc_creation_win_secedit_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b0524451-19af-4efa-a46f-562a977f792e", "title": "ShimCache Flush", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_susp_shimcache_flush.yml", "status": "stable", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b96b2031-7c17-4473-afe7-a30ce714db29", "title": "Use of FSharp Interpreters", "file": "../sigma/rules/windows/process_creation/proc_creation_win_fsi_fsharp_code_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "37c1333a-a0db-48be-b64b-7393b2386e3b", "title": "Hacktool Execution - PE Metadata", "file": "../sigma/rules/windows/process_creation/proc_creation_win_hktl_execution_via_pe_metadata.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "81325ce1-be01-4250-944f-b4789644556f", "title": "Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_schtasks_env_folder.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "3abd6094-7027-475f-9630-8ab9be7b9725", "title": "Windows Admin Share Mount Via Net.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_net_use_mount_admin_share.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "d9047477-0359-48c9-b8c7-792cedcdc9c4", "title": "PUA - NirCmd Execution As LOCAL SYSTEM", "file": "../sigma/rules/windows/process_creation/proc_creation_win_pua_nircmd_as_system.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "0a98a10c-685d-4ab0-bddc-b6bdd1d48458", "title": "Uncommon Userinit Child Process", "file": "../sigma/rules/windows/process_creation/proc_creation_win_userinit_uncommon_child_processes.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "56d19cb4-6414-4769-9644-1ed35ffbb148", "title": "Obfuscated IP Via CLI", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_via_cli.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "title": "Suspicious Script Execution From Temp Folder", "file": "../sigma/rules/windows/process_creation/proc_creation_win_susp_script_exec_from_temp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "title": "TrustedPath UAC Bypass Pattern", "file": "../sigma/rules/windows/process_creation/proc_creation_win_uac_bypass_trustedpath.yml", "status": "test", "level": "critical", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "title": "Browser Started with Remote Debugging", "file": "../sigma/rules/windows/process_creation/proc_creation_win_browsers_remote_debugging.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "5cdb711b-5740-4fb2-ba88-f7945027afac", "title": "Rundll32 UNC Path Execution", "file": "../sigma/rules/windows/process_creation/proc_creation_win_rundll32_unc_path.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "164eda96-11b2-430b-85ff-6a265c15bf32", "title": "Local Groups Reconnaissance Via Wmic.EXE", "file": "../sigma/rules/windows/process_creation/proc_creation_win_wmic_recon_group.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "a58353df-af43-4753-bad0-cd83ef35eef5", "title": "Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)", "file": "../sigma/rules/windows/process_creation/proc_creation_win_ntdsutil_susp_usage.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "56321594-9087-49d9-bf10-524fe8479452", "title": "Potential Persistence Via Netsh Helper DLL", "file": "../sigma/rules/windows/process_creation/proc_creation_win_netsh_helper_dll_persistence.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows"}, {"id": "df3fcaea-2715-4214-99c5-0056ea59eb35", "title": "Credentials In Files - Linux", "file": "../sigma/rules/linux/auditd/lnx_auditd_find_cred_in_files.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "eae8ce9f-bde9-47a6-8e79-f20d18419910", "title": "Suspicious History File Operations - Linux", "file": "../sigma/rules/linux/auditd/lnx_auditd_susp_histfile_operations.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "edd595d7-7895-4fa7-acb3-85a18a8772ca", "title": "Steganography Unzip Hidden Information From Picture File", "file": "../sigma/rules/linux/auditd/lnx_auditd_unzip_hidden_zip_files_steganography.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "1f358e2e-cb63-43c3-b575-dfb072a6814f", "title": "System and Hardware Information Discovery", "file": "../sigma/rules/linux/auditd/lnx_auditd_system_info_discovery2.yml", "status": "stable", "level": "informational", "logsource.category": null, "logsource.product": "linux"}, {"id": "a5b977d6-8a81-4475-91b9-49dbfcd941f7", "title": "Remove Immutable File Attribute - Auditd", "file": "../sigma/rules/linux/auditd/lnx_auditd_chattr_immutable_removal.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "f200dc3f-b219-425d-a17e-c38467364816", "title": "Clipboard Collection of Image Data with Xclip Tool", "file": "../sigma/rules/linux/auditd/lnx_auditd_clipboard_image_collection.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "4b3cb710-5e83-4715-8c45-8b2b5b3e5751", "title": "Modification of ld.so.preload", "file": "../sigma/rules/linux/auditd/lnx_auditd_ld_so_preload_mod.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "3761e026-f259-44e6-8826-719ed8079408", "title": "Linux Network Service Scanning - Auditd", "file": "../sigma/rules/linux/auditd/lnx_auditd_network_service_scanning.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "49aae26c-450e-448b-911d-b3c13d178dfc", "title": "Linux Keylogging with Pam.d", "file": "../sigma/rules/linux/auditd/lnx_auditd_keylogging_with_pam_d.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "c0d3734d-330f-4a03-aae2-65dacc6a8222", "title": "Webshell Remote Command Execution", "file": "../sigma/rules/linux/auditd/lnx_auditd_web_rce.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "linux"}, {"id": "4cb57c2f-1f29-41f8-893d-8bed8e1c1d2f", "title": "System Shutdown/Reboot - Linux", "file": "../sigma/rules/linux/auditd/lnx_auditd_system_shutdown_reboot.yml", "status": "test", "level": "informational", "logsource.category": null, "logsource.product": "linux"}, {"id": "45810b50-7edc-42ca-813b-bdac02fb946b", "title": "Steganography Hide Zip Information in Picture File", "file": "../sigma/rules/linux/auditd/lnx_auditd_hidden_zip_files_steganography.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "70b4156e-50fc-4523-aa50-c9dddf1993fc", "title": "Bpfdoor TCP Ports Redirect", "file": "../sigma/rules/linux/auditd/lnx_auditd_bpfdoor_port_redirect.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "9d4548fa-bba0-4e88-bd66-5d5bf516cda0", "title": "Masquerading as Linux Crond Process", "file": "../sigma/rules/linux/auditd/lnx_auditd_masquerading_crond.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "ca94a6db-8106-4737-9ed2-3e3bb826af0a", "title": "Password Policy Discovery", "file": "../sigma/rules/linux/auditd/lnx_auditd_password_policy_discovery.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "106d7cbd-80ff-4985-b682-a7043e5acb72", "title": "Loading of Kernel Module via Insmod", "file": "../sigma/rules/linux/auditd/lnx_auditd_load_module_insmod.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed", "title": "Possible Coin Miner CPU Priority Param", "file": "../sigma/rules/linux/auditd/lnx_auditd_coinminer.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "linux"}, {"id": "a5a827d9-1bbe-4952-9293-c59d897eb41b", "title": "Steganography Extract Files with Steghide", "file": "../sigma/rules/linux/auditd/lnx_auditd_steghide_extract_steganography.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "c52a914f-3d8b-4b2a-bb75-b3991e75f8ba", "title": "Binary Padding - Linux", "file": "../sigma/rules/linux/auditd/lnx_auditd_binary_padding.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "f7158a64-6204-4d6d-868a-6e6378b467e0", "title": "Suspicious C2 Activities", "file": "../sigma/rules/linux/auditd/lnx_auditd_susp_c2_commands.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "214e7e6c-f21b-47ff-bb6f-551b2d143fcf", "title": "Clipboard Collection with Xclip Tool - Auditd", "file": "../sigma/rules/linux/auditd/lnx_auditd_clipboard_collection.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "e2f17c5d-b02a-442b-9052-6eb89c9fec9c", "title": "Screen Capture with Xwd", "file": "../sigma/rules/linux/auditd/lnx_auditd_screencaputre_xwd.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "a7af2487-9c2f-42e4-9bb9-ff961f0561d5", "title": "Audio Capture", "file": "../sigma/rules/linux/auditd/lnx_auditd_audio_capture.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "2dad0cba-c62a-4a4f-949f-5f6ecd619769", "title": "Split A File Into Pieces - Linux", "file": "../sigma/rules/linux/auditd/lnx_auditd_split_file_into_pieces.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "9a0d8ca0-2385-4020-b6c6-cb6153ca56f3", "title": "System Owner or User Discovery", "file": "../sigma/rules/linux/auditd/lnx_auditd_user_discovery.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "f4d3748a-65d1-4806-bd23-e25728081d01", "title": "Network Sniffing - Linux", "file": "../sigma/rules/linux/auditd/lnx_auditd_network_sniffing.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "53059bc0-1472-438b-956a-7508a94a91f0", "title": "Disable System Firewall", "file": "../sigma/rules/linux/auditd/lnx_auditd_disable_system_firewall.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "1bac86ba-41aa-4f62-9d6b-405eac99b485", "title": "Systemd Service Creation", "file": "../sigma/rules/linux/auditd/lnx_auditd_systemd_service_creation.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "d08722cd-3d09-449a-80b4-83ea2d9d4616", "title": "Hidden Files and Directories", "file": "../sigma/rules/linux/auditd/lnx_auditd_hidden_files_directories.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "f34047d9-20d3-4e8b-8672-0a35cc50dc71", "title": "System Information Discovery - Auditd", "file": "../sigma/rules/linux/auditd/lnx_auditd_system_info_discovery.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "977ef627-4539-4875-adf4-ed8f780c4922", "title": "Auditing Configuration Changes on Linux Host", "file": "../sigma/rules/linux/auditd/lnx_auditd_auditing_config_change.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "323ff3f5-0013-4847-bbd4-250b5edb62cc", "title": "Modify System Firewall", "file": "../sigma/rules/linux/auditd/lnx_auditd_modify_system_firewall.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "74c01ace-0152-4094-8ae2-6fd776dd43e5", "title": "File or Folder Permissions Change", "file": "../sigma/rules/linux/auditd/lnx_auditd_file_or_folder_permissions.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "cb39d16b-b3b6-4a7a-8222-1cf24b686ffc", "title": "Data Exfiltration with Wget", "file": "../sigma/rules/linux/auditd/lnx_auditd_data_exfil_wget.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "a94cdd87-6c54-4678-a6cc-2814ffe5a13d", "title": "Unix Shell Configuration Modification", "file": "../sigma/rules/linux/auditd/lnx_auditd_unix_shell_configuration_modification.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "759d0d51-bc99-4b5e-9add-8f5b2c8e7512", "title": "Creation Of An User Account", "file": "../sigma/rules/linux/auditd/lnx_auditd_create_account.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "1543ae20-cbdf-4ec1-8d12-7664d667a825", "title": "Suspicious Commands Linux", "file": "../sigma/rules/linux/auditd/lnx_auditd_susp_cmds.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "a3b5e3e9-1b49-4119-8b8e-0344a01f21ee", "title": "Data Compressed", "file": "../sigma/rules/linux/auditd/lnx_auditd_data_compressed.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "b3cec4e7-6901-4b0d-a02d-8ab2d8eb818b", "title": "File Time Attribute Change - Linux", "file": "../sigma/rules/linux/auditd/lnx_auditd_change_file_time_attr.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "37222991-11e9-4b6d-8bdf-60fbe48f753e", "title": "Overwriting the File with Dev Zero or Null", "file": "../sigma/rules/linux/auditd/lnx_auditd_dd_delete_file.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "fe10751f-1995-40a5-aaa2-c97ccb4123fe", "title": "Linux Capabilities Discovery", "file": "../sigma/rules/linux/auditd/lnx_auditd_capabilities_discovery.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "dbe4b9c5-c254-4258-9688-d6af0b7967fd", "title": "Screen Capture with Import Tool", "file": "../sigma/rules/linux/auditd/lnx_auditd_screencapture_import.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "9e1bef8d-0fff-46f6-8465-9aa54e128c1e", "title": "Use Of Hidden Paths Or Files", "file": "../sigma/rules/linux/auditd/lnx_auditd_hidden_binary_execution.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "808146b2-9332-4d78-9416-d7e47012d83d", "title": "BPFDoor Abnormal Process ID or Lock File Accessed", "file": "../sigma/rules/linux/auditd/lnx_auditd_bpfdoor_file_accessed.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "c830f15d-6f6e-430f-8074-6f73d6807841", "title": "Logging Configuration Changes on Linux Host", "file": "../sigma/rules/linux/auditd/lnx_auditd_logging_config_change.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "ce446a9e-30b9-4483-8e38-d2c9ad0a2280", "title": "Steganography Hide Files with Steghide", "file": "../sigma/rules/linux/auditd/lnx_auditd_steghide_embed_steganography.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "2625cc59-0634-40d0-821e-cb67382a3dd7", "title": "Systemd Service Reload or Start", "file": "../sigma/rules/linux/auditd/lnx_auditd_pers_systemd_reload.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc", "title": "Program Executions in Suspicious Folders", "file": "../sigma/rules/linux/auditd/lnx_auditd_susp_exe_folders.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871", "title": "Linux Reverse Shell Indicator", "file": "../sigma/rules/linux/network_connection/net_connection_lnx_back_connect_shell_dev.yml", "status": "test", "level": "critical", "logsource.category": "network_connection", "logsource.product": "linux"}, {"id": "dbfc7c98-04ab-4ab7-aa94-c74d22aa7376", "title": "Potentially Suspicious Malware Callback Communication - Linux", "file": "../sigma/rules/linux/network_connection/net_connection_lnx_susp_malware_callback_port.yml", "status": "experimental", "level": "high", "logsource.category": "network_connection", "logsource.product": "linux"}, {"id": "c4568f5d-131f-4e78-83d4-45b2da0ec4f1", "title": "Communication To LocaltoNet Tunneling Service Initiated - Linux", "file": "../sigma/rules/linux/network_connection/net_connection_lnx_domain_localtonet_tunnel.yml", "status": "experimental", "level": "high", "logsource.category": "network_connection", "logsource.product": "linux"}, {"id": "a46c93b7-55ed-4d27-a41b-c259456c4746", "title": "Linux Crypto Mining Pool Connections", "file": "../sigma/rules/linux/network_connection/net_connection_lnx_crypto_mining_indicators.yml", "status": "stable", "level": "high", "logsource.category": "network_connection", "logsource.product": "linux"}, {"id": "19bf6fdb-7721-4f3d-867f-53467f6a5db6", "title": "Communication To Ngrok Tunneling Service - Linux", "file": "../sigma/rules/linux/network_connection/net_connection_lnx_ngrok_tunnel.yml", "status": "test", "level": "high", "logsource.category": "network_connection", "logsource.product": "linux"}, {"id": "2aa1440c-9ae9-4d92-84a7-a9e5f5e31695", "title": "Suspicious Activity in Shell Commands", "file": "../sigma/rules/linux/builtin/lnx_shell_susp_commands.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "f64b6e9a-5d9d-48a5-8289-e1dd2b3876e1", "title": "Suspicious Log Entries", "file": "../sigma/rules/linux/builtin/lnx_shell_susp_log_entries.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "8ec2c8b4-557a-4121-b87c-5dfb3a602fae", "title": "JexBoss Command Sequence", "file": "../sigma/rules/linux/builtin/lnx_susp_jexboss.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "fdc88d25-96fb-4b7c-9633-c0e417fdbd4e", "title": "Linux Command History Tampering", "file": "../sigma/rules/linux/builtin/lnx_shell_clear_cmd_history.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "738d9bcf-6999-4fdb-b4ac-3033037db8ab", "title": "Suspicious Reverse Shell Command Line", "file": "../sigma/rules/linux/builtin/lnx_shell_susp_rev_shells.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781", "title": "Buffer Overflow Attempts", "file": "../sigma/rules/linux/builtin/lnx_buffer_overflows.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "0ac15ec3-d24f-4246-aa2a-3077bb1cf90e", "title": "Privileged User Has Been Created", "file": "../sigma/rules/linux/builtin/lnx_privileged_user_creation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "c67fc22a-0be5-4b4f-aad5-2b32c4b69523", "title": "Symlink Etc Passwd", "file": "../sigma/rules/linux/builtin/lnx_symlink_etc_passwd.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "e09eb557-96d2-4de9-ba2d-30f712a5afd3", "title": "Commands to Clear or Remove the Syslog - Builtin", "file": "../sigma/rules/linux/builtin/lnx_clear_syslog.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "7a14080d-a048-4de8-ae58-604ce58a795b", "title": "Remote File Copy", "file": "../sigma/rules/linux/builtin/lnx_file_copy.yml", "status": "stable", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "7ba05b43-adad-4c02-b5e9-c8c35cdf9fa8", "title": "Nimbuspwn Exploitation", "file": "../sigma/rules/linux/builtin/lnx_nimbuspwn_privilege_escalation_exploit.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "879c3015-c88b-4782-93d7-07adf92dbcb7", "title": "Space After Filename", "file": "../sigma/rules/linux/builtin/lnx_space_after_filename_.yml", "status": "test", "level": "low", "logsource.category": null, "logsource.product": "linux"}, {"id": "6cc5fceb-9a71-4c23-aeeb-963abe0b279c", "title": "Suspicious Use of /dev/tcp", "file": "../sigma/rules/linux/builtin/lnx_susp_dev_tcp.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "41e5c73d-9983-4b69-bd03-e13b67e9623c", "title": "Equation Group Indicators", "file": "../sigma/rules/linux/builtin/lnx_apt_equationgroup_lnx.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "7e3c4651-c347-40c4-b1d4-d48590fdf684", "title": "Code Injection by ld.so Preload", "file": "../sigma/rules/linux/builtin/lnx_ldso_preload_injection.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "c67e0c98-4d39-46ee-8f6b-437ebf6b950e", "title": "Shellshock Expression", "file": "../sigma/rules/linux/builtin/lnx_shellshock.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "0fadd880-6af3-4610-b1e5-008dc3a11b8a", "title": "Potential Suspicious BPF Activity - Linux", "file": "../sigma/rules/linux/builtin/lnx_potential_susp_ebpf_activity.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "7fcc54cb-f27d-4684-84b7-436af096f858", "title": "Sudo Privilege Escalation CVE-2019-14287 - Builtin", "file": "../sigma/rules/linux/builtin/sudo/lnx_sudo_cve_2019_14287_user.yml", "status": "test", "level": "critical", "logsource.category": null, "logsource.product": "linux"}, {"id": "49f5dfc1-f92e-4d34-96fa-feba3f6acf36", "title": "Disabling Security Tools - Builtin", "file": "../sigma/rules/linux/builtin/syslog/lnx_syslog_security_tools_disabling_syslog.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "c8e35e96-19ce-4f16-aeb6-fd5588dc5365", "title": "Suspicious Named Error", "file": "../sigma/rules/linux/builtin/syslog/lnx_syslog_susp_named.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "af202fd3-7bff-4212-a25a-fb34606cfcbe", "title": "Modifying Crontab", "file": "../sigma/rules/linux/builtin/cron/lnx_cron_crontab_file_modification.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "377f33a1-4b36-4ee1-acee-1dbe4b43cfbe", "title": "Suspicious VSFTPD Error Messages", "file": "../sigma/rules/linux/builtin/vsftpd/lnx_vsftpd_susp_error_messages.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "4c9d903d-4939-4094-ade0-3cb748f4d7da", "title": "SSHD Error Message CVE-2018-15473", "file": "../sigma/rules/linux/builtin/sshd/lnx_sshd_ssh_cve_2018_15473.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "e76b413a-83d0-4b94-8e4c-85db4a5b8bdc", "title": "Suspicious OpenSSH Daemon Error", "file": "../sigma/rules/linux/builtin/sshd/lnx_sshd_susp_ssh.yml", "status": "test", "level": "medium", "logsource.category": null, "logsource.product": "linux"}, {"id": "0506a799-698b-43b4-85a1-ac4c84c720e9", "title": "PwnKit Local Privilege Escalation", "file": "../sigma/rules/linux/builtin/auth/lnx_auth_pwnkit_local_privilege_escalation.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "1edd77db-0669-4fef-9598-165bda82826d", "title": "Guacamole Two Users Sharing Session Anomaly", "file": "../sigma/rules/linux/builtin/guacamole/lnx_guacamole_susp_guacamole.yml", "status": "test", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "36aa86ca-fd9d-4456-814e-d3b1b8e1e0bb", "title": "Relevant ClamAV Message", "file": "../sigma/rules/linux/builtin/clamav/lnx_clamav_relevant_message.yml", "status": "stable", "level": "high", "logsource.category": null, "logsource.product": "linux"}, {"id": "35a05c60-9012-49b6-a11f-6bab741c9f74", "title": "Wget Creating Files in Tmp Directory", "file": "../sigma/rules/linux/file_event/file_event_lnx_wget_download_file_in_tmp_dir.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "linux"}, {"id": "ddb26b76-4447-4807-871f-1b035b2bfa5d", "title": "Persistence Via Sudoers Files", "file": "../sigma/rules/linux/file_event/file_event_lnx_persistence_sudoers_files.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "linux"}, {"id": "13f08f54-e705-4498-91fd-cce9d9cee9f1", "title": "Potentially Suspicious Shell Script Creation in Profile Folder", "file": "../sigma/rules/linux/file_event/file_event_lnx_susp_shell_script_under_profile_directory.yml", "status": "test", "level": "low", "logsource.category": "file_event", "logsource.product": "linux"}, {"id": "6c4e2f43-d94d-4ead-b64d-97e53fa2bd05", "title": "Persistence Via Cron Files", "file": "../sigma/rules/linux/file_event/file_event_lnx_persistence_cron_files.yml", "status": "test", "level": "medium", "logsource.category": "file_event", "logsource.product": "linux"}, {"id": "00eee2a5-fdb0-4746-a21d-e43fbdea5681", "title": "Linux Doas Conf File Creation", "file": "../sigma/rules/linux/file_event/file_event_lnx_doas_conf_creation.yml", "status": "stable", "level": "medium", "logsource.category": "file_event", "logsource.product": "linux"}, {"id": "c0239255-822c-4630-b7f1-35362bcb8f44", "title": "Triple Cross eBPF Rootkit Default LockFile", "file": "../sigma/rules/linux/file_event/file_event_lnx_triple_cross_rootkit_lock_file.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "linux"}, {"id": "1a2ea919-d11d-4d1e-8535-06cda13be20f", "title": "Triple Cross eBPF Rootkit Default Persistence", "file": "../sigma/rules/linux/file_event/file_event_lnx_triple_cross_rootkit_persistence.yml", "status": "test", "level": "high", "logsource.category": "file_event", "logsource.product": "linux"}, {"id": "e34cfa0c-0a50-4210-9cb3-5632d08eb041", "title": "Potential GobRAT File Discovery Via Grep", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_malware_gobrat_grep_payload_discovery.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "2d2f44ff-4611-4778-a8fc-323a0e9850cc", "title": "Inline Python Execution - Spawn Shell Via OS System Library", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_python_shell_os_system.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "30aed7b6-d2c1-4eaf-9382-b6bc43e50c57", "title": "File Deletion", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_file_deletion.yml", "status": "stable", "level": "informational", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "8c1a5675-cb85-452f-a298-b01b22a51856", "title": "Suspicious Invocation of Shell via AWK - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_awk_shell_spawn.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "30bcce26-51c5-49f2-99c8-7b59e3af36c7", "title": "Execution Of Script Located In Potentially Suspicious Directory", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_shell_script_exec_from_susp_location.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "676381a6-15ca-4d73-a9c8-6a22e970b90d", "title": "Local Groups Discovery - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_local_groups.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "e4ffe466-6ff8-48d4-94bd-e32d1a6061e2", "title": "Nohup Execution", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_nohup.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "ba592c6d-6888-43c3-b8c6-689b8fe47337", "title": "Linux Base64 Encoded Pipe to Shell", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_base64_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "7f734ed0-4f47-46c0-837f-6ee62505abd9", "title": "Potential Netcat Reverse Shell Execution", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_netcat_reverse_shell.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "38eb1dbb-011f-40b1-a126-cf03a0210563", "title": "ESXi Syslog Configuration Change Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_syslog_config_change.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "b8bdac18-c06e-4016-ac30-221553e74f59", "title": "Potential Ruby Reverse Shell", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_ruby_reverse_shell.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "e7bd1cfa-b446-4c88-8afb-403bcd79e3fa", "title": "System Network Discovery - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_system_network_discovery.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "1182f3b3-e716-4efa-99ab-d2685d04360f", "title": "History File Deletion", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_history_delete.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "c2e234de-03a3-41e1-b39a-1e56dc17ba67", "title": "Remove Scheduled Cron Task/Job", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_crontab_removal.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "e3a8a052-111f-4606-9aee-f28ebeb76776", "title": "Disabling Security Tools", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_security_tools_disabling.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "f74107df-b6c6-4e80-bf00-4170b658162b", "title": "Sudo Privilege Escalation CVE-2019-14287", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_sudo_cve_2019_14287.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf", "title": "Potential Discovery Activity Using Find - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_find_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "47b3bbd4-1bf7-48cc-84ab-995362aaa75a", "title": "Shell Execution via Git - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_git_shell_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "21541900-27a9-4454-9c4c-3f0a4240344a", "title": "OMIGOD SCX RunAsProvider ExecuteShellCommand", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "c8a5f584-cdc8-42cc-8cce-0398e4265de3", "title": "Apache Spark Shell Command Injection - ProcessCreation", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_cve_2022_33891_spark_shell_command_injection.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "de25eeb8-3655-4643-ac3a-b662d3f26b6b", "title": "Disable Or Stop Services", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_services_stop_and_disable.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "6104e693-a7d6-4891-86cb-49a258523559", "title": "Bash Interactive Shell", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_bash_interactive_shell.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "067d8238-7127-451c-a9ec-fa78045b618b", "title": "Linux Doas Tool Execution", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_doas_execution.yml", "status": "stable", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "ec52985a-d024-41e3-8ff6-14169039a0b3", "title": "Mount Execution With Hidepid Parameter", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_mount_hidepid.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "f41dada5-3f56-4232-8503-3fb7f9cf2d60", "title": "ESXi Storage Information Discovery Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_storage_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "bed978f8-7f3a-432b-82c5-9286a9b3031a", "title": "Shell Invocation via Env Command - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_env_shell_invocation.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "cfec9d29-64ec-4a0f-9ffe-0fdb856d5446", "title": "Suspicious Git Clone - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_git_clone.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "84c9e83c-599a-458a-a0cb-0ecce44e807a", "title": "Ufw Force Stop Using Ufw-Init", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_disable_ufw.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "f9b3edc5-3322-4fc7-8aa3-245d646cc4b7", "title": "Potential Linux Amazon SSM Agent Hijacking", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_ssm_agent_abuse.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "880973f3-9708-491c-a77b-2a35a1921158", "title": "Linux Shell Pipe to Shell", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_pipe_shell.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "0cf7a157-8879-41a2-8f55-388dd23746b7", "title": "Linux Recon Indicators", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_recon_indicators.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "97de11cd-4b67-4abf-9a8b-1020e670aa9e", "title": "Pnscan Binary Data Transmission Activity", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_pnscan_binary_cli_pattern.yml", "status": "experimental", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "093d68c7-762a-42f4-9f46-95e79142571a", "title": "Shell Execution via Nice - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_nice_shell_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "7fb14105-530e-4e2e-8cfb-99f7d8700b66", "title": "Atlassian Confluence CVE-2022-26134", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_cve_2022_26134_atlassian_confluence.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "c4042d54-110d-45dd-a0e1-05c47822c937", "title": "Python Spawning Pretty TTY", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_python_pty_spawn.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "c9d8b7fd-78e4-44fe-88f6-599135d46d60", "title": "Security Software Discovery - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_security_software_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "cf610c15-ed71-46e1-bdf8-2bd1a99de6c4", "title": "Download File To Potentially Suspicious Directory Via Wget", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_wget_download_suspicious_directory.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "11063ec2-de63-4153-935e-b1a8b9e616f1", "title": "Linux Remote System Discovery", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_remote_system_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "9691f58d-92c1-4416-8bf3-2edd753ec9cf", "title": "ESXi Admin Permission Assigned To Account Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_permission_change_admin.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "457df417-8b9d-4912-85f3-9dbda39c3645", "title": "Suspicious Nohup Execution", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_nohup_susp_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "34979410-e4b5-4e5d-8cfb-389fdff05c12", "title": "Remove Immutable File Attribute", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_chattr_immutable_removal.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "43e26eb5-cd58-48d1-8ce9-a273f5d298d8", "title": "Potential Container Discovery Via Inodes Listing", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_inod_listing.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "22236d75-d5a0-4287-bf06-c93b1770860f", "title": "Triple Cross eBPF Rootkit Install Commands", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_install.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "a015e032-146d-4717-8944-7a1884122111", "title": "Linux HackTool Execution", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_hktl_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "b86d356d-6093-443d-971c-9b07db583c68", "title": "Suspicious Curl Change User Agents - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_curl_useragent.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "db1ac3be-f606-4e3a-89e0-9607cbe6b98a", "title": "Capsh Shell Invocation - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_capsh_shell_invocation.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "d27ab432-2199-483f-a297-03633c05bae6", "title": "OS Architecture Discovery Via Grep", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_grep_os_arch_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "8a46f16c-8c4c-82d1-b121-0fdd3ba70a84", "title": "Group Has Been Deleted Via Groupdel", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_groupdel.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "6eea1bf6-f8d2-488a-a742-e6ef6c1b67db", "title": "OMIGOD SCX RunAsProvider ExecuteScript", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executescript.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "ec127035-a636-4b9a-8555-0efd4e59f316", "title": "Clipboard Collection with Xclip Tool", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_clipboard_collection.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "403ed92c-b7ec-4edd-9947-5b535ee12d46", "title": "Crontab Enumeration", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_crontab_enumeration.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "32e62bc7-3de0-4bb1-90af-532978fe42c0", "title": "Potential Python Reverse Shell", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_python_reverse_shell.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "64c41342-6b27-523b-5d3f-c265f3efcdb3", "title": "Terminate Linux Process Via Kill", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_kill_process.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "fa4aaed5-4fe0-498d-bbc0-08e3346387ba", "title": "Copy Passwd Or Shadow From TMP Path", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_cp_passwd_or_shadow_tmp.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "259df6bc-003f-4306-9f54-4ff1a08fa38e", "title": "Potential Perl Reverse Shell Execution", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_perl_reverse_shell.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "6adfbf8f-52be-4444-9bac-81b539624146", "title": "Shell Execution via Find - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_find_shell_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "3e102cd9-a70d-4a7a-9508-403963092f31", "title": "Linux Network Service Scanning Tools Execution", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_network_utilities_execution.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "9069ea3c-b213-4c52-be13-86506a227ab1", "title": "Linux Crypto Mining Indicators", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_crypto_mining.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "c6714a24-d7d5-4283-a36b-3ffd091d5f7e", "title": "Potential PHP Reverse Shell", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_php_reverse_shell.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "86157017-c2b1-4d4a-8c33-93b8e67e4af4", "title": "Potential Suspicious Change To Sensitive/Critical Files", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_sensitive_file_access.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d", "title": "Remote Access Tool - Team Viewer Session Started On Linux Host", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.yml", "status": "experimental", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "b45e3d6f-42c6-47d8-a478-df6bd6cf534c", "title": "Local System Accounts Discovery - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_local_account.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "72f4ab3f-787d-495d-a55d-68c2ff46cf4c", "title": "Connection Proxy", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_proxy_connection.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "fe2f9663-41cb-47e2-b954-8a228f3b9dff", "title": "Linux Base64 Encoded Shebang In CLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_base64_shebang_cli.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "11701de9-d5a5-44aa-8238-84252f131895", "title": "Docker Container Discovery Via Dockerenv Listing", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_dockerenv_recon.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "700fb7e8-2981-401c-8430-be58e189e741", "title": "Suspicious Package Installed - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_install_suspicioua_packages.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "746c86fb-ccda-4816-8997-01386263acc4", "title": "Container Residence Discovery Via Proc Virtual FS", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_container_residence_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "7692f583-bd30-4008-8615-75dab3f08a99", "title": "Enable BPF Kprobes Tracing", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_bpf_kprob_tracing_enabled.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "78a80655-a51e-4669-bc6b-e9d206a462ee", "title": "Install Root Certificate", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_install_root_certificate.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "2992ac4d-31e9-4325-99f2-b18a73221bb2", "title": "ESXi VM Kill Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "ea3ecad2-db86-4a89-ad0b-132a10d2db55", "title": "Interactive Bash Suspicious Children", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_interactive_bash.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "4cad6c64-d6df-42d6-8dae-eb78defdc415", "title": "Potential Linux Process Code Injection Via DD Utility", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_dd_process_injection.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "42df45e7-e6e9-43b5-8f26-bec5b39cc239", "title": "System Information Discovery", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_system_info_discovery.yml", "status": "stable", "level": "informational", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "4c519226-f0cd-4471-bd2f-6fbb2bb68a79", "title": "System Network Connections Discovery - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_system_network_connections_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "80915f59-9b56-4616-9de0-fd0dea6c12fe", "title": "Clear Linux Logs", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_clear_logs.yml", "status": "stable", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "4e25af4b-246d-44ea-8563-e42aacab006b", "title": "Potential Xterm Reverse Shell", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_xterm_reverse_shell.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "6a50f16c-3b7b-42d1-b081-0fdd3ba70a73", "title": "User Added To Root/Sudoers Group Using Usermod", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_usermod_susp_group.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "e80273e1-9faf-40bc-bd85-dbaff104c4e9", "title": "ESXi System Information Discovery Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_system_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "d2d642d7-b393-43fe-bae4-e81ed5915c4b", "title": "Scheduled Task/Job At", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_at_command.yml", "status": "stable", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "f8341cb2-ee25-43fa-a975-d8a5a9714b39", "title": "BPFtrace Unsafe Option Usage", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_bpftrace_unsafe_option_usage.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "9d779ce8-5256-4b13-8b6f-b91c602b43f4", "title": "Named Pipe Created Via Mkfifo", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "4b09c71e-4269-4111-9cdd-107d8867f0cc", "title": "Shell Execution via Flock - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_flock_shell_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "5f1573a7-363b-4114-9208-ad7a61de46eb", "title": "ESXi VM List Discovery Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "bb382fd5-b454-47ea-a264-1828e4c766d6", "title": "Shell Invocation via Apt - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_apt_shell_execution.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "6419afd1-3742-47a5-a7e6-b50386cd15f8", "title": "Chmod Suspicious Directory", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_chmod_directories.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "d8d97d51-122d-4cdd-9e2f-01b4b4933530", "title": "Capabilities Discovery - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_capa_discovery.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "e2326866-609f-4015-aea9-7ec634e8aa04", "title": "Shell Execution via Rsync - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_rsync_shell_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "c21c4eaa-ba2e-419a-92b2-8371703cbe21", "title": "Setuid and Setgid", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_setgid_setuid.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "0f79c4d2-4e1f-4683-9c36-b5469a665e06", "title": "Cat Sudoers", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_cat_sudoers.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "4e2f5868-08d4-413d-899f-dc2f1508627b", "title": "Process Discovery", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_process_discovery.yml", "status": "stable", "level": "informational", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "818f7b24-0fba-4c49-a073-8b755573b9c7", "title": "Linux Webshell Indicators", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_webshell_detection.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "d54c2f06-aca9-4e2b-81c9-5317858f4b79", "title": "ESXi VSAN Information Discovery Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "3fcc9b35-39e4-44c0-a2ad-9e82b6902b31", "title": "Commands to Clear or Remove the Syslog", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_clear_syslog.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "d292e0af-9a18-420c-9525-ec0ac3936892", "title": "Suspicious Java Children Processes", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_java_children.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "00b90cc1-17ec-402c-96ad-3a8117d7a582", "title": "Suspicious Curl File Upload - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_curl_fileupload.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "6b14bac8-3e3a-4324-8109-42f0546a347f", "title": "Scheduled Cron Task/Job - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_schedule_task_job_cron.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "e2072cab-8c9a-459b-b63c-40ae79e27031", "title": "Decode Base64 Encoded Text", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_base64_decode.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "0326c3c8-7803-4a0f-8c5c-368f747f7c3e", "title": "Triple Cross eBPF Rootkit Execve Hijack", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_execve_hijack.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "312b42b1-bded-4441-8b58-163a3af58775", "title": "Potentially Suspicious Execution From Tmp Folder", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_execution_tmp_folder.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "95d61234-7f56-465c-6f2d-b562c6fedbc4", "title": "Linux Package Uninstall", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_remove_package.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "33e814e0-1f00-4e43-9c34-31fb7ae2b174", "title": "ESXi Network Configuration Discovery Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_network_discovery.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db", "title": "ESXi Account Creation Via ESXCLI", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_esxcli_user_account_creation.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "8737b7f6-8df3-4bb7-b1da-06019b99b687", "title": "Shell Invocation Via Ssh - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_ssh_shell_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "ea34fb97-e2c4-4afb-810f-785e4459b194", "title": "Curl Usage on Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_curl_usage.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72", "title": "File and Directory Discovery - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_file_and_directory_discovery.yml", "status": "test", "level": "informational", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "9b5de532-a757-4d70-946c-1f3e44f48b4d", "title": "Shell Execution GCC - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_gcc_shell_execution.yml", "status": "experimental", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "2fade0b6-7423-4835-9d4f-335b39b83867", "title": "Shell Execution Of Process Located In Tmp Directory", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "31545105-3444-4584-bebf-c466353230d2", "title": "Touch Suspicious Service File", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_touch_susp.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "d7821ff1-4527-4e33-9f84-d0d57fa2fb66", "title": "Print History File Contents", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_susp_history_recon.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "08f26069-6f80-474b-8d1f-d971c6fedea0", "title": "User Has Been Deleted Via Userdel", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_userdel.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "2953194b-e33c-4859-b9e8-05948c167447", "title": "DD File Overwrite", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_dd_file_overwrite.yml", "status": "test", "level": "low", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "7ab8f73a-fcff-428b-84aa-6a5ff7877dea", "title": "Vim GTFOBin Abuse - Linux", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_vim_shell_execution.yml", "status": "test", "level": "high", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "3be619f4-d9ec-4ea8-a173-18fdd01996ab", "title": "Flush Iptables Ufw Chain", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_iptables_flush_ufw.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}, {"id": "999c3b12-0a8c-40b6-8e13-dd7d62b75c7a", "title": "Potentially Suspicious Named Pipe Created Via Mkfifo", "file": "../sigma/rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.yml", "status": "test", "level": "medium", "logsource.category": "process_creation", "logsource.product": "linux"}], "status": {"uberAgent (develop)": ["dfe8b941-4e54-4242-b674-6b613d521962", "23c43900-e732-45a4-8354-63e4a6c187ce", "47d65ac0-c06f-4ba2-a2e3-d263139d0f51", "65d506d3-fcfe-4071-b4b2-bcefe721bbbb", "5d0fdb62-f225-42fb-8402-3dfe64da468a", "b743623c-2776-40e0-87b1-682b975d0ca5", "089dbdf6-b960-4bcc-90e3-ffc3480c20f6", "2d5e7a8b-f484-4a24-945d-7f0efd52eab0", "58800443-f9fc-4d55-ae0c-98a3966dfb97", "5de06a6f-673a-4fc0-8d48-bcfe3837b033", "1cf98dc2-fcb0-47c9-8aea-654c9284d1ae", "7ed2c9f7-c59d-4c82-a7e2-f859aa676099", "b120b587-a4c2-4b94-875d-99c9807d6955", "7c3b43d8-d794-47d2-800a-d277715aa460", "9a7a0393-2144-4626-9bf1-7c2f5a7321db", "2316929c-01aa-438c-970f-099145ab1ee6", "6d8a7cf1-8085-423b-b87d-7e880faabbdf", "2c95fa8a-8b8d-4787-afce-7117ceb8e3da", "95361ce5-c891-4b0a-87ca-e24607884a96", "1bc2e6c5-0885-472b-bed6-be5ea8eace55", "acf61bd8-d814-4272-81f0-a7a269aa69aa", "ddf36b67-e872-4507-ab2e-46bda21b842c", "bf241472-f014-4f01-a869-96f99330ca8c", "e0cfaecd-602d-41af-988d-f6ccebb2af26", "69483748-1525-4a6c-95ca-90dc8d431b68", "508a9374-ad52-4789-b568-fc358def2c65", "b9d9b652-d8ed-4697-89a2-a1186ee680ac", "f1408a58-0e94-4165-b80a-da9f96cf6fc3", "13db8d2e-7723-4c2c-93c1-a4d36994f7ef", "be2e3a5c-9cc7-4d02-842a-68e9cb26ec49", "84bae5d4-b518-4ae0-b331-6d4afd34d00f", "652c098d-dc11-4ba6-8566-c20e89042f2b", "0877ed01-da46-4c49-8476-d49cdd80dfa7", "234dc5df-40b5-49d1-bf53-0d44ce778eca", "10227522-8429-47e6-a301-f2b2d014e7ad", "719c22d7-c11a-4f2c-93a6-2cfdd5412f68", "a753a6af-3126-426d-8bd0-26ebbcb92254", "0ed75b9c-c73b-424d-9e7d-496cd565fbe0", "51719bf5-e4fd-4e44-8ba8-b830e7ac0731", "85de3a19-b675-4a51-bfc6-b11a5186c971", "7794fa3c-edea-4cff-bec7-267dd4770fd7", "4809c683-059b-4935-879d-36835986f8cf", "6ff08e55-ea53-4f27-94a1-eff92e6d9d5c", "53821412-17b0-4147-ade0-14faae67d54b", "6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4", "40b1fbe2-18ea-4ee7-be47-0294285811de", "b22a5b36-2431-493a-8be1-0bae56c28ef3", "ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e", "f5141b6d-9f42-41c6-a7bf-2a780678b29b", "89bb1f97-c7b9-40e8-b52b-7d6afbd67276", "adc9bcc4-c39c-4f6b-a711-1884017bf043", "60f1ce20-484e-41bd-85f4-ac4afec2c541", "0250638a-2b28-4541-86fc-ea4c558fa0c6", "09a910bf-f71f-4737-9c40-88880ba5913d", "821bcf4d-46c7-4b87-bc57-9509d3ba7c11", "9acf45ed-3a26-4062-bf08-56857613eb52", "ff39f1a6-84ac-476f-a1af-37fcdf53d7c0", "3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe", "88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0", "3603f18a-ec15-43a1-9af2-d196c8a7fec6", "f459ccb4-9805-41ea-b5b2-55e279e2424a", "452df256-da78-427a-866f-49fa04417d74", "7f2bb9d5-6395-4de5-969c-70c11fbe6b12", "53b1b378-9b06-4992-b972-dde6e423d2b4", "f68c4a4f-19ef-4817-952c-50dce331f4b0", "b6e2a2e3-2d30-43b1-a4ea-071e36595690", "d7329412-13bd-44ba-a072-3387f804a106", "47e0852a-cf81-4494-a8e6-31864f8c86ed", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "295a59c1-7b79-4b47-a930-df12c15fc9c2", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "5aad0995-46ab-41bd-a9ff-724f41114971", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "4d431012-2ab5-4db7-a84e-b29809da2172", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "b3503044-60ce-4bf4-bbcb-e3db98788823", "a6b33c02-8305-488f-8585-03cb2a7763f2", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "f663a6d9-9d1b-49b8-b2b1-0637914d199a", "55e29995-75e7-451a-bef0-6225e2f13597", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "b6d235fc-1d38-4b12-adbe-325f06728f37", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "6ea3bf32-9680-422d-9f50-e90716b12a66", "baca5663-583c-45f9-b5dc-ea96a22ce542", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "62120148-6b7a-42be-8b91-271c04e281a3", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "277efb8f-60be-4f10-b4d3-037802f37167", "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "41d1058a-aea7-4952-9293-29eaaf516465", "96f697b0-b499-4e5d-9908-a67bec11cdb6", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "acd74772-5f88-45c7-956b-6a7b36c294d2", "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "92772523-d9c1-4c93-9547-b0ca500baba3", "790317c0-0a36-4a6a-a105-6e576bf99a14", "707e097c-e20f-4f67-8807-1f72ff4500d6", "396ae3eb-4174-4b9b-880e-dc0364d78a19", "e61e8a88-59a9-451c-874e-70fcc9740d67", "48437c39-9e5f-47fb-af95-3d663c3f2919", "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "509e84b9-a71a-40e0-834f-05470369bd1e", "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "7d9263bd-dc47-4a58-bc92-5474abab390c", "c5f6a85d-b647-40f7-bbad-c10b66bab038", "8ffc5407-52e3-478f-9596-0a7371eafe13", "bf344fea-d947-4ef4-9192-34d008315d3a", "5a93eb65-dffa-4543-b761-94aa60098fb6", "7c81fec3-1c1d-43b0-996a-46753041b1b6", "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "e3fdf743-f05b-4051-990a-b66919be1743", "6b6976a3-b0e6-4723-ac24-ae38a737af41", "f7997770-92c3-4ec9-b112-774c4ef96f96", "966315ef-c5e1-4767-ba25-fce9c8de3660", "e7b18879-676e-4a0e-ae18-27039185a8e7", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "8023f872-3f1d-4301-a384-801889917ab4", "44a22d59-b175-4f13-8c16-cbaef5b581ff", "fe20dda1-6f37-4379-bbe0-a98d400cae90", "b7916c2a-fa2f-4795-9477-32b731f70f11", "0cf2e1c6-8d10-4273-8059-738778f981ad", "b86852fb-4c77-48f9-8519-eb1b2c308b59", "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "dc5c24af-6995-49b2-86eb-a9ff62199e82", "92b0b372-a939-44ed-a11b-5136cf680e27", "1c3121ed-041b-4d97-a075-07f54f20fb4a", "cd277474-5c52-4423-a52b-ac2d7969902f", "9df5f547-c86a-433e-b533-f2794357e242", "46490193-1b22-4c29-bdd6-5bf63907216f", "fa277e82-9b78-42dd-b05c-05555c7b6015", "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "91239011-fe3c-4b54-9f24-15c86bb65913", "2f78da12-f7c7-430b-8b19-a28f269b77a3", "18f2065c-d36c-464a-a748-bcf909acb2e3", "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "7f2954d2-99c2-4d42-a065-ca36740f187b", "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "83314318-052a-4c90-a1ad-660ece38d276", "07743f65-7ec9-404a-a519-913db7118a8d", "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "555155a2-03bf-4fe7-af74-d176b3fdbe16", "df4dc653-1029-47ba-8231-3c44238cc0ae", "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "1547e27c-3974-43e2-a7d7-7f484fb928ec", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "fad91067-08c5-4d1a-8d8c-d96a21b37814", "a982fc9c-6333-4ffb-a51d-addb04e8b529", "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "90f342e1-1aaa-4e43-b092-39fda57ed11e", "02ee49e2-e294-4d0f-9278-f5b3212fc588", "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "0eb46774-f1ab-4a74-8238-1155855f2263", "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "c90362e0-2df3-4e61-94fe-b37615814cb1", "974515da-6cc5-4c95-ae65-f97f9150ec7f", "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "c420410f-c2d8-4010-856b-dffe21866437", "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "f37b4bce-49d0-4087-9f5b-58bffda77316", "9827ae57-3802-418f-994b-d5ecf5cd974b", "93d298a1-d28f-47f1-a468-d971e7796679", "46dd5308-4572-4d12-aa43-8938f0184d4f", "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "f742bde7-9528-42e5-bd82-84f51a8387d2", "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "8d85cf08-bf97-4260-ba49-986a2a65129c", "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "2ff692c2-4594-41ec-8fcb-46587de769e0", "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "b23818c7-e575-4d13-8012-332075ec0a2b", "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "160d2780-31f7-4922-8b3a-efce30e63e96", "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "ab567429-1dfb-4674-b6d2-979fd2f9d125", "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "cbf93e5d-ca6c-4722-8bea-e9119007c248", "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "275641a5-a492-45e2-a817-7c81e9d9d3e9", "961e33d1-4f86-4fcf-80ab-930a708b2f82", "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "ad89044a-8f49-4673-9a55-cbd88a1b374f", "086ae989-9ca6-4fe7-895a-759c5544f247", "5de03871-5d46-4539-a82d-3aa992a69a83", "28036918-04d3-423d-91c0-55ecf99fb892", "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "046218bd-e0d8-4113-a3c3-895a12b2b298", "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "a80f662f-022f-4429-9b8c-b1a41aaa6688", "612e47e9-8a59-43a6-b404-f48683f45bd6", "833ef470-fa01-4631-a79b-6f291c9ac498", "9d8f9bb8-01af-4e15-a3a2-349071530530", "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "5df86130-4e95-4a54-90f7-26541b40aec2", "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "f10ed525-97fe-4fed-be7c-2feecca941b1", "5f9db380-ea57-4d1e-beab-8a2d33397e93", "487bb375-12ef-41f6-baae-c6a1572b4dd1", "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "8218c875-90b9-42e2-b60d-0b0069816d10", "53330955-dc52-487f-a3a2-da24dcff99b5", "f2485272-a156-4773-82d7-1d178bc4905b", "724ea201-6514-4f38-9739-e5973c34f49a", "6c304b02-06e6-402d-8be4-d5833cdf8198", "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "4916a35e-bfc4-47d0-8e25-a003d7067061", "73a883d0-0348-4be4-a8d8-51031c2564f8", "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "d223b46b-5621-4037-88fe-fda32eead684", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "480421f9-417f-4d3b-9552-fd2728443ec8", "60936b49-fca0-4f32-993d-7415edcf9a5d", "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "6597be7b-ac61-4ac8-bef4-d3ec88174853", "5b872a46-3b90-45c1-8419-f675db8053aa", "092af964-4233-4373-b4ba-d86ea2890288", "b64a026b-8deb-4c1d-92fd-98893209dff1", "a7df0e9e-91a5-459a-a003-4cde67c2ff5d", "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "34aa0252-6039-40ff-951f-939fd6ce47d8", "63647769-326d-4dde-a419-b925cc0caf42", "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "9d15044a-7cfe-4d23-8085-6ebc11df7685", "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "976dd1f2-a484-45ec-aa1d-0e87e882262b", "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "439957a7-ad86-4a8f-9705-a28131c6821b", "5a5152f1-463f-436b-b2f5-8eceb3964b42", "e0813366-0407-449a-9869-a2db1119dc41", "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "bf9e1387-b040-4393-9851-1598f8ecfae9", "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "9c226817-8dc9-46c2-a58d-66655aafd7dc", "7021255e-5db3-4946-a8b9-0ba7a4644a69", "36803969-5421-41ec-b92f-8500f79c23b0", "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "42205c73-75c8-4a63-9db1-e3782e06fda0", "41f6531d-af6e-4c6e-918f-b946f2b85a36", "e2482f8d-3443-4237-b906-cc145d87a076", "8b9606c9-28be-4a38-b146-0e313cc232c1", "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "4f281b83-0200-4b34-bf35-d24687ea57c2", "243380fa-11eb-4141-af92-e14925e77c1b", "baecf8fb-edbf-429f-9ade-31fc3f22b970", "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "0d7ceeef-3539-4392-8953-3dc664912714", "fc014922-5def-4da9-a0fc-28c973f41bfb", "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7", "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "9ace0707-b560-49b8-b6ca-5148b42f39fb", "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "9b0f8a61-91b2-464f-aceb-0527e0a45020", "1d218616-71b0-4c40-855b-9dbe75510f7f", "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "25ffa65d-76d8-4da5-a832-3f2b0136e133", "f50f3c09-557d-492d-81db-9064a8d4e211", "ec8c4047-fad9-416a-8c81-0f479353d7f6", "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "d13c43f0-f66b-4279-8b2c-5912077c1780", "d2451be2-b582-4e15-8701-4196ac180260", "f40017b3-cb2e-4335-ab5d-3babf679c1de", "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "f354eba5-623b-450f-b073-0b5b2773b6aa", "6414b5cd-b19d-447e-bb5e-9f03940b5784", "ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94", "bdc64095-d59a-42a2-8588-71fd9c9d9abc", "1fbc0671-5596-4e17-8682-f020a0b995dc", "552b6b65-df37-4d3e-a258-f2fc4771ae54", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "333cdbe8-27bb-4246-bf82-b41a0dca4b70", "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "4c21b805-4dd7-469f-b47d-7383a8fcb437", "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "4508a70e-97ef-4300-b62b-ff27992990ea", "857c8db3-c89b-42fb-882b-f681c7cf4da2", "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "3669afd2-9891-4534-a626-e5cf03810a61", "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "7417e29e-c2e7-4cf6-a2e8-767228c64837", "72ca7c75-bf85-45cd-aca7-255d360e423c", "060d5ad4-3153-47bb-8382-43e5e29eda92", "0e0bc253-07ed-43f1-816d-e1b220fe8971", "6e78b74f-c762-4800-82ad-f66787f10c8a", "84b0a8f3-680b-4096-a45b-e9a89221727c", "90ae0469-0cee-4509-b67f-e5efcef040f7", "bf9808c4-d24f-44a2-8398-b65227d406b6", "caa02837-f659-466f-bca6-48bde2826ab4", "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "4fc0deee-0057-4998-ab31-d24e46e0aba4", "e2e01011-5910-4267-9c3b-4149ed5479cf", "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "d2605a99-2218-4894-8fd3-2afb7946514d", "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "a2a3b925-7bb0-433b-b508-db9003263cc4", "68654bf0-4412-43d5-bfe8-5eaa393cd939", "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "952ed57c-8f99-453d-aee0-53a49c22f95d", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "75e508f7-932d-4ebc-af77-269237a84ce1", "50f852e6-af22-4c78-9ede-42ef36aa3453", "8cde342c-ba48-4b74-b615-172c330f2e93", "ea5c131b-380d-49f9-aeb3-920694da4d4b", "a2edbce1-95c8-4291-8676-0d45146862b3", "844f8eb2-610b-42c8-89a4-47596e089663", "6360757a-d460-456c-8b13-74cf0e60cceb", "24b6cf51-6122-469e-861a-22974e9c1e5b", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "9ed5959a-c43c-4c59-84e3-d28628429456", "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "b5de0c9a-6f19-43e0-af4e-55ad01f550af", "fef394cd-f44d-4040-9b18-95d92fe278c0", "48bfd177-7cf2-412b-ad77-baf923489e82", "2092cacb-d77b-4f98-ab0d-32b32f99a054", "ff0f2b05-09db-4095-b96d-1b75ca24894a", "49329257-089d-46e6-af37-4afce4290685", "7707a579-e0d8-4886-a853-ce47e4575aaa", "ee6cea48-c5b6-4304-a332-10fc6446f484", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "e76c8240-d68f-4773-8880-5c6f63595aaf", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "af4c4609-5755-42fe-8075-4effb49f5d44", "9ca2bf31-0570-44d8-a543-534c47c33ed7", "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "6ec86d9e-912e-4726-91a2-209359b999b9", "273a8dd8-3742-4302-bcc7-7df5a80fe425", "90217a70-13fc-48e4-b3db-0d836c5824ac", "3735d5ac-d770-4da0-99ff-156b180bc600", "948a0953-f287-4806-bbcb-3b2e396df89f", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "a1d9eec5-33b2-4177-8d24-27fe754d0812", "613c03ba-0779-4a53-8a1f-47f914a4ded3", "f356a9c4-effd-4608-bbf8-408afd5cd006", "a21bcd7e-38ec-49ad-b69a-9ea17e69509e", "df68f791-ad95-447f-a271-640a0dab9cf8", "e043f529-8514-4205-8ab0-7f7d2927b400", "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "065cceea-77ec-4030-9052-fc0affea7110", "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "36e037c4-c228-4866-b6a3-48eb292b9955", "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3", "e3f673b3-65d1-4d80-9146-466f8b63fa99", "270185ff-5f50-4d6d-a27f-24c3b8c9fef8", "5b2bbc47-dead-4ef7-8908-0cf73fcbecbf", "8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0", "06125661-3814-4e03-bfa2-1e4411c60ac3", "0a1f9d29-6465-4776-b091-7f43b26e4c89", "b1decb61-ed83-4339-8e95-53ea51901720", "a55349d8-9588-4c5a-8e3b-1925fe2a4ffe", "63c779ba-f638-40a0-a593-ddd45e8b1ddc", "ff301988-c231-4bd0-834c-ac9d73b86586", "3eb8c339-a765-48cc-a150-4364c04652bf", "3109530e-ab47-4cc6-a953-cac5ebcc93ae", "6ddab845-b1b8-49c2-bbf7-1a11967f64bc", "407aecb1-e762-4acf-8c7b-d087bcff3bb6", "7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2", "65744385-8541-44a6-8630-ffc824d7d4cc", "d51694fe-484a-46ac-92d6-969e76d60d10", "46612ae6-86be-4802-bc07-39b59feb1309", "f41b0311-44f9-44f0-816d-dd45e39d4bc8", "a5a2d357-1ab8-4675-a967-ef9990a59391", "02773bed-83bf-469f-b7ff-e676e7d78bab", "d353dac0-1b41-46c2-820c-d7d2561fc6ed", "caf02a0a-1e1c-4552-9b48-5e070bd88d11", "68578b43-65df-4f81-9a9b-92f32711a951", "13c02350-4177-4e45-ac17-cf7ca628ff5e", "b8fd0e93-ff58-4cbd-8f48-1c114e342e62", "39f1f9f2-9636-45de-98f6-a4046aa8e4b9", "28a452f3-786c-4fd8-b8f2-bddbe9d616d1", "74babdd6-a758-4549-9632-26535279e654", "fec96f39-988b-4586-b746-b93d59fd1922", "847def9e-924d-4e90-b7c4-5f581395a2b4", "ce7066a6-508a-42d3-995b-2952c65dc2ce", "4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6", "54127bd4-f541-4ac3-afdb-ea073f63f692", "002bdb95-0cf1-46a6-9e08-d38c128a6127", "c7a74c80-ba5a-486e-9974-ab9e682bc5e4", "34746e8c-5fb8-415a-b135-0abc167e912a", "ee63c85c-6d51-4d12-ad09-04e25877a947", "cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca", "1277f594-a7d1-4f28-a2d3-73af5cbeab43", "63e4f530-65dc-49cc-8f80-ccfa95c69d43", "dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c", "2f7979ae-f82b-45af-ac1d-2b10e93b0baa", "059c5af9-5131-4d8d-92b2-de4ad6146712", "7fd164ba-126a-4d9c-9392-0d4f7c243df0", "15904280-565c-4b73-9303-3291f964e7f9", "6902955a-01b7-432c-b32a-6f5f81d8f625", "3ab79e90-9fab-4cdf-a7b2-6522bc742adb", "654fcc6d-840d-4844-9b07-2c3300e54a26", "df6ecb8b-7822-4f4b-b412-08f524b4576c", "cad1fe90-2406-44dc-bd03-59d0b58fe722", "1027d292-dd87-4a1a-8701-2abe04d7783c", "41bb431f-56d8-4691-bb56-ed34e390906f", "de46c52b-0bf8-4936-a327-aace94f94ac6", "576426ad-0131-4001-ae01-be175da0c108", "4e7050dd-e548-483f-b7d6-527ab4fa784d", "3d2a2d59-929c-4b78-8c1a-145dfe9e07b1", "7d604714-e071-49ff-8726-edeb95a70679", "bdd8157d-8e85-4397-bb82-f06cc9c71dbb", "6b269392-9eba-40b5-acb6-55c882b20ba6", "b6f91281-20aa-446a-b986-38a92813a18f", "4aafb0fa-bff5-4b9d-b99e-8093e659c65f", "3da70954-0f2c-4103-adff-b7440368f50e", "e36941d0-c0f0-443f-bc6f-cb2952eb69ea", "6e90ae7a-7cd3-473f-a035-4ebb72d961da", "814ddeca-3d31-4265-8e07-8cc54fb44903", "bd1212e5-78da-431e-95fa-c58e3237a8e6", "9e099d99-44c2-42b6-a6d8-54c3545cab29", "7280c9f3-a5af-45d0-916a-bc01cb4151c9", "75bf09fa-1dd7-4d18-9af9-dd9e492562eb", "8fbf3271-1ef6-4e94-8210-03c2317947f6", "d102b8f5-61dc-4e68-bd83-9a3187c67377", "81315b50-6b60-4d8f-9928-3466e1022515", "2d367498-5112-4ae5-a06a-96e7bc33a211", "8e1cb247-6cf6-42fa-b440-3f27d57e9936", "7047d730-036f-4f40-b9d8-1c63e36d5e62", "2aa0a6b4-a865-495b-ab51-c28249537b75", "65236ec7-ace0-4f0c-82fd-737b04fd4dcb", "e4a74e34-ecde-4aab-b2fb-9112dd01aed0", "614a7e17-5643-4d89-b6fe-f9df1a79641c", "dca1b3e8-e043-4ec8-85d7-867f334b5724", "0b9ad457-2554-44c1-82c2-d56a99c42377", "8c31f563-f9a7-450c-bfa8-35f8f32f1f61", "9b64de98-9db3-4033-bd7a-f51430105f00", "aba15bdd-657f-422a-bab3-ac2d2a0d6f1c", "97aa2e88-555c-450d-85a6-229bcd87efb8", "304afd73-55a5-4bb9-8c21-0b1fc84ea9e4", "69ca12af-119d-44ed-b50f-a47af0ebc364", "b1c50487-1967-4315-a026-6491686d860e", "f0540f7e-2db3-4432-b9e0-3965486744bc", "130c9e58-28ac-4f83-8574-0a4cc913b97e", "92fa78e7-4d39-45f1-91a3-8b23f3f1088d", "33f41cdd-35ac-4ba8-814b-c6a4244a1ad4", "0bcfabcb-7929-47f4-93d6-b33fb67d34d1", "162ab1e4-6874-4564-853c-53ec3ab8be01", "11b1ed55-154d-4e82-8ad7-83739298f720", "c61daa90-3c1e-4f18-af62-8f288b5c9aaf", "fcc6d700-68d9-4241-9a1a-06874d621b06", "f92a6f1e-a512-4a15-9735-da09e78d7273", "7eff1a7f-dd45-4c20-877a-f21e342a7611", "0afecb6e-6223-4a82-99fb-bf5b981e92a5", "f0e2b768-5220-47dd-b891-d57b96fc0ec1", "34986307-b7f4-49be-92f3-e7a4d01ac5db", "9711de76-5d4f-4c50-a94f-21e4e8f8384d", "c3edc6a5-d9d4-48d8-930e-aab518390917", "d5866ddf-ce8f-4aea-b28e-d96485a20d3d", "259e5a6a-b8d2-4c38-86e2-26c5e651361d", "155dbf56-e0a4-4dd0-8905-8a98705045e8", "7fff6773-2baa-46de-a24a-b6eec1aba2d1", "e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f", "0b8baa3f-575c-46ee-8715-d6f28cc7d33c", "2f9356ae-bf43-41b8-b858-4496d83b2acb", "a05baa88-e922-4001-bc4d-8738135f27de", "5b40a734-99b6-4b98-a1d0-1cea51a08ab2", "6e2a900a-ced9-4e4a-a9c2-13e706f9518a", "91174a41-dc8f-401b-be89-7bfc140612a0", "8468111a-ef07-4654-903b-b863a80bbc95", "c048f047-7e2a-4888-b302-55f509d4a91d", "52753ea4-b3a0-4365-910d-36cff487b789", "fccfb43e-09a7-4bd2-8b37-a5a7df33386d", "5f87308a-0a5b-4623-ae15-d8fa1809bc60", "0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b", "a8f866e1-bdd4-425e-a27a-37619238d9c7", "07a99744-56ac-40d2-97b7-2095967b0e03", "3a8da4e0-36c1-40d2-8b29-b3e890d5172a", "0e29e3a7-1ad8-40aa-b691-9f82ecd33d66", "d7b50671-d1ad-4871-aa60-5aa5b331fe04", "409f8a98-4496-4aaa-818a-c931c0a8b832", "a6976974-ea6f-4e97-818e-ea08625c52cb", "3a9fa2ec-30bc-4ebd-b49e-7c9cff225502", "b4926b47-a9d7-434c-b3a0-adc3fa0bd13e", "28208707-fe31-437f-9a7f-4b1108b94d2e", "e15b518d-b4ce-4410-a9cd-501f23ce4a18", "760e75d8-c3b5-409b-a9bf-6130b4c4603f", "e0b06658-7d1d-4cd3-bf15-03467507ff7c", "4e87b8e2-2ee9-4b2a-a715-4727d297ece0", "bb09dd3e-2b78-4819-8e35-a7c1b874e449", "4c7f49ee-2638-43bb-b85b-ce676c30b260", "4358e5a5-7542-4dcb-b9f3-87667371839b", "62ed5b55-f991-406a-85d9-e8e8fdf18789", "e074832a-eada-4fd7-94a1-10642b130e16", "16fe46bb-4f64-46aa-817d-ff7bec4a2352", "8d5aca11-22b3-4f22-b7ba-90e60533e1fb", "3d0ed417-3d94-4963-a562-4a92c940656a", "7892ec59-c5bb-496d-8968-e5d210ca3ac4", "145095eb-e273-443b-83d0-f9b519b7867b", "5d756aee-ad3e-4306-ad95-cb1abec48de2", "48ea844d-19b1-4642-944e-fe39c2cc1fec", "8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9", "1908fcc1-1b92-4272-8214-0fbaf2fa5163", "a10a2c40-2c4d-49f8-b557-1a946bc55d9d", "736ffa74-5f6f-44ca-94ef-1c0df4f51d2a", "bbb7e38c-0b41-4a11-b306-d2a457b7ac2b", "fed85bf9-e075-4280-9159-fbe8a023d6fa", "0e20c89d-2264-44ae-8238-aeeaba609ece", "56e05d41-ce99-4ecd-912d-93f019ee0b71", "b5b78988-486d-4a80-b991-930eff3ff8bf", "805c55d9-31e6-4846-9878-c34c75054fe9", "80e1f67a-4596-4351-98f5-a9c3efabac95", "e3845023-ca9a-4024-b2b2-5422156d5527", "e8a52bbd-bced-459f-bd93-64db45ce7657", "fc4f4817-0c53-4683-a4ee-b17a64bc1039", "f748c45a-f8d3-4e6f-b617-fe176f695b8f", "6ea858a8-ba71-4a12-b2cc-5d83312404c7", "93a19907-d4f9-4deb-9f91-aac4692776a6", "3215aa19-f060-4332-86d5-5602511f3ca8", "117d3d3a-755c-4a61-b23e-9171146d094c", "93d94efc-d7ad-4161-ad7d-1638c4f908d8", "318557a5-150c-4c8d-b70e-a9910e199857", "c3e76af5-4ce0-4a14-9c9a-25ceb8fda182", "f331aa1f-8c53-4fc3-b083-cc159bc971cb", "602a1f13-c640-4d73-b053-be9a2fa58b96", "9f2cc74d-78af-4eb2-bb64-9cd1d292b87b", "c3dbbc9f-ef1d-470a-a90a-d343448d5875", "edf3485d-dac4-4d50-90e4-b0e5813f7e60", "1d08ac94-400d-4469-a82f-daee9a908849", "7e9cf7b6-e827-11ed-a05b-15959c120003", "fa5b1358-b040-4403-9868-15f7d9ab6329", "c649a6c7-cd8c-4a78-9c04-000fc76df954", "e81528db-fc02-45e8-8e98-4e84aba1f10b", "7e9cf7b6-e827-11ed-a05b-0242ac120003", "a66bc059-c370-472c-a0d7-f8fd1bf9d583", "67add051-9ee7-4ad3-93ba-42935615ae8d", "295c9289-acee-4503-a571-8eacaef36b28", "72cd00d6-490c-4650-86ff-1d11f491daa1", "05296024-fe8a-4baf-8f3d-9a5f5624ceb2", "1a42dfa6-6cb2-4df9-9b48-295be477e835", "10cb6535-b31d-4512-9962-513dcbc42cc1", "7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8", "679085d5-f427-4484-9f58-1dc30a7c426d", "2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75", "39b64854-5497-4b57-a448-40977b8c9679", "a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f", "77564cc2-7382-438b-a7f6-395c2ae53b9a", "f239b326-2f41-4d6b-9dfa-c846a60ef505", "caa06de8-fdef-4c91-826a-7f9e163eef4b", "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "2158f96f-43c2-43cb-952a-ab4580f32382", "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "d797268e-28a9-49a7-b9a8-2f5039011c5c", "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "f426547a-e0f7-441a-b63e-854ac5bdf54d", "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "6d3a3952-6530-44a3-8554-cf17c116c615", "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "4c0aaedc-154c-4427-ada0-d80ef9c9deb6", "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "a4824fca-976f-4964-b334-0621379e84c4", "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "92a974db-ab84-457f-9ec0-55db83d7a825", "f9578658-9e71-4711-b634-3f9b50cd3c06", "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "f5240972-3938-4e56-8e4b-e33893176c1f", "fff9d2b7-e11c-4a69-93d3-40ef66189767", "cc9d3712-6310-4320-b2df-7cb408274d53", "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "327ff235-94eb-4f06-b9de-aaee571324be", "42a993dd-bb3e-48c8-b372-4d6684c4106c", "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "36210e0d-5b19-485d-a087-c096088885f0", "1723e720-616d-4ddc-ab02-f7e3685a4713", "90fb5e62-ca1f-4e22-b42e-cc521874c938", "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "57c4bf16-227f-4394-8ec7-1b745ee061c3", "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "0ea52357-cd59-4340-9981-c46c7e900428", "7aa7009a-28b9-4344-8c1f-159489a390df", "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "9719a8aa-401c-41af-8108-ced7ec9cd75c", "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "587254ee-a24b-4335-b3cd-065c0f1f4baa", "98b53e78-ebaf-46f8-be06-421aafd176d9", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "b5746143-59d6-4603-8d06-acbd60e166ee", "c09dad97-1c78-4f71-b127-7edb2b8e491a", "551d9c1f-816c-445b-a7a6-7a3864720d60", "e31033fc-33f0-4020-9a16-faf9b31cbf08", "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "8e3c7994-131e-4ba5-b6ea-804d49113a26", "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "e32d4572-9826-4738-b651-95fa63747e8a", "043c4b8b-3a54-4780-9682-081cb6b8185c", "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "c363385c-f75d-4753-a108-c1a8e28bdbda", "5cb299fc-5fb1-4d07-b989-0644c68b6043", "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "811f459f-9231-45d4-959a-0266c6311987", "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "7d6d30b8-5b91-4b90-a891-46cccaf29598", "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "087790e3-3287-436c-bccf-cbd0184a7db1", "6812a10b-60ea-420c-832f-dfcc33b646ba", "84b14121-9d14-416e-800b-f3b829c5a14d", "32e280f1-8ad4-46ef-9e80-910657611fbc", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "9cfc00b6-bfb7-49ce-9781-ef78503154bb", "3f5491e2-8db8-496b-9e95-1029fce852d4", "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "02030f2f-6199-49ec-b258-ea71b07e03dc", "74403157-20f5-415d-89a7-c505779585cf", "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "4d7cda18-1b12-4e52-b45c-d28653210df8", "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "c9783e20-4793-4164-ba96-d9ee483992c4", "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "94771a71-ba41-4b6e-a757-b531372eaab6", "2f869d59-7f6a-4931-992c-cce556ff2d53", "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "1775e15e-b61b-4d14-a1a3-80981298085a", "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "42b1a5b8-353f-4f10-b256-39de4467faff", "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "9292293b-8496-4715-9db6-37028dcda4b3", "52788a70-f1da-40dd-8fbd-73b5865d6568", "349d891d-fef0-4fe4-bc53-eee623a15969", "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "6f3e2987-db24-4c78-a860-b4f4095a7095", "1ec65a5f-9473-4f12-97da-622044d6df21", "d042284c-a296-4988-9be5-f424fadcc28c", "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "1327381e-6ab0-4f38-b583-4c1b8346a56b", "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "9ec9fb1b-e059-4489-9642-f270c207923d", "058f4380-962d-40a5-afce-50207d36d7e2", "fe63010f-8823-4864-a96b-a7b4a0f7b929", "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "c86133ad-4725-4bd0-8170-210788e0a7ba", "f5d19838-41b5-476c-98d8-ba8af4929ee2", "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "82880171-b475-4201-b811-e9c826cd5eaa", "023c654f-8f16-44d9-bb2b-00ff36a62af9", "d557dc06-62e8-4468-a8e8-7984124908ce", "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "a642964e-bead-4bed-8910-1bb4d63e3b4d", "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "e4a6b256-3e47-40fc-89d2-7a477edd6915", "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "9fff585c-c33e-4a86-b3cd-39312079a65f", "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "fa00b701-44c6-4679-994d-5a18afa8a707", "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "313d6012-51a0-4d93-8dfc-de8553239e25", "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "8d63dadf-b91b-4187-87b6-34a1114577ea", "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "b36d01a3-ddaf-4804-be18-18a6247adfcd", "aaf46cdc-934e-4284-b329-34aa701e3771", "575dce0c-8139-4e30-9295-1ee75969f7fe", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "a1473adb-5338-4a20-b4c3-126763e2d3d3", "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "241e802a-b65e-484f-88cd-c2dc10f9206d", "fd877b94-9bb5-4191-bb25-d79cbd93c167", "d047726b-c71c-4048-a99b-2e2f50dc107d", "40b95d31-1afc-469e-8d34-9a3a667d058e", "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "e6c54d94-498c-4562-a37c-b469d8e9a275", "64760eef-87f7-4ed3-93fd-655668ea9420", "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "da2738f2-fadb-4394-afa7-0a0674885afa", "88872991-7445-4a22-90b2-a3adadb0e827", "f576a613-2392-4067-9d1a-9345fb58d8d1", "431a1fdb-4799-4f3b-91c3-a683b003fc49", "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "4931188c-178e-4ee7-a348-39e8a7a56821", "85ff530b-261d-48c6-a441-facaa2e81e48", "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "8cbc9475-8d05-4e27-9c32-df960716c701", "378a05d8-963c-46c9-bcce-13c7657eac99", "e8d34729-86a4-4140-adfd-0a29c2106307", "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "e568650b-5dcd-4658-8f34-ded0b1e13992", "f208d6d8-d83a-4c2c-960d-877c37da84e5", "514e4c3a-c77d-4cde-a00f-046425e2301e", "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "01aeb693-138d-49d2-9403-c4f52d7d3d62", "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "83865853-59aa-449e-9600-74b9d89a6d6e", "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "b53317a0-8acf-4fd1-8de8-a5401e776b96", "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "10344bb3-7f65-46c2-b915-2d00d47be5b0", "185d7418-f250-42d0-b72e-0c8b70661e93", "379fa130-190e-4c3f-b7bc-6c8e834485f3", "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "e83e8899-c9b2-483b-b355-5decc942b959", "6385697e-9f1b-40bd-8817-f4a91f40508e", "24357373-078f-44ed-9ac4-6d334a668a11", "15619216-e993-4721-b590-4c520615a67d", "d2eb17db-1d39-41dc-b57f-301f6512fa75", "5a6e1e16-07de-48d8-8aae-faa766c05e88", "5a3164f2-b373-4152-93cf-090b13c12d27", "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "cbec226f-63d9-4eca-9f52-dfb6652f24df", "5b768e71-86f2-4879-b448-81061cbae951", "ca621ba5-54ab-4035-9942-d378e6fcde3c", "98767d61-b2e8-4d71-b661-e36783ee24c1", "a85ffc3a-e8fd-4040-93bf-78aff284d801", "88f46b67-14d4-4f45-ac2c-d66984f22191", "83809e84-4475-4b69-bc3e-4aad8568612f", "ce72ef99-22f1-43d4-8695-419dcb5d9330", "add64136-62e5-48ea-807e-88638d02df1e", "04936b66-3915-43ad-a8e5-809eadfd1141", "847d5ff3-8a31-4737-a970-aeae8fe21765", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "c49c5062-0966-4170-9efd-9968c913a6cf", "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "850d55f9-6eeb-4492-ad69-a72338f65ba4", "d87bd452-6da1-456e-8155-7dc988157b7d", "5bb68627-3198-40ca-b458-49f973db8752", "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "caf201a9-c2ce-4a26-9c3a-2b9525413711", "4e762605-34a8-406d-b72e-c1a089313320", "d3c3861d-c504-4c77-ba55-224ba82d0118", "2ddef153-167b-4e89-86b6-757a9e65dcac", "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "8a582fe2-0882-4b89-a82a-da6b2dc32937", "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "f35c5d71-b489-4e22-a115-f003df287317", "fbd7c32d-db2a-4418-b92c-566eb8911133", "87a476dc-0079-4583-a985-dee7a20a03de", "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "38879043-7e1e-47a9-8d46-6bec88e201df", "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "f9999590-1f94-4a34-a91e-951e47bedefd", "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "4eddc365-79b4-43ff-a9d7-99422dc34b93", "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "220457c1-1c9f-4c2e-afe6-9598926222c1", "bf361876-6620-407a-812f-bfe11e51e924", "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "c79da740-5030-45ec-a2e0-479e824a562c", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "a197e378-d31b-41c0-9635-cfdf1c1bb423", "737e618a-a410-49b5-bec3-9e55ff7fbc15", "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "30edb182-aa75-42c0-b0a9-e998bb29067c", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "eb1c4225-1c23-4241-8dd4-051389fde4ce", "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "e312efd0-35a1-407f-8439-b8d434b438a6", "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "ba42babc-0666-4393-a4f7-ceaf5a69191e", "c27515df-97a9-4162-8a60-dc0eeb51b775", "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "0f6da907-5854-4be6-859a-e9958747b0aa", "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "5edc2273-c26f-406c-83f3-f4d948e740dd", "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "0f0450f3-8b47-441e-a31b-15a91dc243e2", "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "817f252c-5143-4dae-b418-48c3e9f63728", "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "07e3cb2c-0608-410d-be4b-1511cb1a0448", "138d3531-8793-4f50-a2cd-f291b2863d78", "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "ddeff553-5233-4ae9-bbab-d64d2bd634be", "e212d415-0e93-435f-9e1a-f29005bb4723", "55f0a3a1-846e-40eb-8273-677371b8d912", "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "e7888eb1-13b0-4616-bd99-4bc0c2b054b9", "6ba5a05f-b095-4f0a-8654-b825f4f16334", "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "7cce6fc8-a07f-4d84-a53e-96e1879843c9", "45d3a03d-f441-458c-8883-df101a3bb146", "871b9555-69ca-4993-99d3-35a59f9f3599", "f2c64357-b1d2-41b7-849f-34d2682c0fad", "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "12fbff88-16b5-4b42-9754-cd001a789fb3", "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "0403d67d-6227-4ea8-8145-4e72db7da120", "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "bd1c6866-65fc-44b2-be51-5588fcff82b9", "1114e048-b69c-4f41-bc20-657245ae6e3f", "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "27aec9c9-dbb0-4939-8422-1742242471d0", "727454c0-d851-48b0-8b89-385611ab0704", "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "d20ee2f4-822c-4827-9e15-41500b1fff10", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "efec536f-72e8-4656-8960-5e85d091345b", "6f4191bb-912b-48a8-9ce7-682769541e6d", "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "517490a7-115a-48c6-8862-1a481504d5a8", "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "49d9671b-0a0a-4c09-8280-d215bfd30662", "05f3c945-dcc8-4393-9f3d-af65077a8f86", "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "554601fb-9b71-4bcc-abf4-21a611be4fde", "7b10f171-7f04-47c7-9fa2-5be43c76e535", "45239e6a-b035-4aaf-b339-8ad379fcb67e", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "7be5fb68-f9ef-476d-8b51-0256ebece19e", "6e22722b-dfb1-4508-a911-49ac840b40f8", "9ccba514-7cb6-4c5c-b377-700758f2f120", "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "7a74da6b-ea76-47db-92cc-874ad90df734", "f11f2808-adb4-46c0-802a-8660db50fa99", "43e32da2-fdd0-4156-90de-50dfd62636f9", "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "a20def93-0709-4eae-9bd2-31206e21e6b2", "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "6004abd0-afa4-4557-ba90-49d172e0a299", "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "970823b7-273b-460a-8afc-3a6811998529", "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "15b75071-74cc-47e0-b4c6-b43744a62a2b", "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "f99abdf0-6283-4e71-bd2b-b5c048a94743", "0a13e132-651d-11eb-ae93-0242ac130002", "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "e9f55347-2928-4c06-88e5-1a7f8169942e", "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "6a69f62d-ce75-4b57-8dce-6351eb55b362", "8b0e12da-d3c3-49db-bb4f-256703f380e5", "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "98a96a5a-64a0-4c42-92c5-489da3866cb0", "47e4bab7-c626-47dc-967b-255608c9a920", "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "40b19fa6-d835-400c-b301-41f3a2baacaf", "71158e3f-df67-472b-930e-7d287acaa3e1", "f44800ac-38ec-471f-936e-3fa7d9c53100", "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "24c8392b-aa3c-46b7-a545-43f71657fe98", "88f680b8-070e-402c-ae11-d2914f2257f1", "15434e33-5027-4914-88d5-3d4145ec25a9", "b98d0db6-511d-45de-ad02-e82a98729620", "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "0bbc6369-43e3-453d-9944-cae58821c173", "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "b7966f4a-b333-455b-8370-8ca53c229762", "43fa5350-db63-4b8f-9a01-789a427074e1", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "ec290c06-9b6b-4338-8b6b-095c0f284f10", "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "d4498716-1d52-438f-8084-4a603157d131", "b222df08-0e07-11eb-adc1-0242ac120002", "e1693bc8-7168-4eab-8718-cdcaa68a1738", "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "d3b70aad-097e-409c-9df2-450f80dc476b", "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "312d0384-401c-4b8b-abdf-685ffba9a332", "cc368ed0-2411-45dc-a222-510ace303cb2", "42333b2c-b425-441c-b70e-99404a17170f", "0e4164da-94bc-450d-a7be-a4b176179f1f", "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "ebef4391-1a81-4761-a40a-1db446c0e625", "f26307d8-14cd-47e3-a26b-4b4769f24af6", "03cc0c25-389f-4bf8-b48d-11878079f1ca", "8834e2f7-6b4b-4f09-8906-d2276470ee23", "7090adee-82e2-4269-bd59-80691e7c6338", "c74c0390-3e20-41fd-a69a-128f0275a5ea", "b6457d63-d2a2-4e29-859d-4e7affc153d1", "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "5f6a601c-2ecb-498b-9c33-660362323afa", "aa8e035d-7be4-48d3-a944-102aec04400d", "b243b280-65fe-48df-ba07-6ddea7646427", "236d8e89-ed95-4789-a982-36f4643738ba", "277a4393-446c-449a-b0ed-7fdc7795244c", "4fe074b4-b833-4081-8f24-7dcfeca72b42", "68bcd73b-37ef-49cb-95fc-edc809730be6", "86588b36-c6d3-465f-9cee-8f9093e07798", "502b42de-4306-40b4-9596-6f590c81f073", "0a99eb3e-1617-41bd-b095-13dc767f3def", "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "07f8bdc2-c9b3-472a-9817-5a670b872f53", "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "28ac00d6-22d9-4a3c-927f-bbd770104573", "452bce90-6fb0-43cc-97a5-affc283139b3", "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "ce7cf472-6fcc-490a-9481-3786840b5d9b", "c6fb44c6-71f5-49e6-9462-1425d328aee3", "9c0295ce-d60d-40bd-bd74-84673b7592b1", "0a4f6091-223b-41f6-8743-f322ec84930b", "98c5aeef-32d5-492f-b174-64a691896d25", "6fe4aa1e-0531-4510-8be2-782154b73b48", "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "d78b5d61-187d-44b6-bf02-93486a80de5a", "e9b61244-893f-427c-b287-3e708f321c6b", "70bc5215-526f-4477-963c-a47a5c9ebd12", "b6e04788-29e1-4557-bb14-77f761848ab8", "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "0685b176-c816-4837-8e7b-1216f346636b", "e84d89c4-f544-41ca-a6af-4b92fd38b023", "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "023394c4-29d5-46ab-92b8-6a534c6f447b", "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "ebea773c-a8f1-42ad-a856-00cb221966e8", "0b7163dc-7eee-4960-af17-c0cd517f92da", "98dedfdd-8333-49d4-9f23-d7018cccae53", "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "f24bcaea-0cd1-11eb-adc1-0242ac120002", "ccb5742c-c248-4982-8c5c-5571b9275ad3", "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "4abc0ec4-db5a-412f-9632-26659cddf145", "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "5cddf373-ef00-4112-ad72-960ac29bac34", "37db85d1-b089-490a-a59a-c7b6f984f480", "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "f1edd233-30b5-4823-9e6a-c4171b24d316", "e92a4287-e072-4a40-9739-370c106bb750", "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "8bc64091-6875-4881-aaf9-7bd25b5dda08", "56c217c3-2de2-479b-990f-5c109ba8458f", "eee00933-a761-4cd0-be70-c42fe91731e7", "bab049ca-7471-4828-9024-38279a4c04da", "c3a99af4-35a9-4668-879e-c09aeb4f2bdf", "d7654f02-e04b-4934-9838-65c46f187ebc", "2a072a96-a086-49fa-bcb5-15cc5a619093", "883faa95-175a-4e22-8181-e5761aeb373c", "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "63d1ccc0-2a43-4f4b-9289-361b308991ff", "4f154fb6-27d1-4813-a759-78b93e0b9c48", "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "33be4333-2c6b-44f4-ae28-102cdbde0a31", "395907ee-96e5-4666-af2e-2ca91688e151", "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "b0ce780f-10bd-496d-9067-066d23dc3aa5", "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "79b06761-465f-4f88-9ef2-150e24d3d737", "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "c615d676-f655-46b9-b913-78729021e5d7", "b19146a3-25d4-41b4-928b-1e2a92641b1b", "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "e6474a1b-5390-49cd-ab41-8d88655f7394", "692f0bec-83ba-4d04-af7e-e884a96059b6", "93671f99-04eb-4ab4-a161-70d446a84003", "0d5675be-bc88-4172-86d3-1e96a4476536", "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "4281cb20-2994-4580-aa63-c8b86d019934", "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "a34f79a3-8e5f-4cc3-b765-de00695452c2", "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "5589ab4f-a767-433c-961d-c91f3f704db1", "e8a95b5e-c891-46e2-b33a-93937d3abc31", "c86500e9-a645-4680-98d7-f882c70c1ea3", "58f50261-c53b-4c88-bd12-1d71f12eda4c", "34ebb878-1b15-4895-b352-ca2eeb99b274", "7a02e22e-b885-4404-b38b-1ddc7e65258a", "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "24de4f3b-804c-4165-b442-5a06a2302c7e", "731231b9-0b5d-4219-94dd-abb6959aa7ea", "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "d7bcd677-645d-4691-a8d4-7a5602b780d1", "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "6e897651-f157-4d8f-aaeb-df8151488385", "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "9847f263-4a81-424f-970c-875dab15b79b", "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "4b046706-5789-4673-b111-66f25fe99534", "73bba97f-a82d-42ce-b315-9182e76c57b1", "646bc99f-6682-4b47-a73a-17b1b64c9d34", "6c96fc76-0eb1-11eb-adc1-0242ac120002", "7050bba1-1aed-454e-8f73-3f46f09ce56a", "744a188b-0415-4792-896f-11ddb0588dbc", "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "faa48cae-6b25-4f00-a094-08947fef582f", "70ad0861-d1fe-491c-a45f-fa48148a300d", "a16980c2-0c56-4de0-9a79-17971979efdd", "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "954f0af7-62dd-418f-b3df-a84bc2c7a774", "a7ee1722-c3c5-aeff-3212-c777e4733217", "1dde5376-a648-492e-9e54-4241dd9b0c7f", "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "10c14723-61c7-4c75-92ca-9af245723ad2", "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "41421f44-58f9-455d-838a-c398859841d4", "ae9b0bd7-8888-4606-b444-0ed7410cb728", "8de1cbe8-d6f5-496d-8237-5f44a721c7a0", "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "43103702-5886-11ed-9b6a-0242ac120002", "16905e21-66ee-42fe-b256-1318ada2d770", "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "a7c3d773-caef-227e-a7e7-c2f13c622329", "214641c2-c579-4ecb-8427-0cf19df6842e", "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "07aa184a-870d-413d-893a-157f317f6f58", "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "f548a603-c9f2-4c89-b511-b089f7e94549", "93199800-b52a-4dec-b762-75212c196542", "526be59f-a573-4eea-b5f7-f0973207634d", "6345b048-8441-43a7-9bed-541133633d7a", "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "25676e10-2121-446e-80a4-71ff8506af47", "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "ac1c92b4-ac81-405a-9978-4604d78cc47e", "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "bdeb2cff-af74-4094-8426-724dc937f20a", "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "a383dec4-deec-4e6e-913b-ed9249670848", "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "ac20ae82-8758-4f38-958e-b44a3140ca88", "54786ddc-5b8a-11ed-9b6a-0242ac120002", "41ca393d-538c-408a-ac27-cf1e038be80c", "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "cd71385d-fd9b-4691-9b98-2b1f7e508714", "c8a180d6-47a3-4345-a609-53f9c3d834fc", "044ba588-dff4-4918-9808-3f95e8160606", "1af57a4b-460a-4738-9034-db68b880c665", "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "1dd05363-104e-4b4a-b963-196a534b03a1", "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "84b1ecf9-6eff-4004-bafb-bae5c0e251b2", "204b17ae-4007-471b-917b-b917b315c5db", "50d66fb0-03f8-4da0-8add-84e77d12a020", "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "c2b86e67-b880-4eec-b045-50bc98ef4844", "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "e593cf51-88db-4ee1-b920-37e89012a3c9", "90d6bd71-dffb-4989-8d86-a827fedd6624", "8202070f-edeb-4d31-a010-a26c72ac5600", "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "3268b746-88d8-4cd3-bffc-30077d02c787", "18988e1b-9087-4f8a-82fe-0414dce49878", "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "f53714ec-5077-420e-ad20-907ff9bb2958", "f117933c-980c-4f78-b384-e3d838111165", "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "a29c1813-ab1f-4dde-b489-330b952e91ae", "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "b655a06a-31c0-477a-95c2-3726b83d649d", "21d856f9-9281-4ded-9377-51a1a6e2a432", "b66474aa-bd92-4333-a16c-298155b120df", "b2309017-4235-44fe-b5af-b15363011957", "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "62510e69-616b-4078-b371-847da438cc03", "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "285b85b1-a555-4095-8652-a8a4106af63f", "84f52741-8834-4a8c-a413-2eb2269aa6c8", "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "be344333-921d-4c4d-8bb8-e584cf584780", "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "fb843269-508c-4b76-8b8d-88679db22ce7", "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "de587dce-915e-4218-aac4-835ca6af6f70", "c7942406-33dd-4377-a564-0f62db0593a3", "ab9e3b40-0c85-4ba1-aede-455d226fd124", "ef61af62-bc74-4f58-b49b-626448227652", "a20391f8-76fb-437b-abc0-dba2df1952c6", "899133d5-4d7c-4a7f-94ee-27355c879d90", "1ac8666b-046f-4201-8aba-1951aaec03a3", "1c67a717-32ba-409b-a45d-0fb704a73a81", "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "eca49c87-8a75-4f13-9c73-a5a29e845f03", "435e10e4-992a-4281-96f3-38b11106adde", "b3512211-c67e-4707-bedc-66efc7848863", "c15a46a0-07d4-4c87-b4b6-89207835a83b", "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "1f0f6176-6482-4027-b151-00071af39d7e", "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "9257c05b-4a4a-48e5-a670-b7b073cf401b", "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "99793437-3e16-439b-be0f-078782cf953d", "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "ac175779-025a-4f12-98b0-acdaeb77ea85", "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "90d50722-0483-4065-8e35-57efaadd354d", "180c7c5c-d64b-4a63-86e9-68910451bc8b", "d55b793d-f847-4eea-b59a-5ab09908ac90", "aef9d1f1-7396-4e92-a927-4567c7a495c1", "6c6d9280-e6d0-4b9d-80ac-254701b64916", "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "9212f354-7775-4e28-9c9f-8f0a4544e664", "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "ffa6861c-4461-4f59-8a41-578c39f3f23e", "a0459f02-ac51-4c09-b511-b8c9203fc429", "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "534f2ef7-e8a2-4433-816d-c91bccde289b", "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "84232095-ecca-4015-b0d7-7726507ee793", "4e2ed651-1906-4a59-a78a-18220fca1b22", "96036718-71cc-4027-a538-d1587e0006a7", "60f16a96-db70-42eb-8f76-16763e333590", "5afee48e-67dd-4e03-a783-f74259dcf998", "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "771d1eb5-9587-4568-95fb-9ec44153a012", "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "e28a5a99-da44-436d-b7a0-2afc20a5f413", "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "68d37776-61db-42f5-bf54-27e87072d17e", "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "d2b749ee-4225-417e-b20e-a8d2193cbb84", "1193d960-2369-499f-a158-7b50a31df682", "6b65c28e-11f3-46cb-902a-68f2cafaf474", "242301bc-f92f-4476-8718-78004a6efd9f", "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "52d097e2-063e-4c9c-8fbb-855c8948d135", "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "647c7b9e-d784-4fda-b9a0-45c565a7b729", "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "bb76d96b-821c-47cf-944b-7ce377864492", "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "1816994b-42e1-4fb1-afd2-134d88184f71", "12827a56-61a4-476a-a9cb-f3068f191073", "32b96012-7892-429e-b26c-ac2bf46066ff", "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "f4bbd493-b796-416e-bbf2-121235348529", "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "d06be4b9-8045-428b-a567-740a26d9db25", "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "65c3ca2c-525f-4ced-968e-246a713d164f", "347906f3-e207-4d18-ae5b-a9403d6bcdef", "a29808fd-ef50-49ff-9c7a-59a9b040b404", "e66779cc-383e-4224-a3a4-267eeb585c40", "85c312b7-f44d-4a51-a024-d671c40b49fc", "6da2c9f5-7c53-401b-aacb-92c040ce1215", "6bd75993-9888-4f91-9404-e1e4e4e34b77", "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "ff992eac-6449-4c60-8c1d-91c9722a1d48", "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "208748f7-881d-47ac-a29c-07ea84bf691d", "89ca78fd-b37c-4310-b3d3-81a023f83936", "a2910908-e86f-4687-aeba-76a5f996e652", "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "9c14c9fa-1a63-4a64-8e57-d19280559490", "221b251a-357a-49a9-920a-271802777cc0", "50919691-7302-437f-8e10-1fe088afa145", "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "f14e169e-9978-4c69-acb3-1cff8200bc36", "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "1c8774a0-44d4-4db0-91f8-e792359c70bd", "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "9fc3072c-dc8f-4bf7-b231-18950000fadd", "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "ada4b0c4-758b-46ac-9033-9004613a150d", "584bca0f-3608-4402-80fd-4075ff6072e3", "9a132afa-654e-11eb-ae93-0242ac130002", "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "a70dcb37-3bee-453a-99df-d0c683151be6", "85b0b087-eddf-4a2b-b033-d771fa2b9775", "2267fe65-0681-42ad-9a6d-46553d3f3480", "28c8f68b-098d-45af-8d43-8089f3e35403", "cd8c163e-a19b-402e-bdd5-419ff5859f12", "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "2c28c248-7f50-417a-9186-a85b223010ee", "84972c80-251c-4c3a-9079-4f00aad93938", "434c08ba-8406-4d15-8b24-782cb071a691", "bed2a484-9348-4143-8a8a-b801c979301c", "a0d7e4d2-bede-4141-8896-bc6e237e977c", "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "1c526788-0abe-4713-862f-b520da5e5316", "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "9f107a84-532c-41af-b005-8d12a607639f", "455b9d50-15a1-4b99-853f-8d37655a4c1b", "dee0a7a3-f200-4112-a99b-952196d81e42", "79ce34ca-af29-4d0e-b832-fc1b377020db", "2afafd61-6aae-4df4-baed-139fa1f4c345", "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "f0507c0f-a3a2-40f5-acc6-7f543c334993", "970007b7-ce32-49d0-a4a4-fbef016950bd", "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "f4264e47-f522-4c38-a420-04525d5b880f", "b2ddd389-f676-4ac4-845a-e00781a48e5f", "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "4a6713f6-3331-11ed-a261-0242ac120002", "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "5cc2cda8-f261-4d88-a2de-e9e193c86716", "2d22a514-e024-4428-9dba-41505bd63a5b", "01c42d3c-242d-4655-85b2-34f1739632f7", "77946e79-97f1-45a2-84b4-f37b5c0d8682", "27ba3207-dd30-4812-abbf-5d20c57d474e", "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "1228c958-e64e-4e71-92ad-7d429f4138ba", "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "b1377339-fda6-477a-b455-ac0923f9ec2c", "44143844-0631-49ab-97a0-96387d6b2d7c", "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "85de1f22-d189-44e4-8239-dc276b45379b", "92626ddd-662c-49e3-ac59-f6535f12d189", "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "e56d3073-83ff-4021-90fe-c658e0709e72", "deb9b646-a508-44ee-b7c9-d8965921c6b6", "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "cea2b7ea-792b-405f-95a1-b903ea06458f", "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "730fc21b-eaff-474b-ad23-90fd265d4988", "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "48917adc-a28e-4f5d-b729-11e75da8941f", "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "0900463c-b33b-49a8-be1d-552a3b553dae", "82a6714f-4899-4f16-9c1e-9a333544d4c3", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "1e59c230-6670-45bf-83b0-98903780607e", "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "5687f942-867b-4578-ade7-1e341c46e99a", "258fc8ce-8352-443a-9120-8a11e4857fa5", "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "4ae81040-fc1c-4249-bfa3-938d260214d9", "aa2efee7-34dd-446e-8a37-40790a66efd7", "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "ae215552-081e-44c7-805f-be16f975c8a2", "30bf1789-379d-4fdc-900f-55cd0a90a801", "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "4f7a6757-ff79-46db-9687-66501a02d9ec", "129966c9-de17-4334-a123-8b58172e664d", "696bfb54-227e-4602-ac5b-30d9d2053312", "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "7df1713a-1a5b-4a4b-a071-dc83b144a101", "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "814c95cc-8192-4378-a70a-f1aafd877af1", "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "99c840f2-2012-46fd-9141-c761987550ef", "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "de16d92c-c446-4d53-8938-10aeef41c8b6", "056c7317-9a09-4bd4-9067-d051312752ea", "60fc936d-2eb0-4543-8a13-911c750a1dfc", "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "114de787-4eb2-48cc-abdb-c0b449f93ea4", "207b0396-3689-42d9-8399-4222658efc99", "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "9248c7e1-2bf3-4661-a22c-600a8040b446", "146aace8-9bd6-42ba-be7a-0070d8027b76", "3d7679bd-0c00-440c-97b0-3f204273e6c7", "ea011323-7045-460b-b2d7-0f7442ea6b38", "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "e290b10b-1023-4452-a4a9-eb31a9013b3a", "ca5583e9-8f80-46ac-ab91-7f314d13b984", "cd3d1298-eb3b-476c-ac67-12847de55813", "867356ee-9352-41c9-a8f2-1be690d78216", "67f113fa-e23d-4271-befa-30113b3e08b1", "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "62b20d44-1546-4e61-afce-8e175eb9473c", "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "b6676963-0353-4f88-90f5-36c20d443c6a", "99cf1e02-00fb-4c0d-8375-563f978dfd37", "903076ff-f442-475a-b667-4f246bcc203b", "a77c1610-fc73-4019-8e29-0f51efc04a51", "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "cea72823-df4d-4567-950c-0b579eaf0846", "74a2b202-73e0-4693-9a3a-9d36146d0775", "5fc297ae-25b6-488a-8f25-cc12ac29b744", "12f6b752-042d-483e-bf9c-915a6d06ad75", "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "c1d867fe-8d95-4487-aab4-e53f2d339f90", "e13f668e-7f95-443d-98d2-1816a7648a7b", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "9c8c7000-3065-44a8-a555-79bcba5d9955", "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "ee5e119b-1f75-4b34-add8-3be976961e39", "33339be3-148b-4e16-af56-ad16ec6c7e7b", "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "01d2e2a1-5f09-44f7-9fc1-24faa7479b6d", "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "646ea171-dded-4578-8a4d-65e9822892e3", "84b1706c-932a-44c4-ae28-892b28a25b94", "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "1012f107-b8f1-4271-af30-5aed2de89b39", "074e0ded-6ced-4ebd-8b4d-53f55908119d", "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "af491bca-e752-4b44-9c86-df5680533dbc", "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "f0f7be61-9cf5-43be-9836-99d6ef448a18", "b1f73849-6329-4069-bc8f-78a604bb8b23", "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "0b80ade5-6997-4b1d-99a1-71701778ea61", "81ebd28b-9607-4478-bf06-974ed9d53ed7", "dc4576d4-7467-424f-9eee-fd2b02855fe0", "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "e9142d84-fbe0-401d-ac50-3e519fb00c89", "b4dc61f5-6cce-468e-a608-b48b469feaa2", "e6313acd-208c-44fc-a0ff-db85d572e90e", "f3d39c45-de1a-4486-a687-ab126124f744", "97dbf6e2-e436-44d8-abee-4261b24d3e41", "729ce0ea-5d8f-4769-9762-e35de441586d", "0fc35fc3-efe6-4898-8a37-0b233339524f", "c947b146-0abc-4c87-9c64-b17e9d7274a2", "91a2c315-9ee6-4052-a853-6f6a8238f90d", "9525dc73-0327-438c-8c04-13c0e037e9da", "a4694263-59a8-4608-a3a0-6f8d3a51664c", "f37aba28-a9e6-4045-882c-d5004043b337", "5e95028c-5229-4214-afae-d653d573d0ec", "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "f7375e28-5c14-432f-b8d1-1db26c832df3", "0e0255bf-2548-47b8-9582-c0955c9283f5", "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "d65aee4d-2292-4cea-b832-83accd6cfa43", "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "889719ef-dd62-43df-86c3-768fb08dc7c0", "18ee686c-38a3-4f65-9f44-48a077141f42", "af77cf95-c469-471c-b6a0-946c685c4798", "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "4bf943c6-5146-4273-98dd-e958fd1e3abf", "7f741dcf-fc22-4759-87b4-9ae8376676a2", "8a3038e8-9c9d-46f8-b184-66234a160f6f", "7d4aaec2-08ed-4430-8b96-28420e030e04", "75d0a94e-6252-448d-a7be-d953dff527bb", "327f48c1-a6db-4eb8-875a-f6981f1b0183", "5f03babb-12db-4eec-8c82-7b4cb5580868", "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "cd1f961e-0b96-436b-b7c6-38da4583ec00", "7b4f794b-590a-4ad4-ba18-7964a2832205", "438025f9-5856-4663-83f7-52f878a70a50", "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "213d6a77-3d55-4ce8-ba74-fcfef741974e", "aaafa146-074c-11eb-adc1-0242ac120002", "2433a154-bb3d-42e4-86c3-a26bdac91c45", "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "4f647cfa-b598-4e12-ad69-c68dd16caef8", "16c37b52-b141-42a5-a3ea-bbe098444397", "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "17769c90-230e-488b-a463-e05c08e9d48f", "222129f7-f4dc-4568-b0d2-22440a9639ba", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "e173ad47-4388-4012-ae62-bd13f71c18a8", "48bbc537-b652-4b4e-bd1d-281172df448f", "1edff897-9146-48d2-9066-52e8d8f80a2f", "c248c896-e412-4279-8c15-1c558067b6fa", "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "2cf29f11-e356-4f61-98c0-1bdb9393d6da", "d522eca2-2973-4391-a3e0-ef0374321dae", "62e0298b-e994-4189-bc87-bc699aa62d97", "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "a537cfc3-4297-4789-92b5-345bfd845ad0", "74a12f18-505c-4114-8d0b-8448dd5485c6", "4a2a2c3e-209f-4d01-b513-4155a540b469", "32410e29-5f94-4568-b6a3-d91a8adad863", "f64e5c19-879c-4bae-b471-6d84c8339677", "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "536e2947-3729-478c-9903-745aaffe60d2", "40aa399c-7b02-4715-8e5f-73572b493f33", "883835a7-df45-43e4-bf1d-4268768afda4", "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "b57ba453-b384-4ab9-9f40-1038086b4e53", "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "3bad990e-4848-4a78-9530-b427d854aac0", "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "09576804-7a05-458e-a817-eb718ca91f54", "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "b0524451-19af-4efa-a46f-562a977f792e", "b96b2031-7c17-4473-afe7-a30ce714db29", "37c1333a-a0db-48be-b64b-7393b2386e3b", "81325ce1-be01-4250-944f-b4789644556f", "3abd6094-7027-475f-9630-8ab9be7b9725", "d9047477-0359-48c9-b8c7-792cedcdc9c4", "0a98a10c-685d-4ab0-bddc-b6bdd1d48458", "56d19cb4-6414-4769-9644-1ed35ffbb148", "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "5cdb711b-5740-4fb2-ba88-f7945027afac", "164eda96-11b2-430b-85ff-6a265c15bf32", "a58353df-af43-4753-bad0-cd83ef35eef5", "56321594-9087-49d9-bf10-524fe8479452"], "uberAgent 7.3": ["dfe8b941-4e54-4242-b674-6b613d521962", "23c43900-e732-45a4-8354-63e4a6c187ce", "47d65ac0-c06f-4ba2-a2e3-d263139d0f51", "65d506d3-fcfe-4071-b4b2-bcefe721bbbb", "5d0fdb62-f225-42fb-8402-3dfe64da468a", "b743623c-2776-40e0-87b1-682b975d0ca5", "089dbdf6-b960-4bcc-90e3-ffc3480c20f6", "2d5e7a8b-f484-4a24-945d-7f0efd52eab0", "58800443-f9fc-4d55-ae0c-98a3966dfb97", "5de06a6f-673a-4fc0-8d48-bcfe3837b033", "1cf98dc2-fcb0-47c9-8aea-654c9284d1ae", "7ed2c9f7-c59d-4c82-a7e2-f859aa676099", "b120b587-a4c2-4b94-875d-99c9807d6955", "7c3b43d8-d794-47d2-800a-d277715aa460", "9a7a0393-2144-4626-9bf1-7c2f5a7321db", "2316929c-01aa-438c-970f-099145ab1ee6", "6d8a7cf1-8085-423b-b87d-7e880faabbdf", "2c95fa8a-8b8d-4787-afce-7117ceb8e3da", "95361ce5-c891-4b0a-87ca-e24607884a96", "1bc2e6c5-0885-472b-bed6-be5ea8eace55", "acf61bd8-d814-4272-81f0-a7a269aa69aa", "ddf36b67-e872-4507-ab2e-46bda21b842c", "bf241472-f014-4f01-a869-96f99330ca8c", "e0cfaecd-602d-41af-988d-f6ccebb2af26", "69483748-1525-4a6c-95ca-90dc8d431b68", "508a9374-ad52-4789-b568-fc358def2c65", "b9d9b652-d8ed-4697-89a2-a1186ee680ac", "f1408a58-0e94-4165-b80a-da9f96cf6fc3", "13db8d2e-7723-4c2c-93c1-a4d36994f7ef", "be2e3a5c-9cc7-4d02-842a-68e9cb26ec49", "84bae5d4-b518-4ae0-b331-6d4afd34d00f", "652c098d-dc11-4ba6-8566-c20e89042f2b", "0877ed01-da46-4c49-8476-d49cdd80dfa7", "234dc5df-40b5-49d1-bf53-0d44ce778eca", "10227522-8429-47e6-a301-f2b2d014e7ad", "719c22d7-c11a-4f2c-93a6-2cfdd5412f68", "a753a6af-3126-426d-8bd0-26ebbcb92254", "0ed75b9c-c73b-424d-9e7d-496cd565fbe0", "51719bf5-e4fd-4e44-8ba8-b830e7ac0731", "85de3a19-b675-4a51-bfc6-b11a5186c971", "7794fa3c-edea-4cff-bec7-267dd4770fd7", "4809c683-059b-4935-879d-36835986f8cf", "6ff08e55-ea53-4f27-94a1-eff92e6d9d5c", "53821412-17b0-4147-ade0-14faae67d54b", "6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4", "40b1fbe2-18ea-4ee7-be47-0294285811de", "b22a5b36-2431-493a-8be1-0bae56c28ef3", "ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e", "f5141b6d-9f42-41c6-a7bf-2a780678b29b", "89bb1f97-c7b9-40e8-b52b-7d6afbd67276", "adc9bcc4-c39c-4f6b-a711-1884017bf043", "60f1ce20-484e-41bd-85f4-ac4afec2c541", "0250638a-2b28-4541-86fc-ea4c558fa0c6", "09a910bf-f71f-4737-9c40-88880ba5913d", "821bcf4d-46c7-4b87-bc57-9509d3ba7c11", "9acf45ed-3a26-4062-bf08-56857613eb52", "ff39f1a6-84ac-476f-a1af-37fcdf53d7c0", "3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe", "88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0", "3603f18a-ec15-43a1-9af2-d196c8a7fec6", "f459ccb4-9805-41ea-b5b2-55e279e2424a", "452df256-da78-427a-866f-49fa04417d74", "7f2bb9d5-6395-4de5-969c-70c11fbe6b12", "53b1b378-9b06-4992-b972-dde6e423d2b4", "f68c4a4f-19ef-4817-952c-50dce331f4b0", "b6e2a2e3-2d30-43b1-a4ea-071e36595690", "d7329412-13bd-44ba-a072-3387f804a106", "47e0852a-cf81-4494-a8e6-31864f8c86ed", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "295a59c1-7b79-4b47-a930-df12c15fc9c2", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "5aad0995-46ab-41bd-a9ff-724f41114971", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "4d431012-2ab5-4db7-a84e-b29809da2172", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "b3503044-60ce-4bf4-bbcb-e3db98788823", "a6b33c02-8305-488f-8585-03cb2a7763f2", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "f663a6d9-9d1b-49b8-b2b1-0637914d199a", "55e29995-75e7-451a-bef0-6225e2f13597", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "b6d235fc-1d38-4b12-adbe-325f06728f37", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "6ea3bf32-9680-422d-9f50-e90716b12a66", "baca5663-583c-45f9-b5dc-ea96a22ce542", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "62120148-6b7a-42be-8b91-271c04e281a3", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "277efb8f-60be-4f10-b4d3-037802f37167", "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "41d1058a-aea7-4952-9293-29eaaf516465", "96f697b0-b499-4e5d-9908-a67bec11cdb6", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "acd74772-5f88-45c7-956b-6a7b36c294d2", "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "92772523-d9c1-4c93-9547-b0ca500baba3", "790317c0-0a36-4a6a-a105-6e576bf99a14", "707e097c-e20f-4f67-8807-1f72ff4500d6", "396ae3eb-4174-4b9b-880e-dc0364d78a19", "e61e8a88-59a9-451c-874e-70fcc9740d67", "48437c39-9e5f-47fb-af95-3d663c3f2919", "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "509e84b9-a71a-40e0-834f-05470369bd1e", "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "7d9263bd-dc47-4a58-bc92-5474abab390c", "c5f6a85d-b647-40f7-bbad-c10b66bab038", "8ffc5407-52e3-478f-9596-0a7371eafe13", "bf344fea-d947-4ef4-9192-34d008315d3a", "5a93eb65-dffa-4543-b761-94aa60098fb6", "7c81fec3-1c1d-43b0-996a-46753041b1b6", "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "e3fdf743-f05b-4051-990a-b66919be1743", "6b6976a3-b0e6-4723-ac24-ae38a737af41", "f7997770-92c3-4ec9-b112-774c4ef96f96", "966315ef-c5e1-4767-ba25-fce9c8de3660", "e7b18879-676e-4a0e-ae18-27039185a8e7", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "8023f872-3f1d-4301-a384-801889917ab4", "44a22d59-b175-4f13-8c16-cbaef5b581ff", "fe20dda1-6f37-4379-bbe0-a98d400cae90", "b7916c2a-fa2f-4795-9477-32b731f70f11", "0cf2e1c6-8d10-4273-8059-738778f981ad", "b86852fb-4c77-48f9-8519-eb1b2c308b59", "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "dc5c24af-6995-49b2-86eb-a9ff62199e82", "92b0b372-a939-44ed-a11b-5136cf680e27", "1c3121ed-041b-4d97-a075-07f54f20fb4a", "cd277474-5c52-4423-a52b-ac2d7969902f", "9df5f547-c86a-433e-b533-f2794357e242", "46490193-1b22-4c29-bdd6-5bf63907216f", "fa277e82-9b78-42dd-b05c-05555c7b6015", "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "91239011-fe3c-4b54-9f24-15c86bb65913", "2f78da12-f7c7-430b-8b19-a28f269b77a3", "18f2065c-d36c-464a-a748-bcf909acb2e3", "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "7f2954d2-99c2-4d42-a065-ca36740f187b", "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "83314318-052a-4c90-a1ad-660ece38d276", "07743f65-7ec9-404a-a519-913db7118a8d", "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "555155a2-03bf-4fe7-af74-d176b3fdbe16", "df4dc653-1029-47ba-8231-3c44238cc0ae", "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "1547e27c-3974-43e2-a7d7-7f484fb928ec", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "fad91067-08c5-4d1a-8d8c-d96a21b37814", "a982fc9c-6333-4ffb-a51d-addb04e8b529", "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "90f342e1-1aaa-4e43-b092-39fda57ed11e", "02ee49e2-e294-4d0f-9278-f5b3212fc588", "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "0eb46774-f1ab-4a74-8238-1155855f2263", "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "c90362e0-2df3-4e61-94fe-b37615814cb1", "974515da-6cc5-4c95-ae65-f97f9150ec7f", "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "c420410f-c2d8-4010-856b-dffe21866437", "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "f37b4bce-49d0-4087-9f5b-58bffda77316", "9827ae57-3802-418f-994b-d5ecf5cd974b", "93d298a1-d28f-47f1-a468-d971e7796679", "46dd5308-4572-4d12-aa43-8938f0184d4f", "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "f742bde7-9528-42e5-bd82-84f51a8387d2", "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "8d85cf08-bf97-4260-ba49-986a2a65129c", "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "2ff692c2-4594-41ec-8fcb-46587de769e0", "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "b23818c7-e575-4d13-8012-332075ec0a2b", "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "160d2780-31f7-4922-8b3a-efce30e63e96", "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "ab567429-1dfb-4674-b6d2-979fd2f9d125", "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "cbf93e5d-ca6c-4722-8bea-e9119007c248", "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "275641a5-a492-45e2-a817-7c81e9d9d3e9", "961e33d1-4f86-4fcf-80ab-930a708b2f82", "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "ad89044a-8f49-4673-9a55-cbd88a1b374f", "086ae989-9ca6-4fe7-895a-759c5544f247", "5de03871-5d46-4539-a82d-3aa992a69a83", "28036918-04d3-423d-91c0-55ecf99fb892", "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "046218bd-e0d8-4113-a3c3-895a12b2b298", "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "a80f662f-022f-4429-9b8c-b1a41aaa6688", "612e47e9-8a59-43a6-b404-f48683f45bd6", "833ef470-fa01-4631-a79b-6f291c9ac498", "9d8f9bb8-01af-4e15-a3a2-349071530530", "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "5df86130-4e95-4a54-90f7-26541b40aec2", "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "f10ed525-97fe-4fed-be7c-2feecca941b1", "5f9db380-ea57-4d1e-beab-8a2d33397e93", "487bb375-12ef-41f6-baae-c6a1572b4dd1", "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "8218c875-90b9-42e2-b60d-0b0069816d10", "53330955-dc52-487f-a3a2-da24dcff99b5", "f2485272-a156-4773-82d7-1d178bc4905b", "724ea201-6514-4f38-9739-e5973c34f49a", "6c304b02-06e6-402d-8be4-d5833cdf8198", "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "4916a35e-bfc4-47d0-8e25-a003d7067061", "73a883d0-0348-4be4-a8d8-51031c2564f8", "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "d223b46b-5621-4037-88fe-fda32eead684", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "480421f9-417f-4d3b-9552-fd2728443ec8", "60936b49-fca0-4f32-993d-7415edcf9a5d", "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "6597be7b-ac61-4ac8-bef4-d3ec88174853", "5b872a46-3b90-45c1-8419-f675db8053aa", "092af964-4233-4373-b4ba-d86ea2890288", "b64a026b-8deb-4c1d-92fd-98893209dff1", "a7df0e9e-91a5-459a-a003-4cde67c2ff5d", "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "34aa0252-6039-40ff-951f-939fd6ce47d8", "63647769-326d-4dde-a419-b925cc0caf42", "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "9d15044a-7cfe-4d23-8085-6ebc11df7685", "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "976dd1f2-a484-45ec-aa1d-0e87e882262b", "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "439957a7-ad86-4a8f-9705-a28131c6821b", "5a5152f1-463f-436b-b2f5-8eceb3964b42", "e0813366-0407-449a-9869-a2db1119dc41", "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "bf9e1387-b040-4393-9851-1598f8ecfae9", "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "9c226817-8dc9-46c2-a58d-66655aafd7dc", "7021255e-5db3-4946-a8b9-0ba7a4644a69", "36803969-5421-41ec-b92f-8500f79c23b0", "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "42205c73-75c8-4a63-9db1-e3782e06fda0", "41f6531d-af6e-4c6e-918f-b946f2b85a36", "e2482f8d-3443-4237-b906-cc145d87a076", "8b9606c9-28be-4a38-b146-0e313cc232c1", "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "4f281b83-0200-4b34-bf35-d24687ea57c2", "243380fa-11eb-4141-af92-e14925e77c1b", "baecf8fb-edbf-429f-9ade-31fc3f22b970", "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "0d7ceeef-3539-4392-8953-3dc664912714", "fc014922-5def-4da9-a0fc-28c973f41bfb", "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7", "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "9ace0707-b560-49b8-b6ca-5148b42f39fb", "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "9b0f8a61-91b2-464f-aceb-0527e0a45020", "1d218616-71b0-4c40-855b-9dbe75510f7f", "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "25ffa65d-76d8-4da5-a832-3f2b0136e133", "f50f3c09-557d-492d-81db-9064a8d4e211", "ec8c4047-fad9-416a-8c81-0f479353d7f6", "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "d13c43f0-f66b-4279-8b2c-5912077c1780", "d2451be2-b582-4e15-8701-4196ac180260", "f40017b3-cb2e-4335-ab5d-3babf679c1de", "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "f354eba5-623b-450f-b073-0b5b2773b6aa", "6414b5cd-b19d-447e-bb5e-9f03940b5784", "ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94", "bdc64095-d59a-42a2-8588-71fd9c9d9abc", "1fbc0671-5596-4e17-8682-f020a0b995dc", "552b6b65-df37-4d3e-a258-f2fc4771ae54", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "333cdbe8-27bb-4246-bf82-b41a0dca4b70", "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "4c21b805-4dd7-469f-b47d-7383a8fcb437", "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "4508a70e-97ef-4300-b62b-ff27992990ea", "857c8db3-c89b-42fb-882b-f681c7cf4da2", "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "3669afd2-9891-4534-a626-e5cf03810a61", "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "7417e29e-c2e7-4cf6-a2e8-767228c64837", "72ca7c75-bf85-45cd-aca7-255d360e423c", "060d5ad4-3153-47bb-8382-43e5e29eda92", "0e0bc253-07ed-43f1-816d-e1b220fe8971", "6e78b74f-c762-4800-82ad-f66787f10c8a", "84b0a8f3-680b-4096-a45b-e9a89221727c", "90ae0469-0cee-4509-b67f-e5efcef040f7", "bf9808c4-d24f-44a2-8398-b65227d406b6", "caa02837-f659-466f-bca6-48bde2826ab4", "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "4fc0deee-0057-4998-ab31-d24e46e0aba4", "e2e01011-5910-4267-9c3b-4149ed5479cf", "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "d2605a99-2218-4894-8fd3-2afb7946514d", "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "a2a3b925-7bb0-433b-b508-db9003263cc4", "68654bf0-4412-43d5-bfe8-5eaa393cd939", "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "952ed57c-8f99-453d-aee0-53a49c22f95d", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "75e508f7-932d-4ebc-af77-269237a84ce1", "50f852e6-af22-4c78-9ede-42ef36aa3453", "8cde342c-ba48-4b74-b615-172c330f2e93", "ea5c131b-380d-49f9-aeb3-920694da4d4b", "a2edbce1-95c8-4291-8676-0d45146862b3", "844f8eb2-610b-42c8-89a4-47596e089663", "6360757a-d460-456c-8b13-74cf0e60cceb", "24b6cf51-6122-469e-861a-22974e9c1e5b", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "9ed5959a-c43c-4c59-84e3-d28628429456", "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "b5de0c9a-6f19-43e0-af4e-55ad01f550af", "fef394cd-f44d-4040-9b18-95d92fe278c0", "48bfd177-7cf2-412b-ad77-baf923489e82", "2092cacb-d77b-4f98-ab0d-32b32f99a054", "ff0f2b05-09db-4095-b96d-1b75ca24894a", "49329257-089d-46e6-af37-4afce4290685", "7707a579-e0d8-4886-a853-ce47e4575aaa", "ee6cea48-c5b6-4304-a332-10fc6446f484", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "e76c8240-d68f-4773-8880-5c6f63595aaf", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "af4c4609-5755-42fe-8075-4effb49f5d44", "9ca2bf31-0570-44d8-a543-534c47c33ed7", "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "6ec86d9e-912e-4726-91a2-209359b999b9", "273a8dd8-3742-4302-bcc7-7df5a80fe425", "90217a70-13fc-48e4-b3db-0d836c5824ac", "3735d5ac-d770-4da0-99ff-156b180bc600", "948a0953-f287-4806-bbcb-3b2e396df89f", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "a1d9eec5-33b2-4177-8d24-27fe754d0812", "613c03ba-0779-4a53-8a1f-47f914a4ded3", "f356a9c4-effd-4608-bbf8-408afd5cd006", "a21bcd7e-38ec-49ad-b69a-9ea17e69509e", "df68f791-ad95-447f-a271-640a0dab9cf8", "e043f529-8514-4205-8ab0-7f7d2927b400", "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "065cceea-77ec-4030-9052-fc0affea7110", "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "36e037c4-c228-4866-b6a3-48eb292b9955", "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3", "e3f673b3-65d1-4d80-9146-466f8b63fa99", "270185ff-5f50-4d6d-a27f-24c3b8c9fef8", "5b2bbc47-dead-4ef7-8908-0cf73fcbecbf", "8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0", "06125661-3814-4e03-bfa2-1e4411c60ac3", "0a1f9d29-6465-4776-b091-7f43b26e4c89", "b1decb61-ed83-4339-8e95-53ea51901720", "a55349d8-9588-4c5a-8e3b-1925fe2a4ffe", "63c779ba-f638-40a0-a593-ddd45e8b1ddc", "ff301988-c231-4bd0-834c-ac9d73b86586", "3eb8c339-a765-48cc-a150-4364c04652bf", "3109530e-ab47-4cc6-a953-cac5ebcc93ae", "6ddab845-b1b8-49c2-bbf7-1a11967f64bc", "407aecb1-e762-4acf-8c7b-d087bcff3bb6", "7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2", "65744385-8541-44a6-8630-ffc824d7d4cc", "d51694fe-484a-46ac-92d6-969e76d60d10", "46612ae6-86be-4802-bc07-39b59feb1309", "f41b0311-44f9-44f0-816d-dd45e39d4bc8", "a5a2d357-1ab8-4675-a967-ef9990a59391", "02773bed-83bf-469f-b7ff-e676e7d78bab", "d353dac0-1b41-46c2-820c-d7d2561fc6ed", "caf02a0a-1e1c-4552-9b48-5e070bd88d11", "68578b43-65df-4f81-9a9b-92f32711a951", "13c02350-4177-4e45-ac17-cf7ca628ff5e", "b8fd0e93-ff58-4cbd-8f48-1c114e342e62", "39f1f9f2-9636-45de-98f6-a4046aa8e4b9", "28a452f3-786c-4fd8-b8f2-bddbe9d616d1", "74babdd6-a758-4549-9632-26535279e654", "fec96f39-988b-4586-b746-b93d59fd1922", "847def9e-924d-4e90-b7c4-5f581395a2b4", "ce7066a6-508a-42d3-995b-2952c65dc2ce", "4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6", "54127bd4-f541-4ac3-afdb-ea073f63f692", "002bdb95-0cf1-46a6-9e08-d38c128a6127", "c7a74c80-ba5a-486e-9974-ab9e682bc5e4", "34746e8c-5fb8-415a-b135-0abc167e912a", "ee63c85c-6d51-4d12-ad09-04e25877a947", "cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca", "1277f594-a7d1-4f28-a2d3-73af5cbeab43", "63e4f530-65dc-49cc-8f80-ccfa95c69d43", "dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c", "2f7979ae-f82b-45af-ac1d-2b10e93b0baa", "059c5af9-5131-4d8d-92b2-de4ad6146712", "7fd164ba-126a-4d9c-9392-0d4f7c243df0", "15904280-565c-4b73-9303-3291f964e7f9", "6902955a-01b7-432c-b32a-6f5f81d8f625", "3ab79e90-9fab-4cdf-a7b2-6522bc742adb", "654fcc6d-840d-4844-9b07-2c3300e54a26", "df6ecb8b-7822-4f4b-b412-08f524b4576c", "cad1fe90-2406-44dc-bd03-59d0b58fe722", "1027d292-dd87-4a1a-8701-2abe04d7783c", "41bb431f-56d8-4691-bb56-ed34e390906f", "de46c52b-0bf8-4936-a327-aace94f94ac6", "576426ad-0131-4001-ae01-be175da0c108", "4e7050dd-e548-483f-b7d6-527ab4fa784d", "3d2a2d59-929c-4b78-8c1a-145dfe9e07b1", "7d604714-e071-49ff-8726-edeb95a70679", "bdd8157d-8e85-4397-bb82-f06cc9c71dbb", "6b269392-9eba-40b5-acb6-55c882b20ba6", "b6f91281-20aa-446a-b986-38a92813a18f", "4aafb0fa-bff5-4b9d-b99e-8093e659c65f", "3da70954-0f2c-4103-adff-b7440368f50e", "e36941d0-c0f0-443f-bc6f-cb2952eb69ea", "6e90ae7a-7cd3-473f-a035-4ebb72d961da", "814ddeca-3d31-4265-8e07-8cc54fb44903", "bd1212e5-78da-431e-95fa-c58e3237a8e6", "9e099d99-44c2-42b6-a6d8-54c3545cab29", "7280c9f3-a5af-45d0-916a-bc01cb4151c9", "75bf09fa-1dd7-4d18-9af9-dd9e492562eb", "8fbf3271-1ef6-4e94-8210-03c2317947f6", "d102b8f5-61dc-4e68-bd83-9a3187c67377", "81315b50-6b60-4d8f-9928-3466e1022515", "2d367498-5112-4ae5-a06a-96e7bc33a211", "8e1cb247-6cf6-42fa-b440-3f27d57e9936", "7047d730-036f-4f40-b9d8-1c63e36d5e62", "2aa0a6b4-a865-495b-ab51-c28249537b75", "65236ec7-ace0-4f0c-82fd-737b04fd4dcb", "e4a74e34-ecde-4aab-b2fb-9112dd01aed0", "614a7e17-5643-4d89-b6fe-f9df1a79641c", "dca1b3e8-e043-4ec8-85d7-867f334b5724", "0b9ad457-2554-44c1-82c2-d56a99c42377", "8c31f563-f9a7-450c-bfa8-35f8f32f1f61", "9b64de98-9db3-4033-bd7a-f51430105f00", "aba15bdd-657f-422a-bab3-ac2d2a0d6f1c", "97aa2e88-555c-450d-85a6-229bcd87efb8", "304afd73-55a5-4bb9-8c21-0b1fc84ea9e4", "69ca12af-119d-44ed-b50f-a47af0ebc364", "b1c50487-1967-4315-a026-6491686d860e", "f0540f7e-2db3-4432-b9e0-3965486744bc", "130c9e58-28ac-4f83-8574-0a4cc913b97e", "92fa78e7-4d39-45f1-91a3-8b23f3f1088d", "33f41cdd-35ac-4ba8-814b-c6a4244a1ad4", "0bcfabcb-7929-47f4-93d6-b33fb67d34d1", "162ab1e4-6874-4564-853c-53ec3ab8be01", "11b1ed55-154d-4e82-8ad7-83739298f720", "c61daa90-3c1e-4f18-af62-8f288b5c9aaf", "fcc6d700-68d9-4241-9a1a-06874d621b06", "f92a6f1e-a512-4a15-9735-da09e78d7273", "7eff1a7f-dd45-4c20-877a-f21e342a7611", "0afecb6e-6223-4a82-99fb-bf5b981e92a5", "f0e2b768-5220-47dd-b891-d57b96fc0ec1", "34986307-b7f4-49be-92f3-e7a4d01ac5db", "9711de76-5d4f-4c50-a94f-21e4e8f8384d", "c3edc6a5-d9d4-48d8-930e-aab518390917", "d5866ddf-ce8f-4aea-b28e-d96485a20d3d", "259e5a6a-b8d2-4c38-86e2-26c5e651361d", "155dbf56-e0a4-4dd0-8905-8a98705045e8", "7fff6773-2baa-46de-a24a-b6eec1aba2d1", "e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f", "0b8baa3f-575c-46ee-8715-d6f28cc7d33c", "2f9356ae-bf43-41b8-b858-4496d83b2acb", "a05baa88-e922-4001-bc4d-8738135f27de", "5b40a734-99b6-4b98-a1d0-1cea51a08ab2", "6e2a900a-ced9-4e4a-a9c2-13e706f9518a", "91174a41-dc8f-401b-be89-7bfc140612a0", "8468111a-ef07-4654-903b-b863a80bbc95", "c048f047-7e2a-4888-b302-55f509d4a91d", "52753ea4-b3a0-4365-910d-36cff487b789", "fccfb43e-09a7-4bd2-8b37-a5a7df33386d", "5f87308a-0a5b-4623-ae15-d8fa1809bc60", "0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b", "a8f866e1-bdd4-425e-a27a-37619238d9c7", "07a99744-56ac-40d2-97b7-2095967b0e03", "3a8da4e0-36c1-40d2-8b29-b3e890d5172a", "0e29e3a7-1ad8-40aa-b691-9f82ecd33d66", "d7b50671-d1ad-4871-aa60-5aa5b331fe04", "409f8a98-4496-4aaa-818a-c931c0a8b832", "a6976974-ea6f-4e97-818e-ea08625c52cb", "3a9fa2ec-30bc-4ebd-b49e-7c9cff225502", "b4926b47-a9d7-434c-b3a0-adc3fa0bd13e", "28208707-fe31-437f-9a7f-4b1108b94d2e", "e15b518d-b4ce-4410-a9cd-501f23ce4a18", "760e75d8-c3b5-409b-a9bf-6130b4c4603f", "e0b06658-7d1d-4cd3-bf15-03467507ff7c", "4e87b8e2-2ee9-4b2a-a715-4727d297ece0", "bb09dd3e-2b78-4819-8e35-a7c1b874e449", "4c7f49ee-2638-43bb-b85b-ce676c30b260", "4358e5a5-7542-4dcb-b9f3-87667371839b", "62ed5b55-f991-406a-85d9-e8e8fdf18789", "e074832a-eada-4fd7-94a1-10642b130e16", "16fe46bb-4f64-46aa-817d-ff7bec4a2352", "8d5aca11-22b3-4f22-b7ba-90e60533e1fb", "3d0ed417-3d94-4963-a562-4a92c940656a", "7892ec59-c5bb-496d-8968-e5d210ca3ac4", "145095eb-e273-443b-83d0-f9b519b7867b", "5d756aee-ad3e-4306-ad95-cb1abec48de2", "48ea844d-19b1-4642-944e-fe39c2cc1fec", "8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9", "1908fcc1-1b92-4272-8214-0fbaf2fa5163", "a10a2c40-2c4d-49f8-b557-1a946bc55d9d", "736ffa74-5f6f-44ca-94ef-1c0df4f51d2a", "bbb7e38c-0b41-4a11-b306-d2a457b7ac2b", "fed85bf9-e075-4280-9159-fbe8a023d6fa", "0e20c89d-2264-44ae-8238-aeeaba609ece", "56e05d41-ce99-4ecd-912d-93f019ee0b71", "b5b78988-486d-4a80-b991-930eff3ff8bf", "805c55d9-31e6-4846-9878-c34c75054fe9", "80e1f67a-4596-4351-98f5-a9c3efabac95", "e3845023-ca9a-4024-b2b2-5422156d5527", "e8a52bbd-bced-459f-bd93-64db45ce7657", "fc4f4817-0c53-4683-a4ee-b17a64bc1039", "f748c45a-f8d3-4e6f-b617-fe176f695b8f", "6ea858a8-ba71-4a12-b2cc-5d83312404c7", "93a19907-d4f9-4deb-9f91-aac4692776a6", "3215aa19-f060-4332-86d5-5602511f3ca8", "117d3d3a-755c-4a61-b23e-9171146d094c", "93d94efc-d7ad-4161-ad7d-1638c4f908d8", "318557a5-150c-4c8d-b70e-a9910e199857", "c3e76af5-4ce0-4a14-9c9a-25ceb8fda182", "f331aa1f-8c53-4fc3-b083-cc159bc971cb", "602a1f13-c640-4d73-b053-be9a2fa58b96", "9f2cc74d-78af-4eb2-bb64-9cd1d292b87b", "c3dbbc9f-ef1d-470a-a90a-d343448d5875", "edf3485d-dac4-4d50-90e4-b0e5813f7e60", "1d08ac94-400d-4469-a82f-daee9a908849", "7e9cf7b6-e827-11ed-a05b-15959c120003", "fa5b1358-b040-4403-9868-15f7d9ab6329", "c649a6c7-cd8c-4a78-9c04-000fc76df954", "e81528db-fc02-45e8-8e98-4e84aba1f10b", "7e9cf7b6-e827-11ed-a05b-0242ac120003", "a66bc059-c370-472c-a0d7-f8fd1bf9d583", "67add051-9ee7-4ad3-93ba-42935615ae8d", "295c9289-acee-4503-a571-8eacaef36b28", "72cd00d6-490c-4650-86ff-1d11f491daa1", "05296024-fe8a-4baf-8f3d-9a5f5624ceb2", "1a42dfa6-6cb2-4df9-9b48-295be477e835", "10cb6535-b31d-4512-9962-513dcbc42cc1", "7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8", "679085d5-f427-4484-9f58-1dc30a7c426d", "2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75", "39b64854-5497-4b57-a448-40977b8c9679", "a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f", "77564cc2-7382-438b-a7f6-395c2ae53b9a", "f239b326-2f41-4d6b-9dfa-c846a60ef505", "caa06de8-fdef-4c91-826a-7f9e163eef4b", "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "2158f96f-43c2-43cb-952a-ab4580f32382", "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "d797268e-28a9-49a7-b9a8-2f5039011c5c", "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "f426547a-e0f7-441a-b63e-854ac5bdf54d", "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "6d3a3952-6530-44a3-8554-cf17c116c615", "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "4c0aaedc-154c-4427-ada0-d80ef9c9deb6", "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "a4824fca-976f-4964-b334-0621379e84c4", "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "92a974db-ab84-457f-9ec0-55db83d7a825", "f9578658-9e71-4711-b634-3f9b50cd3c06", "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "f5240972-3938-4e56-8e4b-e33893176c1f", "fff9d2b7-e11c-4a69-93d3-40ef66189767", "cc9d3712-6310-4320-b2df-7cb408274d53", "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "327ff235-94eb-4f06-b9de-aaee571324be", "42a993dd-bb3e-48c8-b372-4d6684c4106c", "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "36210e0d-5b19-485d-a087-c096088885f0", "1723e720-616d-4ddc-ab02-f7e3685a4713", "90fb5e62-ca1f-4e22-b42e-cc521874c938", "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "57c4bf16-227f-4394-8ec7-1b745ee061c3", "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "0ea52357-cd59-4340-9981-c46c7e900428", "7aa7009a-28b9-4344-8c1f-159489a390df", "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "9719a8aa-401c-41af-8108-ced7ec9cd75c", "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "587254ee-a24b-4335-b3cd-065c0f1f4baa", "98b53e78-ebaf-46f8-be06-421aafd176d9", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "b5746143-59d6-4603-8d06-acbd60e166ee", "c09dad97-1c78-4f71-b127-7edb2b8e491a", "551d9c1f-816c-445b-a7a6-7a3864720d60", "e31033fc-33f0-4020-9a16-faf9b31cbf08", "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "8e3c7994-131e-4ba5-b6ea-804d49113a26", "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "e32d4572-9826-4738-b651-95fa63747e8a", "043c4b8b-3a54-4780-9682-081cb6b8185c", "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "c363385c-f75d-4753-a108-c1a8e28bdbda", "5cb299fc-5fb1-4d07-b989-0644c68b6043", "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "811f459f-9231-45d4-959a-0266c6311987", "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "7d6d30b8-5b91-4b90-a891-46cccaf29598", "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "087790e3-3287-436c-bccf-cbd0184a7db1", "6812a10b-60ea-420c-832f-dfcc33b646ba", "84b14121-9d14-416e-800b-f3b829c5a14d", "32e280f1-8ad4-46ef-9e80-910657611fbc", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "9cfc00b6-bfb7-49ce-9781-ef78503154bb", "3f5491e2-8db8-496b-9e95-1029fce852d4", "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "02030f2f-6199-49ec-b258-ea71b07e03dc", "74403157-20f5-415d-89a7-c505779585cf", "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "4d7cda18-1b12-4e52-b45c-d28653210df8", "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "c9783e20-4793-4164-ba96-d9ee483992c4", "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "94771a71-ba41-4b6e-a757-b531372eaab6", "2f869d59-7f6a-4931-992c-cce556ff2d53", "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "1775e15e-b61b-4d14-a1a3-80981298085a", "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "42b1a5b8-353f-4f10-b256-39de4467faff", "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "9292293b-8496-4715-9db6-37028dcda4b3", "52788a70-f1da-40dd-8fbd-73b5865d6568", "349d891d-fef0-4fe4-bc53-eee623a15969", "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "6f3e2987-db24-4c78-a860-b4f4095a7095", "1ec65a5f-9473-4f12-97da-622044d6df21", "d042284c-a296-4988-9be5-f424fadcc28c", "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "1327381e-6ab0-4f38-b583-4c1b8346a56b", "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "9ec9fb1b-e059-4489-9642-f270c207923d", "058f4380-962d-40a5-afce-50207d36d7e2", "fe63010f-8823-4864-a96b-a7b4a0f7b929", "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "c86133ad-4725-4bd0-8170-210788e0a7ba", "f5d19838-41b5-476c-98d8-ba8af4929ee2", "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "82880171-b475-4201-b811-e9c826cd5eaa", "023c654f-8f16-44d9-bb2b-00ff36a62af9", "d557dc06-62e8-4468-a8e8-7984124908ce", "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "a642964e-bead-4bed-8910-1bb4d63e3b4d", "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "e4a6b256-3e47-40fc-89d2-7a477edd6915", "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "9fff585c-c33e-4a86-b3cd-39312079a65f", "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "fa00b701-44c6-4679-994d-5a18afa8a707", "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "313d6012-51a0-4d93-8dfc-de8553239e25", "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "8d63dadf-b91b-4187-87b6-34a1114577ea", "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "b36d01a3-ddaf-4804-be18-18a6247adfcd", "aaf46cdc-934e-4284-b329-34aa701e3771", "575dce0c-8139-4e30-9295-1ee75969f7fe", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "a1473adb-5338-4a20-b4c3-126763e2d3d3", "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "241e802a-b65e-484f-88cd-c2dc10f9206d", "fd877b94-9bb5-4191-bb25-d79cbd93c167", "d047726b-c71c-4048-a99b-2e2f50dc107d", "40b95d31-1afc-469e-8d34-9a3a667d058e", "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "e6c54d94-498c-4562-a37c-b469d8e9a275", "64760eef-87f7-4ed3-93fd-655668ea9420", "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "da2738f2-fadb-4394-afa7-0a0674885afa", "88872991-7445-4a22-90b2-a3adadb0e827", "f576a613-2392-4067-9d1a-9345fb58d8d1", "431a1fdb-4799-4f3b-91c3-a683b003fc49", "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "4931188c-178e-4ee7-a348-39e8a7a56821", "85ff530b-261d-48c6-a441-facaa2e81e48", "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "8cbc9475-8d05-4e27-9c32-df960716c701", "378a05d8-963c-46c9-bcce-13c7657eac99", "e8d34729-86a4-4140-adfd-0a29c2106307", "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "e568650b-5dcd-4658-8f34-ded0b1e13992", "f208d6d8-d83a-4c2c-960d-877c37da84e5", "514e4c3a-c77d-4cde-a00f-046425e2301e", "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "01aeb693-138d-49d2-9403-c4f52d7d3d62", "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "83865853-59aa-449e-9600-74b9d89a6d6e", "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "b53317a0-8acf-4fd1-8de8-a5401e776b96", "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "10344bb3-7f65-46c2-b915-2d00d47be5b0", "185d7418-f250-42d0-b72e-0c8b70661e93", "379fa130-190e-4c3f-b7bc-6c8e834485f3", "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "e83e8899-c9b2-483b-b355-5decc942b959", "6385697e-9f1b-40bd-8817-f4a91f40508e", "24357373-078f-44ed-9ac4-6d334a668a11", "15619216-e993-4721-b590-4c520615a67d", "d2eb17db-1d39-41dc-b57f-301f6512fa75", "5a6e1e16-07de-48d8-8aae-faa766c05e88", "5a3164f2-b373-4152-93cf-090b13c12d27", "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "cbec226f-63d9-4eca-9f52-dfb6652f24df", "5b768e71-86f2-4879-b448-81061cbae951", "ca621ba5-54ab-4035-9942-d378e6fcde3c", "98767d61-b2e8-4d71-b661-e36783ee24c1", "a85ffc3a-e8fd-4040-93bf-78aff284d801", "88f46b67-14d4-4f45-ac2c-d66984f22191", "83809e84-4475-4b69-bc3e-4aad8568612f", "ce72ef99-22f1-43d4-8695-419dcb5d9330", "add64136-62e5-48ea-807e-88638d02df1e", "04936b66-3915-43ad-a8e5-809eadfd1141", "847d5ff3-8a31-4737-a970-aeae8fe21765", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "c49c5062-0966-4170-9efd-9968c913a6cf", "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "850d55f9-6eeb-4492-ad69-a72338f65ba4", "d87bd452-6da1-456e-8155-7dc988157b7d", "5bb68627-3198-40ca-b458-49f973db8752", "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "caf201a9-c2ce-4a26-9c3a-2b9525413711", "4e762605-34a8-406d-b72e-c1a089313320", "d3c3861d-c504-4c77-ba55-224ba82d0118", "2ddef153-167b-4e89-86b6-757a9e65dcac", "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "8a582fe2-0882-4b89-a82a-da6b2dc32937", "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "f35c5d71-b489-4e22-a115-f003df287317", "fbd7c32d-db2a-4418-b92c-566eb8911133", "87a476dc-0079-4583-a985-dee7a20a03de", "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "38879043-7e1e-47a9-8d46-6bec88e201df", "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "f9999590-1f94-4a34-a91e-951e47bedefd", "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "4eddc365-79b4-43ff-a9d7-99422dc34b93", "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "220457c1-1c9f-4c2e-afe6-9598926222c1", "bf361876-6620-407a-812f-bfe11e51e924", "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "c79da740-5030-45ec-a2e0-479e824a562c", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "a197e378-d31b-41c0-9635-cfdf1c1bb423", "737e618a-a410-49b5-bec3-9e55ff7fbc15", "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "30edb182-aa75-42c0-b0a9-e998bb29067c", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "eb1c4225-1c23-4241-8dd4-051389fde4ce", "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "e312efd0-35a1-407f-8439-b8d434b438a6", "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "ba42babc-0666-4393-a4f7-ceaf5a69191e", "c27515df-97a9-4162-8a60-dc0eeb51b775", "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "0f6da907-5854-4be6-859a-e9958747b0aa", "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "5edc2273-c26f-406c-83f3-f4d948e740dd", "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "0f0450f3-8b47-441e-a31b-15a91dc243e2", "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "817f252c-5143-4dae-b418-48c3e9f63728", "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "07e3cb2c-0608-410d-be4b-1511cb1a0448", "138d3531-8793-4f50-a2cd-f291b2863d78", "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "ddeff553-5233-4ae9-bbab-d64d2bd634be", "e212d415-0e93-435f-9e1a-f29005bb4723", "55f0a3a1-846e-40eb-8273-677371b8d912", "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "e7888eb1-13b0-4616-bd99-4bc0c2b054b9", "6ba5a05f-b095-4f0a-8654-b825f4f16334", "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "7cce6fc8-a07f-4d84-a53e-96e1879843c9", "45d3a03d-f441-458c-8883-df101a3bb146", "871b9555-69ca-4993-99d3-35a59f9f3599", "f2c64357-b1d2-41b7-849f-34d2682c0fad", "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "12fbff88-16b5-4b42-9754-cd001a789fb3", "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "0403d67d-6227-4ea8-8145-4e72db7da120", "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "bd1c6866-65fc-44b2-be51-5588fcff82b9", "1114e048-b69c-4f41-bc20-657245ae6e3f", "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "27aec9c9-dbb0-4939-8422-1742242471d0", "727454c0-d851-48b0-8b89-385611ab0704", "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "d20ee2f4-822c-4827-9e15-41500b1fff10", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "efec536f-72e8-4656-8960-5e85d091345b", "6f4191bb-912b-48a8-9ce7-682769541e6d", "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "517490a7-115a-48c6-8862-1a481504d5a8", "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "49d9671b-0a0a-4c09-8280-d215bfd30662", "05f3c945-dcc8-4393-9f3d-af65077a8f86", "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "554601fb-9b71-4bcc-abf4-21a611be4fde", "7b10f171-7f04-47c7-9fa2-5be43c76e535", "45239e6a-b035-4aaf-b339-8ad379fcb67e", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "7be5fb68-f9ef-476d-8b51-0256ebece19e", "6e22722b-dfb1-4508-a911-49ac840b40f8", "9ccba514-7cb6-4c5c-b377-700758f2f120", "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "7a74da6b-ea76-47db-92cc-874ad90df734", "f11f2808-adb4-46c0-802a-8660db50fa99", "43e32da2-fdd0-4156-90de-50dfd62636f9", "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "a20def93-0709-4eae-9bd2-31206e21e6b2", "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "6004abd0-afa4-4557-ba90-49d172e0a299", "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "970823b7-273b-460a-8afc-3a6811998529", "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "15b75071-74cc-47e0-b4c6-b43744a62a2b", "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "f99abdf0-6283-4e71-bd2b-b5c048a94743", "0a13e132-651d-11eb-ae93-0242ac130002", "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "e9f55347-2928-4c06-88e5-1a7f8169942e", "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "6a69f62d-ce75-4b57-8dce-6351eb55b362", "8b0e12da-d3c3-49db-bb4f-256703f380e5", "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "98a96a5a-64a0-4c42-92c5-489da3866cb0", "47e4bab7-c626-47dc-967b-255608c9a920", "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "40b19fa6-d835-400c-b301-41f3a2baacaf", "71158e3f-df67-472b-930e-7d287acaa3e1", "f44800ac-38ec-471f-936e-3fa7d9c53100", "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "24c8392b-aa3c-46b7-a545-43f71657fe98", "88f680b8-070e-402c-ae11-d2914f2257f1", "15434e33-5027-4914-88d5-3d4145ec25a9", "b98d0db6-511d-45de-ad02-e82a98729620", "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "0bbc6369-43e3-453d-9944-cae58821c173", "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "b7966f4a-b333-455b-8370-8ca53c229762", "43fa5350-db63-4b8f-9a01-789a427074e1", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "ec290c06-9b6b-4338-8b6b-095c0f284f10", "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "d4498716-1d52-438f-8084-4a603157d131", "b222df08-0e07-11eb-adc1-0242ac120002", "e1693bc8-7168-4eab-8718-cdcaa68a1738", "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "d3b70aad-097e-409c-9df2-450f80dc476b", "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "312d0384-401c-4b8b-abdf-685ffba9a332", "cc368ed0-2411-45dc-a222-510ace303cb2", "42333b2c-b425-441c-b70e-99404a17170f", "0e4164da-94bc-450d-a7be-a4b176179f1f", "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "ebef4391-1a81-4761-a40a-1db446c0e625", "f26307d8-14cd-47e3-a26b-4b4769f24af6", "03cc0c25-389f-4bf8-b48d-11878079f1ca", "8834e2f7-6b4b-4f09-8906-d2276470ee23", "7090adee-82e2-4269-bd59-80691e7c6338", "c74c0390-3e20-41fd-a69a-128f0275a5ea", "b6457d63-d2a2-4e29-859d-4e7affc153d1", "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "5f6a601c-2ecb-498b-9c33-660362323afa", "aa8e035d-7be4-48d3-a944-102aec04400d", "b243b280-65fe-48df-ba07-6ddea7646427", "236d8e89-ed95-4789-a982-36f4643738ba", "277a4393-446c-449a-b0ed-7fdc7795244c", "4fe074b4-b833-4081-8f24-7dcfeca72b42", "68bcd73b-37ef-49cb-95fc-edc809730be6", "86588b36-c6d3-465f-9cee-8f9093e07798", "502b42de-4306-40b4-9596-6f590c81f073", "0a99eb3e-1617-41bd-b095-13dc767f3def", "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "07f8bdc2-c9b3-472a-9817-5a670b872f53", "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "28ac00d6-22d9-4a3c-927f-bbd770104573", "452bce90-6fb0-43cc-97a5-affc283139b3", "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "ce7cf472-6fcc-490a-9481-3786840b5d9b", "c6fb44c6-71f5-49e6-9462-1425d328aee3", "9c0295ce-d60d-40bd-bd74-84673b7592b1", "0a4f6091-223b-41f6-8743-f322ec84930b", "98c5aeef-32d5-492f-b174-64a691896d25", "6fe4aa1e-0531-4510-8be2-782154b73b48", "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "d78b5d61-187d-44b6-bf02-93486a80de5a", "e9b61244-893f-427c-b287-3e708f321c6b", "70bc5215-526f-4477-963c-a47a5c9ebd12", "b6e04788-29e1-4557-bb14-77f761848ab8", "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "0685b176-c816-4837-8e7b-1216f346636b", "e84d89c4-f544-41ca-a6af-4b92fd38b023", "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "023394c4-29d5-46ab-92b8-6a534c6f447b", "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "ebea773c-a8f1-42ad-a856-00cb221966e8", "0b7163dc-7eee-4960-af17-c0cd517f92da", "98dedfdd-8333-49d4-9f23-d7018cccae53", "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "f24bcaea-0cd1-11eb-adc1-0242ac120002", "ccb5742c-c248-4982-8c5c-5571b9275ad3", "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "4abc0ec4-db5a-412f-9632-26659cddf145", "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "5cddf373-ef00-4112-ad72-960ac29bac34", "37db85d1-b089-490a-a59a-c7b6f984f480", "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "f1edd233-30b5-4823-9e6a-c4171b24d316", "e92a4287-e072-4a40-9739-370c106bb750", "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "8bc64091-6875-4881-aaf9-7bd25b5dda08", "56c217c3-2de2-479b-990f-5c109ba8458f", "eee00933-a761-4cd0-be70-c42fe91731e7", "bab049ca-7471-4828-9024-38279a4c04da", "c3a99af4-35a9-4668-879e-c09aeb4f2bdf", "d7654f02-e04b-4934-9838-65c46f187ebc", "2a072a96-a086-49fa-bcb5-15cc5a619093", "883faa95-175a-4e22-8181-e5761aeb373c", "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "63d1ccc0-2a43-4f4b-9289-361b308991ff", "4f154fb6-27d1-4813-a759-78b93e0b9c48", "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "33be4333-2c6b-44f4-ae28-102cdbde0a31", "395907ee-96e5-4666-af2e-2ca91688e151", "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "b0ce780f-10bd-496d-9067-066d23dc3aa5", "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "79b06761-465f-4f88-9ef2-150e24d3d737", "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "c615d676-f655-46b9-b913-78729021e5d7", "b19146a3-25d4-41b4-928b-1e2a92641b1b", "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "e6474a1b-5390-49cd-ab41-8d88655f7394", "692f0bec-83ba-4d04-af7e-e884a96059b6", "93671f99-04eb-4ab4-a161-70d446a84003", "0d5675be-bc88-4172-86d3-1e96a4476536", "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "4281cb20-2994-4580-aa63-c8b86d019934", "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "a34f79a3-8e5f-4cc3-b765-de00695452c2", "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "5589ab4f-a767-433c-961d-c91f3f704db1", "e8a95b5e-c891-46e2-b33a-93937d3abc31", "c86500e9-a645-4680-98d7-f882c70c1ea3", "58f50261-c53b-4c88-bd12-1d71f12eda4c", "34ebb878-1b15-4895-b352-ca2eeb99b274", "7a02e22e-b885-4404-b38b-1ddc7e65258a", "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "24de4f3b-804c-4165-b442-5a06a2302c7e", "731231b9-0b5d-4219-94dd-abb6959aa7ea", "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "d7bcd677-645d-4691-a8d4-7a5602b780d1", "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "6e897651-f157-4d8f-aaeb-df8151488385", "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "9847f263-4a81-424f-970c-875dab15b79b", "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "4b046706-5789-4673-b111-66f25fe99534", "73bba97f-a82d-42ce-b315-9182e76c57b1", "646bc99f-6682-4b47-a73a-17b1b64c9d34", "6c96fc76-0eb1-11eb-adc1-0242ac120002", "7050bba1-1aed-454e-8f73-3f46f09ce56a", "744a188b-0415-4792-896f-11ddb0588dbc", "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "faa48cae-6b25-4f00-a094-08947fef582f", "70ad0861-d1fe-491c-a45f-fa48148a300d", "a16980c2-0c56-4de0-9a79-17971979efdd", "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "954f0af7-62dd-418f-b3df-a84bc2c7a774", "a7ee1722-c3c5-aeff-3212-c777e4733217", "1dde5376-a648-492e-9e54-4241dd9b0c7f", "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "10c14723-61c7-4c75-92ca-9af245723ad2", "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "41421f44-58f9-455d-838a-c398859841d4", "ae9b0bd7-8888-4606-b444-0ed7410cb728", "8de1cbe8-d6f5-496d-8237-5f44a721c7a0", "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "43103702-5886-11ed-9b6a-0242ac120002", "16905e21-66ee-42fe-b256-1318ada2d770", "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "a7c3d773-caef-227e-a7e7-c2f13c622329", "214641c2-c579-4ecb-8427-0cf19df6842e", "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "07aa184a-870d-413d-893a-157f317f6f58", "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "f548a603-c9f2-4c89-b511-b089f7e94549", "93199800-b52a-4dec-b762-75212c196542", "526be59f-a573-4eea-b5f7-f0973207634d", "6345b048-8441-43a7-9bed-541133633d7a", "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "25676e10-2121-446e-80a4-71ff8506af47", "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "ac1c92b4-ac81-405a-9978-4604d78cc47e", "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "bdeb2cff-af74-4094-8426-724dc937f20a", "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "a383dec4-deec-4e6e-913b-ed9249670848", "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "ac20ae82-8758-4f38-958e-b44a3140ca88", "54786ddc-5b8a-11ed-9b6a-0242ac120002", "41ca393d-538c-408a-ac27-cf1e038be80c", "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "cd71385d-fd9b-4691-9b98-2b1f7e508714", "c8a180d6-47a3-4345-a609-53f9c3d834fc", "044ba588-dff4-4918-9808-3f95e8160606", "1af57a4b-460a-4738-9034-db68b880c665", "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "1dd05363-104e-4b4a-b963-196a534b03a1", "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "84b1ecf9-6eff-4004-bafb-bae5c0e251b2", "204b17ae-4007-471b-917b-b917b315c5db", "50d66fb0-03f8-4da0-8add-84e77d12a020", "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "c2b86e67-b880-4eec-b045-50bc98ef4844", "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "e593cf51-88db-4ee1-b920-37e89012a3c9", "90d6bd71-dffb-4989-8d86-a827fedd6624", "8202070f-edeb-4d31-a010-a26c72ac5600", "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "3268b746-88d8-4cd3-bffc-30077d02c787", "18988e1b-9087-4f8a-82fe-0414dce49878", "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "f53714ec-5077-420e-ad20-907ff9bb2958", "f117933c-980c-4f78-b384-e3d838111165", "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "a29c1813-ab1f-4dde-b489-330b952e91ae", "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "b655a06a-31c0-477a-95c2-3726b83d649d", "21d856f9-9281-4ded-9377-51a1a6e2a432", "b66474aa-bd92-4333-a16c-298155b120df", "b2309017-4235-44fe-b5af-b15363011957", "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "62510e69-616b-4078-b371-847da438cc03", "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "285b85b1-a555-4095-8652-a8a4106af63f", "84f52741-8834-4a8c-a413-2eb2269aa6c8", "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "be344333-921d-4c4d-8bb8-e584cf584780", "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "fb843269-508c-4b76-8b8d-88679db22ce7", "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "de587dce-915e-4218-aac4-835ca6af6f70", "c7942406-33dd-4377-a564-0f62db0593a3", "ab9e3b40-0c85-4ba1-aede-455d226fd124", "ef61af62-bc74-4f58-b49b-626448227652", "a20391f8-76fb-437b-abc0-dba2df1952c6", "899133d5-4d7c-4a7f-94ee-27355c879d90", "1ac8666b-046f-4201-8aba-1951aaec03a3", "1c67a717-32ba-409b-a45d-0fb704a73a81", "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "eca49c87-8a75-4f13-9c73-a5a29e845f03", "435e10e4-992a-4281-96f3-38b11106adde", "b3512211-c67e-4707-bedc-66efc7848863", "c15a46a0-07d4-4c87-b4b6-89207835a83b", "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "1f0f6176-6482-4027-b151-00071af39d7e", "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "9257c05b-4a4a-48e5-a670-b7b073cf401b", "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "99793437-3e16-439b-be0f-078782cf953d", "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "ac175779-025a-4f12-98b0-acdaeb77ea85", "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "90d50722-0483-4065-8e35-57efaadd354d", "180c7c5c-d64b-4a63-86e9-68910451bc8b", "d55b793d-f847-4eea-b59a-5ab09908ac90", "aef9d1f1-7396-4e92-a927-4567c7a495c1", "6c6d9280-e6d0-4b9d-80ac-254701b64916", "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "9212f354-7775-4e28-9c9f-8f0a4544e664", "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "ffa6861c-4461-4f59-8a41-578c39f3f23e", "a0459f02-ac51-4c09-b511-b8c9203fc429", "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "534f2ef7-e8a2-4433-816d-c91bccde289b", "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "84232095-ecca-4015-b0d7-7726507ee793", "4e2ed651-1906-4a59-a78a-18220fca1b22", "96036718-71cc-4027-a538-d1587e0006a7", "60f16a96-db70-42eb-8f76-16763e333590", "5afee48e-67dd-4e03-a783-f74259dcf998", "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "771d1eb5-9587-4568-95fb-9ec44153a012", "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "e28a5a99-da44-436d-b7a0-2afc20a5f413", "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "68d37776-61db-42f5-bf54-27e87072d17e", "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "d2b749ee-4225-417e-b20e-a8d2193cbb84", "1193d960-2369-499f-a158-7b50a31df682", "6b65c28e-11f3-46cb-902a-68f2cafaf474", "242301bc-f92f-4476-8718-78004a6efd9f", "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "52d097e2-063e-4c9c-8fbb-855c8948d135", "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "647c7b9e-d784-4fda-b9a0-45c565a7b729", "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "bb76d96b-821c-47cf-944b-7ce377864492", "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "1816994b-42e1-4fb1-afd2-134d88184f71", "12827a56-61a4-476a-a9cb-f3068f191073", "32b96012-7892-429e-b26c-ac2bf46066ff", "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "f4bbd493-b796-416e-bbf2-121235348529", "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "d06be4b9-8045-428b-a567-740a26d9db25", "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "65c3ca2c-525f-4ced-968e-246a713d164f", "347906f3-e207-4d18-ae5b-a9403d6bcdef", "a29808fd-ef50-49ff-9c7a-59a9b040b404", "e66779cc-383e-4224-a3a4-267eeb585c40", "85c312b7-f44d-4a51-a024-d671c40b49fc", "6da2c9f5-7c53-401b-aacb-92c040ce1215", "6bd75993-9888-4f91-9404-e1e4e4e34b77", "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "ff992eac-6449-4c60-8c1d-91c9722a1d48", "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "208748f7-881d-47ac-a29c-07ea84bf691d", "89ca78fd-b37c-4310-b3d3-81a023f83936", "a2910908-e86f-4687-aeba-76a5f996e652", "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "9c14c9fa-1a63-4a64-8e57-d19280559490", "221b251a-357a-49a9-920a-271802777cc0", "50919691-7302-437f-8e10-1fe088afa145", "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "f14e169e-9978-4c69-acb3-1cff8200bc36", "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "1c8774a0-44d4-4db0-91f8-e792359c70bd", "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "9fc3072c-dc8f-4bf7-b231-18950000fadd", "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "ada4b0c4-758b-46ac-9033-9004613a150d", "584bca0f-3608-4402-80fd-4075ff6072e3", "9a132afa-654e-11eb-ae93-0242ac130002", "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "a70dcb37-3bee-453a-99df-d0c683151be6", "85b0b087-eddf-4a2b-b033-d771fa2b9775", "2267fe65-0681-42ad-9a6d-46553d3f3480", "28c8f68b-098d-45af-8d43-8089f3e35403", "cd8c163e-a19b-402e-bdd5-419ff5859f12", "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "2c28c248-7f50-417a-9186-a85b223010ee", "84972c80-251c-4c3a-9079-4f00aad93938", "434c08ba-8406-4d15-8b24-782cb071a691", "bed2a484-9348-4143-8a8a-b801c979301c", "a0d7e4d2-bede-4141-8896-bc6e237e977c", "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "1c526788-0abe-4713-862f-b520da5e5316", "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "9f107a84-532c-41af-b005-8d12a607639f", "455b9d50-15a1-4b99-853f-8d37655a4c1b", "dee0a7a3-f200-4112-a99b-952196d81e42", "79ce34ca-af29-4d0e-b832-fc1b377020db", "2afafd61-6aae-4df4-baed-139fa1f4c345", "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "f0507c0f-a3a2-40f5-acc6-7f543c334993", "970007b7-ce32-49d0-a4a4-fbef016950bd", "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "f4264e47-f522-4c38-a420-04525d5b880f", "b2ddd389-f676-4ac4-845a-e00781a48e5f", "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "4a6713f6-3331-11ed-a261-0242ac120002", "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "5cc2cda8-f261-4d88-a2de-e9e193c86716", "2d22a514-e024-4428-9dba-41505bd63a5b", "01c42d3c-242d-4655-85b2-34f1739632f7", "77946e79-97f1-45a2-84b4-f37b5c0d8682", "27ba3207-dd30-4812-abbf-5d20c57d474e", "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "1228c958-e64e-4e71-92ad-7d429f4138ba", "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "b1377339-fda6-477a-b455-ac0923f9ec2c", "44143844-0631-49ab-97a0-96387d6b2d7c", "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "85de1f22-d189-44e4-8239-dc276b45379b", "92626ddd-662c-49e3-ac59-f6535f12d189", "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "e56d3073-83ff-4021-90fe-c658e0709e72", "deb9b646-a508-44ee-b7c9-d8965921c6b6", "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "cea2b7ea-792b-405f-95a1-b903ea06458f", "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "730fc21b-eaff-474b-ad23-90fd265d4988", "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "48917adc-a28e-4f5d-b729-11e75da8941f", "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "0900463c-b33b-49a8-be1d-552a3b553dae", "82a6714f-4899-4f16-9c1e-9a333544d4c3", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "1e59c230-6670-45bf-83b0-98903780607e", "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "5687f942-867b-4578-ade7-1e341c46e99a", "258fc8ce-8352-443a-9120-8a11e4857fa5", "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "4ae81040-fc1c-4249-bfa3-938d260214d9", "aa2efee7-34dd-446e-8a37-40790a66efd7", "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "ae215552-081e-44c7-805f-be16f975c8a2", "30bf1789-379d-4fdc-900f-55cd0a90a801", "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "4f7a6757-ff79-46db-9687-66501a02d9ec", "129966c9-de17-4334-a123-8b58172e664d", "696bfb54-227e-4602-ac5b-30d9d2053312", "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "7df1713a-1a5b-4a4b-a071-dc83b144a101", "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "814c95cc-8192-4378-a70a-f1aafd877af1", "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "99c840f2-2012-46fd-9141-c761987550ef", "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "de16d92c-c446-4d53-8938-10aeef41c8b6", "056c7317-9a09-4bd4-9067-d051312752ea", "60fc936d-2eb0-4543-8a13-911c750a1dfc", "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "114de787-4eb2-48cc-abdb-c0b449f93ea4", "207b0396-3689-42d9-8399-4222658efc99", "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "9248c7e1-2bf3-4661-a22c-600a8040b446", "146aace8-9bd6-42ba-be7a-0070d8027b76", "3d7679bd-0c00-440c-97b0-3f204273e6c7", "ea011323-7045-460b-b2d7-0f7442ea6b38", "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "e290b10b-1023-4452-a4a9-eb31a9013b3a", "ca5583e9-8f80-46ac-ab91-7f314d13b984", "cd3d1298-eb3b-476c-ac67-12847de55813", "867356ee-9352-41c9-a8f2-1be690d78216", "67f113fa-e23d-4271-befa-30113b3e08b1", "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "62b20d44-1546-4e61-afce-8e175eb9473c", "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "b6676963-0353-4f88-90f5-36c20d443c6a", "99cf1e02-00fb-4c0d-8375-563f978dfd37", "903076ff-f442-475a-b667-4f246bcc203b", "a77c1610-fc73-4019-8e29-0f51efc04a51", "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "cea72823-df4d-4567-950c-0b579eaf0846", "74a2b202-73e0-4693-9a3a-9d36146d0775", "5fc297ae-25b6-488a-8f25-cc12ac29b744", "12f6b752-042d-483e-bf9c-915a6d06ad75", "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "c1d867fe-8d95-4487-aab4-e53f2d339f90", "e13f668e-7f95-443d-98d2-1816a7648a7b", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "9c8c7000-3065-44a8-a555-79bcba5d9955", "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "ee5e119b-1f75-4b34-add8-3be976961e39", "33339be3-148b-4e16-af56-ad16ec6c7e7b", "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "01d2e2a1-5f09-44f7-9fc1-24faa7479b6d", "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "646ea171-dded-4578-8a4d-65e9822892e3", "84b1706c-932a-44c4-ae28-892b28a25b94", "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "1012f107-b8f1-4271-af30-5aed2de89b39", "074e0ded-6ced-4ebd-8b4d-53f55908119d", "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "af491bca-e752-4b44-9c86-df5680533dbc", "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "f0f7be61-9cf5-43be-9836-99d6ef448a18", "b1f73849-6329-4069-bc8f-78a604bb8b23", "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "0b80ade5-6997-4b1d-99a1-71701778ea61", "81ebd28b-9607-4478-bf06-974ed9d53ed7", "dc4576d4-7467-424f-9eee-fd2b02855fe0", "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "e9142d84-fbe0-401d-ac50-3e519fb00c89", "b4dc61f5-6cce-468e-a608-b48b469feaa2", "e6313acd-208c-44fc-a0ff-db85d572e90e", "f3d39c45-de1a-4486-a687-ab126124f744", "97dbf6e2-e436-44d8-abee-4261b24d3e41", "729ce0ea-5d8f-4769-9762-e35de441586d", "0fc35fc3-efe6-4898-8a37-0b233339524f", "c947b146-0abc-4c87-9c64-b17e9d7274a2", "91a2c315-9ee6-4052-a853-6f6a8238f90d", "9525dc73-0327-438c-8c04-13c0e037e9da", "a4694263-59a8-4608-a3a0-6f8d3a51664c", "f37aba28-a9e6-4045-882c-d5004043b337", "5e95028c-5229-4214-afae-d653d573d0ec", "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "f7375e28-5c14-432f-b8d1-1db26c832df3", "0e0255bf-2548-47b8-9582-c0955c9283f5", "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "d65aee4d-2292-4cea-b832-83accd6cfa43", "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "889719ef-dd62-43df-86c3-768fb08dc7c0", "18ee686c-38a3-4f65-9f44-48a077141f42", "af77cf95-c469-471c-b6a0-946c685c4798", "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "4bf943c6-5146-4273-98dd-e958fd1e3abf", "7f741dcf-fc22-4759-87b4-9ae8376676a2", "8a3038e8-9c9d-46f8-b184-66234a160f6f", "7d4aaec2-08ed-4430-8b96-28420e030e04", "75d0a94e-6252-448d-a7be-d953dff527bb", "327f48c1-a6db-4eb8-875a-f6981f1b0183", "5f03babb-12db-4eec-8c82-7b4cb5580868", "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "cd1f961e-0b96-436b-b7c6-38da4583ec00", "7b4f794b-590a-4ad4-ba18-7964a2832205", "438025f9-5856-4663-83f7-52f878a70a50", "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "213d6a77-3d55-4ce8-ba74-fcfef741974e", "aaafa146-074c-11eb-adc1-0242ac120002", "2433a154-bb3d-42e4-86c3-a26bdac91c45", "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "4f647cfa-b598-4e12-ad69-c68dd16caef8", "16c37b52-b141-42a5-a3ea-bbe098444397", "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "17769c90-230e-488b-a463-e05c08e9d48f", "222129f7-f4dc-4568-b0d2-22440a9639ba", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "e173ad47-4388-4012-ae62-bd13f71c18a8", "48bbc537-b652-4b4e-bd1d-281172df448f", "1edff897-9146-48d2-9066-52e8d8f80a2f", "c248c896-e412-4279-8c15-1c558067b6fa", "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "2cf29f11-e356-4f61-98c0-1bdb9393d6da", "d522eca2-2973-4391-a3e0-ef0374321dae", "62e0298b-e994-4189-bc87-bc699aa62d97", "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "a537cfc3-4297-4789-92b5-345bfd845ad0", "74a12f18-505c-4114-8d0b-8448dd5485c6", "4a2a2c3e-209f-4d01-b513-4155a540b469", "32410e29-5f94-4568-b6a3-d91a8adad863", "f64e5c19-879c-4bae-b471-6d84c8339677", "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "536e2947-3729-478c-9903-745aaffe60d2", "40aa399c-7b02-4715-8e5f-73572b493f33", "883835a7-df45-43e4-bf1d-4268768afda4", "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "b57ba453-b384-4ab9-9f40-1038086b4e53", "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "3bad990e-4848-4a78-9530-b427d854aac0", "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "09576804-7a05-458e-a817-eb718ca91f54", "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "b0524451-19af-4efa-a46f-562a977f792e", "b96b2031-7c17-4473-afe7-a30ce714db29", "37c1333a-a0db-48be-b64b-7393b2386e3b", "81325ce1-be01-4250-944f-b4789644556f", "3abd6094-7027-475f-9630-8ab9be7b9725", "d9047477-0359-48c9-b8c7-792cedcdc9c4", "0a98a10c-685d-4ab0-bddc-b6bdd1d48458", "56d19cb4-6414-4769-9644-1ed35ffbb148", "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "5cdb711b-5740-4fb2-ba88-f7945027afac", "164eda96-11b2-430b-85ff-6a265c15bf32", "a58353df-af43-4753-bad0-cd83ef35eef5", "56321594-9087-49d9-bf10-524fe8479452"], "uberAgent 7.2": ["dfe8b941-4e54-4242-b674-6b613d521962", "23c43900-e732-45a4-8354-63e4a6c187ce", "47d65ac0-c06f-4ba2-a2e3-d263139d0f51", "65d506d3-fcfe-4071-b4b2-bcefe721bbbb", "5d0fdb62-f225-42fb-8402-3dfe64da468a", "b743623c-2776-40e0-87b1-682b975d0ca5", "089dbdf6-b960-4bcc-90e3-ffc3480c20f6", "2d5e7a8b-f484-4a24-945d-7f0efd52eab0", "58800443-f9fc-4d55-ae0c-98a3966dfb97", "5de06a6f-673a-4fc0-8d48-bcfe3837b033", "1cf98dc2-fcb0-47c9-8aea-654c9284d1ae", "7ed2c9f7-c59d-4c82-a7e2-f859aa676099", "b120b587-a4c2-4b94-875d-99c9807d6955", "7c3b43d8-d794-47d2-800a-d277715aa460", "9a7a0393-2144-4626-9bf1-7c2f5a7321db", "2316929c-01aa-438c-970f-099145ab1ee6", "6d8a7cf1-8085-423b-b87d-7e880faabbdf", "2c95fa8a-8b8d-4787-afce-7117ceb8e3da", "95361ce5-c891-4b0a-87ca-e24607884a96", "1bc2e6c5-0885-472b-bed6-be5ea8eace55", "acf61bd8-d814-4272-81f0-a7a269aa69aa", "ddf36b67-e872-4507-ab2e-46bda21b842c", "bf241472-f014-4f01-a869-96f99330ca8c", "e0cfaecd-602d-41af-988d-f6ccebb2af26", "69483748-1525-4a6c-95ca-90dc8d431b68", "508a9374-ad52-4789-b568-fc358def2c65", "b9d9b652-d8ed-4697-89a2-a1186ee680ac", "f1408a58-0e94-4165-b80a-da9f96cf6fc3", "13db8d2e-7723-4c2c-93c1-a4d36994f7ef", "be2e3a5c-9cc7-4d02-842a-68e9cb26ec49", "84bae5d4-b518-4ae0-b331-6d4afd34d00f", "652c098d-dc11-4ba6-8566-c20e89042f2b", "0877ed01-da46-4c49-8476-d49cdd80dfa7", "234dc5df-40b5-49d1-bf53-0d44ce778eca", "10227522-8429-47e6-a301-f2b2d014e7ad", "719c22d7-c11a-4f2c-93a6-2cfdd5412f68", "a753a6af-3126-426d-8bd0-26ebbcb92254", "0ed75b9c-c73b-424d-9e7d-496cd565fbe0", "51719bf5-e4fd-4e44-8ba8-b830e7ac0731", "85de3a19-b675-4a51-bfc6-b11a5186c971", "7794fa3c-edea-4cff-bec7-267dd4770fd7", "4809c683-059b-4935-879d-36835986f8cf", "6ff08e55-ea53-4f27-94a1-eff92e6d9d5c", "53821412-17b0-4147-ade0-14faae67d54b", "6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4", "40b1fbe2-18ea-4ee7-be47-0294285811de", "b22a5b36-2431-493a-8be1-0bae56c28ef3", "ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e", "f5141b6d-9f42-41c6-a7bf-2a780678b29b", "89bb1f97-c7b9-40e8-b52b-7d6afbd67276", "adc9bcc4-c39c-4f6b-a711-1884017bf043", "60f1ce20-484e-41bd-85f4-ac4afec2c541", "0250638a-2b28-4541-86fc-ea4c558fa0c6", "09a910bf-f71f-4737-9c40-88880ba5913d", "821bcf4d-46c7-4b87-bc57-9509d3ba7c11", "9acf45ed-3a26-4062-bf08-56857613eb52", "ff39f1a6-84ac-476f-a1af-37fcdf53d7c0", "3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe", "88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0", "3603f18a-ec15-43a1-9af2-d196c8a7fec6", "f459ccb4-9805-41ea-b5b2-55e279e2424a", "452df256-da78-427a-866f-49fa04417d74", "7f2bb9d5-6395-4de5-969c-70c11fbe6b12", "53b1b378-9b06-4992-b972-dde6e423d2b4", "f68c4a4f-19ef-4817-952c-50dce331f4b0", "b6e2a2e3-2d30-43b1-a4ea-071e36595690", "d7329412-13bd-44ba-a072-3387f804a106", "47e0852a-cf81-4494-a8e6-31864f8c86ed", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "295a59c1-7b79-4b47-a930-df12c15fc9c2", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "5aad0995-46ab-41bd-a9ff-724f41114971", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "4d431012-2ab5-4db7-a84e-b29809da2172", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "b3503044-60ce-4bf4-bbcb-e3db98788823", "a6b33c02-8305-488f-8585-03cb2a7763f2", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "f663a6d9-9d1b-49b8-b2b1-0637914d199a", "55e29995-75e7-451a-bef0-6225e2f13597", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "b6d235fc-1d38-4b12-adbe-325f06728f37", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "6ea3bf32-9680-422d-9f50-e90716b12a66", "baca5663-583c-45f9-b5dc-ea96a22ce542", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "62120148-6b7a-42be-8b91-271c04e281a3", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "277efb8f-60be-4f10-b4d3-037802f37167", "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "41d1058a-aea7-4952-9293-29eaaf516465", "96f697b0-b499-4e5d-9908-a67bec11cdb6", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "acd74772-5f88-45c7-956b-6a7b36c294d2", "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "92772523-d9c1-4c93-9547-b0ca500baba3", "790317c0-0a36-4a6a-a105-6e576bf99a14", "707e097c-e20f-4f67-8807-1f72ff4500d6", "396ae3eb-4174-4b9b-880e-dc0364d78a19", "e61e8a88-59a9-451c-874e-70fcc9740d67", "48437c39-9e5f-47fb-af95-3d663c3f2919", "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "509e84b9-a71a-40e0-834f-05470369bd1e", "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "7d9263bd-dc47-4a58-bc92-5474abab390c", "c5f6a85d-b647-40f7-bbad-c10b66bab038", "8ffc5407-52e3-478f-9596-0a7371eafe13", "bf344fea-d947-4ef4-9192-34d008315d3a", "5a93eb65-dffa-4543-b761-94aa60098fb6", "7c81fec3-1c1d-43b0-996a-46753041b1b6", "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "e3fdf743-f05b-4051-990a-b66919be1743", "6b6976a3-b0e6-4723-ac24-ae38a737af41", "f7997770-92c3-4ec9-b112-774c4ef96f96", "966315ef-c5e1-4767-ba25-fce9c8de3660", "e7b18879-676e-4a0e-ae18-27039185a8e7", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "8023f872-3f1d-4301-a384-801889917ab4", "44a22d59-b175-4f13-8c16-cbaef5b581ff", "fe20dda1-6f37-4379-bbe0-a98d400cae90", "b7916c2a-fa2f-4795-9477-32b731f70f11", "0cf2e1c6-8d10-4273-8059-738778f981ad", "b86852fb-4c77-48f9-8519-eb1b2c308b59", "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "dc5c24af-6995-49b2-86eb-a9ff62199e82", "92b0b372-a939-44ed-a11b-5136cf680e27", "1c3121ed-041b-4d97-a075-07f54f20fb4a", "cd277474-5c52-4423-a52b-ac2d7969902f", "9df5f547-c86a-433e-b533-f2794357e242", "46490193-1b22-4c29-bdd6-5bf63907216f", "fa277e82-9b78-42dd-b05c-05555c7b6015", "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "91239011-fe3c-4b54-9f24-15c86bb65913", "2f78da12-f7c7-430b-8b19-a28f269b77a3", "18f2065c-d36c-464a-a748-bcf909acb2e3", "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "7f2954d2-99c2-4d42-a065-ca36740f187b", "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "83314318-052a-4c90-a1ad-660ece38d276", "07743f65-7ec9-404a-a519-913db7118a8d", "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "555155a2-03bf-4fe7-af74-d176b3fdbe16", "df4dc653-1029-47ba-8231-3c44238cc0ae", "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "1547e27c-3974-43e2-a7d7-7f484fb928ec", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "fad91067-08c5-4d1a-8d8c-d96a21b37814", "a982fc9c-6333-4ffb-a51d-addb04e8b529", "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "90f342e1-1aaa-4e43-b092-39fda57ed11e", "02ee49e2-e294-4d0f-9278-f5b3212fc588", "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "0eb46774-f1ab-4a74-8238-1155855f2263", "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "c90362e0-2df3-4e61-94fe-b37615814cb1", "974515da-6cc5-4c95-ae65-f97f9150ec7f", "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "c420410f-c2d8-4010-856b-dffe21866437", "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "f37b4bce-49d0-4087-9f5b-58bffda77316", "9827ae57-3802-418f-994b-d5ecf5cd974b", "93d298a1-d28f-47f1-a468-d971e7796679", "46dd5308-4572-4d12-aa43-8938f0184d4f", "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "f742bde7-9528-42e5-bd82-84f51a8387d2", "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "8d85cf08-bf97-4260-ba49-986a2a65129c", "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "2ff692c2-4594-41ec-8fcb-46587de769e0", "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "b23818c7-e575-4d13-8012-332075ec0a2b", "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "160d2780-31f7-4922-8b3a-efce30e63e96", "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "ab567429-1dfb-4674-b6d2-979fd2f9d125", "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "cbf93e5d-ca6c-4722-8bea-e9119007c248", "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "275641a5-a492-45e2-a817-7c81e9d9d3e9", "961e33d1-4f86-4fcf-80ab-930a708b2f82", "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "ad89044a-8f49-4673-9a55-cbd88a1b374f", "086ae989-9ca6-4fe7-895a-759c5544f247", "5de03871-5d46-4539-a82d-3aa992a69a83", "28036918-04d3-423d-91c0-55ecf99fb892", "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "046218bd-e0d8-4113-a3c3-895a12b2b298", "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "a80f662f-022f-4429-9b8c-b1a41aaa6688", "612e47e9-8a59-43a6-b404-f48683f45bd6", "833ef470-fa01-4631-a79b-6f291c9ac498", "9d8f9bb8-01af-4e15-a3a2-349071530530", "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "5df86130-4e95-4a54-90f7-26541b40aec2", "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "f10ed525-97fe-4fed-be7c-2feecca941b1", "5f9db380-ea57-4d1e-beab-8a2d33397e93", "487bb375-12ef-41f6-baae-c6a1572b4dd1", "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "8218c875-90b9-42e2-b60d-0b0069816d10", "53330955-dc52-487f-a3a2-da24dcff99b5", "f2485272-a156-4773-82d7-1d178bc4905b", "724ea201-6514-4f38-9739-e5973c34f49a", "6c304b02-06e6-402d-8be4-d5833cdf8198", "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "4916a35e-bfc4-47d0-8e25-a003d7067061", "73a883d0-0348-4be4-a8d8-51031c2564f8", "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "d223b46b-5621-4037-88fe-fda32eead684", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "480421f9-417f-4d3b-9552-fd2728443ec8", "60936b49-fca0-4f32-993d-7415edcf9a5d", "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "6597be7b-ac61-4ac8-bef4-d3ec88174853", "5b872a46-3b90-45c1-8419-f675db8053aa", "092af964-4233-4373-b4ba-d86ea2890288", "b64a026b-8deb-4c1d-92fd-98893209dff1", "a7df0e9e-91a5-459a-a003-4cde67c2ff5d", "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "34aa0252-6039-40ff-951f-939fd6ce47d8", "63647769-326d-4dde-a419-b925cc0caf42", "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "9d15044a-7cfe-4d23-8085-6ebc11df7685", "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "976dd1f2-a484-45ec-aa1d-0e87e882262b", "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "439957a7-ad86-4a8f-9705-a28131c6821b", "5a5152f1-463f-436b-b2f5-8eceb3964b42", "e0813366-0407-449a-9869-a2db1119dc41", "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "bf9e1387-b040-4393-9851-1598f8ecfae9", "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "9c226817-8dc9-46c2-a58d-66655aafd7dc", "7021255e-5db3-4946-a8b9-0ba7a4644a69", "36803969-5421-41ec-b92f-8500f79c23b0", "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "42205c73-75c8-4a63-9db1-e3782e06fda0", "41f6531d-af6e-4c6e-918f-b946f2b85a36", "e2482f8d-3443-4237-b906-cc145d87a076", "8b9606c9-28be-4a38-b146-0e313cc232c1", "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "4f281b83-0200-4b34-bf35-d24687ea57c2", "243380fa-11eb-4141-af92-e14925e77c1b", "baecf8fb-edbf-429f-9ade-31fc3f22b970", "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "0d7ceeef-3539-4392-8953-3dc664912714", "fc014922-5def-4da9-a0fc-28c973f41bfb", "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7", "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "9ace0707-b560-49b8-b6ca-5148b42f39fb", "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "9b0f8a61-91b2-464f-aceb-0527e0a45020", "1d218616-71b0-4c40-855b-9dbe75510f7f", "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "25ffa65d-76d8-4da5-a832-3f2b0136e133", "f50f3c09-557d-492d-81db-9064a8d4e211", "ec8c4047-fad9-416a-8c81-0f479353d7f6", "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "d13c43f0-f66b-4279-8b2c-5912077c1780", "d2451be2-b582-4e15-8701-4196ac180260", "f40017b3-cb2e-4335-ab5d-3babf679c1de", "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "f354eba5-623b-450f-b073-0b5b2773b6aa", "6414b5cd-b19d-447e-bb5e-9f03940b5784", "ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94", "bdc64095-d59a-42a2-8588-71fd9c9d9abc", "1fbc0671-5596-4e17-8682-f020a0b995dc", "552b6b65-df37-4d3e-a258-f2fc4771ae54", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "333cdbe8-27bb-4246-bf82-b41a0dca4b70", "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "4c21b805-4dd7-469f-b47d-7383a8fcb437", "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "4508a70e-97ef-4300-b62b-ff27992990ea", "857c8db3-c89b-42fb-882b-f681c7cf4da2", "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "3669afd2-9891-4534-a626-e5cf03810a61", "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "7417e29e-c2e7-4cf6-a2e8-767228c64837", "72ca7c75-bf85-45cd-aca7-255d360e423c", "060d5ad4-3153-47bb-8382-43e5e29eda92", "0e0bc253-07ed-43f1-816d-e1b220fe8971", "6e78b74f-c762-4800-82ad-f66787f10c8a", "84b0a8f3-680b-4096-a45b-e9a89221727c", "90ae0469-0cee-4509-b67f-e5efcef040f7", "bf9808c4-d24f-44a2-8398-b65227d406b6", "caa02837-f659-466f-bca6-48bde2826ab4", "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "4fc0deee-0057-4998-ab31-d24e46e0aba4", "e2e01011-5910-4267-9c3b-4149ed5479cf", "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "d2605a99-2218-4894-8fd3-2afb7946514d", "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "a2a3b925-7bb0-433b-b508-db9003263cc4", "68654bf0-4412-43d5-bfe8-5eaa393cd939", "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "952ed57c-8f99-453d-aee0-53a49c22f95d", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "75e508f7-932d-4ebc-af77-269237a84ce1", "50f852e6-af22-4c78-9ede-42ef36aa3453", "8cde342c-ba48-4b74-b615-172c330f2e93", "ea5c131b-380d-49f9-aeb3-920694da4d4b", "a2edbce1-95c8-4291-8676-0d45146862b3", "844f8eb2-610b-42c8-89a4-47596e089663", "6360757a-d460-456c-8b13-74cf0e60cceb", "24b6cf51-6122-469e-861a-22974e9c1e5b", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "9ed5959a-c43c-4c59-84e3-d28628429456", "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "b5de0c9a-6f19-43e0-af4e-55ad01f550af", "fef394cd-f44d-4040-9b18-95d92fe278c0", "48bfd177-7cf2-412b-ad77-baf923489e82", "2092cacb-d77b-4f98-ab0d-32b32f99a054", "ff0f2b05-09db-4095-b96d-1b75ca24894a", "49329257-089d-46e6-af37-4afce4290685", "7707a579-e0d8-4886-a853-ce47e4575aaa", "ee6cea48-c5b6-4304-a332-10fc6446f484", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "e76c8240-d68f-4773-8880-5c6f63595aaf", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "af4c4609-5755-42fe-8075-4effb49f5d44", "9ca2bf31-0570-44d8-a543-534c47c33ed7", "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "6ec86d9e-912e-4726-91a2-209359b999b9", "273a8dd8-3742-4302-bcc7-7df5a80fe425", "90217a70-13fc-48e4-b3db-0d836c5824ac", "3735d5ac-d770-4da0-99ff-156b180bc600", "948a0953-f287-4806-bbcb-3b2e396df89f", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "a1d9eec5-33b2-4177-8d24-27fe754d0812", "613c03ba-0779-4a53-8a1f-47f914a4ded3", "f356a9c4-effd-4608-bbf8-408afd5cd006", "a21bcd7e-38ec-49ad-b69a-9ea17e69509e", "df68f791-ad95-447f-a271-640a0dab9cf8", "e043f529-8514-4205-8ab0-7f7d2927b400", "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "065cceea-77ec-4030-9052-fc0affea7110", "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "36e037c4-c228-4866-b6a3-48eb292b9955", "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3", "e3f673b3-65d1-4d80-9146-466f8b63fa99", "270185ff-5f50-4d6d-a27f-24c3b8c9fef8", "5b2bbc47-dead-4ef7-8908-0cf73fcbecbf", "8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0", "06125661-3814-4e03-bfa2-1e4411c60ac3", "0a1f9d29-6465-4776-b091-7f43b26e4c89", "b1decb61-ed83-4339-8e95-53ea51901720", "a55349d8-9588-4c5a-8e3b-1925fe2a4ffe", "63c779ba-f638-40a0-a593-ddd45e8b1ddc", "ff301988-c231-4bd0-834c-ac9d73b86586", "3eb8c339-a765-48cc-a150-4364c04652bf", "3109530e-ab47-4cc6-a953-cac5ebcc93ae", "6ddab845-b1b8-49c2-bbf7-1a11967f64bc", "407aecb1-e762-4acf-8c7b-d087bcff3bb6", "7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2", "65744385-8541-44a6-8630-ffc824d7d4cc", "d51694fe-484a-46ac-92d6-969e76d60d10", "46612ae6-86be-4802-bc07-39b59feb1309", "f41b0311-44f9-44f0-816d-dd45e39d4bc8", "a5a2d357-1ab8-4675-a967-ef9990a59391", "02773bed-83bf-469f-b7ff-e676e7d78bab", "d353dac0-1b41-46c2-820c-d7d2561fc6ed", "caf02a0a-1e1c-4552-9b48-5e070bd88d11", "68578b43-65df-4f81-9a9b-92f32711a951", "13c02350-4177-4e45-ac17-cf7ca628ff5e", "b8fd0e93-ff58-4cbd-8f48-1c114e342e62", "39f1f9f2-9636-45de-98f6-a4046aa8e4b9", "28a452f3-786c-4fd8-b8f2-bddbe9d616d1", "74babdd6-a758-4549-9632-26535279e654", "fec96f39-988b-4586-b746-b93d59fd1922", "847def9e-924d-4e90-b7c4-5f581395a2b4", "ce7066a6-508a-42d3-995b-2952c65dc2ce", "4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6", "54127bd4-f541-4ac3-afdb-ea073f63f692", "002bdb95-0cf1-46a6-9e08-d38c128a6127", "c7a74c80-ba5a-486e-9974-ab9e682bc5e4", "34746e8c-5fb8-415a-b135-0abc167e912a", "ee63c85c-6d51-4d12-ad09-04e25877a947", "cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca", "1277f594-a7d1-4f28-a2d3-73af5cbeab43", "63e4f530-65dc-49cc-8f80-ccfa95c69d43", "dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c", "2f7979ae-f82b-45af-ac1d-2b10e93b0baa", "059c5af9-5131-4d8d-92b2-de4ad6146712", "7fd164ba-126a-4d9c-9392-0d4f7c243df0", "15904280-565c-4b73-9303-3291f964e7f9", "6902955a-01b7-432c-b32a-6f5f81d8f625", "3ab79e90-9fab-4cdf-a7b2-6522bc742adb", "654fcc6d-840d-4844-9b07-2c3300e54a26", "df6ecb8b-7822-4f4b-b412-08f524b4576c", "cad1fe90-2406-44dc-bd03-59d0b58fe722", "1027d292-dd87-4a1a-8701-2abe04d7783c", "41bb431f-56d8-4691-bb56-ed34e390906f", "de46c52b-0bf8-4936-a327-aace94f94ac6", "576426ad-0131-4001-ae01-be175da0c108", "4e7050dd-e548-483f-b7d6-527ab4fa784d", "3d2a2d59-929c-4b78-8c1a-145dfe9e07b1", "7d604714-e071-49ff-8726-edeb95a70679", "bdd8157d-8e85-4397-bb82-f06cc9c71dbb", "6b269392-9eba-40b5-acb6-55c882b20ba6", "b6f91281-20aa-446a-b986-38a92813a18f", "4aafb0fa-bff5-4b9d-b99e-8093e659c65f", "3da70954-0f2c-4103-adff-b7440368f50e", "e36941d0-c0f0-443f-bc6f-cb2952eb69ea", "6e90ae7a-7cd3-473f-a035-4ebb72d961da", "814ddeca-3d31-4265-8e07-8cc54fb44903", "bd1212e5-78da-431e-95fa-c58e3237a8e6", "9e099d99-44c2-42b6-a6d8-54c3545cab29", "7280c9f3-a5af-45d0-916a-bc01cb4151c9", "75bf09fa-1dd7-4d18-9af9-dd9e492562eb", "8fbf3271-1ef6-4e94-8210-03c2317947f6", "d102b8f5-61dc-4e68-bd83-9a3187c67377", "81315b50-6b60-4d8f-9928-3466e1022515", "2d367498-5112-4ae5-a06a-96e7bc33a211", "8e1cb247-6cf6-42fa-b440-3f27d57e9936", "7047d730-036f-4f40-b9d8-1c63e36d5e62", "2aa0a6b4-a865-495b-ab51-c28249537b75", "65236ec7-ace0-4f0c-82fd-737b04fd4dcb", "e4a74e34-ecde-4aab-b2fb-9112dd01aed0", "614a7e17-5643-4d89-b6fe-f9df1a79641c", "dca1b3e8-e043-4ec8-85d7-867f334b5724", "0b9ad457-2554-44c1-82c2-d56a99c42377", "8c31f563-f9a7-450c-bfa8-35f8f32f1f61", "9b64de98-9db3-4033-bd7a-f51430105f00", "aba15bdd-657f-422a-bab3-ac2d2a0d6f1c", "97aa2e88-555c-450d-85a6-229bcd87efb8", "304afd73-55a5-4bb9-8c21-0b1fc84ea9e4", "69ca12af-119d-44ed-b50f-a47af0ebc364", "b1c50487-1967-4315-a026-6491686d860e", "f0540f7e-2db3-4432-b9e0-3965486744bc", "130c9e58-28ac-4f83-8574-0a4cc913b97e", "92fa78e7-4d39-45f1-91a3-8b23f3f1088d", "33f41cdd-35ac-4ba8-814b-c6a4244a1ad4", "0bcfabcb-7929-47f4-93d6-b33fb67d34d1", "162ab1e4-6874-4564-853c-53ec3ab8be01", "11b1ed55-154d-4e82-8ad7-83739298f720", "c61daa90-3c1e-4f18-af62-8f288b5c9aaf", "fcc6d700-68d9-4241-9a1a-06874d621b06", "f92a6f1e-a512-4a15-9735-da09e78d7273", "7eff1a7f-dd45-4c20-877a-f21e342a7611", "0afecb6e-6223-4a82-99fb-bf5b981e92a5", "f0e2b768-5220-47dd-b891-d57b96fc0ec1", "34986307-b7f4-49be-92f3-e7a4d01ac5db", "9711de76-5d4f-4c50-a94f-21e4e8f8384d", "c3edc6a5-d9d4-48d8-930e-aab518390917", "d5866ddf-ce8f-4aea-b28e-d96485a20d3d", "259e5a6a-b8d2-4c38-86e2-26c5e651361d", "155dbf56-e0a4-4dd0-8905-8a98705045e8", "7fff6773-2baa-46de-a24a-b6eec1aba2d1", "e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f", "0b8baa3f-575c-46ee-8715-d6f28cc7d33c", "2f9356ae-bf43-41b8-b858-4496d83b2acb", "a05baa88-e922-4001-bc4d-8738135f27de", "5b40a734-99b6-4b98-a1d0-1cea51a08ab2", "6e2a900a-ced9-4e4a-a9c2-13e706f9518a", "91174a41-dc8f-401b-be89-7bfc140612a0", "8468111a-ef07-4654-903b-b863a80bbc95", "c048f047-7e2a-4888-b302-55f509d4a91d", "52753ea4-b3a0-4365-910d-36cff487b789", "fccfb43e-09a7-4bd2-8b37-a5a7df33386d", "5f87308a-0a5b-4623-ae15-d8fa1809bc60", "0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b", "a8f866e1-bdd4-425e-a27a-37619238d9c7", "07a99744-56ac-40d2-97b7-2095967b0e03", "3a8da4e0-36c1-40d2-8b29-b3e890d5172a", "0e29e3a7-1ad8-40aa-b691-9f82ecd33d66", "d7b50671-d1ad-4871-aa60-5aa5b331fe04", "409f8a98-4496-4aaa-818a-c931c0a8b832", "a6976974-ea6f-4e97-818e-ea08625c52cb", "3a9fa2ec-30bc-4ebd-b49e-7c9cff225502", "b4926b47-a9d7-434c-b3a0-adc3fa0bd13e", "28208707-fe31-437f-9a7f-4b1108b94d2e", "e15b518d-b4ce-4410-a9cd-501f23ce4a18", "760e75d8-c3b5-409b-a9bf-6130b4c4603f", "e0b06658-7d1d-4cd3-bf15-03467507ff7c", "4e87b8e2-2ee9-4b2a-a715-4727d297ece0", "bb09dd3e-2b78-4819-8e35-a7c1b874e449", "4c7f49ee-2638-43bb-b85b-ce676c30b260", "4358e5a5-7542-4dcb-b9f3-87667371839b", "62ed5b55-f991-406a-85d9-e8e8fdf18789", "e074832a-eada-4fd7-94a1-10642b130e16", "16fe46bb-4f64-46aa-817d-ff7bec4a2352", "8d5aca11-22b3-4f22-b7ba-90e60533e1fb", "3d0ed417-3d94-4963-a562-4a92c940656a", "7892ec59-c5bb-496d-8968-e5d210ca3ac4", "145095eb-e273-443b-83d0-f9b519b7867b", "5d756aee-ad3e-4306-ad95-cb1abec48de2", "48ea844d-19b1-4642-944e-fe39c2cc1fec", "8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9", "1908fcc1-1b92-4272-8214-0fbaf2fa5163", "a10a2c40-2c4d-49f8-b557-1a946bc55d9d", "736ffa74-5f6f-44ca-94ef-1c0df4f51d2a", "bbb7e38c-0b41-4a11-b306-d2a457b7ac2b", "fed85bf9-e075-4280-9159-fbe8a023d6fa", "0e20c89d-2264-44ae-8238-aeeaba609ece", "56e05d41-ce99-4ecd-912d-93f019ee0b71", "b5b78988-486d-4a80-b991-930eff3ff8bf", "805c55d9-31e6-4846-9878-c34c75054fe9", "80e1f67a-4596-4351-98f5-a9c3efabac95", "e3845023-ca9a-4024-b2b2-5422156d5527", "e8a52bbd-bced-459f-bd93-64db45ce7657", "fc4f4817-0c53-4683-a4ee-b17a64bc1039", "f748c45a-f8d3-4e6f-b617-fe176f695b8f", "6ea858a8-ba71-4a12-b2cc-5d83312404c7", "93a19907-d4f9-4deb-9f91-aac4692776a6", "3215aa19-f060-4332-86d5-5602511f3ca8", "117d3d3a-755c-4a61-b23e-9171146d094c", "93d94efc-d7ad-4161-ad7d-1638c4f908d8", "318557a5-150c-4c8d-b70e-a9910e199857", "c3e76af5-4ce0-4a14-9c9a-25ceb8fda182", "f331aa1f-8c53-4fc3-b083-cc159bc971cb", "602a1f13-c640-4d73-b053-be9a2fa58b96", "9f2cc74d-78af-4eb2-bb64-9cd1d292b87b", "c3dbbc9f-ef1d-470a-a90a-d343448d5875", "edf3485d-dac4-4d50-90e4-b0e5813f7e60", "1d08ac94-400d-4469-a82f-daee9a908849", "7e9cf7b6-e827-11ed-a05b-15959c120003", "fa5b1358-b040-4403-9868-15f7d9ab6329", "c649a6c7-cd8c-4a78-9c04-000fc76df954", "e81528db-fc02-45e8-8e98-4e84aba1f10b", "7e9cf7b6-e827-11ed-a05b-0242ac120003", "a66bc059-c370-472c-a0d7-f8fd1bf9d583", "67add051-9ee7-4ad3-93ba-42935615ae8d", "295c9289-acee-4503-a571-8eacaef36b28", "72cd00d6-490c-4650-86ff-1d11f491daa1", "05296024-fe8a-4baf-8f3d-9a5f5624ceb2", "1a42dfa6-6cb2-4df9-9b48-295be477e835", "10cb6535-b31d-4512-9962-513dcbc42cc1", "7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8", "679085d5-f427-4484-9f58-1dc30a7c426d", "2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75", "39b64854-5497-4b57-a448-40977b8c9679", "a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f", "77564cc2-7382-438b-a7f6-395c2ae53b9a", "f239b326-2f41-4d6b-9dfa-c846a60ef505", "caa06de8-fdef-4c91-826a-7f9e163eef4b", "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "2158f96f-43c2-43cb-952a-ab4580f32382", "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "d797268e-28a9-49a7-b9a8-2f5039011c5c", "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "f426547a-e0f7-441a-b63e-854ac5bdf54d", "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "6d3a3952-6530-44a3-8554-cf17c116c615", "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "4c0aaedc-154c-4427-ada0-d80ef9c9deb6", "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "a4824fca-976f-4964-b334-0621379e84c4", "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "92a974db-ab84-457f-9ec0-55db83d7a825", "f9578658-9e71-4711-b634-3f9b50cd3c06", "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "f5240972-3938-4e56-8e4b-e33893176c1f", "fff9d2b7-e11c-4a69-93d3-40ef66189767", "cc9d3712-6310-4320-b2df-7cb408274d53", "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "327ff235-94eb-4f06-b9de-aaee571324be", "42a993dd-bb3e-48c8-b372-4d6684c4106c", "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "36210e0d-5b19-485d-a087-c096088885f0", "1723e720-616d-4ddc-ab02-f7e3685a4713", "90fb5e62-ca1f-4e22-b42e-cc521874c938", "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "57c4bf16-227f-4394-8ec7-1b745ee061c3", "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "0ea52357-cd59-4340-9981-c46c7e900428", "7aa7009a-28b9-4344-8c1f-159489a390df", "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "9719a8aa-401c-41af-8108-ced7ec9cd75c", "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "587254ee-a24b-4335-b3cd-065c0f1f4baa", "98b53e78-ebaf-46f8-be06-421aafd176d9", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "b5746143-59d6-4603-8d06-acbd60e166ee", "c09dad97-1c78-4f71-b127-7edb2b8e491a", "551d9c1f-816c-445b-a7a6-7a3864720d60", "e31033fc-33f0-4020-9a16-faf9b31cbf08", "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "8e3c7994-131e-4ba5-b6ea-804d49113a26", "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "e32d4572-9826-4738-b651-95fa63747e8a", "043c4b8b-3a54-4780-9682-081cb6b8185c", "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "c363385c-f75d-4753-a108-c1a8e28bdbda", "5cb299fc-5fb1-4d07-b989-0644c68b6043", "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "811f459f-9231-45d4-959a-0266c6311987", "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "7d6d30b8-5b91-4b90-a891-46cccaf29598", "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "087790e3-3287-436c-bccf-cbd0184a7db1", "6812a10b-60ea-420c-832f-dfcc33b646ba", "84b14121-9d14-416e-800b-f3b829c5a14d", "32e280f1-8ad4-46ef-9e80-910657611fbc", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "9cfc00b6-bfb7-49ce-9781-ef78503154bb", "3f5491e2-8db8-496b-9e95-1029fce852d4", "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "02030f2f-6199-49ec-b258-ea71b07e03dc", "74403157-20f5-415d-89a7-c505779585cf", "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "4d7cda18-1b12-4e52-b45c-d28653210df8", "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "c9783e20-4793-4164-ba96-d9ee483992c4", "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "94771a71-ba41-4b6e-a757-b531372eaab6", "2f869d59-7f6a-4931-992c-cce556ff2d53", "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "1775e15e-b61b-4d14-a1a3-80981298085a", "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "42b1a5b8-353f-4f10-b256-39de4467faff", "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "9292293b-8496-4715-9db6-37028dcda4b3", "52788a70-f1da-40dd-8fbd-73b5865d6568", "349d891d-fef0-4fe4-bc53-eee623a15969", "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "6f3e2987-db24-4c78-a860-b4f4095a7095", "1ec65a5f-9473-4f12-97da-622044d6df21", "d042284c-a296-4988-9be5-f424fadcc28c", "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "1327381e-6ab0-4f38-b583-4c1b8346a56b", "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "9ec9fb1b-e059-4489-9642-f270c207923d", "058f4380-962d-40a5-afce-50207d36d7e2", "fe63010f-8823-4864-a96b-a7b4a0f7b929", "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "c86133ad-4725-4bd0-8170-210788e0a7ba", "f5d19838-41b5-476c-98d8-ba8af4929ee2", "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "82880171-b475-4201-b811-e9c826cd5eaa", "023c654f-8f16-44d9-bb2b-00ff36a62af9", "d557dc06-62e8-4468-a8e8-7984124908ce", "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "a642964e-bead-4bed-8910-1bb4d63e3b4d", "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "e4a6b256-3e47-40fc-89d2-7a477edd6915", "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "9fff585c-c33e-4a86-b3cd-39312079a65f", "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "fa00b701-44c6-4679-994d-5a18afa8a707", "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "313d6012-51a0-4d93-8dfc-de8553239e25", "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "8d63dadf-b91b-4187-87b6-34a1114577ea", "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "b36d01a3-ddaf-4804-be18-18a6247adfcd", "aaf46cdc-934e-4284-b329-34aa701e3771", "575dce0c-8139-4e30-9295-1ee75969f7fe", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "a1473adb-5338-4a20-b4c3-126763e2d3d3", "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "241e802a-b65e-484f-88cd-c2dc10f9206d", "fd877b94-9bb5-4191-bb25-d79cbd93c167", "d047726b-c71c-4048-a99b-2e2f50dc107d", "40b95d31-1afc-469e-8d34-9a3a667d058e", "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "e6c54d94-498c-4562-a37c-b469d8e9a275", "64760eef-87f7-4ed3-93fd-655668ea9420", "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "da2738f2-fadb-4394-afa7-0a0674885afa", "88872991-7445-4a22-90b2-a3adadb0e827", "f576a613-2392-4067-9d1a-9345fb58d8d1", "431a1fdb-4799-4f3b-91c3-a683b003fc49", "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "4931188c-178e-4ee7-a348-39e8a7a56821", "85ff530b-261d-48c6-a441-facaa2e81e48", "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "8cbc9475-8d05-4e27-9c32-df960716c701", "378a05d8-963c-46c9-bcce-13c7657eac99", "e8d34729-86a4-4140-adfd-0a29c2106307", "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "e568650b-5dcd-4658-8f34-ded0b1e13992", "f208d6d8-d83a-4c2c-960d-877c37da84e5", "514e4c3a-c77d-4cde-a00f-046425e2301e", "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "01aeb693-138d-49d2-9403-c4f52d7d3d62", "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "83865853-59aa-449e-9600-74b9d89a6d6e", "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "b53317a0-8acf-4fd1-8de8-a5401e776b96", "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "10344bb3-7f65-46c2-b915-2d00d47be5b0", "185d7418-f250-42d0-b72e-0c8b70661e93", "379fa130-190e-4c3f-b7bc-6c8e834485f3", "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "e83e8899-c9b2-483b-b355-5decc942b959", "6385697e-9f1b-40bd-8817-f4a91f40508e", "24357373-078f-44ed-9ac4-6d334a668a11", "15619216-e993-4721-b590-4c520615a67d", "d2eb17db-1d39-41dc-b57f-301f6512fa75", "5a6e1e16-07de-48d8-8aae-faa766c05e88", "5a3164f2-b373-4152-93cf-090b13c12d27", "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "cbec226f-63d9-4eca-9f52-dfb6652f24df", "5b768e71-86f2-4879-b448-81061cbae951", "ca621ba5-54ab-4035-9942-d378e6fcde3c", "98767d61-b2e8-4d71-b661-e36783ee24c1", "a85ffc3a-e8fd-4040-93bf-78aff284d801", "88f46b67-14d4-4f45-ac2c-d66984f22191", "83809e84-4475-4b69-bc3e-4aad8568612f", "ce72ef99-22f1-43d4-8695-419dcb5d9330", "add64136-62e5-48ea-807e-88638d02df1e", "04936b66-3915-43ad-a8e5-809eadfd1141", "847d5ff3-8a31-4737-a970-aeae8fe21765", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "c49c5062-0966-4170-9efd-9968c913a6cf", "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "850d55f9-6eeb-4492-ad69-a72338f65ba4", "d87bd452-6da1-456e-8155-7dc988157b7d", "5bb68627-3198-40ca-b458-49f973db8752", "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "caf201a9-c2ce-4a26-9c3a-2b9525413711", "4e762605-34a8-406d-b72e-c1a089313320", "d3c3861d-c504-4c77-ba55-224ba82d0118", "2ddef153-167b-4e89-86b6-757a9e65dcac", "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "8a582fe2-0882-4b89-a82a-da6b2dc32937", "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "f35c5d71-b489-4e22-a115-f003df287317", "fbd7c32d-db2a-4418-b92c-566eb8911133", "87a476dc-0079-4583-a985-dee7a20a03de", "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "38879043-7e1e-47a9-8d46-6bec88e201df", "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "f9999590-1f94-4a34-a91e-951e47bedefd", "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "4eddc365-79b4-43ff-a9d7-99422dc34b93", "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "220457c1-1c9f-4c2e-afe6-9598926222c1", "bf361876-6620-407a-812f-bfe11e51e924", "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "c79da740-5030-45ec-a2e0-479e824a562c", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "a197e378-d31b-41c0-9635-cfdf1c1bb423", "737e618a-a410-49b5-bec3-9e55ff7fbc15", "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "30edb182-aa75-42c0-b0a9-e998bb29067c", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "eb1c4225-1c23-4241-8dd4-051389fde4ce", "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "e312efd0-35a1-407f-8439-b8d434b438a6", "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "ba42babc-0666-4393-a4f7-ceaf5a69191e", "c27515df-97a9-4162-8a60-dc0eeb51b775", "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "0f6da907-5854-4be6-859a-e9958747b0aa", "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "5edc2273-c26f-406c-83f3-f4d948e740dd", "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "0f0450f3-8b47-441e-a31b-15a91dc243e2", "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "817f252c-5143-4dae-b418-48c3e9f63728", "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "07e3cb2c-0608-410d-be4b-1511cb1a0448", "138d3531-8793-4f50-a2cd-f291b2863d78", "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "ddeff553-5233-4ae9-bbab-d64d2bd634be", "e212d415-0e93-435f-9e1a-f29005bb4723", "55f0a3a1-846e-40eb-8273-677371b8d912", "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "e7888eb1-13b0-4616-bd99-4bc0c2b054b9", "6ba5a05f-b095-4f0a-8654-b825f4f16334", "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "7cce6fc8-a07f-4d84-a53e-96e1879843c9", "45d3a03d-f441-458c-8883-df101a3bb146", "871b9555-69ca-4993-99d3-35a59f9f3599", "f2c64357-b1d2-41b7-849f-34d2682c0fad", "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "12fbff88-16b5-4b42-9754-cd001a789fb3", "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "0403d67d-6227-4ea8-8145-4e72db7da120", "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "bd1c6866-65fc-44b2-be51-5588fcff82b9", "1114e048-b69c-4f41-bc20-657245ae6e3f", "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "27aec9c9-dbb0-4939-8422-1742242471d0", "727454c0-d851-48b0-8b89-385611ab0704", "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "d20ee2f4-822c-4827-9e15-41500b1fff10", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "efec536f-72e8-4656-8960-5e85d091345b", "6f4191bb-912b-48a8-9ce7-682769541e6d", "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "517490a7-115a-48c6-8862-1a481504d5a8", "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "49d9671b-0a0a-4c09-8280-d215bfd30662", "05f3c945-dcc8-4393-9f3d-af65077a8f86", "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "554601fb-9b71-4bcc-abf4-21a611be4fde", "7b10f171-7f04-47c7-9fa2-5be43c76e535", "45239e6a-b035-4aaf-b339-8ad379fcb67e", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "7be5fb68-f9ef-476d-8b51-0256ebece19e", "6e22722b-dfb1-4508-a911-49ac840b40f8", "9ccba514-7cb6-4c5c-b377-700758f2f120", "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "7a74da6b-ea76-47db-92cc-874ad90df734", "f11f2808-adb4-46c0-802a-8660db50fa99", "43e32da2-fdd0-4156-90de-50dfd62636f9", "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "a20def93-0709-4eae-9bd2-31206e21e6b2", "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "6004abd0-afa4-4557-ba90-49d172e0a299", "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "970823b7-273b-460a-8afc-3a6811998529", "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "15b75071-74cc-47e0-b4c6-b43744a62a2b", "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "f99abdf0-6283-4e71-bd2b-b5c048a94743", "0a13e132-651d-11eb-ae93-0242ac130002", "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "e9f55347-2928-4c06-88e5-1a7f8169942e", "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "6a69f62d-ce75-4b57-8dce-6351eb55b362", "8b0e12da-d3c3-49db-bb4f-256703f380e5", "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "98a96a5a-64a0-4c42-92c5-489da3866cb0", "47e4bab7-c626-47dc-967b-255608c9a920", "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "40b19fa6-d835-400c-b301-41f3a2baacaf", "71158e3f-df67-472b-930e-7d287acaa3e1", "f44800ac-38ec-471f-936e-3fa7d9c53100", "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "24c8392b-aa3c-46b7-a545-43f71657fe98", "88f680b8-070e-402c-ae11-d2914f2257f1", "15434e33-5027-4914-88d5-3d4145ec25a9", "b98d0db6-511d-45de-ad02-e82a98729620", "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "0bbc6369-43e3-453d-9944-cae58821c173", "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "b7966f4a-b333-455b-8370-8ca53c229762", "43fa5350-db63-4b8f-9a01-789a427074e1", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "ec290c06-9b6b-4338-8b6b-095c0f284f10", "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "d4498716-1d52-438f-8084-4a603157d131", "b222df08-0e07-11eb-adc1-0242ac120002", "e1693bc8-7168-4eab-8718-cdcaa68a1738", "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "d3b70aad-097e-409c-9df2-450f80dc476b", "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "312d0384-401c-4b8b-abdf-685ffba9a332", "cc368ed0-2411-45dc-a222-510ace303cb2", "42333b2c-b425-441c-b70e-99404a17170f", "0e4164da-94bc-450d-a7be-a4b176179f1f", "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "ebef4391-1a81-4761-a40a-1db446c0e625", "f26307d8-14cd-47e3-a26b-4b4769f24af6", "03cc0c25-389f-4bf8-b48d-11878079f1ca", "8834e2f7-6b4b-4f09-8906-d2276470ee23", "7090adee-82e2-4269-bd59-80691e7c6338", "c74c0390-3e20-41fd-a69a-128f0275a5ea", "b6457d63-d2a2-4e29-859d-4e7affc153d1", "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "5f6a601c-2ecb-498b-9c33-660362323afa", "aa8e035d-7be4-48d3-a944-102aec04400d", "b243b280-65fe-48df-ba07-6ddea7646427", "236d8e89-ed95-4789-a982-36f4643738ba", "277a4393-446c-449a-b0ed-7fdc7795244c", "4fe074b4-b833-4081-8f24-7dcfeca72b42", "68bcd73b-37ef-49cb-95fc-edc809730be6", "86588b36-c6d3-465f-9cee-8f9093e07798", "502b42de-4306-40b4-9596-6f590c81f073", "0a99eb3e-1617-41bd-b095-13dc767f3def", "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "07f8bdc2-c9b3-472a-9817-5a670b872f53", "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "28ac00d6-22d9-4a3c-927f-bbd770104573", "452bce90-6fb0-43cc-97a5-affc283139b3", "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "ce7cf472-6fcc-490a-9481-3786840b5d9b", "c6fb44c6-71f5-49e6-9462-1425d328aee3", "9c0295ce-d60d-40bd-bd74-84673b7592b1", "0a4f6091-223b-41f6-8743-f322ec84930b", "98c5aeef-32d5-492f-b174-64a691896d25", "6fe4aa1e-0531-4510-8be2-782154b73b48", "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "d78b5d61-187d-44b6-bf02-93486a80de5a", "e9b61244-893f-427c-b287-3e708f321c6b", "70bc5215-526f-4477-963c-a47a5c9ebd12", "b6e04788-29e1-4557-bb14-77f761848ab8", "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "0685b176-c816-4837-8e7b-1216f346636b", "e84d89c4-f544-41ca-a6af-4b92fd38b023", "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "023394c4-29d5-46ab-92b8-6a534c6f447b", "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "ebea773c-a8f1-42ad-a856-00cb221966e8", "0b7163dc-7eee-4960-af17-c0cd517f92da", "98dedfdd-8333-49d4-9f23-d7018cccae53", "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "f24bcaea-0cd1-11eb-adc1-0242ac120002", "ccb5742c-c248-4982-8c5c-5571b9275ad3", "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "4abc0ec4-db5a-412f-9632-26659cddf145", "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "5cddf373-ef00-4112-ad72-960ac29bac34", "37db85d1-b089-490a-a59a-c7b6f984f480", "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "f1edd233-30b5-4823-9e6a-c4171b24d316", "e92a4287-e072-4a40-9739-370c106bb750", "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "8bc64091-6875-4881-aaf9-7bd25b5dda08", "56c217c3-2de2-479b-990f-5c109ba8458f", "eee00933-a761-4cd0-be70-c42fe91731e7", "bab049ca-7471-4828-9024-38279a4c04da", "c3a99af4-35a9-4668-879e-c09aeb4f2bdf", "d7654f02-e04b-4934-9838-65c46f187ebc", "2a072a96-a086-49fa-bcb5-15cc5a619093", "883faa95-175a-4e22-8181-e5761aeb373c", "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "63d1ccc0-2a43-4f4b-9289-361b308991ff", "4f154fb6-27d1-4813-a759-78b93e0b9c48", "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "33be4333-2c6b-44f4-ae28-102cdbde0a31", "395907ee-96e5-4666-af2e-2ca91688e151", "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "b0ce780f-10bd-496d-9067-066d23dc3aa5", "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "79b06761-465f-4f88-9ef2-150e24d3d737", "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "c615d676-f655-46b9-b913-78729021e5d7", "b19146a3-25d4-41b4-928b-1e2a92641b1b", "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "e6474a1b-5390-49cd-ab41-8d88655f7394", "692f0bec-83ba-4d04-af7e-e884a96059b6", "93671f99-04eb-4ab4-a161-70d446a84003", "0d5675be-bc88-4172-86d3-1e96a4476536", "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "4281cb20-2994-4580-aa63-c8b86d019934", "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "a34f79a3-8e5f-4cc3-b765-de00695452c2", "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "5589ab4f-a767-433c-961d-c91f3f704db1", "e8a95b5e-c891-46e2-b33a-93937d3abc31", "c86500e9-a645-4680-98d7-f882c70c1ea3", "58f50261-c53b-4c88-bd12-1d71f12eda4c", "34ebb878-1b15-4895-b352-ca2eeb99b274", "7a02e22e-b885-4404-b38b-1ddc7e65258a", "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "24de4f3b-804c-4165-b442-5a06a2302c7e", "731231b9-0b5d-4219-94dd-abb6959aa7ea", "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "d7bcd677-645d-4691-a8d4-7a5602b780d1", "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "6e897651-f157-4d8f-aaeb-df8151488385", "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "9847f263-4a81-424f-970c-875dab15b79b", "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "4b046706-5789-4673-b111-66f25fe99534", "73bba97f-a82d-42ce-b315-9182e76c57b1", "646bc99f-6682-4b47-a73a-17b1b64c9d34", "6c96fc76-0eb1-11eb-adc1-0242ac120002", "7050bba1-1aed-454e-8f73-3f46f09ce56a", "744a188b-0415-4792-896f-11ddb0588dbc", "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "faa48cae-6b25-4f00-a094-08947fef582f", "70ad0861-d1fe-491c-a45f-fa48148a300d", "a16980c2-0c56-4de0-9a79-17971979efdd", "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "954f0af7-62dd-418f-b3df-a84bc2c7a774", "a7ee1722-c3c5-aeff-3212-c777e4733217", "1dde5376-a648-492e-9e54-4241dd9b0c7f", "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "10c14723-61c7-4c75-92ca-9af245723ad2", "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "41421f44-58f9-455d-838a-c398859841d4", "ae9b0bd7-8888-4606-b444-0ed7410cb728", "8de1cbe8-d6f5-496d-8237-5f44a721c7a0", "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "43103702-5886-11ed-9b6a-0242ac120002", "16905e21-66ee-42fe-b256-1318ada2d770", "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "a7c3d773-caef-227e-a7e7-c2f13c622329", "214641c2-c579-4ecb-8427-0cf19df6842e", "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "07aa184a-870d-413d-893a-157f317f6f58", "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "f548a603-c9f2-4c89-b511-b089f7e94549", "93199800-b52a-4dec-b762-75212c196542", "526be59f-a573-4eea-b5f7-f0973207634d", "6345b048-8441-43a7-9bed-541133633d7a", "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "25676e10-2121-446e-80a4-71ff8506af47", "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "ac1c92b4-ac81-405a-9978-4604d78cc47e", "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "bdeb2cff-af74-4094-8426-724dc937f20a", "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "a383dec4-deec-4e6e-913b-ed9249670848", "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "ac20ae82-8758-4f38-958e-b44a3140ca88", "54786ddc-5b8a-11ed-9b6a-0242ac120002", "41ca393d-538c-408a-ac27-cf1e038be80c", "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "cd71385d-fd9b-4691-9b98-2b1f7e508714", "c8a180d6-47a3-4345-a609-53f9c3d834fc", "044ba588-dff4-4918-9808-3f95e8160606", "1af57a4b-460a-4738-9034-db68b880c665", "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "1dd05363-104e-4b4a-b963-196a534b03a1", "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "84b1ecf9-6eff-4004-bafb-bae5c0e251b2", "204b17ae-4007-471b-917b-b917b315c5db", "50d66fb0-03f8-4da0-8add-84e77d12a020", "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "c2b86e67-b880-4eec-b045-50bc98ef4844", "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "e593cf51-88db-4ee1-b920-37e89012a3c9", "90d6bd71-dffb-4989-8d86-a827fedd6624", "8202070f-edeb-4d31-a010-a26c72ac5600", "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "3268b746-88d8-4cd3-bffc-30077d02c787", "18988e1b-9087-4f8a-82fe-0414dce49878", "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "f53714ec-5077-420e-ad20-907ff9bb2958", "f117933c-980c-4f78-b384-e3d838111165", "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "a29c1813-ab1f-4dde-b489-330b952e91ae", "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "b655a06a-31c0-477a-95c2-3726b83d649d", "21d856f9-9281-4ded-9377-51a1a6e2a432", "b66474aa-bd92-4333-a16c-298155b120df", "b2309017-4235-44fe-b5af-b15363011957", "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "62510e69-616b-4078-b371-847da438cc03", "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "285b85b1-a555-4095-8652-a8a4106af63f", "84f52741-8834-4a8c-a413-2eb2269aa6c8", "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "be344333-921d-4c4d-8bb8-e584cf584780", "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "fb843269-508c-4b76-8b8d-88679db22ce7", "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "de587dce-915e-4218-aac4-835ca6af6f70", "c7942406-33dd-4377-a564-0f62db0593a3", "ab9e3b40-0c85-4ba1-aede-455d226fd124", "ef61af62-bc74-4f58-b49b-626448227652", "a20391f8-76fb-437b-abc0-dba2df1952c6", "899133d5-4d7c-4a7f-94ee-27355c879d90", "1ac8666b-046f-4201-8aba-1951aaec03a3", "1c67a717-32ba-409b-a45d-0fb704a73a81", "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "eca49c87-8a75-4f13-9c73-a5a29e845f03", "435e10e4-992a-4281-96f3-38b11106adde", "b3512211-c67e-4707-bedc-66efc7848863", "c15a46a0-07d4-4c87-b4b6-89207835a83b", "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "1f0f6176-6482-4027-b151-00071af39d7e", "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "9257c05b-4a4a-48e5-a670-b7b073cf401b", "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "99793437-3e16-439b-be0f-078782cf953d", "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "ac175779-025a-4f12-98b0-acdaeb77ea85", "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "90d50722-0483-4065-8e35-57efaadd354d", "180c7c5c-d64b-4a63-86e9-68910451bc8b", "d55b793d-f847-4eea-b59a-5ab09908ac90", "aef9d1f1-7396-4e92-a927-4567c7a495c1", "6c6d9280-e6d0-4b9d-80ac-254701b64916", "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "9212f354-7775-4e28-9c9f-8f0a4544e664", "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "ffa6861c-4461-4f59-8a41-578c39f3f23e", "a0459f02-ac51-4c09-b511-b8c9203fc429", "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "534f2ef7-e8a2-4433-816d-c91bccde289b", "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "84232095-ecca-4015-b0d7-7726507ee793", "4e2ed651-1906-4a59-a78a-18220fca1b22", "96036718-71cc-4027-a538-d1587e0006a7", "60f16a96-db70-42eb-8f76-16763e333590", "5afee48e-67dd-4e03-a783-f74259dcf998", "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "771d1eb5-9587-4568-95fb-9ec44153a012", "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "e28a5a99-da44-436d-b7a0-2afc20a5f413", "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "68d37776-61db-42f5-bf54-27e87072d17e", "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "d2b749ee-4225-417e-b20e-a8d2193cbb84", "1193d960-2369-499f-a158-7b50a31df682", "6b65c28e-11f3-46cb-902a-68f2cafaf474", "242301bc-f92f-4476-8718-78004a6efd9f", "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "52d097e2-063e-4c9c-8fbb-855c8948d135", "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "647c7b9e-d784-4fda-b9a0-45c565a7b729", "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "bb76d96b-821c-47cf-944b-7ce377864492", "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "1816994b-42e1-4fb1-afd2-134d88184f71", "12827a56-61a4-476a-a9cb-f3068f191073", "32b96012-7892-429e-b26c-ac2bf46066ff", "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "f4bbd493-b796-416e-bbf2-121235348529", "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "d06be4b9-8045-428b-a567-740a26d9db25", "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "65c3ca2c-525f-4ced-968e-246a713d164f", "347906f3-e207-4d18-ae5b-a9403d6bcdef", "a29808fd-ef50-49ff-9c7a-59a9b040b404", "e66779cc-383e-4224-a3a4-267eeb585c40", "85c312b7-f44d-4a51-a024-d671c40b49fc", "6da2c9f5-7c53-401b-aacb-92c040ce1215", "6bd75993-9888-4f91-9404-e1e4e4e34b77", "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "ff992eac-6449-4c60-8c1d-91c9722a1d48", "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "208748f7-881d-47ac-a29c-07ea84bf691d", "89ca78fd-b37c-4310-b3d3-81a023f83936", "a2910908-e86f-4687-aeba-76a5f996e652", "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "9c14c9fa-1a63-4a64-8e57-d19280559490", "221b251a-357a-49a9-920a-271802777cc0", "50919691-7302-437f-8e10-1fe088afa145", "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "f14e169e-9978-4c69-acb3-1cff8200bc36", "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "1c8774a0-44d4-4db0-91f8-e792359c70bd", "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "9fc3072c-dc8f-4bf7-b231-18950000fadd", "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "ada4b0c4-758b-46ac-9033-9004613a150d", "584bca0f-3608-4402-80fd-4075ff6072e3", "9a132afa-654e-11eb-ae93-0242ac130002", "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "a70dcb37-3bee-453a-99df-d0c683151be6", "85b0b087-eddf-4a2b-b033-d771fa2b9775", "2267fe65-0681-42ad-9a6d-46553d3f3480", "28c8f68b-098d-45af-8d43-8089f3e35403", "cd8c163e-a19b-402e-bdd5-419ff5859f12", "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "2c28c248-7f50-417a-9186-a85b223010ee", "84972c80-251c-4c3a-9079-4f00aad93938", "434c08ba-8406-4d15-8b24-782cb071a691", "bed2a484-9348-4143-8a8a-b801c979301c", "a0d7e4d2-bede-4141-8896-bc6e237e977c", "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "1c526788-0abe-4713-862f-b520da5e5316", "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "9f107a84-532c-41af-b005-8d12a607639f", "455b9d50-15a1-4b99-853f-8d37655a4c1b", "dee0a7a3-f200-4112-a99b-952196d81e42", "79ce34ca-af29-4d0e-b832-fc1b377020db", "2afafd61-6aae-4df4-baed-139fa1f4c345", "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "f0507c0f-a3a2-40f5-acc6-7f543c334993", "970007b7-ce32-49d0-a4a4-fbef016950bd", "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "f4264e47-f522-4c38-a420-04525d5b880f", "b2ddd389-f676-4ac4-845a-e00781a48e5f", "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "4a6713f6-3331-11ed-a261-0242ac120002", "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "5cc2cda8-f261-4d88-a2de-e9e193c86716", "2d22a514-e024-4428-9dba-41505bd63a5b", "01c42d3c-242d-4655-85b2-34f1739632f7", "77946e79-97f1-45a2-84b4-f37b5c0d8682", "27ba3207-dd30-4812-abbf-5d20c57d474e", "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "1228c958-e64e-4e71-92ad-7d429f4138ba", "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "b1377339-fda6-477a-b455-ac0923f9ec2c", "44143844-0631-49ab-97a0-96387d6b2d7c", "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "85de1f22-d189-44e4-8239-dc276b45379b", "92626ddd-662c-49e3-ac59-f6535f12d189", "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "e56d3073-83ff-4021-90fe-c658e0709e72", "deb9b646-a508-44ee-b7c9-d8965921c6b6", "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "cea2b7ea-792b-405f-95a1-b903ea06458f", "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "730fc21b-eaff-474b-ad23-90fd265d4988", "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "48917adc-a28e-4f5d-b729-11e75da8941f", "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "0900463c-b33b-49a8-be1d-552a3b553dae", "82a6714f-4899-4f16-9c1e-9a333544d4c3", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "1e59c230-6670-45bf-83b0-98903780607e", "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "5687f942-867b-4578-ade7-1e341c46e99a", "258fc8ce-8352-443a-9120-8a11e4857fa5", "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "4ae81040-fc1c-4249-bfa3-938d260214d9", "aa2efee7-34dd-446e-8a37-40790a66efd7", "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "ae215552-081e-44c7-805f-be16f975c8a2", "30bf1789-379d-4fdc-900f-55cd0a90a801", "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "4f7a6757-ff79-46db-9687-66501a02d9ec", "129966c9-de17-4334-a123-8b58172e664d", "696bfb54-227e-4602-ac5b-30d9d2053312", "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "7df1713a-1a5b-4a4b-a071-dc83b144a101", "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "814c95cc-8192-4378-a70a-f1aafd877af1", "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "99c840f2-2012-46fd-9141-c761987550ef", "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "de16d92c-c446-4d53-8938-10aeef41c8b6", "056c7317-9a09-4bd4-9067-d051312752ea", "60fc936d-2eb0-4543-8a13-911c750a1dfc", "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "114de787-4eb2-48cc-abdb-c0b449f93ea4", "207b0396-3689-42d9-8399-4222658efc99", "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "9248c7e1-2bf3-4661-a22c-600a8040b446", "146aace8-9bd6-42ba-be7a-0070d8027b76", "3d7679bd-0c00-440c-97b0-3f204273e6c7", "ea011323-7045-460b-b2d7-0f7442ea6b38", "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "e290b10b-1023-4452-a4a9-eb31a9013b3a", "ca5583e9-8f80-46ac-ab91-7f314d13b984", "cd3d1298-eb3b-476c-ac67-12847de55813", "867356ee-9352-41c9-a8f2-1be690d78216", "67f113fa-e23d-4271-befa-30113b3e08b1", "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "62b20d44-1546-4e61-afce-8e175eb9473c", "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "b6676963-0353-4f88-90f5-36c20d443c6a", "99cf1e02-00fb-4c0d-8375-563f978dfd37", "903076ff-f442-475a-b667-4f246bcc203b", "a77c1610-fc73-4019-8e29-0f51efc04a51", "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "cea72823-df4d-4567-950c-0b579eaf0846", "74a2b202-73e0-4693-9a3a-9d36146d0775", "5fc297ae-25b6-488a-8f25-cc12ac29b744", "12f6b752-042d-483e-bf9c-915a6d06ad75", "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "c1d867fe-8d95-4487-aab4-e53f2d339f90", "e13f668e-7f95-443d-98d2-1816a7648a7b", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "9c8c7000-3065-44a8-a555-79bcba5d9955", "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "ee5e119b-1f75-4b34-add8-3be976961e39", "33339be3-148b-4e16-af56-ad16ec6c7e7b", "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "01d2e2a1-5f09-44f7-9fc1-24faa7479b6d", "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "646ea171-dded-4578-8a4d-65e9822892e3", "84b1706c-932a-44c4-ae28-892b28a25b94", "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "1012f107-b8f1-4271-af30-5aed2de89b39", "074e0ded-6ced-4ebd-8b4d-53f55908119d", "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "af491bca-e752-4b44-9c86-df5680533dbc", "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "f0f7be61-9cf5-43be-9836-99d6ef448a18", "b1f73849-6329-4069-bc8f-78a604bb8b23", "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "0b80ade5-6997-4b1d-99a1-71701778ea61", "81ebd28b-9607-4478-bf06-974ed9d53ed7", "dc4576d4-7467-424f-9eee-fd2b02855fe0", "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "e9142d84-fbe0-401d-ac50-3e519fb00c89", "b4dc61f5-6cce-468e-a608-b48b469feaa2", "e6313acd-208c-44fc-a0ff-db85d572e90e", "f3d39c45-de1a-4486-a687-ab126124f744", "97dbf6e2-e436-44d8-abee-4261b24d3e41", "729ce0ea-5d8f-4769-9762-e35de441586d", "0fc35fc3-efe6-4898-8a37-0b233339524f", "c947b146-0abc-4c87-9c64-b17e9d7274a2", "91a2c315-9ee6-4052-a853-6f6a8238f90d", "9525dc73-0327-438c-8c04-13c0e037e9da", "a4694263-59a8-4608-a3a0-6f8d3a51664c", "f37aba28-a9e6-4045-882c-d5004043b337", "5e95028c-5229-4214-afae-d653d573d0ec", "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "f7375e28-5c14-432f-b8d1-1db26c832df3", "0e0255bf-2548-47b8-9582-c0955c9283f5", "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "d65aee4d-2292-4cea-b832-83accd6cfa43", "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "889719ef-dd62-43df-86c3-768fb08dc7c0", "18ee686c-38a3-4f65-9f44-48a077141f42", "af77cf95-c469-471c-b6a0-946c685c4798", "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "4bf943c6-5146-4273-98dd-e958fd1e3abf", "7f741dcf-fc22-4759-87b4-9ae8376676a2", "8a3038e8-9c9d-46f8-b184-66234a160f6f", "7d4aaec2-08ed-4430-8b96-28420e030e04", "75d0a94e-6252-448d-a7be-d953dff527bb", "327f48c1-a6db-4eb8-875a-f6981f1b0183", "5f03babb-12db-4eec-8c82-7b4cb5580868", "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "cd1f961e-0b96-436b-b7c6-38da4583ec00", "7b4f794b-590a-4ad4-ba18-7964a2832205", "438025f9-5856-4663-83f7-52f878a70a50", "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "213d6a77-3d55-4ce8-ba74-fcfef741974e", "aaafa146-074c-11eb-adc1-0242ac120002", "2433a154-bb3d-42e4-86c3-a26bdac91c45", "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "4f647cfa-b598-4e12-ad69-c68dd16caef8", "16c37b52-b141-42a5-a3ea-bbe098444397", "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "17769c90-230e-488b-a463-e05c08e9d48f", "222129f7-f4dc-4568-b0d2-22440a9639ba", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "e173ad47-4388-4012-ae62-bd13f71c18a8", "48bbc537-b652-4b4e-bd1d-281172df448f", "1edff897-9146-48d2-9066-52e8d8f80a2f", "c248c896-e412-4279-8c15-1c558067b6fa", "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "2cf29f11-e356-4f61-98c0-1bdb9393d6da", "d522eca2-2973-4391-a3e0-ef0374321dae", "62e0298b-e994-4189-bc87-bc699aa62d97", "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "a537cfc3-4297-4789-92b5-345bfd845ad0", "74a12f18-505c-4114-8d0b-8448dd5485c6", "4a2a2c3e-209f-4d01-b513-4155a540b469", "32410e29-5f94-4568-b6a3-d91a8adad863", "f64e5c19-879c-4bae-b471-6d84c8339677", "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "536e2947-3729-478c-9903-745aaffe60d2", "40aa399c-7b02-4715-8e5f-73572b493f33", "883835a7-df45-43e4-bf1d-4268768afda4", "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "b57ba453-b384-4ab9-9f40-1038086b4e53", "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "3bad990e-4848-4a78-9530-b427d854aac0", "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "09576804-7a05-458e-a817-eb718ca91f54", "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "b0524451-19af-4efa-a46f-562a977f792e", "b96b2031-7c17-4473-afe7-a30ce714db29", "37c1333a-a0db-48be-b64b-7393b2386e3b", "81325ce1-be01-4250-944f-b4789644556f", "3abd6094-7027-475f-9630-8ab9be7b9725", "d9047477-0359-48c9-b8c7-792cedcdc9c4", "0a98a10c-685d-4ab0-bddc-b6bdd1d48458", "56d19cb4-6414-4769-9644-1ed35ffbb148", "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "5cdb711b-5740-4fb2-ba88-f7945027afac", "164eda96-11b2-430b-85ff-6a265c15bf32", "a58353df-af43-4753-bad0-cd83ef35eef5", "56321594-9087-49d9-bf10-524fe8479452"], "uberAgent 7.1": ["dfe8b941-4e54-4242-b674-6b613d521962", "23c43900-e732-45a4-8354-63e4a6c187ce", "47d65ac0-c06f-4ba2-a2e3-d263139d0f51", "65d506d3-fcfe-4071-b4b2-bcefe721bbbb", "5d0fdb62-f225-42fb-8402-3dfe64da468a", "b743623c-2776-40e0-87b1-682b975d0ca5", "089dbdf6-b960-4bcc-90e3-ffc3480c20f6", "2d5e7a8b-f484-4a24-945d-7f0efd52eab0", "58800443-f9fc-4d55-ae0c-98a3966dfb97", "5de06a6f-673a-4fc0-8d48-bcfe3837b033", "1cf98dc2-fcb0-47c9-8aea-654c9284d1ae", "7ed2c9f7-c59d-4c82-a7e2-f859aa676099", "b120b587-a4c2-4b94-875d-99c9807d6955", "7c3b43d8-d794-47d2-800a-d277715aa460", "9a7a0393-2144-4626-9bf1-7c2f5a7321db", "2316929c-01aa-438c-970f-099145ab1ee6", "6d8a7cf1-8085-423b-b87d-7e880faabbdf", "2c95fa8a-8b8d-4787-afce-7117ceb8e3da", "95361ce5-c891-4b0a-87ca-e24607884a96", "1bc2e6c5-0885-472b-bed6-be5ea8eace55", "acf61bd8-d814-4272-81f0-a7a269aa69aa", "ddf36b67-e872-4507-ab2e-46bda21b842c", "bf241472-f014-4f01-a869-96f99330ca8c", "e0cfaecd-602d-41af-988d-f6ccebb2af26", "69483748-1525-4a6c-95ca-90dc8d431b68", "508a9374-ad52-4789-b568-fc358def2c65", "b9d9b652-d8ed-4697-89a2-a1186ee680ac", "f1408a58-0e94-4165-b80a-da9f96cf6fc3", "13db8d2e-7723-4c2c-93c1-a4d36994f7ef", "be2e3a5c-9cc7-4d02-842a-68e9cb26ec49", "84bae5d4-b518-4ae0-b331-6d4afd34d00f", "652c098d-dc11-4ba6-8566-c20e89042f2b", "0877ed01-da46-4c49-8476-d49cdd80dfa7", "234dc5df-40b5-49d1-bf53-0d44ce778eca", "10227522-8429-47e6-a301-f2b2d014e7ad", "719c22d7-c11a-4f2c-93a6-2cfdd5412f68", "a753a6af-3126-426d-8bd0-26ebbcb92254", "0ed75b9c-c73b-424d-9e7d-496cd565fbe0", "51719bf5-e4fd-4e44-8ba8-b830e7ac0731", "85de3a19-b675-4a51-bfc6-b11a5186c971", "7794fa3c-edea-4cff-bec7-267dd4770fd7", "4809c683-059b-4935-879d-36835986f8cf", "6ff08e55-ea53-4f27-94a1-eff92e6d9d5c", "53821412-17b0-4147-ade0-14faae67d54b", "6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4", "40b1fbe2-18ea-4ee7-be47-0294285811de", "b22a5b36-2431-493a-8be1-0bae56c28ef3", "ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e", "f5141b6d-9f42-41c6-a7bf-2a780678b29b", "89bb1f97-c7b9-40e8-b52b-7d6afbd67276", "adc9bcc4-c39c-4f6b-a711-1884017bf043", "60f1ce20-484e-41bd-85f4-ac4afec2c541", "0250638a-2b28-4541-86fc-ea4c558fa0c6", "09a910bf-f71f-4737-9c40-88880ba5913d", "821bcf4d-46c7-4b87-bc57-9509d3ba7c11", "9acf45ed-3a26-4062-bf08-56857613eb52", "ff39f1a6-84ac-476f-a1af-37fcdf53d7c0", "3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe", "88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0", "3603f18a-ec15-43a1-9af2-d196c8a7fec6", "f459ccb4-9805-41ea-b5b2-55e279e2424a", "452df256-da78-427a-866f-49fa04417d74", "7f2bb9d5-6395-4de5-969c-70c11fbe6b12", "53b1b378-9b06-4992-b972-dde6e423d2b4", "f68c4a4f-19ef-4817-952c-50dce331f4b0", "b6e2a2e3-2d30-43b1-a4ea-071e36595690", "d7329412-13bd-44ba-a072-3387f804a106", "ec8c4047-fad9-416a-8c81-0f479353d7f6", "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "d13c43f0-f66b-4279-8b2c-5912077c1780", "d2451be2-b582-4e15-8701-4196ac180260", "f40017b3-cb2e-4335-ab5d-3babf679c1de", "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "f354eba5-623b-450f-b073-0b5b2773b6aa", "6414b5cd-b19d-447e-bb5e-9f03940b5784", "ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94", "bdc64095-d59a-42a2-8588-71fd9c9d9abc", "1fbc0671-5596-4e17-8682-f020a0b995dc", "552b6b65-df37-4d3e-a258-f2fc4771ae54", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "333cdbe8-27bb-4246-bf82-b41a0dca4b70", "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "4c21b805-4dd7-469f-b47d-7383a8fcb437", "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "4508a70e-97ef-4300-b62b-ff27992990ea", "857c8db3-c89b-42fb-882b-f681c7cf4da2", "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "3669afd2-9891-4534-a626-e5cf03810a61", "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "7417e29e-c2e7-4cf6-a2e8-767228c64837", "72ca7c75-bf85-45cd-aca7-255d360e423c", "060d5ad4-3153-47bb-8382-43e5e29eda92", "0e0bc253-07ed-43f1-816d-e1b220fe8971", "6e78b74f-c762-4800-82ad-f66787f10c8a", "84b0a8f3-680b-4096-a45b-e9a89221727c", "90ae0469-0cee-4509-b67f-e5efcef040f7", "bf9808c4-d24f-44a2-8398-b65227d406b6", "caa02837-f659-466f-bca6-48bde2826ab4", "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "4fc0deee-0057-4998-ab31-d24e46e0aba4", "e2e01011-5910-4267-9c3b-4149ed5479cf", "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "d2605a99-2218-4894-8fd3-2afb7946514d", "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "a2a3b925-7bb0-433b-b508-db9003263cc4", "68654bf0-4412-43d5-bfe8-5eaa393cd939", "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "952ed57c-8f99-453d-aee0-53a49c22f95d", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "75e508f7-932d-4ebc-af77-269237a84ce1", "50f852e6-af22-4c78-9ede-42ef36aa3453", "8cde342c-ba48-4b74-b615-172c330f2e93", "ea5c131b-380d-49f9-aeb3-920694da4d4b", "a2edbce1-95c8-4291-8676-0d45146862b3", "844f8eb2-610b-42c8-89a4-47596e089663", "6360757a-d460-456c-8b13-74cf0e60cceb", "24b6cf51-6122-469e-861a-22974e9c1e5b", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "9ed5959a-c43c-4c59-84e3-d28628429456", "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "b5de0c9a-6f19-43e0-af4e-55ad01f550af", "fef394cd-f44d-4040-9b18-95d92fe278c0", "48bfd177-7cf2-412b-ad77-baf923489e82", "2092cacb-d77b-4f98-ab0d-32b32f99a054", "ff0f2b05-09db-4095-b96d-1b75ca24894a", "49329257-089d-46e6-af37-4afce4290685", "7707a579-e0d8-4886-a853-ce47e4575aaa", "ee6cea48-c5b6-4304-a332-10fc6446f484", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "e76c8240-d68f-4773-8880-5c6f63595aaf", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "af4c4609-5755-42fe-8075-4effb49f5d44", "9ca2bf31-0570-44d8-a543-534c47c33ed7", "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "6ec86d9e-912e-4726-91a2-209359b999b9", "273a8dd8-3742-4302-bcc7-7df5a80fe425", "90217a70-13fc-48e4-b3db-0d836c5824ac", "3735d5ac-d770-4da0-99ff-156b180bc600", "948a0953-f287-4806-bbcb-3b2e396df89f", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "a1d9eec5-33b2-4177-8d24-27fe754d0812", "613c03ba-0779-4a53-8a1f-47f914a4ded3", "f356a9c4-effd-4608-bbf8-408afd5cd006", "a21bcd7e-38ec-49ad-b69a-9ea17e69509e", "df68f791-ad95-447f-a271-640a0dab9cf8", "e043f529-8514-4205-8ab0-7f7d2927b400", "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "065cceea-77ec-4030-9052-fc0affea7110", "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "36e037c4-c228-4866-b6a3-48eb292b9955", "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3", "e3f673b3-65d1-4d80-9146-466f8b63fa99", "270185ff-5f50-4d6d-a27f-24c3b8c9fef8", "5b2bbc47-dead-4ef7-8908-0cf73fcbecbf", "8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0", "06125661-3814-4e03-bfa2-1e4411c60ac3", "0a1f9d29-6465-4776-b091-7f43b26e4c89", "b1decb61-ed83-4339-8e95-53ea51901720", "a55349d8-9588-4c5a-8e3b-1925fe2a4ffe", "63c779ba-f638-40a0-a593-ddd45e8b1ddc", "ff301988-c231-4bd0-834c-ac9d73b86586", "3eb8c339-a765-48cc-a150-4364c04652bf", "3109530e-ab47-4cc6-a953-cac5ebcc93ae", "6ddab845-b1b8-49c2-bbf7-1a11967f64bc", "407aecb1-e762-4acf-8c7b-d087bcff3bb6", "7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2", "65744385-8541-44a6-8630-ffc824d7d4cc", "d51694fe-484a-46ac-92d6-969e76d60d10", "46612ae6-86be-4802-bc07-39b59feb1309", "f41b0311-44f9-44f0-816d-dd45e39d4bc8", "a5a2d357-1ab8-4675-a967-ef9990a59391", "02773bed-83bf-469f-b7ff-e676e7d78bab", "d353dac0-1b41-46c2-820c-d7d2561fc6ed", "caf02a0a-1e1c-4552-9b48-5e070bd88d11", "68578b43-65df-4f81-9a9b-92f32711a951", "13c02350-4177-4e45-ac17-cf7ca628ff5e", "b8fd0e93-ff58-4cbd-8f48-1c114e342e62", "39f1f9f2-9636-45de-98f6-a4046aa8e4b9", "28a452f3-786c-4fd8-b8f2-bddbe9d616d1", "74babdd6-a758-4549-9632-26535279e654", "fec96f39-988b-4586-b746-b93d59fd1922", "847def9e-924d-4e90-b7c4-5f581395a2b4", "ce7066a6-508a-42d3-995b-2952c65dc2ce", "4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6", "54127bd4-f541-4ac3-afdb-ea073f63f692", "002bdb95-0cf1-46a6-9e08-d38c128a6127", "c7a74c80-ba5a-486e-9974-ab9e682bc5e4", "34746e8c-5fb8-415a-b135-0abc167e912a", "ee63c85c-6d51-4d12-ad09-04e25877a947", "cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca", "1277f594-a7d1-4f28-a2d3-73af5cbeab43", "63e4f530-65dc-49cc-8f80-ccfa95c69d43", "dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c", "2f7979ae-f82b-45af-ac1d-2b10e93b0baa", "059c5af9-5131-4d8d-92b2-de4ad6146712", "7fd164ba-126a-4d9c-9392-0d4f7c243df0", "15904280-565c-4b73-9303-3291f964e7f9", "6902955a-01b7-432c-b32a-6f5f81d8f625", "3ab79e90-9fab-4cdf-a7b2-6522bc742adb", "654fcc6d-840d-4844-9b07-2c3300e54a26", "df6ecb8b-7822-4f4b-b412-08f524b4576c", "cad1fe90-2406-44dc-bd03-59d0b58fe722", "1027d292-dd87-4a1a-8701-2abe04d7783c", "41bb431f-56d8-4691-bb56-ed34e390906f", "de46c52b-0bf8-4936-a327-aace94f94ac6", "576426ad-0131-4001-ae01-be175da0c108", "4e7050dd-e548-483f-b7d6-527ab4fa784d", "3d2a2d59-929c-4b78-8c1a-145dfe9e07b1", "7d604714-e071-49ff-8726-edeb95a70679", "bdd8157d-8e85-4397-bb82-f06cc9c71dbb", "6b269392-9eba-40b5-acb6-55c882b20ba6", "b6f91281-20aa-446a-b986-38a92813a18f", "4aafb0fa-bff5-4b9d-b99e-8093e659c65f", "3da70954-0f2c-4103-adff-b7440368f50e", "e36941d0-c0f0-443f-bc6f-cb2952eb69ea", "6e90ae7a-7cd3-473f-a035-4ebb72d961da", "814ddeca-3d31-4265-8e07-8cc54fb44903", "bd1212e5-78da-431e-95fa-c58e3237a8e6", "9e099d99-44c2-42b6-a6d8-54c3545cab29", "7280c9f3-a5af-45d0-916a-bc01cb4151c9", "75bf09fa-1dd7-4d18-9af9-dd9e492562eb", "8fbf3271-1ef6-4e94-8210-03c2317947f6", "d102b8f5-61dc-4e68-bd83-9a3187c67377", "81315b50-6b60-4d8f-9928-3466e1022515", "2d367498-5112-4ae5-a06a-96e7bc33a211", "8e1cb247-6cf6-42fa-b440-3f27d57e9936", "7047d730-036f-4f40-b9d8-1c63e36d5e62", "2aa0a6b4-a865-495b-ab51-c28249537b75", "65236ec7-ace0-4f0c-82fd-737b04fd4dcb", "e4a74e34-ecde-4aab-b2fb-9112dd01aed0", "614a7e17-5643-4d89-b6fe-f9df1a79641c", "dca1b3e8-e043-4ec8-85d7-867f334b5724", "0b9ad457-2554-44c1-82c2-d56a99c42377", "8c31f563-f9a7-450c-bfa8-35f8f32f1f61", "9b64de98-9db3-4033-bd7a-f51430105f00", "aba15bdd-657f-422a-bab3-ac2d2a0d6f1c", "97aa2e88-555c-450d-85a6-229bcd87efb8", "304afd73-55a5-4bb9-8c21-0b1fc84ea9e4", "69ca12af-119d-44ed-b50f-a47af0ebc364", "b1c50487-1967-4315-a026-6491686d860e", "f0540f7e-2db3-4432-b9e0-3965486744bc", "130c9e58-28ac-4f83-8574-0a4cc913b97e", "92fa78e7-4d39-45f1-91a3-8b23f3f1088d", "33f41cdd-35ac-4ba8-814b-c6a4244a1ad4", "0bcfabcb-7929-47f4-93d6-b33fb67d34d1", "162ab1e4-6874-4564-853c-53ec3ab8be01", "11b1ed55-154d-4e82-8ad7-83739298f720", "c61daa90-3c1e-4f18-af62-8f288b5c9aaf", "fcc6d700-68d9-4241-9a1a-06874d621b06", "f92a6f1e-a512-4a15-9735-da09e78d7273", "7eff1a7f-dd45-4c20-877a-f21e342a7611", "0afecb6e-6223-4a82-99fb-bf5b981e92a5", "f0e2b768-5220-47dd-b891-d57b96fc0ec1", "34986307-b7f4-49be-92f3-e7a4d01ac5db", "9711de76-5d4f-4c50-a94f-21e4e8f8384d", "c3edc6a5-d9d4-48d8-930e-aab518390917", "d5866ddf-ce8f-4aea-b28e-d96485a20d3d", "259e5a6a-b8d2-4c38-86e2-26c5e651361d", "155dbf56-e0a4-4dd0-8905-8a98705045e8", "7fff6773-2baa-46de-a24a-b6eec1aba2d1", "e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f", "0b8baa3f-575c-46ee-8715-d6f28cc7d33c", "2f9356ae-bf43-41b8-b858-4496d83b2acb", "a05baa88-e922-4001-bc4d-8738135f27de", "5b40a734-99b6-4b98-a1d0-1cea51a08ab2", "6e2a900a-ced9-4e4a-a9c2-13e706f9518a", "91174a41-dc8f-401b-be89-7bfc140612a0", "8468111a-ef07-4654-903b-b863a80bbc95", "c048f047-7e2a-4888-b302-55f509d4a91d", "52753ea4-b3a0-4365-910d-36cff487b789", "fccfb43e-09a7-4bd2-8b37-a5a7df33386d", "5f87308a-0a5b-4623-ae15-d8fa1809bc60", "0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b", "a8f866e1-bdd4-425e-a27a-37619238d9c7", "07a99744-56ac-40d2-97b7-2095967b0e03", "3a8da4e0-36c1-40d2-8b29-b3e890d5172a", "0e29e3a7-1ad8-40aa-b691-9f82ecd33d66", "d7b50671-d1ad-4871-aa60-5aa5b331fe04", "409f8a98-4496-4aaa-818a-c931c0a8b832", "a6976974-ea6f-4e97-818e-ea08625c52cb", "3a9fa2ec-30bc-4ebd-b49e-7c9cff225502", "b4926b47-a9d7-434c-b3a0-adc3fa0bd13e", "28208707-fe31-437f-9a7f-4b1108b94d2e", "e15b518d-b4ce-4410-a9cd-501f23ce4a18", "760e75d8-c3b5-409b-a9bf-6130b4c4603f", "e0b06658-7d1d-4cd3-bf15-03467507ff7c", "4e87b8e2-2ee9-4b2a-a715-4727d297ece0", "bb09dd3e-2b78-4819-8e35-a7c1b874e449", "4c7f49ee-2638-43bb-b85b-ce676c30b260", "4358e5a5-7542-4dcb-b9f3-87667371839b", "62ed5b55-f991-406a-85d9-e8e8fdf18789", "e074832a-eada-4fd7-94a1-10642b130e16", "16fe46bb-4f64-46aa-817d-ff7bec4a2352", "8d5aca11-22b3-4f22-b7ba-90e60533e1fb", "3d0ed417-3d94-4963-a562-4a92c940656a", "7892ec59-c5bb-496d-8968-e5d210ca3ac4", "145095eb-e273-443b-83d0-f9b519b7867b", "5d756aee-ad3e-4306-ad95-cb1abec48de2", "48ea844d-19b1-4642-944e-fe39c2cc1fec", "8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9", "1908fcc1-1b92-4272-8214-0fbaf2fa5163", "a10a2c40-2c4d-49f8-b557-1a946bc55d9d", "736ffa74-5f6f-44ca-94ef-1c0df4f51d2a", "bbb7e38c-0b41-4a11-b306-d2a457b7ac2b", "fed85bf9-e075-4280-9159-fbe8a023d6fa", "0e20c89d-2264-44ae-8238-aeeaba609ece", "56e05d41-ce99-4ecd-912d-93f019ee0b71", "b5b78988-486d-4a80-b991-930eff3ff8bf", "805c55d9-31e6-4846-9878-c34c75054fe9", "80e1f67a-4596-4351-98f5-a9c3efabac95", "e3845023-ca9a-4024-b2b2-5422156d5527", "e8a52bbd-bced-459f-bd93-64db45ce7657", "fc4f4817-0c53-4683-a4ee-b17a64bc1039", "f748c45a-f8d3-4e6f-b617-fe176f695b8f", "6ea858a8-ba71-4a12-b2cc-5d83312404c7", "93a19907-d4f9-4deb-9f91-aac4692776a6", "3215aa19-f060-4332-86d5-5602511f3ca8", "117d3d3a-755c-4a61-b23e-9171146d094c", "93d94efc-d7ad-4161-ad7d-1638c4f908d8", "318557a5-150c-4c8d-b70e-a9910e199857", "c3e76af5-4ce0-4a14-9c9a-25ceb8fda182", "f331aa1f-8c53-4fc3-b083-cc159bc971cb", "602a1f13-c640-4d73-b053-be9a2fa58b96", "9f2cc74d-78af-4eb2-bb64-9cd1d292b87b", "c3dbbc9f-ef1d-470a-a90a-d343448d5875", "edf3485d-dac4-4d50-90e4-b0e5813f7e60", "1d08ac94-400d-4469-a82f-daee9a908849", "7e9cf7b6-e827-11ed-a05b-15959c120003", "fa5b1358-b040-4403-9868-15f7d9ab6329", "c649a6c7-cd8c-4a78-9c04-000fc76df954", "e81528db-fc02-45e8-8e98-4e84aba1f10b", "7e9cf7b6-e827-11ed-a05b-0242ac120003", "a66bc059-c370-472c-a0d7-f8fd1bf9d583", "67add051-9ee7-4ad3-93ba-42935615ae8d", "295c9289-acee-4503-a571-8eacaef36b28", "72cd00d6-490c-4650-86ff-1d11f491daa1", "05296024-fe8a-4baf-8f3d-9a5f5624ceb2", "1a42dfa6-6cb2-4df9-9b48-295be477e835", "10cb6535-b31d-4512-9962-513dcbc42cc1", "7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8", "679085d5-f427-4484-9f58-1dc30a7c426d", "2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75", "39b64854-5497-4b57-a448-40977b8c9679", "a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f", "77564cc2-7382-438b-a7f6-395c2ae53b9a", "f239b326-2f41-4d6b-9dfa-c846a60ef505", "caa06de8-fdef-4c91-826a-7f9e163eef4b", "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "2158f96f-43c2-43cb-952a-ab4580f32382", "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "d797268e-28a9-49a7-b9a8-2f5039011c5c", "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "f426547a-e0f7-441a-b63e-854ac5bdf54d", "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "6d3a3952-6530-44a3-8554-cf17c116c615", "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "4c0aaedc-154c-4427-ada0-d80ef9c9deb6", "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "a4824fca-976f-4964-b334-0621379e84c4", "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "92a974db-ab84-457f-9ec0-55db83d7a825", "f9578658-9e71-4711-b634-3f9b50cd3c06", "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "f5240972-3938-4e56-8e4b-e33893176c1f", "fff9d2b7-e11c-4a69-93d3-40ef66189767", "cc9d3712-6310-4320-b2df-7cb408274d53", "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "327ff235-94eb-4f06-b9de-aaee571324be", "42a993dd-bb3e-48c8-b372-4d6684c4106c", "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "36210e0d-5b19-485d-a087-c096088885f0", "1723e720-616d-4ddc-ab02-f7e3685a4713", "90fb5e62-ca1f-4e22-b42e-cc521874c938", "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "57c4bf16-227f-4394-8ec7-1b745ee061c3", "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "0ea52357-cd59-4340-9981-c46c7e900428", "7aa7009a-28b9-4344-8c1f-159489a390df", "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "9719a8aa-401c-41af-8108-ced7ec9cd75c", "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "587254ee-a24b-4335-b3cd-065c0f1f4baa", "98b53e78-ebaf-46f8-be06-421aafd176d9", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "b5746143-59d6-4603-8d06-acbd60e166ee", "c09dad97-1c78-4f71-b127-7edb2b8e491a", "551d9c1f-816c-445b-a7a6-7a3864720d60", "e31033fc-33f0-4020-9a16-faf9b31cbf08", "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "8e3c7994-131e-4ba5-b6ea-804d49113a26", "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "e32d4572-9826-4738-b651-95fa63747e8a", "043c4b8b-3a54-4780-9682-081cb6b8185c", "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "c363385c-f75d-4753-a108-c1a8e28bdbda", "5cb299fc-5fb1-4d07-b989-0644c68b6043", "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "811f459f-9231-45d4-959a-0266c6311987", "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "7d6d30b8-5b91-4b90-a891-46cccaf29598", "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "087790e3-3287-436c-bccf-cbd0184a7db1", "6812a10b-60ea-420c-832f-dfcc33b646ba", "84b14121-9d14-416e-800b-f3b829c5a14d", "32e280f1-8ad4-46ef-9e80-910657611fbc", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "9cfc00b6-bfb7-49ce-9781-ef78503154bb", "3f5491e2-8db8-496b-9e95-1029fce852d4", "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "02030f2f-6199-49ec-b258-ea71b07e03dc", "74403157-20f5-415d-89a7-c505779585cf", "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "4d7cda18-1b12-4e52-b45c-d28653210df8", "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "c9783e20-4793-4164-ba96-d9ee483992c4", "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "94771a71-ba41-4b6e-a757-b531372eaab6", "2f869d59-7f6a-4931-992c-cce556ff2d53", "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "1775e15e-b61b-4d14-a1a3-80981298085a", "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "42b1a5b8-353f-4f10-b256-39de4467faff", "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "9292293b-8496-4715-9db6-37028dcda4b3", "52788a70-f1da-40dd-8fbd-73b5865d6568", "349d891d-fef0-4fe4-bc53-eee623a15969", "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "6f3e2987-db24-4c78-a860-b4f4095a7095", "1ec65a5f-9473-4f12-97da-622044d6df21", "d042284c-a296-4988-9be5-f424fadcc28c", "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "1327381e-6ab0-4f38-b583-4c1b8346a56b", "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "9ec9fb1b-e059-4489-9642-f270c207923d", "058f4380-962d-40a5-afce-50207d36d7e2", "fe63010f-8823-4864-a96b-a7b4a0f7b929", "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "c86133ad-4725-4bd0-8170-210788e0a7ba", "f5d19838-41b5-476c-98d8-ba8af4929ee2", "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "82880171-b475-4201-b811-e9c826cd5eaa", "023c654f-8f16-44d9-bb2b-00ff36a62af9", "d557dc06-62e8-4468-a8e8-7984124908ce", "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "a642964e-bead-4bed-8910-1bb4d63e3b4d", "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "e4a6b256-3e47-40fc-89d2-7a477edd6915", "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "9fff585c-c33e-4a86-b3cd-39312079a65f", "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "fa00b701-44c6-4679-994d-5a18afa8a707", "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "313d6012-51a0-4d93-8dfc-de8553239e25", "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "8d63dadf-b91b-4187-87b6-34a1114577ea", "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "b36d01a3-ddaf-4804-be18-18a6247adfcd", "aaf46cdc-934e-4284-b329-34aa701e3771", "575dce0c-8139-4e30-9295-1ee75969f7fe", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "a1473adb-5338-4a20-b4c3-126763e2d3d3", "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "241e802a-b65e-484f-88cd-c2dc10f9206d", "fd877b94-9bb5-4191-bb25-d79cbd93c167", "d047726b-c71c-4048-a99b-2e2f50dc107d", "40b95d31-1afc-469e-8d34-9a3a667d058e", "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "e6c54d94-498c-4562-a37c-b469d8e9a275", "64760eef-87f7-4ed3-93fd-655668ea9420", "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "da2738f2-fadb-4394-afa7-0a0674885afa", "88872991-7445-4a22-90b2-a3adadb0e827", "f576a613-2392-4067-9d1a-9345fb58d8d1", "431a1fdb-4799-4f3b-91c3-a683b003fc49", "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "4931188c-178e-4ee7-a348-39e8a7a56821", "85ff530b-261d-48c6-a441-facaa2e81e48", "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "8cbc9475-8d05-4e27-9c32-df960716c701", "378a05d8-963c-46c9-bcce-13c7657eac99", "e8d34729-86a4-4140-adfd-0a29c2106307", "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "e568650b-5dcd-4658-8f34-ded0b1e13992", "f208d6d8-d83a-4c2c-960d-877c37da84e5", "514e4c3a-c77d-4cde-a00f-046425e2301e", "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "01aeb693-138d-49d2-9403-c4f52d7d3d62", "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "83865853-59aa-449e-9600-74b9d89a6d6e", "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "b53317a0-8acf-4fd1-8de8-a5401e776b96", "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "10344bb3-7f65-46c2-b915-2d00d47be5b0", "185d7418-f250-42d0-b72e-0c8b70661e93", "379fa130-190e-4c3f-b7bc-6c8e834485f3", "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "e83e8899-c9b2-483b-b355-5decc942b959", "6385697e-9f1b-40bd-8817-f4a91f40508e", "24357373-078f-44ed-9ac4-6d334a668a11", "15619216-e993-4721-b590-4c520615a67d", "d2eb17db-1d39-41dc-b57f-301f6512fa75", "5a6e1e16-07de-48d8-8aae-faa766c05e88", "5a3164f2-b373-4152-93cf-090b13c12d27", "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "cbec226f-63d9-4eca-9f52-dfb6652f24df", "5b768e71-86f2-4879-b448-81061cbae951", "ca621ba5-54ab-4035-9942-d378e6fcde3c", "98767d61-b2e8-4d71-b661-e36783ee24c1", "a85ffc3a-e8fd-4040-93bf-78aff284d801", "88f46b67-14d4-4f45-ac2c-d66984f22191", "83809e84-4475-4b69-bc3e-4aad8568612f", "ce72ef99-22f1-43d4-8695-419dcb5d9330", "add64136-62e5-48ea-807e-88638d02df1e", "04936b66-3915-43ad-a8e5-809eadfd1141", "847d5ff3-8a31-4737-a970-aeae8fe21765", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "c49c5062-0966-4170-9efd-9968c913a6cf", "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "850d55f9-6eeb-4492-ad69-a72338f65ba4", "d87bd452-6da1-456e-8155-7dc988157b7d", "5bb68627-3198-40ca-b458-49f973db8752", "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "caf201a9-c2ce-4a26-9c3a-2b9525413711", "4e762605-34a8-406d-b72e-c1a089313320", "d3c3861d-c504-4c77-ba55-224ba82d0118", "2ddef153-167b-4e89-86b6-757a9e65dcac", "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "8a582fe2-0882-4b89-a82a-da6b2dc32937", "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "f35c5d71-b489-4e22-a115-f003df287317", "fbd7c32d-db2a-4418-b92c-566eb8911133", "87a476dc-0079-4583-a985-dee7a20a03de", "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "38879043-7e1e-47a9-8d46-6bec88e201df", "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "f9999590-1f94-4a34-a91e-951e47bedefd", "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "4eddc365-79b4-43ff-a9d7-99422dc34b93", "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "220457c1-1c9f-4c2e-afe6-9598926222c1", "bf361876-6620-407a-812f-bfe11e51e924", "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "c79da740-5030-45ec-a2e0-479e824a562c", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "a197e378-d31b-41c0-9635-cfdf1c1bb423", "737e618a-a410-49b5-bec3-9e55ff7fbc15", "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "30edb182-aa75-42c0-b0a9-e998bb29067c", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "eb1c4225-1c23-4241-8dd4-051389fde4ce", "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "e312efd0-35a1-407f-8439-b8d434b438a6", "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "ba42babc-0666-4393-a4f7-ceaf5a69191e", "c27515df-97a9-4162-8a60-dc0eeb51b775", "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "0f6da907-5854-4be6-859a-e9958747b0aa", "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "5edc2273-c26f-406c-83f3-f4d948e740dd", "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "0f0450f3-8b47-441e-a31b-15a91dc243e2", "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "817f252c-5143-4dae-b418-48c3e9f63728", "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "07e3cb2c-0608-410d-be4b-1511cb1a0448", "138d3531-8793-4f50-a2cd-f291b2863d78", "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "ddeff553-5233-4ae9-bbab-d64d2bd634be", "e212d415-0e93-435f-9e1a-f29005bb4723", "55f0a3a1-846e-40eb-8273-677371b8d912", "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "e7888eb1-13b0-4616-bd99-4bc0c2b054b9", "6ba5a05f-b095-4f0a-8654-b825f4f16334", "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "7cce6fc8-a07f-4d84-a53e-96e1879843c9", "45d3a03d-f441-458c-8883-df101a3bb146", "871b9555-69ca-4993-99d3-35a59f9f3599", "f2c64357-b1d2-41b7-849f-34d2682c0fad", "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "12fbff88-16b5-4b42-9754-cd001a789fb3", "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "0403d67d-6227-4ea8-8145-4e72db7da120", "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "bd1c6866-65fc-44b2-be51-5588fcff82b9", "1114e048-b69c-4f41-bc20-657245ae6e3f", "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "27aec9c9-dbb0-4939-8422-1742242471d0", "727454c0-d851-48b0-8b89-385611ab0704", "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "d20ee2f4-822c-4827-9e15-41500b1fff10", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "efec536f-72e8-4656-8960-5e85d091345b", "6f4191bb-912b-48a8-9ce7-682769541e6d", "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "517490a7-115a-48c6-8862-1a481504d5a8", "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "49d9671b-0a0a-4c09-8280-d215bfd30662", "05f3c945-dcc8-4393-9f3d-af65077a8f86", "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "554601fb-9b71-4bcc-abf4-21a611be4fde", "7b10f171-7f04-47c7-9fa2-5be43c76e535", "45239e6a-b035-4aaf-b339-8ad379fcb67e", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "7be5fb68-f9ef-476d-8b51-0256ebece19e", "6e22722b-dfb1-4508-a911-49ac840b40f8", "9ccba514-7cb6-4c5c-b377-700758f2f120", "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "7a74da6b-ea76-47db-92cc-874ad90df734", "f11f2808-adb4-46c0-802a-8660db50fa99", "43e32da2-fdd0-4156-90de-50dfd62636f9", "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "a20def93-0709-4eae-9bd2-31206e21e6b2", "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "6004abd0-afa4-4557-ba90-49d172e0a299", "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "970823b7-273b-460a-8afc-3a6811998529", "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "15b75071-74cc-47e0-b4c6-b43744a62a2b", "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "f99abdf0-6283-4e71-bd2b-b5c048a94743", "0a13e132-651d-11eb-ae93-0242ac130002", "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "e9f55347-2928-4c06-88e5-1a7f8169942e", "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "6a69f62d-ce75-4b57-8dce-6351eb55b362", "8b0e12da-d3c3-49db-bb4f-256703f380e5", "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "98a96a5a-64a0-4c42-92c5-489da3866cb0", "47e4bab7-c626-47dc-967b-255608c9a920", "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "40b19fa6-d835-400c-b301-41f3a2baacaf", "71158e3f-df67-472b-930e-7d287acaa3e1", "f44800ac-38ec-471f-936e-3fa7d9c53100", "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "24c8392b-aa3c-46b7-a545-43f71657fe98", "88f680b8-070e-402c-ae11-d2914f2257f1", "15434e33-5027-4914-88d5-3d4145ec25a9", "b98d0db6-511d-45de-ad02-e82a98729620", "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "0bbc6369-43e3-453d-9944-cae58821c173", "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "b7966f4a-b333-455b-8370-8ca53c229762", "43fa5350-db63-4b8f-9a01-789a427074e1", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "ec290c06-9b6b-4338-8b6b-095c0f284f10", "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "d4498716-1d52-438f-8084-4a603157d131", "b222df08-0e07-11eb-adc1-0242ac120002", "e1693bc8-7168-4eab-8718-cdcaa68a1738", "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "d3b70aad-097e-409c-9df2-450f80dc476b", "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "312d0384-401c-4b8b-abdf-685ffba9a332", "cc368ed0-2411-45dc-a222-510ace303cb2", "42333b2c-b425-441c-b70e-99404a17170f", "0e4164da-94bc-450d-a7be-a4b176179f1f", "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "ebef4391-1a81-4761-a40a-1db446c0e625", "f26307d8-14cd-47e3-a26b-4b4769f24af6", "03cc0c25-389f-4bf8-b48d-11878079f1ca", "8834e2f7-6b4b-4f09-8906-d2276470ee23", "7090adee-82e2-4269-bd59-80691e7c6338", "c74c0390-3e20-41fd-a69a-128f0275a5ea", "b6457d63-d2a2-4e29-859d-4e7affc153d1", "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "5f6a601c-2ecb-498b-9c33-660362323afa", "aa8e035d-7be4-48d3-a944-102aec04400d", "b243b280-65fe-48df-ba07-6ddea7646427", "236d8e89-ed95-4789-a982-36f4643738ba", "277a4393-446c-449a-b0ed-7fdc7795244c", "4fe074b4-b833-4081-8f24-7dcfeca72b42", "68bcd73b-37ef-49cb-95fc-edc809730be6", "86588b36-c6d3-465f-9cee-8f9093e07798", "502b42de-4306-40b4-9596-6f590c81f073", "0a99eb3e-1617-41bd-b095-13dc767f3def", "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "07f8bdc2-c9b3-472a-9817-5a670b872f53", "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "28ac00d6-22d9-4a3c-927f-bbd770104573", "452bce90-6fb0-43cc-97a5-affc283139b3", "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "ce7cf472-6fcc-490a-9481-3786840b5d9b", "c6fb44c6-71f5-49e6-9462-1425d328aee3", "9c0295ce-d60d-40bd-bd74-84673b7592b1", "0a4f6091-223b-41f6-8743-f322ec84930b", "98c5aeef-32d5-492f-b174-64a691896d25", "6fe4aa1e-0531-4510-8be2-782154b73b48", "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "d78b5d61-187d-44b6-bf02-93486a80de5a", "e9b61244-893f-427c-b287-3e708f321c6b", "70bc5215-526f-4477-963c-a47a5c9ebd12", "b6e04788-29e1-4557-bb14-77f761848ab8", "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "0685b176-c816-4837-8e7b-1216f346636b", "e84d89c4-f544-41ca-a6af-4b92fd38b023", "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "023394c4-29d5-46ab-92b8-6a534c6f447b", "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "ebea773c-a8f1-42ad-a856-00cb221966e8", "0b7163dc-7eee-4960-af17-c0cd517f92da", "98dedfdd-8333-49d4-9f23-d7018cccae53", "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "f24bcaea-0cd1-11eb-adc1-0242ac120002", "ccb5742c-c248-4982-8c5c-5571b9275ad3", "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "4abc0ec4-db5a-412f-9632-26659cddf145", "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "5cddf373-ef00-4112-ad72-960ac29bac34", "37db85d1-b089-490a-a59a-c7b6f984f480", "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "f1edd233-30b5-4823-9e6a-c4171b24d316", "e92a4287-e072-4a40-9739-370c106bb750", "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "8bc64091-6875-4881-aaf9-7bd25b5dda08", "56c217c3-2de2-479b-990f-5c109ba8458f", "eee00933-a761-4cd0-be70-c42fe91731e7", "bab049ca-7471-4828-9024-38279a4c04da", "c3a99af4-35a9-4668-879e-c09aeb4f2bdf", "d7654f02-e04b-4934-9838-65c46f187ebc", "2a072a96-a086-49fa-bcb5-15cc5a619093", "883faa95-175a-4e22-8181-e5761aeb373c", "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "63d1ccc0-2a43-4f4b-9289-361b308991ff", "4f154fb6-27d1-4813-a759-78b93e0b9c48", "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "33be4333-2c6b-44f4-ae28-102cdbde0a31", "395907ee-96e5-4666-af2e-2ca91688e151", "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "b0ce780f-10bd-496d-9067-066d23dc3aa5", "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "79b06761-465f-4f88-9ef2-150e24d3d737", "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "c615d676-f655-46b9-b913-78729021e5d7", "b19146a3-25d4-41b4-928b-1e2a92641b1b", "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "e6474a1b-5390-49cd-ab41-8d88655f7394", "692f0bec-83ba-4d04-af7e-e884a96059b6", "93671f99-04eb-4ab4-a161-70d446a84003", "0d5675be-bc88-4172-86d3-1e96a4476536", "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "4281cb20-2994-4580-aa63-c8b86d019934", "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "a34f79a3-8e5f-4cc3-b765-de00695452c2", "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "5589ab4f-a767-433c-961d-c91f3f704db1", "e8a95b5e-c891-46e2-b33a-93937d3abc31", "c86500e9-a645-4680-98d7-f882c70c1ea3", "58f50261-c53b-4c88-bd12-1d71f12eda4c", "34ebb878-1b15-4895-b352-ca2eeb99b274", "7a02e22e-b885-4404-b38b-1ddc7e65258a", "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "24de4f3b-804c-4165-b442-5a06a2302c7e", "731231b9-0b5d-4219-94dd-abb6959aa7ea", "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "d7bcd677-645d-4691-a8d4-7a5602b780d1", "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "6e897651-f157-4d8f-aaeb-df8151488385", "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "9847f263-4a81-424f-970c-875dab15b79b", "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "4b046706-5789-4673-b111-66f25fe99534", "73bba97f-a82d-42ce-b315-9182e76c57b1", "646bc99f-6682-4b47-a73a-17b1b64c9d34", "6c96fc76-0eb1-11eb-adc1-0242ac120002", "7050bba1-1aed-454e-8f73-3f46f09ce56a", "744a188b-0415-4792-896f-11ddb0588dbc", "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "faa48cae-6b25-4f00-a094-08947fef582f", "70ad0861-d1fe-491c-a45f-fa48148a300d", "a16980c2-0c56-4de0-9a79-17971979efdd", "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "954f0af7-62dd-418f-b3df-a84bc2c7a774", "a7ee1722-c3c5-aeff-3212-c777e4733217", "1dde5376-a648-492e-9e54-4241dd9b0c7f", "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "10c14723-61c7-4c75-92ca-9af245723ad2", "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "41421f44-58f9-455d-838a-c398859841d4", "ae9b0bd7-8888-4606-b444-0ed7410cb728", "8de1cbe8-d6f5-496d-8237-5f44a721c7a0", "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "43103702-5886-11ed-9b6a-0242ac120002", "16905e21-66ee-42fe-b256-1318ada2d770", "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "a7c3d773-caef-227e-a7e7-c2f13c622329", "214641c2-c579-4ecb-8427-0cf19df6842e", "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "07aa184a-870d-413d-893a-157f317f6f58", "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "f548a603-c9f2-4c89-b511-b089f7e94549", "93199800-b52a-4dec-b762-75212c196542", "526be59f-a573-4eea-b5f7-f0973207634d", "6345b048-8441-43a7-9bed-541133633d7a", "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "25676e10-2121-446e-80a4-71ff8506af47", "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "ac1c92b4-ac81-405a-9978-4604d78cc47e", "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "bdeb2cff-af74-4094-8426-724dc937f20a", "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "a383dec4-deec-4e6e-913b-ed9249670848", "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "ac20ae82-8758-4f38-958e-b44a3140ca88", "54786ddc-5b8a-11ed-9b6a-0242ac120002", "41ca393d-538c-408a-ac27-cf1e038be80c", "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "cd71385d-fd9b-4691-9b98-2b1f7e508714", "c8a180d6-47a3-4345-a609-53f9c3d834fc", "044ba588-dff4-4918-9808-3f95e8160606", "1af57a4b-460a-4738-9034-db68b880c665", "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "1dd05363-104e-4b4a-b963-196a534b03a1", "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "84b1ecf9-6eff-4004-bafb-bae5c0e251b2", "204b17ae-4007-471b-917b-b917b315c5db", "50d66fb0-03f8-4da0-8add-84e77d12a020", "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "c2b86e67-b880-4eec-b045-50bc98ef4844", "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "e593cf51-88db-4ee1-b920-37e89012a3c9", "90d6bd71-dffb-4989-8d86-a827fedd6624", "8202070f-edeb-4d31-a010-a26c72ac5600", "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "3268b746-88d8-4cd3-bffc-30077d02c787", "18988e1b-9087-4f8a-82fe-0414dce49878", "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "f53714ec-5077-420e-ad20-907ff9bb2958", "f117933c-980c-4f78-b384-e3d838111165", "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "a29c1813-ab1f-4dde-b489-330b952e91ae", "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "b655a06a-31c0-477a-95c2-3726b83d649d", "21d856f9-9281-4ded-9377-51a1a6e2a432", "b66474aa-bd92-4333-a16c-298155b120df", "b2309017-4235-44fe-b5af-b15363011957", "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "62510e69-616b-4078-b371-847da438cc03", "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "285b85b1-a555-4095-8652-a8a4106af63f", "84f52741-8834-4a8c-a413-2eb2269aa6c8", "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "be344333-921d-4c4d-8bb8-e584cf584780", "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "fb843269-508c-4b76-8b8d-88679db22ce7", "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "de587dce-915e-4218-aac4-835ca6af6f70", "c7942406-33dd-4377-a564-0f62db0593a3", "ab9e3b40-0c85-4ba1-aede-455d226fd124", "ef61af62-bc74-4f58-b49b-626448227652", "a20391f8-76fb-437b-abc0-dba2df1952c6", "899133d5-4d7c-4a7f-94ee-27355c879d90", "1ac8666b-046f-4201-8aba-1951aaec03a3", "1c67a717-32ba-409b-a45d-0fb704a73a81", "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "eca49c87-8a75-4f13-9c73-a5a29e845f03", "435e10e4-992a-4281-96f3-38b11106adde", "b3512211-c67e-4707-bedc-66efc7848863", "c15a46a0-07d4-4c87-b4b6-89207835a83b", "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "1f0f6176-6482-4027-b151-00071af39d7e", "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "9257c05b-4a4a-48e5-a670-b7b073cf401b", "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "99793437-3e16-439b-be0f-078782cf953d", "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "ac175779-025a-4f12-98b0-acdaeb77ea85", "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "90d50722-0483-4065-8e35-57efaadd354d", "180c7c5c-d64b-4a63-86e9-68910451bc8b", "d55b793d-f847-4eea-b59a-5ab09908ac90", "aef9d1f1-7396-4e92-a927-4567c7a495c1", "6c6d9280-e6d0-4b9d-80ac-254701b64916", "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "9212f354-7775-4e28-9c9f-8f0a4544e664", "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "ffa6861c-4461-4f59-8a41-578c39f3f23e", "a0459f02-ac51-4c09-b511-b8c9203fc429", "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "534f2ef7-e8a2-4433-816d-c91bccde289b", "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "84232095-ecca-4015-b0d7-7726507ee793", "4e2ed651-1906-4a59-a78a-18220fca1b22", "96036718-71cc-4027-a538-d1587e0006a7", "60f16a96-db70-42eb-8f76-16763e333590", "5afee48e-67dd-4e03-a783-f74259dcf998", "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "771d1eb5-9587-4568-95fb-9ec44153a012", "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "e28a5a99-da44-436d-b7a0-2afc20a5f413", "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "68d37776-61db-42f5-bf54-27e87072d17e", "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "d2b749ee-4225-417e-b20e-a8d2193cbb84", "1193d960-2369-499f-a158-7b50a31df682", "6b65c28e-11f3-46cb-902a-68f2cafaf474", "242301bc-f92f-4476-8718-78004a6efd9f", "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "52d097e2-063e-4c9c-8fbb-855c8948d135", "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "647c7b9e-d784-4fda-b9a0-45c565a7b729", "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "bb76d96b-821c-47cf-944b-7ce377864492", "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "1816994b-42e1-4fb1-afd2-134d88184f71", "12827a56-61a4-476a-a9cb-f3068f191073", "32b96012-7892-429e-b26c-ac2bf46066ff", "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "f4bbd493-b796-416e-bbf2-121235348529", "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "d06be4b9-8045-428b-a567-740a26d9db25", "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "65c3ca2c-525f-4ced-968e-246a713d164f", "347906f3-e207-4d18-ae5b-a9403d6bcdef", "a29808fd-ef50-49ff-9c7a-59a9b040b404", "e66779cc-383e-4224-a3a4-267eeb585c40", "85c312b7-f44d-4a51-a024-d671c40b49fc", "6da2c9f5-7c53-401b-aacb-92c040ce1215", "6bd75993-9888-4f91-9404-e1e4e4e34b77", "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "ff992eac-6449-4c60-8c1d-91c9722a1d48", "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "208748f7-881d-47ac-a29c-07ea84bf691d", "89ca78fd-b37c-4310-b3d3-81a023f83936", "a2910908-e86f-4687-aeba-76a5f996e652", "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "9c14c9fa-1a63-4a64-8e57-d19280559490", "221b251a-357a-49a9-920a-271802777cc0", "50919691-7302-437f-8e10-1fe088afa145", "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "f14e169e-9978-4c69-acb3-1cff8200bc36", "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "1c8774a0-44d4-4db0-91f8-e792359c70bd", "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "9fc3072c-dc8f-4bf7-b231-18950000fadd", "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "ada4b0c4-758b-46ac-9033-9004613a150d", "584bca0f-3608-4402-80fd-4075ff6072e3", "9a132afa-654e-11eb-ae93-0242ac130002", "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "a70dcb37-3bee-453a-99df-d0c683151be6", "85b0b087-eddf-4a2b-b033-d771fa2b9775", "2267fe65-0681-42ad-9a6d-46553d3f3480", "28c8f68b-098d-45af-8d43-8089f3e35403", "cd8c163e-a19b-402e-bdd5-419ff5859f12", "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "2c28c248-7f50-417a-9186-a85b223010ee", "84972c80-251c-4c3a-9079-4f00aad93938", "434c08ba-8406-4d15-8b24-782cb071a691", "bed2a484-9348-4143-8a8a-b801c979301c", "a0d7e4d2-bede-4141-8896-bc6e237e977c", "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "1c526788-0abe-4713-862f-b520da5e5316", "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "9f107a84-532c-41af-b005-8d12a607639f", "455b9d50-15a1-4b99-853f-8d37655a4c1b", "dee0a7a3-f200-4112-a99b-952196d81e42", "79ce34ca-af29-4d0e-b832-fc1b377020db", "2afafd61-6aae-4df4-baed-139fa1f4c345", "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "f0507c0f-a3a2-40f5-acc6-7f543c334993", "970007b7-ce32-49d0-a4a4-fbef016950bd", "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "f4264e47-f522-4c38-a420-04525d5b880f", "b2ddd389-f676-4ac4-845a-e00781a48e5f", "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "4a6713f6-3331-11ed-a261-0242ac120002", "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "5cc2cda8-f261-4d88-a2de-e9e193c86716", "2d22a514-e024-4428-9dba-41505bd63a5b", "01c42d3c-242d-4655-85b2-34f1739632f7", "77946e79-97f1-45a2-84b4-f37b5c0d8682", "27ba3207-dd30-4812-abbf-5d20c57d474e", "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "1228c958-e64e-4e71-92ad-7d429f4138ba", "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "b1377339-fda6-477a-b455-ac0923f9ec2c", "44143844-0631-49ab-97a0-96387d6b2d7c", "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "85de1f22-d189-44e4-8239-dc276b45379b", "92626ddd-662c-49e3-ac59-f6535f12d189", "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "e56d3073-83ff-4021-90fe-c658e0709e72", "deb9b646-a508-44ee-b7c9-d8965921c6b6", "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "cea2b7ea-792b-405f-95a1-b903ea06458f", "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "730fc21b-eaff-474b-ad23-90fd265d4988", "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "48917adc-a28e-4f5d-b729-11e75da8941f", "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "0900463c-b33b-49a8-be1d-552a3b553dae", "82a6714f-4899-4f16-9c1e-9a333544d4c3", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "1e59c230-6670-45bf-83b0-98903780607e", "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "5687f942-867b-4578-ade7-1e341c46e99a", "258fc8ce-8352-443a-9120-8a11e4857fa5", "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "4ae81040-fc1c-4249-bfa3-938d260214d9", "aa2efee7-34dd-446e-8a37-40790a66efd7", "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "ae215552-081e-44c7-805f-be16f975c8a2", "30bf1789-379d-4fdc-900f-55cd0a90a801", "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "4f7a6757-ff79-46db-9687-66501a02d9ec", "129966c9-de17-4334-a123-8b58172e664d", "696bfb54-227e-4602-ac5b-30d9d2053312", "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "7df1713a-1a5b-4a4b-a071-dc83b144a101", "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "814c95cc-8192-4378-a70a-f1aafd877af1", "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "99c840f2-2012-46fd-9141-c761987550ef", "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "de16d92c-c446-4d53-8938-10aeef41c8b6", "056c7317-9a09-4bd4-9067-d051312752ea", "60fc936d-2eb0-4543-8a13-911c750a1dfc", "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "114de787-4eb2-48cc-abdb-c0b449f93ea4", "207b0396-3689-42d9-8399-4222658efc99", "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "9248c7e1-2bf3-4661-a22c-600a8040b446", "146aace8-9bd6-42ba-be7a-0070d8027b76", "3d7679bd-0c00-440c-97b0-3f204273e6c7", "ea011323-7045-460b-b2d7-0f7442ea6b38", "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "e290b10b-1023-4452-a4a9-eb31a9013b3a", "ca5583e9-8f80-46ac-ab91-7f314d13b984", "cd3d1298-eb3b-476c-ac67-12847de55813", "867356ee-9352-41c9-a8f2-1be690d78216", "67f113fa-e23d-4271-befa-30113b3e08b1", "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "62b20d44-1546-4e61-afce-8e175eb9473c", "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "b6676963-0353-4f88-90f5-36c20d443c6a", "99cf1e02-00fb-4c0d-8375-563f978dfd37", "903076ff-f442-475a-b667-4f246bcc203b", "a77c1610-fc73-4019-8e29-0f51efc04a51", "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "cea72823-df4d-4567-950c-0b579eaf0846", "74a2b202-73e0-4693-9a3a-9d36146d0775", "5fc297ae-25b6-488a-8f25-cc12ac29b744", "12f6b752-042d-483e-bf9c-915a6d06ad75", "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "c1d867fe-8d95-4487-aab4-e53f2d339f90", "e13f668e-7f95-443d-98d2-1816a7648a7b", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "9c8c7000-3065-44a8-a555-79bcba5d9955", "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "ee5e119b-1f75-4b34-add8-3be976961e39", "33339be3-148b-4e16-af56-ad16ec6c7e7b", "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "01d2e2a1-5f09-44f7-9fc1-24faa7479b6d", "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "646ea171-dded-4578-8a4d-65e9822892e3", "84b1706c-932a-44c4-ae28-892b28a25b94", "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "1012f107-b8f1-4271-af30-5aed2de89b39", "074e0ded-6ced-4ebd-8b4d-53f55908119d", "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "af491bca-e752-4b44-9c86-df5680533dbc", "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "f0f7be61-9cf5-43be-9836-99d6ef448a18", "b1f73849-6329-4069-bc8f-78a604bb8b23", "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "0b80ade5-6997-4b1d-99a1-71701778ea61", "81ebd28b-9607-4478-bf06-974ed9d53ed7", "dc4576d4-7467-424f-9eee-fd2b02855fe0", "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "e9142d84-fbe0-401d-ac50-3e519fb00c89", "b4dc61f5-6cce-468e-a608-b48b469feaa2", "e6313acd-208c-44fc-a0ff-db85d572e90e", "f3d39c45-de1a-4486-a687-ab126124f744", "97dbf6e2-e436-44d8-abee-4261b24d3e41", "729ce0ea-5d8f-4769-9762-e35de441586d", "0fc35fc3-efe6-4898-8a37-0b233339524f", "c947b146-0abc-4c87-9c64-b17e9d7274a2", "91a2c315-9ee6-4052-a853-6f6a8238f90d", "9525dc73-0327-438c-8c04-13c0e037e9da", "a4694263-59a8-4608-a3a0-6f8d3a51664c", "f37aba28-a9e6-4045-882c-d5004043b337", "5e95028c-5229-4214-afae-d653d573d0ec", "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "f7375e28-5c14-432f-b8d1-1db26c832df3", "0e0255bf-2548-47b8-9582-c0955c9283f5", "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "d65aee4d-2292-4cea-b832-83accd6cfa43", "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "889719ef-dd62-43df-86c3-768fb08dc7c0", "18ee686c-38a3-4f65-9f44-48a077141f42", "af77cf95-c469-471c-b6a0-946c685c4798", "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "4bf943c6-5146-4273-98dd-e958fd1e3abf", "7f741dcf-fc22-4759-87b4-9ae8376676a2", "8a3038e8-9c9d-46f8-b184-66234a160f6f", "7d4aaec2-08ed-4430-8b96-28420e030e04", "75d0a94e-6252-448d-a7be-d953dff527bb", "327f48c1-a6db-4eb8-875a-f6981f1b0183", "5f03babb-12db-4eec-8c82-7b4cb5580868", "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "cd1f961e-0b96-436b-b7c6-38da4583ec00", "7b4f794b-590a-4ad4-ba18-7964a2832205", "438025f9-5856-4663-83f7-52f878a70a50", "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "213d6a77-3d55-4ce8-ba74-fcfef741974e", "aaafa146-074c-11eb-adc1-0242ac120002", "2433a154-bb3d-42e4-86c3-a26bdac91c45", "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "4f647cfa-b598-4e12-ad69-c68dd16caef8", "16c37b52-b141-42a5-a3ea-bbe098444397", "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "17769c90-230e-488b-a463-e05c08e9d48f", "222129f7-f4dc-4568-b0d2-22440a9639ba", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "e173ad47-4388-4012-ae62-bd13f71c18a8", "48bbc537-b652-4b4e-bd1d-281172df448f", "1edff897-9146-48d2-9066-52e8d8f80a2f", "c248c896-e412-4279-8c15-1c558067b6fa", "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "2cf29f11-e356-4f61-98c0-1bdb9393d6da", "d522eca2-2973-4391-a3e0-ef0374321dae", "62e0298b-e994-4189-bc87-bc699aa62d97", "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "a537cfc3-4297-4789-92b5-345bfd845ad0", "74a12f18-505c-4114-8d0b-8448dd5485c6", "4a2a2c3e-209f-4d01-b513-4155a540b469", "32410e29-5f94-4568-b6a3-d91a8adad863", "f64e5c19-879c-4bae-b471-6d84c8339677", "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "536e2947-3729-478c-9903-745aaffe60d2", "40aa399c-7b02-4715-8e5f-73572b493f33", "883835a7-df45-43e4-bf1d-4268768afda4", "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "b57ba453-b384-4ab9-9f40-1038086b4e53", "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "3bad990e-4848-4a78-9530-b427d854aac0", "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "09576804-7a05-458e-a817-eb718ca91f54", "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "b0524451-19af-4efa-a46f-562a977f792e", "b96b2031-7c17-4473-afe7-a30ce714db29", "37c1333a-a0db-48be-b64b-7393b2386e3b", "81325ce1-be01-4250-944f-b4789644556f", "3abd6094-7027-475f-9630-8ab9be7b9725", "d9047477-0359-48c9-b8c7-792cedcdc9c4", "0a98a10c-685d-4ab0-bddc-b6bdd1d48458", "56d19cb4-6414-4769-9644-1ed35ffbb148", "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "5cdb711b-5740-4fb2-ba88-f7945027afac", "164eda96-11b2-430b-85ff-6a265c15bf32", "a58353df-af43-4753-bad0-cd83ef35eef5", "56321594-9087-49d9-bf10-524fe8479452"], "uberAgent 7.0": ["ec8c4047-fad9-416a-8c81-0f479353d7f6", "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "d13c43f0-f66b-4279-8b2c-5912077c1780", "d2451be2-b582-4e15-8701-4196ac180260", "f40017b3-cb2e-4335-ab5d-3babf679c1de", "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "f354eba5-623b-450f-b073-0b5b2773b6aa", "6414b5cd-b19d-447e-bb5e-9f03940b5784", "ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94", "bdc64095-d59a-42a2-8588-71fd9c9d9abc", "1fbc0671-5596-4e17-8682-f020a0b995dc", "552b6b65-df37-4d3e-a258-f2fc4771ae54", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "333cdbe8-27bb-4246-bf82-b41a0dca4b70", "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "4c21b805-4dd7-469f-b47d-7383a8fcb437", "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "4508a70e-97ef-4300-b62b-ff27992990ea", "857c8db3-c89b-42fb-882b-f681c7cf4da2", "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "3669afd2-9891-4534-a626-e5cf03810a61", "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "7417e29e-c2e7-4cf6-a2e8-767228c64837", "72ca7c75-bf85-45cd-aca7-255d360e423c", "060d5ad4-3153-47bb-8382-43e5e29eda92", "0e0bc253-07ed-43f1-816d-e1b220fe8971", "6e78b74f-c762-4800-82ad-f66787f10c8a", "84b0a8f3-680b-4096-a45b-e9a89221727c", "90ae0469-0cee-4509-b67f-e5efcef040f7", "bf9808c4-d24f-44a2-8398-b65227d406b6", "caa02837-f659-466f-bca6-48bde2826ab4", "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "4fc0deee-0057-4998-ab31-d24e46e0aba4", "e2e01011-5910-4267-9c3b-4149ed5479cf", "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "d2605a99-2218-4894-8fd3-2afb7946514d", "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "a2a3b925-7bb0-433b-b508-db9003263cc4", "68654bf0-4412-43d5-bfe8-5eaa393cd939", "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "952ed57c-8f99-453d-aee0-53a49c22f95d", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "75e508f7-932d-4ebc-af77-269237a84ce1", "50f852e6-af22-4c78-9ede-42ef36aa3453", "8cde342c-ba48-4b74-b615-172c330f2e93", "ea5c131b-380d-49f9-aeb3-920694da4d4b", "a2edbce1-95c8-4291-8676-0d45146862b3", "844f8eb2-610b-42c8-89a4-47596e089663", "6360757a-d460-456c-8b13-74cf0e60cceb", "24b6cf51-6122-469e-861a-22974e9c1e5b", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "9ed5959a-c43c-4c59-84e3-d28628429456", "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "b5de0c9a-6f19-43e0-af4e-55ad01f550af", "fef394cd-f44d-4040-9b18-95d92fe278c0", "48bfd177-7cf2-412b-ad77-baf923489e82", "2092cacb-d77b-4f98-ab0d-32b32f99a054", "ff0f2b05-09db-4095-b96d-1b75ca24894a", "49329257-089d-46e6-af37-4afce4290685", "7707a579-e0d8-4886-a853-ce47e4575aaa", "ee6cea48-c5b6-4304-a332-10fc6446f484", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "e76c8240-d68f-4773-8880-5c6f63595aaf", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "af4c4609-5755-42fe-8075-4effb49f5d44", "9ca2bf31-0570-44d8-a543-534c47c33ed7", "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "6ec86d9e-912e-4726-91a2-209359b999b9", "273a8dd8-3742-4302-bcc7-7df5a80fe425", "90217a70-13fc-48e4-b3db-0d836c5824ac", "3735d5ac-d770-4da0-99ff-156b180bc600", "948a0953-f287-4806-bbcb-3b2e396df89f", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "a1d9eec5-33b2-4177-8d24-27fe754d0812", "613c03ba-0779-4a53-8a1f-47f914a4ded3", "f356a9c4-effd-4608-bbf8-408afd5cd006", "a21bcd7e-38ec-49ad-b69a-9ea17e69509e", "df68f791-ad95-447f-a271-640a0dab9cf8", "e043f529-8514-4205-8ab0-7f7d2927b400", "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "065cceea-77ec-4030-9052-fc0affea7110", "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "36e037c4-c228-4866-b6a3-48eb292b9955", "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "9f2cc74d-78af-4eb2-bb64-9cd1d292b87b", "c3dbbc9f-ef1d-470a-a90a-d343448d5875", "edf3485d-dac4-4d50-90e4-b0e5813f7e60", "1d08ac94-400d-4469-a82f-daee9a908849", "7e9cf7b6-e827-11ed-a05b-15959c120003", "fa5b1358-b040-4403-9868-15f7d9ab6329", "c649a6c7-cd8c-4a78-9c04-000fc76df954", "e81528db-fc02-45e8-8e98-4e84aba1f10b", "7e9cf7b6-e827-11ed-a05b-0242ac120003", "a66bc059-c370-472c-a0d7-f8fd1bf9d583", "a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f", "77564cc2-7382-438b-a7f6-395c2ae53b9a", "f239b326-2f41-4d6b-9dfa-c846a60ef505", "caa06de8-fdef-4c91-826a-7f9e163eef4b", "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "2158f96f-43c2-43cb-952a-ab4580f32382", "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "d797268e-28a9-49a7-b9a8-2f5039011c5c", "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "f426547a-e0f7-441a-b63e-854ac5bdf54d", "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "6d3a3952-6530-44a3-8554-cf17c116c615", "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "4c0aaedc-154c-4427-ada0-d80ef9c9deb6", "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "a4824fca-976f-4964-b334-0621379e84c4", "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "92a974db-ab84-457f-9ec0-55db83d7a825", "f9578658-9e71-4711-b634-3f9b50cd3c06", "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "f5240972-3938-4e56-8e4b-e33893176c1f", "fff9d2b7-e11c-4a69-93d3-40ef66189767", "cc9d3712-6310-4320-b2df-7cb408274d53", "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "327ff235-94eb-4f06-b9de-aaee571324be", "42a993dd-bb3e-48c8-b372-4d6684c4106c", "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "36210e0d-5b19-485d-a087-c096088885f0", "1723e720-616d-4ddc-ab02-f7e3685a4713", "90fb5e62-ca1f-4e22-b42e-cc521874c938", "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "57c4bf16-227f-4394-8ec7-1b745ee061c3", "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "0ea52357-cd59-4340-9981-c46c7e900428", "7aa7009a-28b9-4344-8c1f-159489a390df", "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "9719a8aa-401c-41af-8108-ced7ec9cd75c", "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "587254ee-a24b-4335-b3cd-065c0f1f4baa", "98b53e78-ebaf-46f8-be06-421aafd176d9", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "b5746143-59d6-4603-8d06-acbd60e166ee", "c09dad97-1c78-4f71-b127-7edb2b8e491a", "551d9c1f-816c-445b-a7a6-7a3864720d60", "e31033fc-33f0-4020-9a16-faf9b31cbf08", "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "8e3c7994-131e-4ba5-b6ea-804d49113a26", "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "e32d4572-9826-4738-b651-95fa63747e8a", "043c4b8b-3a54-4780-9682-081cb6b8185c", "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "c363385c-f75d-4753-a108-c1a8e28bdbda", "5cb299fc-5fb1-4d07-b989-0644c68b6043", "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "811f459f-9231-45d4-959a-0266c6311987", "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "7d6d30b8-5b91-4b90-a891-46cccaf29598", "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "087790e3-3287-436c-bccf-cbd0184a7db1", "6812a10b-60ea-420c-832f-dfcc33b646ba", "84b14121-9d14-416e-800b-f3b829c5a14d", "32e280f1-8ad4-46ef-9e80-910657611fbc", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "9cfc00b6-bfb7-49ce-9781-ef78503154bb", "3f5491e2-8db8-496b-9e95-1029fce852d4", "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "02030f2f-6199-49ec-b258-ea71b07e03dc", "74403157-20f5-415d-89a7-c505779585cf", "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "4d7cda18-1b12-4e52-b45c-d28653210df8", "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "c9783e20-4793-4164-ba96-d9ee483992c4", "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "94771a71-ba41-4b6e-a757-b531372eaab6", "2f869d59-7f6a-4931-992c-cce556ff2d53", "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "1775e15e-b61b-4d14-a1a3-80981298085a", "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "42b1a5b8-353f-4f10-b256-39de4467faff", "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "9292293b-8496-4715-9db6-37028dcda4b3", "52788a70-f1da-40dd-8fbd-73b5865d6568", "349d891d-fef0-4fe4-bc53-eee623a15969", "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "6f3e2987-db24-4c78-a860-b4f4095a7095", "1ec65a5f-9473-4f12-97da-622044d6df21", "d042284c-a296-4988-9be5-f424fadcc28c", "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "1327381e-6ab0-4f38-b583-4c1b8346a56b", "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "9ec9fb1b-e059-4489-9642-f270c207923d", "058f4380-962d-40a5-afce-50207d36d7e2", "fe63010f-8823-4864-a96b-a7b4a0f7b929", "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "c86133ad-4725-4bd0-8170-210788e0a7ba", "f5d19838-41b5-476c-98d8-ba8af4929ee2", "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "82880171-b475-4201-b811-e9c826cd5eaa", "023c654f-8f16-44d9-bb2b-00ff36a62af9", "d557dc06-62e8-4468-a8e8-7984124908ce", "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "a642964e-bead-4bed-8910-1bb4d63e3b4d", "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "e4a6b256-3e47-40fc-89d2-7a477edd6915", "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "9fff585c-c33e-4a86-b3cd-39312079a65f", "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "fa00b701-44c6-4679-994d-5a18afa8a707", "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "313d6012-51a0-4d93-8dfc-de8553239e25", "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "8d63dadf-b91b-4187-87b6-34a1114577ea", "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "b36d01a3-ddaf-4804-be18-18a6247adfcd", "aaf46cdc-934e-4284-b329-34aa701e3771", "575dce0c-8139-4e30-9295-1ee75969f7fe", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "a1473adb-5338-4a20-b4c3-126763e2d3d3", "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "241e802a-b65e-484f-88cd-c2dc10f9206d", "fd877b94-9bb5-4191-bb25-d79cbd93c167", "d047726b-c71c-4048-a99b-2e2f50dc107d", "40b95d31-1afc-469e-8d34-9a3a667d058e", "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "e6c54d94-498c-4562-a37c-b469d8e9a275", "64760eef-87f7-4ed3-93fd-655668ea9420", "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "da2738f2-fadb-4394-afa7-0a0674885afa", "88872991-7445-4a22-90b2-a3adadb0e827", "f576a613-2392-4067-9d1a-9345fb58d8d1", "431a1fdb-4799-4f3b-91c3-a683b003fc49", "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "4931188c-178e-4ee7-a348-39e8a7a56821", "85ff530b-261d-48c6-a441-facaa2e81e48", "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "8cbc9475-8d05-4e27-9c32-df960716c701", "378a05d8-963c-46c9-bcce-13c7657eac99", "e8d34729-86a4-4140-adfd-0a29c2106307", "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "e568650b-5dcd-4658-8f34-ded0b1e13992", "f208d6d8-d83a-4c2c-960d-877c37da84e5", "514e4c3a-c77d-4cde-a00f-046425e2301e", "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "01aeb693-138d-49d2-9403-c4f52d7d3d62", "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "83865853-59aa-449e-9600-74b9d89a6d6e", "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "b53317a0-8acf-4fd1-8de8-a5401e776b96", "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "10344bb3-7f65-46c2-b915-2d00d47be5b0", "185d7418-f250-42d0-b72e-0c8b70661e93", "379fa130-190e-4c3f-b7bc-6c8e834485f3", "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "e83e8899-c9b2-483b-b355-5decc942b959", "6385697e-9f1b-40bd-8817-f4a91f40508e", "24357373-078f-44ed-9ac4-6d334a668a11", "15619216-e993-4721-b590-4c520615a67d", "d2eb17db-1d39-41dc-b57f-301f6512fa75", "5a6e1e16-07de-48d8-8aae-faa766c05e88", "5a3164f2-b373-4152-93cf-090b13c12d27", "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "cbec226f-63d9-4eca-9f52-dfb6652f24df", "5b768e71-86f2-4879-b448-81061cbae951", "ca621ba5-54ab-4035-9942-d378e6fcde3c", "98767d61-b2e8-4d71-b661-e36783ee24c1", "a85ffc3a-e8fd-4040-93bf-78aff284d801", "88f46b67-14d4-4f45-ac2c-d66984f22191", "83809e84-4475-4b69-bc3e-4aad8568612f", "ce72ef99-22f1-43d4-8695-419dcb5d9330", "add64136-62e5-48ea-807e-88638d02df1e", "04936b66-3915-43ad-a8e5-809eadfd1141", "847d5ff3-8a31-4737-a970-aeae8fe21765", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "c49c5062-0966-4170-9efd-9968c913a6cf", "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "850d55f9-6eeb-4492-ad69-a72338f65ba4", "d87bd452-6da1-456e-8155-7dc988157b7d", "5bb68627-3198-40ca-b458-49f973db8752", "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "caf201a9-c2ce-4a26-9c3a-2b9525413711", "4e762605-34a8-406d-b72e-c1a089313320", "d3c3861d-c504-4c77-ba55-224ba82d0118", "2ddef153-167b-4e89-86b6-757a9e65dcac", "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "8a582fe2-0882-4b89-a82a-da6b2dc32937", "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "f35c5d71-b489-4e22-a115-f003df287317", "fbd7c32d-db2a-4418-b92c-566eb8911133", "87a476dc-0079-4583-a985-dee7a20a03de", "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "38879043-7e1e-47a9-8d46-6bec88e201df", "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "f9999590-1f94-4a34-a91e-951e47bedefd", "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "4eddc365-79b4-43ff-a9d7-99422dc34b93", "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "220457c1-1c9f-4c2e-afe6-9598926222c1", "bf361876-6620-407a-812f-bfe11e51e924", "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "c79da740-5030-45ec-a2e0-479e824a562c", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "a197e378-d31b-41c0-9635-cfdf1c1bb423", "737e618a-a410-49b5-bec3-9e55ff7fbc15", "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "30edb182-aa75-42c0-b0a9-e998bb29067c", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "eb1c4225-1c23-4241-8dd4-051389fde4ce", "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "e312efd0-35a1-407f-8439-b8d434b438a6", "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "ba42babc-0666-4393-a4f7-ceaf5a69191e", "c27515df-97a9-4162-8a60-dc0eeb51b775", "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "0f6da907-5854-4be6-859a-e9958747b0aa", "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "5edc2273-c26f-406c-83f3-f4d948e740dd", "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "0f0450f3-8b47-441e-a31b-15a91dc243e2", "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "817f252c-5143-4dae-b418-48c3e9f63728", "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "07e3cb2c-0608-410d-be4b-1511cb1a0448", "138d3531-8793-4f50-a2cd-f291b2863d78", "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "ddeff553-5233-4ae9-bbab-d64d2bd634be", "e212d415-0e93-435f-9e1a-f29005bb4723", "55f0a3a1-846e-40eb-8273-677371b8d912", "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "e7888eb1-13b0-4616-bd99-4bc0c2b054b9", "6ba5a05f-b095-4f0a-8654-b825f4f16334", "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "7cce6fc8-a07f-4d84-a53e-96e1879843c9", "45d3a03d-f441-458c-8883-df101a3bb146", "871b9555-69ca-4993-99d3-35a59f9f3599", "f2c64357-b1d2-41b7-849f-34d2682c0fad", "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "12fbff88-16b5-4b42-9754-cd001a789fb3", "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "0403d67d-6227-4ea8-8145-4e72db7da120", "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "bd1c6866-65fc-44b2-be51-5588fcff82b9", "1114e048-b69c-4f41-bc20-657245ae6e3f", "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "27aec9c9-dbb0-4939-8422-1742242471d0", "727454c0-d851-48b0-8b89-385611ab0704", "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "d20ee2f4-822c-4827-9e15-41500b1fff10", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "efec536f-72e8-4656-8960-5e85d091345b", "6f4191bb-912b-48a8-9ce7-682769541e6d", "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "517490a7-115a-48c6-8862-1a481504d5a8", "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "49d9671b-0a0a-4c09-8280-d215bfd30662", "05f3c945-dcc8-4393-9f3d-af65077a8f86", "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "554601fb-9b71-4bcc-abf4-21a611be4fde", "7b10f171-7f04-47c7-9fa2-5be43c76e535", "45239e6a-b035-4aaf-b339-8ad379fcb67e", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "7be5fb68-f9ef-476d-8b51-0256ebece19e", "6e22722b-dfb1-4508-a911-49ac840b40f8", "9ccba514-7cb6-4c5c-b377-700758f2f120", "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "7a74da6b-ea76-47db-92cc-874ad90df734", "f11f2808-adb4-46c0-802a-8660db50fa99", "43e32da2-fdd0-4156-90de-50dfd62636f9", "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "a20def93-0709-4eae-9bd2-31206e21e6b2", "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "6004abd0-afa4-4557-ba90-49d172e0a299", "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "970823b7-273b-460a-8afc-3a6811998529", "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "15b75071-74cc-47e0-b4c6-b43744a62a2b", "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "f99abdf0-6283-4e71-bd2b-b5c048a94743", "0a13e132-651d-11eb-ae93-0242ac130002", "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "e9f55347-2928-4c06-88e5-1a7f8169942e", "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "6a69f62d-ce75-4b57-8dce-6351eb55b362", "8b0e12da-d3c3-49db-bb4f-256703f380e5", "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "98a96a5a-64a0-4c42-92c5-489da3866cb0", "47e4bab7-c626-47dc-967b-255608c9a920", "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "40b19fa6-d835-400c-b301-41f3a2baacaf", "71158e3f-df67-472b-930e-7d287acaa3e1", "f44800ac-38ec-471f-936e-3fa7d9c53100", "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "24c8392b-aa3c-46b7-a545-43f71657fe98", "88f680b8-070e-402c-ae11-d2914f2257f1", "15434e33-5027-4914-88d5-3d4145ec25a9", "b98d0db6-511d-45de-ad02-e82a98729620", "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "0bbc6369-43e3-453d-9944-cae58821c173", "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "b7966f4a-b333-455b-8370-8ca53c229762", "43fa5350-db63-4b8f-9a01-789a427074e1", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "ec290c06-9b6b-4338-8b6b-095c0f284f10", "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "d4498716-1d52-438f-8084-4a603157d131", "b222df08-0e07-11eb-adc1-0242ac120002", "e1693bc8-7168-4eab-8718-cdcaa68a1738", "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "d3b70aad-097e-409c-9df2-450f80dc476b", "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "312d0384-401c-4b8b-abdf-685ffba9a332", "cc368ed0-2411-45dc-a222-510ace303cb2", "42333b2c-b425-441c-b70e-99404a17170f", "0e4164da-94bc-450d-a7be-a4b176179f1f", "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "ebef4391-1a81-4761-a40a-1db446c0e625", "f26307d8-14cd-47e3-a26b-4b4769f24af6", "03cc0c25-389f-4bf8-b48d-11878079f1ca", "8834e2f7-6b4b-4f09-8906-d2276470ee23", "7090adee-82e2-4269-bd59-80691e7c6338", "c74c0390-3e20-41fd-a69a-128f0275a5ea", "b6457d63-d2a2-4e29-859d-4e7affc153d1", "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "5f6a601c-2ecb-498b-9c33-660362323afa", "aa8e035d-7be4-48d3-a944-102aec04400d", "b243b280-65fe-48df-ba07-6ddea7646427", "236d8e89-ed95-4789-a982-36f4643738ba", "277a4393-446c-449a-b0ed-7fdc7795244c", "4fe074b4-b833-4081-8f24-7dcfeca72b42", "68bcd73b-37ef-49cb-95fc-edc809730be6", "86588b36-c6d3-465f-9cee-8f9093e07798", "502b42de-4306-40b4-9596-6f590c81f073", "0a99eb3e-1617-41bd-b095-13dc767f3def", "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "07f8bdc2-c9b3-472a-9817-5a670b872f53", "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "28ac00d6-22d9-4a3c-927f-bbd770104573", "452bce90-6fb0-43cc-97a5-affc283139b3", "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "ce7cf472-6fcc-490a-9481-3786840b5d9b", "c6fb44c6-71f5-49e6-9462-1425d328aee3", "9c0295ce-d60d-40bd-bd74-84673b7592b1", "0a4f6091-223b-41f6-8743-f322ec84930b", "98c5aeef-32d5-492f-b174-64a691896d25", "6fe4aa1e-0531-4510-8be2-782154b73b48", "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "d78b5d61-187d-44b6-bf02-93486a80de5a", "e9b61244-893f-427c-b287-3e708f321c6b", "70bc5215-526f-4477-963c-a47a5c9ebd12", "b6e04788-29e1-4557-bb14-77f761848ab8", "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "0685b176-c816-4837-8e7b-1216f346636b", "e84d89c4-f544-41ca-a6af-4b92fd38b023", "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "023394c4-29d5-46ab-92b8-6a534c6f447b", "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "ebea773c-a8f1-42ad-a856-00cb221966e8", "0b7163dc-7eee-4960-af17-c0cd517f92da", "98dedfdd-8333-49d4-9f23-d7018cccae53", "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "f24bcaea-0cd1-11eb-adc1-0242ac120002", "ccb5742c-c248-4982-8c5c-5571b9275ad3", "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "4abc0ec4-db5a-412f-9632-26659cddf145", "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "5cddf373-ef00-4112-ad72-960ac29bac34", "37db85d1-b089-490a-a59a-c7b6f984f480", "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "f1edd233-30b5-4823-9e6a-c4171b24d316", "e92a4287-e072-4a40-9739-370c106bb750", "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "8bc64091-6875-4881-aaf9-7bd25b5dda08", "56c217c3-2de2-479b-990f-5c109ba8458f", "eee00933-a761-4cd0-be70-c42fe91731e7", "bab049ca-7471-4828-9024-38279a4c04da", "c3a99af4-35a9-4668-879e-c09aeb4f2bdf", "d7654f02-e04b-4934-9838-65c46f187ebc", "2a072a96-a086-49fa-bcb5-15cc5a619093", "883faa95-175a-4e22-8181-e5761aeb373c", "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "63d1ccc0-2a43-4f4b-9289-361b308991ff", "4f154fb6-27d1-4813-a759-78b93e0b9c48", "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "33be4333-2c6b-44f4-ae28-102cdbde0a31", "395907ee-96e5-4666-af2e-2ca91688e151", "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "b0ce780f-10bd-496d-9067-066d23dc3aa5", "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "79b06761-465f-4f88-9ef2-150e24d3d737", "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "c615d676-f655-46b9-b913-78729021e5d7", "b19146a3-25d4-41b4-928b-1e2a92641b1b", "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "e6474a1b-5390-49cd-ab41-8d88655f7394", "692f0bec-83ba-4d04-af7e-e884a96059b6", "93671f99-04eb-4ab4-a161-70d446a84003", "0d5675be-bc88-4172-86d3-1e96a4476536", "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "4281cb20-2994-4580-aa63-c8b86d019934", "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "a34f79a3-8e5f-4cc3-b765-de00695452c2", "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "5589ab4f-a767-433c-961d-c91f3f704db1", "e8a95b5e-c891-46e2-b33a-93937d3abc31", "c86500e9-a645-4680-98d7-f882c70c1ea3", "58f50261-c53b-4c88-bd12-1d71f12eda4c", "34ebb878-1b15-4895-b352-ca2eeb99b274", "7a02e22e-b885-4404-b38b-1ddc7e65258a", "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "24de4f3b-804c-4165-b442-5a06a2302c7e", "731231b9-0b5d-4219-94dd-abb6959aa7ea", "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "d7bcd677-645d-4691-a8d4-7a5602b780d1", "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "6e897651-f157-4d8f-aaeb-df8151488385", "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "9847f263-4a81-424f-970c-875dab15b79b", "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "4b046706-5789-4673-b111-66f25fe99534", "73bba97f-a82d-42ce-b315-9182e76c57b1", "646bc99f-6682-4b47-a73a-17b1b64c9d34", "6c96fc76-0eb1-11eb-adc1-0242ac120002", "7050bba1-1aed-454e-8f73-3f46f09ce56a", "744a188b-0415-4792-896f-11ddb0588dbc", "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "faa48cae-6b25-4f00-a094-08947fef582f", "70ad0861-d1fe-491c-a45f-fa48148a300d", "a16980c2-0c56-4de0-9a79-17971979efdd", "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "954f0af7-62dd-418f-b3df-a84bc2c7a774", "a7ee1722-c3c5-aeff-3212-c777e4733217", "1dde5376-a648-492e-9e54-4241dd9b0c7f", "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "10c14723-61c7-4c75-92ca-9af245723ad2", "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "41421f44-58f9-455d-838a-c398859841d4", "ae9b0bd7-8888-4606-b444-0ed7410cb728", "8de1cbe8-d6f5-496d-8237-5f44a721c7a0", "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "43103702-5886-11ed-9b6a-0242ac120002", "16905e21-66ee-42fe-b256-1318ada2d770", "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "a7c3d773-caef-227e-a7e7-c2f13c622329", "214641c2-c579-4ecb-8427-0cf19df6842e", "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "07aa184a-870d-413d-893a-157f317f6f58", "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "f548a603-c9f2-4c89-b511-b089f7e94549", "93199800-b52a-4dec-b762-75212c196542", "526be59f-a573-4eea-b5f7-f0973207634d", "6345b048-8441-43a7-9bed-541133633d7a", "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "25676e10-2121-446e-80a4-71ff8506af47", "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "ac1c92b4-ac81-405a-9978-4604d78cc47e", "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "bdeb2cff-af74-4094-8426-724dc937f20a", "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "a383dec4-deec-4e6e-913b-ed9249670848", "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "ac20ae82-8758-4f38-958e-b44a3140ca88", "54786ddc-5b8a-11ed-9b6a-0242ac120002", "41ca393d-538c-408a-ac27-cf1e038be80c", "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "cd71385d-fd9b-4691-9b98-2b1f7e508714", "c8a180d6-47a3-4345-a609-53f9c3d834fc", "044ba588-dff4-4918-9808-3f95e8160606", "1af57a4b-460a-4738-9034-db68b880c665", "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "1dd05363-104e-4b4a-b963-196a534b03a1", "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "84b1ecf9-6eff-4004-bafb-bae5c0e251b2", "204b17ae-4007-471b-917b-b917b315c5db", "50d66fb0-03f8-4da0-8add-84e77d12a020", "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "c2b86e67-b880-4eec-b045-50bc98ef4844", "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "e593cf51-88db-4ee1-b920-37e89012a3c9", "90d6bd71-dffb-4989-8d86-a827fedd6624", "8202070f-edeb-4d31-a010-a26c72ac5600", "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "3268b746-88d8-4cd3-bffc-30077d02c787", "18988e1b-9087-4f8a-82fe-0414dce49878", "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "f53714ec-5077-420e-ad20-907ff9bb2958", "f117933c-980c-4f78-b384-e3d838111165", "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "a29c1813-ab1f-4dde-b489-330b952e91ae", "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "b655a06a-31c0-477a-95c2-3726b83d649d", "21d856f9-9281-4ded-9377-51a1a6e2a432", "b66474aa-bd92-4333-a16c-298155b120df", "b2309017-4235-44fe-b5af-b15363011957", "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "62510e69-616b-4078-b371-847da438cc03", "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "285b85b1-a555-4095-8652-a8a4106af63f", "84f52741-8834-4a8c-a413-2eb2269aa6c8", "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "be344333-921d-4c4d-8bb8-e584cf584780", "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "fb843269-508c-4b76-8b8d-88679db22ce7", "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "de587dce-915e-4218-aac4-835ca6af6f70", "c7942406-33dd-4377-a564-0f62db0593a3", "ab9e3b40-0c85-4ba1-aede-455d226fd124", "ef61af62-bc74-4f58-b49b-626448227652", "a20391f8-76fb-437b-abc0-dba2df1952c6", "899133d5-4d7c-4a7f-94ee-27355c879d90", "1ac8666b-046f-4201-8aba-1951aaec03a3", "1c67a717-32ba-409b-a45d-0fb704a73a81", "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "eca49c87-8a75-4f13-9c73-a5a29e845f03", "435e10e4-992a-4281-96f3-38b11106adde", "b3512211-c67e-4707-bedc-66efc7848863", "c15a46a0-07d4-4c87-b4b6-89207835a83b", "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "1f0f6176-6482-4027-b151-00071af39d7e", "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "9257c05b-4a4a-48e5-a670-b7b073cf401b", "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "99793437-3e16-439b-be0f-078782cf953d", "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "ac175779-025a-4f12-98b0-acdaeb77ea85", "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "90d50722-0483-4065-8e35-57efaadd354d", "180c7c5c-d64b-4a63-86e9-68910451bc8b", "d55b793d-f847-4eea-b59a-5ab09908ac90", "aef9d1f1-7396-4e92-a927-4567c7a495c1", "6c6d9280-e6d0-4b9d-80ac-254701b64916", "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "9212f354-7775-4e28-9c9f-8f0a4544e664", "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "ffa6861c-4461-4f59-8a41-578c39f3f23e", "a0459f02-ac51-4c09-b511-b8c9203fc429", "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "534f2ef7-e8a2-4433-816d-c91bccde289b", "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "84232095-ecca-4015-b0d7-7726507ee793", "4e2ed651-1906-4a59-a78a-18220fca1b22", "96036718-71cc-4027-a538-d1587e0006a7", "60f16a96-db70-42eb-8f76-16763e333590", "5afee48e-67dd-4e03-a783-f74259dcf998", "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "771d1eb5-9587-4568-95fb-9ec44153a012", "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "e28a5a99-da44-436d-b7a0-2afc20a5f413", "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "68d37776-61db-42f5-bf54-27e87072d17e", "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "d2b749ee-4225-417e-b20e-a8d2193cbb84", "1193d960-2369-499f-a158-7b50a31df682", "6b65c28e-11f3-46cb-902a-68f2cafaf474", "242301bc-f92f-4476-8718-78004a6efd9f", "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "52d097e2-063e-4c9c-8fbb-855c8948d135", "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "647c7b9e-d784-4fda-b9a0-45c565a7b729", "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "bb76d96b-821c-47cf-944b-7ce377864492", "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "1816994b-42e1-4fb1-afd2-134d88184f71", "12827a56-61a4-476a-a9cb-f3068f191073", "32b96012-7892-429e-b26c-ac2bf46066ff", "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "f4bbd493-b796-416e-bbf2-121235348529", "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "d06be4b9-8045-428b-a567-740a26d9db25", "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "65c3ca2c-525f-4ced-968e-246a713d164f", "347906f3-e207-4d18-ae5b-a9403d6bcdef", "a29808fd-ef50-49ff-9c7a-59a9b040b404", "e66779cc-383e-4224-a3a4-267eeb585c40", "85c312b7-f44d-4a51-a024-d671c40b49fc", "6da2c9f5-7c53-401b-aacb-92c040ce1215", "6bd75993-9888-4f91-9404-e1e4e4e34b77", "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "ff992eac-6449-4c60-8c1d-91c9722a1d48", "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "208748f7-881d-47ac-a29c-07ea84bf691d", "89ca78fd-b37c-4310-b3d3-81a023f83936", "a2910908-e86f-4687-aeba-76a5f996e652", "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "9c14c9fa-1a63-4a64-8e57-d19280559490", "221b251a-357a-49a9-920a-271802777cc0", "50919691-7302-437f-8e10-1fe088afa145", "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "f14e169e-9978-4c69-acb3-1cff8200bc36", "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "1c8774a0-44d4-4db0-91f8-e792359c70bd", "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "9fc3072c-dc8f-4bf7-b231-18950000fadd", "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "ada4b0c4-758b-46ac-9033-9004613a150d", "584bca0f-3608-4402-80fd-4075ff6072e3", "9a132afa-654e-11eb-ae93-0242ac130002", "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "a70dcb37-3bee-453a-99df-d0c683151be6", "85b0b087-eddf-4a2b-b033-d771fa2b9775", "2267fe65-0681-42ad-9a6d-46553d3f3480", "28c8f68b-098d-45af-8d43-8089f3e35403", "cd8c163e-a19b-402e-bdd5-419ff5859f12", "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "2c28c248-7f50-417a-9186-a85b223010ee", "84972c80-251c-4c3a-9079-4f00aad93938", "434c08ba-8406-4d15-8b24-782cb071a691", "bed2a484-9348-4143-8a8a-b801c979301c", "a0d7e4d2-bede-4141-8896-bc6e237e977c", "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "1c526788-0abe-4713-862f-b520da5e5316", "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "9f107a84-532c-41af-b005-8d12a607639f", "455b9d50-15a1-4b99-853f-8d37655a4c1b", "dee0a7a3-f200-4112-a99b-952196d81e42", "79ce34ca-af29-4d0e-b832-fc1b377020db", "2afafd61-6aae-4df4-baed-139fa1f4c345", "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "f0507c0f-a3a2-40f5-acc6-7f543c334993", "970007b7-ce32-49d0-a4a4-fbef016950bd", "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "f4264e47-f522-4c38-a420-04525d5b880f", "b2ddd389-f676-4ac4-845a-e00781a48e5f", "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "4a6713f6-3331-11ed-a261-0242ac120002", "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "5cc2cda8-f261-4d88-a2de-e9e193c86716", "2d22a514-e024-4428-9dba-41505bd63a5b", "01c42d3c-242d-4655-85b2-34f1739632f7", "77946e79-97f1-45a2-84b4-f37b5c0d8682", "27ba3207-dd30-4812-abbf-5d20c57d474e", "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "1228c958-e64e-4e71-92ad-7d429f4138ba", "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "b1377339-fda6-477a-b455-ac0923f9ec2c", "44143844-0631-49ab-97a0-96387d6b2d7c", "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "85de1f22-d189-44e4-8239-dc276b45379b", "92626ddd-662c-49e3-ac59-f6535f12d189", "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "e56d3073-83ff-4021-90fe-c658e0709e72", "deb9b646-a508-44ee-b7c9-d8965921c6b6", "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "cea2b7ea-792b-405f-95a1-b903ea06458f", "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "730fc21b-eaff-474b-ad23-90fd265d4988", "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "48917adc-a28e-4f5d-b729-11e75da8941f", "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "0900463c-b33b-49a8-be1d-552a3b553dae", "82a6714f-4899-4f16-9c1e-9a333544d4c3", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "1e59c230-6670-45bf-83b0-98903780607e", "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "5687f942-867b-4578-ade7-1e341c46e99a", "258fc8ce-8352-443a-9120-8a11e4857fa5", "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "4ae81040-fc1c-4249-bfa3-938d260214d9", "aa2efee7-34dd-446e-8a37-40790a66efd7", "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "ae215552-081e-44c7-805f-be16f975c8a2", "30bf1789-379d-4fdc-900f-55cd0a90a801", "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "4f7a6757-ff79-46db-9687-66501a02d9ec", "129966c9-de17-4334-a123-8b58172e664d", "696bfb54-227e-4602-ac5b-30d9d2053312", "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "7df1713a-1a5b-4a4b-a071-dc83b144a101", "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "814c95cc-8192-4378-a70a-f1aafd877af1", "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "99c840f2-2012-46fd-9141-c761987550ef", "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "de16d92c-c446-4d53-8938-10aeef41c8b6", "056c7317-9a09-4bd4-9067-d051312752ea", "60fc936d-2eb0-4543-8a13-911c750a1dfc", "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "114de787-4eb2-48cc-abdb-c0b449f93ea4", "207b0396-3689-42d9-8399-4222658efc99", "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "9248c7e1-2bf3-4661-a22c-600a8040b446", "146aace8-9bd6-42ba-be7a-0070d8027b76", "3d7679bd-0c00-440c-97b0-3f204273e6c7", "ea011323-7045-460b-b2d7-0f7442ea6b38", "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "e290b10b-1023-4452-a4a9-eb31a9013b3a", "ca5583e9-8f80-46ac-ab91-7f314d13b984", "cd3d1298-eb3b-476c-ac67-12847de55813", "867356ee-9352-41c9-a8f2-1be690d78216", "67f113fa-e23d-4271-befa-30113b3e08b1", "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "62b20d44-1546-4e61-afce-8e175eb9473c", "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "b6676963-0353-4f88-90f5-36c20d443c6a", "99cf1e02-00fb-4c0d-8375-563f978dfd37", "903076ff-f442-475a-b667-4f246bcc203b", "a77c1610-fc73-4019-8e29-0f51efc04a51", "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "cea72823-df4d-4567-950c-0b579eaf0846", "74a2b202-73e0-4693-9a3a-9d36146d0775", "5fc297ae-25b6-488a-8f25-cc12ac29b744", "12f6b752-042d-483e-bf9c-915a6d06ad75", "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "c1d867fe-8d95-4487-aab4-e53f2d339f90", "e13f668e-7f95-443d-98d2-1816a7648a7b", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "9c8c7000-3065-44a8-a555-79bcba5d9955", "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "ee5e119b-1f75-4b34-add8-3be976961e39", "33339be3-148b-4e16-af56-ad16ec6c7e7b", "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "01d2e2a1-5f09-44f7-9fc1-24faa7479b6d", "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "646ea171-dded-4578-8a4d-65e9822892e3", "84b1706c-932a-44c4-ae28-892b28a25b94", "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "1012f107-b8f1-4271-af30-5aed2de89b39", "074e0ded-6ced-4ebd-8b4d-53f55908119d", "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "af491bca-e752-4b44-9c86-df5680533dbc", "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "f0f7be61-9cf5-43be-9836-99d6ef448a18", "b1f73849-6329-4069-bc8f-78a604bb8b23", "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "0b80ade5-6997-4b1d-99a1-71701778ea61", "81ebd28b-9607-4478-bf06-974ed9d53ed7", "dc4576d4-7467-424f-9eee-fd2b02855fe0", "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "e9142d84-fbe0-401d-ac50-3e519fb00c89", "b4dc61f5-6cce-468e-a608-b48b469feaa2", "e6313acd-208c-44fc-a0ff-db85d572e90e", "f3d39c45-de1a-4486-a687-ab126124f744", "97dbf6e2-e436-44d8-abee-4261b24d3e41", "729ce0ea-5d8f-4769-9762-e35de441586d", "0fc35fc3-efe6-4898-8a37-0b233339524f", "c947b146-0abc-4c87-9c64-b17e9d7274a2", "91a2c315-9ee6-4052-a853-6f6a8238f90d", "9525dc73-0327-438c-8c04-13c0e037e9da", "a4694263-59a8-4608-a3a0-6f8d3a51664c", "f37aba28-a9e6-4045-882c-d5004043b337", "5e95028c-5229-4214-afae-d653d573d0ec", "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "f7375e28-5c14-432f-b8d1-1db26c832df3", "0e0255bf-2548-47b8-9582-c0955c9283f5", "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "d65aee4d-2292-4cea-b832-83accd6cfa43", "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "889719ef-dd62-43df-86c3-768fb08dc7c0", "18ee686c-38a3-4f65-9f44-48a077141f42", "af77cf95-c469-471c-b6a0-946c685c4798", "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "4bf943c6-5146-4273-98dd-e958fd1e3abf", "7f741dcf-fc22-4759-87b4-9ae8376676a2", "8a3038e8-9c9d-46f8-b184-66234a160f6f", "7d4aaec2-08ed-4430-8b96-28420e030e04", "75d0a94e-6252-448d-a7be-d953dff527bb", "327f48c1-a6db-4eb8-875a-f6981f1b0183", "5f03babb-12db-4eec-8c82-7b4cb5580868", "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "cd1f961e-0b96-436b-b7c6-38da4583ec00", "7b4f794b-590a-4ad4-ba18-7964a2832205", "438025f9-5856-4663-83f7-52f878a70a50", "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "213d6a77-3d55-4ce8-ba74-fcfef741974e", "aaafa146-074c-11eb-adc1-0242ac120002", "2433a154-bb3d-42e4-86c3-a26bdac91c45", "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "4f647cfa-b598-4e12-ad69-c68dd16caef8", "16c37b52-b141-42a5-a3ea-bbe098444397", "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "17769c90-230e-488b-a463-e05c08e9d48f", "222129f7-f4dc-4568-b0d2-22440a9639ba", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "e173ad47-4388-4012-ae62-bd13f71c18a8", "48bbc537-b652-4b4e-bd1d-281172df448f", "1edff897-9146-48d2-9066-52e8d8f80a2f", "c248c896-e412-4279-8c15-1c558067b6fa", "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "2cf29f11-e356-4f61-98c0-1bdb9393d6da", "d522eca2-2973-4391-a3e0-ef0374321dae", "62e0298b-e994-4189-bc87-bc699aa62d97", "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "a537cfc3-4297-4789-92b5-345bfd845ad0", "74a12f18-505c-4114-8d0b-8448dd5485c6", "4a2a2c3e-209f-4d01-b513-4155a540b469", "32410e29-5f94-4568-b6a3-d91a8adad863", "f64e5c19-879c-4bae-b471-6d84c8339677", "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "536e2947-3729-478c-9903-745aaffe60d2", "40aa399c-7b02-4715-8e5f-73572b493f33", "883835a7-df45-43e4-bf1d-4268768afda4", "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "b57ba453-b384-4ab9-9f40-1038086b4e53", "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "3bad990e-4848-4a78-9530-b427d854aac0", "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "09576804-7a05-458e-a817-eb718ca91f54", "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "b0524451-19af-4efa-a46f-562a977f792e", "b96b2031-7c17-4473-afe7-a30ce714db29", "37c1333a-a0db-48be-b64b-7393b2386e3b", "81325ce1-be01-4250-944f-b4789644556f", "3abd6094-7027-475f-9630-8ab9be7b9725", "d9047477-0359-48c9-b8c7-792cedcdc9c4", "0a98a10c-685d-4ab0-bddc-b6bdd1d48458", "56d19cb4-6414-4769-9644-1ed35ffbb148", "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "5cdb711b-5740-4fb2-ba88-f7945027afac", "164eda96-11b2-430b-85ff-6a265c15bf32", "a58353df-af43-4753-bad0-cd83ef35eef5", "56321594-9087-49d9-bf10-524fe8479452"], "uberAgent 6.2": ["ec8c4047-fad9-416a-8c81-0f479353d7f6", "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "d13c43f0-f66b-4279-8b2c-5912077c1780", "d2451be2-b582-4e15-8701-4196ac180260", "f40017b3-cb2e-4335-ab5d-3babf679c1de", "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "f354eba5-623b-450f-b073-0b5b2773b6aa", "6414b5cd-b19d-447e-bb5e-9f03940b5784", "bdc64095-d59a-42a2-8588-71fd9c9d9abc", "1fbc0671-5596-4e17-8682-f020a0b995dc", "552b6b65-df37-4d3e-a258-f2fc4771ae54", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "4c21b805-4dd7-469f-b47d-7383a8fcb437", "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "4508a70e-97ef-4300-b62b-ff27992990ea", "857c8db3-c89b-42fb-882b-f681c7cf4da2", "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "3669afd2-9891-4534-a626-e5cf03810a61", "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "7417e29e-c2e7-4cf6-a2e8-767228c64837", "72ca7c75-bf85-45cd-aca7-255d360e423c", "060d5ad4-3153-47bb-8382-43e5e29eda92", "0e0bc253-07ed-43f1-816d-e1b220fe8971", "6e78b74f-c762-4800-82ad-f66787f10c8a", "84b0a8f3-680b-4096-a45b-e9a89221727c", "90ae0469-0cee-4509-b67f-e5efcef040f7", "bf9808c4-d24f-44a2-8398-b65227d406b6", "caa02837-f659-466f-bca6-48bde2826ab4", "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "4fc0deee-0057-4998-ab31-d24e46e0aba4", "e2e01011-5910-4267-9c3b-4149ed5479cf", "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "d2605a99-2218-4894-8fd3-2afb7946514d", "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "a2a3b925-7bb0-433b-b508-db9003263cc4", "68654bf0-4412-43d5-bfe8-5eaa393cd939", "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "952ed57c-8f99-453d-aee0-53a49c22f95d", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "75e508f7-932d-4ebc-af77-269237a84ce1", "8cde342c-ba48-4b74-b615-172c330f2e93", "ea5c131b-380d-49f9-aeb3-920694da4d4b", "a2edbce1-95c8-4291-8676-0d45146862b3", "844f8eb2-610b-42c8-89a4-47596e089663", "6360757a-d460-456c-8b13-74cf0e60cceb", "24b6cf51-6122-469e-861a-22974e9c1e5b", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "9ed5959a-c43c-4c59-84e3-d28628429456", "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "fef394cd-f44d-4040-9b18-95d92fe278c0", "48bfd177-7cf2-412b-ad77-baf923489e82", "2092cacb-d77b-4f98-ab0d-32b32f99a054", "ff0f2b05-09db-4095-b96d-1b75ca24894a", "49329257-089d-46e6-af37-4afce4290685", "7707a579-e0d8-4886-a853-ce47e4575aaa", "ee6cea48-c5b6-4304-a332-10fc6446f484", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "e76c8240-d68f-4773-8880-5c6f63595aaf", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "af4c4609-5755-42fe-8075-4effb49f5d44", "9ca2bf31-0570-44d8-a543-534c47c33ed7", "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "6ec86d9e-912e-4726-91a2-209359b999b9", "273a8dd8-3742-4302-bcc7-7df5a80fe425", "90217a70-13fc-48e4-b3db-0d836c5824ac", "3735d5ac-d770-4da0-99ff-156b180bc600", "948a0953-f287-4806-bbcb-3b2e396df89f", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "a1d9eec5-33b2-4177-8d24-27fe754d0812", "613c03ba-0779-4a53-8a1f-47f914a4ded3", "f356a9c4-effd-4608-bbf8-408afd5cd006", "df68f791-ad95-447f-a271-640a0dab9cf8", "e043f529-8514-4205-8ab0-7f7d2927b400", "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "065cceea-77ec-4030-9052-fc0affea7110", "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "36e037c4-c228-4866-b6a3-48eb292b9955", "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "9f2cc74d-78af-4eb2-bb64-9cd1d292b87b", "c3dbbc9f-ef1d-470a-a90a-d343448d5875", "edf3485d-dac4-4d50-90e4-b0e5813f7e60", "1d08ac94-400d-4469-a82f-daee9a908849", "7e9cf7b6-e827-11ed-a05b-15959c120003", "fa5b1358-b040-4403-9868-15f7d9ab6329", "e81528db-fc02-45e8-8e98-4e84aba1f10b", "a66bc059-c370-472c-a0d7-f8fd1bf9d583", "a9d4d3fa-8fc0-41bc-80b1-30b9fda79d6f", "77564cc2-7382-438b-a7f6-395c2ae53b9a", "f239b326-2f41-4d6b-9dfa-c846a60ef505", "caa06de8-fdef-4c91-826a-7f9e163eef4b", "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "2158f96f-43c2-43cb-952a-ab4580f32382", "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "d797268e-28a9-49a7-b9a8-2f5039011c5c", "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "f426547a-e0f7-441a-b63e-854ac5bdf54d", "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "6d3a3952-6530-44a3-8554-cf17c116c615", "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "a4824fca-976f-4964-b334-0621379e84c4", "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "92a974db-ab84-457f-9ec0-55db83d7a825", "f9578658-9e71-4711-b634-3f9b50cd3c06", "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "f5240972-3938-4e56-8e4b-e33893176c1f", "fff9d2b7-e11c-4a69-93d3-40ef66189767", "cc9d3712-6310-4320-b2df-7cb408274d53", "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "42a993dd-bb3e-48c8-b372-4d6684c4106c", "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "36210e0d-5b19-485d-a087-c096088885f0", "1723e720-616d-4ddc-ab02-f7e3685a4713", "90fb5e62-ca1f-4e22-b42e-cc521874c938", "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "57c4bf16-227f-4394-8ec7-1b745ee061c3", "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "0ea52357-cd59-4340-9981-c46c7e900428", "7aa7009a-28b9-4344-8c1f-159489a390df", "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "9719a8aa-401c-41af-8108-ced7ec9cd75c", "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "587254ee-a24b-4335-b3cd-065c0f1f4baa", "98b53e78-ebaf-46f8-be06-421aafd176d9", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "b5746143-59d6-4603-8d06-acbd60e166ee", "551d9c1f-816c-445b-a7a6-7a3864720d60", "e31033fc-33f0-4020-9a16-faf9b31cbf08", "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "8e3c7994-131e-4ba5-b6ea-804d49113a26", "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "e32d4572-9826-4738-b651-95fa63747e8a", "043c4b8b-3a54-4780-9682-081cb6b8185c", "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "c363385c-f75d-4753-a108-c1a8e28bdbda", "5cb299fc-5fb1-4d07-b989-0644c68b6043", "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "811f459f-9231-45d4-959a-0266c6311987", "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "7d6d30b8-5b91-4b90-a891-46cccaf29598", "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "087790e3-3287-436c-bccf-cbd0184a7db1", "6812a10b-60ea-420c-832f-dfcc33b646ba", "84b14121-9d14-416e-800b-f3b829c5a14d", "32e280f1-8ad4-46ef-9e80-910657611fbc", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "3f5491e2-8db8-496b-9e95-1029fce852d4", "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "02030f2f-6199-49ec-b258-ea71b07e03dc", "74403157-20f5-415d-89a7-c505779585cf", "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "4d7cda18-1b12-4e52-b45c-d28653210df8", "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "c9783e20-4793-4164-ba96-d9ee483992c4", "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "94771a71-ba41-4b6e-a757-b531372eaab6", "2f869d59-7f6a-4931-992c-cce556ff2d53", "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "1775e15e-b61b-4d14-a1a3-80981298085a", "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "42b1a5b8-353f-4f10-b256-39de4467faff", "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "9292293b-8496-4715-9db6-37028dcda4b3", "52788a70-f1da-40dd-8fbd-73b5865d6568", "349d891d-fef0-4fe4-bc53-eee623a15969", "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "6f3e2987-db24-4c78-a860-b4f4095a7095", "1ec65a5f-9473-4f12-97da-622044d6df21", "d042284c-a296-4988-9be5-f424fadcc28c", "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "1327381e-6ab0-4f38-b583-4c1b8346a56b", "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "9ec9fb1b-e059-4489-9642-f270c207923d", "058f4380-962d-40a5-afce-50207d36d7e2", "fe63010f-8823-4864-a96b-a7b4a0f7b929", "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "c86133ad-4725-4bd0-8170-210788e0a7ba", "f5d19838-41b5-476c-98d8-ba8af4929ee2", "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "82880171-b475-4201-b811-e9c826cd5eaa", "023c654f-8f16-44d9-bb2b-00ff36a62af9", "d557dc06-62e8-4468-a8e8-7984124908ce", "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "a642964e-bead-4bed-8910-1bb4d63e3b4d", "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "e4a6b256-3e47-40fc-89d2-7a477edd6915", "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "9fff585c-c33e-4a86-b3cd-39312079a65f", "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "fa00b701-44c6-4679-994d-5a18afa8a707", "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "313d6012-51a0-4d93-8dfc-de8553239e25", "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "8d63dadf-b91b-4187-87b6-34a1114577ea", "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "b36d01a3-ddaf-4804-be18-18a6247adfcd", "aaf46cdc-934e-4284-b329-34aa701e3771", "575dce0c-8139-4e30-9295-1ee75969f7fe", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "a1473adb-5338-4a20-b4c3-126763e2d3d3", "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "241e802a-b65e-484f-88cd-c2dc10f9206d", "fd877b94-9bb5-4191-bb25-d79cbd93c167", "d047726b-c71c-4048-a99b-2e2f50dc107d", "40b95d31-1afc-469e-8d34-9a3a667d058e", "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "e6c54d94-498c-4562-a37c-b469d8e9a275", "64760eef-87f7-4ed3-93fd-655668ea9420", "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "da2738f2-fadb-4394-afa7-0a0674885afa", "88872991-7445-4a22-90b2-a3adadb0e827", "f576a613-2392-4067-9d1a-9345fb58d8d1", "431a1fdb-4799-4f3b-91c3-a683b003fc49", "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "4931188c-178e-4ee7-a348-39e8a7a56821", "85ff530b-261d-48c6-a441-facaa2e81e48", "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "8cbc9475-8d05-4e27-9c32-df960716c701", "378a05d8-963c-46c9-bcce-13c7657eac99", "e8d34729-86a4-4140-adfd-0a29c2106307", "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "e568650b-5dcd-4658-8f34-ded0b1e13992", "f208d6d8-d83a-4c2c-960d-877c37da84e5", "514e4c3a-c77d-4cde-a00f-046425e2301e", "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "01aeb693-138d-49d2-9403-c4f52d7d3d62", "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "83865853-59aa-449e-9600-74b9d89a6d6e", "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "b53317a0-8acf-4fd1-8de8-a5401e776b96", "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "10344bb3-7f65-46c2-b915-2d00d47be5b0", "185d7418-f250-42d0-b72e-0c8b70661e93", "379fa130-190e-4c3f-b7bc-6c8e834485f3", "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "e83e8899-c9b2-483b-b355-5decc942b959", "6385697e-9f1b-40bd-8817-f4a91f40508e", "24357373-078f-44ed-9ac4-6d334a668a11", "15619216-e993-4721-b590-4c520615a67d", "d2eb17db-1d39-41dc-b57f-301f6512fa75", "5a6e1e16-07de-48d8-8aae-faa766c05e88", "5a3164f2-b373-4152-93cf-090b13c12d27", "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "5b768e71-86f2-4879-b448-81061cbae951", "ca621ba5-54ab-4035-9942-d378e6fcde3c", "98767d61-b2e8-4d71-b661-e36783ee24c1", "a85ffc3a-e8fd-4040-93bf-78aff284d801", "88f46b67-14d4-4f45-ac2c-d66984f22191", "83809e84-4475-4b69-bc3e-4aad8568612f", "ce72ef99-22f1-43d4-8695-419dcb5d9330", "add64136-62e5-48ea-807e-88638d02df1e", "04936b66-3915-43ad-a8e5-809eadfd1141", "847d5ff3-8a31-4737-a970-aeae8fe21765", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "c49c5062-0966-4170-9efd-9968c913a6cf", "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "850d55f9-6eeb-4492-ad69-a72338f65ba4", "d87bd452-6da1-456e-8155-7dc988157b7d", "5bb68627-3198-40ca-b458-49f973db8752", "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "caf201a9-c2ce-4a26-9c3a-2b9525413711", "4e762605-34a8-406d-b72e-c1a089313320", "d3c3861d-c504-4c77-ba55-224ba82d0118", "2ddef153-167b-4e89-86b6-757a9e65dcac", "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "8a582fe2-0882-4b89-a82a-da6b2dc32937", "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "f35c5d71-b489-4e22-a115-f003df287317", "fbd7c32d-db2a-4418-b92c-566eb8911133", "87a476dc-0079-4583-a985-dee7a20a03de", "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "38879043-7e1e-47a9-8d46-6bec88e201df", "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "f9999590-1f94-4a34-a91e-951e47bedefd", "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "4eddc365-79b4-43ff-a9d7-99422dc34b93", "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "220457c1-1c9f-4c2e-afe6-9598926222c1", "bf361876-6620-407a-812f-bfe11e51e924", "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "c79da740-5030-45ec-a2e0-479e824a562c", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "a197e378-d31b-41c0-9635-cfdf1c1bb423", "737e618a-a410-49b5-bec3-9e55ff7fbc15", "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "30edb182-aa75-42c0-b0a9-e998bb29067c", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "eb1c4225-1c23-4241-8dd4-051389fde4ce", "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "e312efd0-35a1-407f-8439-b8d434b438a6", "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "ba42babc-0666-4393-a4f7-ceaf5a69191e", "c27515df-97a9-4162-8a60-dc0eeb51b775", "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "0f6da907-5854-4be6-859a-e9958747b0aa", "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "5edc2273-c26f-406c-83f3-f4d948e740dd", "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "0f0450f3-8b47-441e-a31b-15a91dc243e2", "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "817f252c-5143-4dae-b418-48c3e9f63728", "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "07e3cb2c-0608-410d-be4b-1511cb1a0448", "138d3531-8793-4f50-a2cd-f291b2863d78", "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "ddeff553-5233-4ae9-bbab-d64d2bd634be", "e212d415-0e93-435f-9e1a-f29005bb4723", "55f0a3a1-846e-40eb-8273-677371b8d912", "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "6ba5a05f-b095-4f0a-8654-b825f4f16334", "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "45d3a03d-f441-458c-8883-df101a3bb146", "871b9555-69ca-4993-99d3-35a59f9f3599", "f2c64357-b1d2-41b7-849f-34d2682c0fad", "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "12fbff88-16b5-4b42-9754-cd001a789fb3", "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "0403d67d-6227-4ea8-8145-4e72db7da120", "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "bd1c6866-65fc-44b2-be51-5588fcff82b9", "1114e048-b69c-4f41-bc20-657245ae6e3f", "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "27aec9c9-dbb0-4939-8422-1742242471d0", "727454c0-d851-48b0-8b89-385611ab0704", "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "d20ee2f4-822c-4827-9e15-41500b1fff10", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "efec536f-72e8-4656-8960-5e85d091345b", "6f4191bb-912b-48a8-9ce7-682769541e6d", "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "517490a7-115a-48c6-8862-1a481504d5a8", "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "49d9671b-0a0a-4c09-8280-d215bfd30662", "05f3c945-dcc8-4393-9f3d-af65077a8f86", "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "554601fb-9b71-4bcc-abf4-21a611be4fde", "7b10f171-7f04-47c7-9fa2-5be43c76e535", "45239e6a-b035-4aaf-b339-8ad379fcb67e", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "7be5fb68-f9ef-476d-8b51-0256ebece19e", "6e22722b-dfb1-4508-a911-49ac840b40f8", "9ccba514-7cb6-4c5c-b377-700758f2f120", "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "7a74da6b-ea76-47db-92cc-874ad90df734", "f11f2808-adb4-46c0-802a-8660db50fa99", "43e32da2-fdd0-4156-90de-50dfd62636f9", "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "a20def93-0709-4eae-9bd2-31206e21e6b2", "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "6004abd0-afa4-4557-ba90-49d172e0a299", "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "970823b7-273b-460a-8afc-3a6811998529", "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "15b75071-74cc-47e0-b4c6-b43744a62a2b", "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "f99abdf0-6283-4e71-bd2b-b5c048a94743", "0a13e132-651d-11eb-ae93-0242ac130002", "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "e9f55347-2928-4c06-88e5-1a7f8169942e", "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "6a69f62d-ce75-4b57-8dce-6351eb55b362", "8b0e12da-d3c3-49db-bb4f-256703f380e5", "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "98a96a5a-64a0-4c42-92c5-489da3866cb0", "47e4bab7-c626-47dc-967b-255608c9a920", "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "40b19fa6-d835-400c-b301-41f3a2baacaf", "f44800ac-38ec-471f-936e-3fa7d9c53100", "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "24c8392b-aa3c-46b7-a545-43f71657fe98", "88f680b8-070e-402c-ae11-d2914f2257f1", "15434e33-5027-4914-88d5-3d4145ec25a9", "b98d0db6-511d-45de-ad02-e82a98729620", "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "0bbc6369-43e3-453d-9944-cae58821c173", "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "b7966f4a-b333-455b-8370-8ca53c229762", "43fa5350-db63-4b8f-9a01-789a427074e1", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "ec290c06-9b6b-4338-8b6b-095c0f284f10", "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "d4498716-1d52-438f-8084-4a603157d131", "b222df08-0e07-11eb-adc1-0242ac120002", "e1693bc8-7168-4eab-8718-cdcaa68a1738", "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "d3b70aad-097e-409c-9df2-450f80dc476b", "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "312d0384-401c-4b8b-abdf-685ffba9a332", "cc368ed0-2411-45dc-a222-510ace303cb2", "42333b2c-b425-441c-b70e-99404a17170f", "0e4164da-94bc-450d-a7be-a4b176179f1f", "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "ebef4391-1a81-4761-a40a-1db446c0e625", "f26307d8-14cd-47e3-a26b-4b4769f24af6", "03cc0c25-389f-4bf8-b48d-11878079f1ca", "8834e2f7-6b4b-4f09-8906-d2276470ee23", "7090adee-82e2-4269-bd59-80691e7c6338", "c74c0390-3e20-41fd-a69a-128f0275a5ea", "b6457d63-d2a2-4e29-859d-4e7affc153d1", "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "5f6a601c-2ecb-498b-9c33-660362323afa", "aa8e035d-7be4-48d3-a944-102aec04400d", "b243b280-65fe-48df-ba07-6ddea7646427", "236d8e89-ed95-4789-a982-36f4643738ba", "277a4393-446c-449a-b0ed-7fdc7795244c", "4fe074b4-b833-4081-8f24-7dcfeca72b42", "68bcd73b-37ef-49cb-95fc-edc809730be6", "86588b36-c6d3-465f-9cee-8f9093e07798", "502b42de-4306-40b4-9596-6f590c81f073", "0a99eb3e-1617-41bd-b095-13dc767f3def", "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "07f8bdc2-c9b3-472a-9817-5a670b872f53", "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "28ac00d6-22d9-4a3c-927f-bbd770104573", "452bce90-6fb0-43cc-97a5-affc283139b3", "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "ce7cf472-6fcc-490a-9481-3786840b5d9b", "c6fb44c6-71f5-49e6-9462-1425d328aee3", "9c0295ce-d60d-40bd-bd74-84673b7592b1", "0a4f6091-223b-41f6-8743-f322ec84930b", "98c5aeef-32d5-492f-b174-64a691896d25", "6fe4aa1e-0531-4510-8be2-782154b73b48", "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "d78b5d61-187d-44b6-bf02-93486a80de5a", "e9b61244-893f-427c-b287-3e708f321c6b", "70bc5215-526f-4477-963c-a47a5c9ebd12", "b6e04788-29e1-4557-bb14-77f761848ab8", "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "0685b176-c816-4837-8e7b-1216f346636b", "e84d89c4-f544-41ca-a6af-4b92fd38b023", "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "023394c4-29d5-46ab-92b8-6a534c6f447b", "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "ebea773c-a8f1-42ad-a856-00cb221966e8", "0b7163dc-7eee-4960-af17-c0cd517f92da", "98dedfdd-8333-49d4-9f23-d7018cccae53", "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "f24bcaea-0cd1-11eb-adc1-0242ac120002", "ccb5742c-c248-4982-8c5c-5571b9275ad3", "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "4abc0ec4-db5a-412f-9632-26659cddf145", "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "5cddf373-ef00-4112-ad72-960ac29bac34", "37db85d1-b089-490a-a59a-c7b6f984f480", "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "f1edd233-30b5-4823-9e6a-c4171b24d316", "e92a4287-e072-4a40-9739-370c106bb750", "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "8bc64091-6875-4881-aaf9-7bd25b5dda08", "56c217c3-2de2-479b-990f-5c109ba8458f", "eee00933-a761-4cd0-be70-c42fe91731e7", "bab049ca-7471-4828-9024-38279a4c04da", "d7654f02-e04b-4934-9838-65c46f187ebc", "2a072a96-a086-49fa-bcb5-15cc5a619093", "883faa95-175a-4e22-8181-e5761aeb373c", "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "63d1ccc0-2a43-4f4b-9289-361b308991ff", "4f154fb6-27d1-4813-a759-78b93e0b9c48", "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "33be4333-2c6b-44f4-ae28-102cdbde0a31", "395907ee-96e5-4666-af2e-2ca91688e151", "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "b0ce780f-10bd-496d-9067-066d23dc3aa5", "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "79b06761-465f-4f88-9ef2-150e24d3d737", "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "c615d676-f655-46b9-b913-78729021e5d7", "b19146a3-25d4-41b4-928b-1e2a92641b1b", "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "e6474a1b-5390-49cd-ab41-8d88655f7394", "692f0bec-83ba-4d04-af7e-e884a96059b6", "93671f99-04eb-4ab4-a161-70d446a84003", "0d5675be-bc88-4172-86d3-1e96a4476536", "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "4281cb20-2994-4580-aa63-c8b86d019934", "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "a34f79a3-8e5f-4cc3-b765-de00695452c2", "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "5589ab4f-a767-433c-961d-c91f3f704db1", "e8a95b5e-c891-46e2-b33a-93937d3abc31", "c86500e9-a645-4680-98d7-f882c70c1ea3", "58f50261-c53b-4c88-bd12-1d71f12eda4c", "34ebb878-1b15-4895-b352-ca2eeb99b274", "7a02e22e-b885-4404-b38b-1ddc7e65258a", "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "24de4f3b-804c-4165-b442-5a06a2302c7e", "731231b9-0b5d-4219-94dd-abb6959aa7ea", "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "d7bcd677-645d-4691-a8d4-7a5602b780d1", "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "6e897651-f157-4d8f-aaeb-df8151488385", "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "9847f263-4a81-424f-970c-875dab15b79b", "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "4b046706-5789-4673-b111-66f25fe99534", "73bba97f-a82d-42ce-b315-9182e76c57b1", "646bc99f-6682-4b47-a73a-17b1b64c9d34", "6c96fc76-0eb1-11eb-adc1-0242ac120002", "7050bba1-1aed-454e-8f73-3f46f09ce56a", "744a188b-0415-4792-896f-11ddb0588dbc", "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "faa48cae-6b25-4f00-a094-08947fef582f", "70ad0861-d1fe-491c-a45f-fa48148a300d", "a16980c2-0c56-4de0-9a79-17971979efdd", "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "954f0af7-62dd-418f-b3df-a84bc2c7a774", "a7ee1722-c3c5-aeff-3212-c777e4733217", "1dde5376-a648-492e-9e54-4241dd9b0c7f", "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "10c14723-61c7-4c75-92ca-9af245723ad2", "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "41421f44-58f9-455d-838a-c398859841d4", "ae9b0bd7-8888-4606-b444-0ed7410cb728", "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "43103702-5886-11ed-9b6a-0242ac120002", "16905e21-66ee-42fe-b256-1318ada2d770", "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "a7c3d773-caef-227e-a7e7-c2f13c622329", "214641c2-c579-4ecb-8427-0cf19df6842e", "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "07aa184a-870d-413d-893a-157f317f6f58", "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "f548a603-c9f2-4c89-b511-b089f7e94549", "93199800-b52a-4dec-b762-75212c196542", "526be59f-a573-4eea-b5f7-f0973207634d", "6345b048-8441-43a7-9bed-541133633d7a", "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "25676e10-2121-446e-80a4-71ff8506af47", "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "ac1c92b4-ac81-405a-9978-4604d78cc47e", "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "bdeb2cff-af74-4094-8426-724dc937f20a", "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "a383dec4-deec-4e6e-913b-ed9249670848", "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "ac20ae82-8758-4f38-958e-b44a3140ca88", "54786ddc-5b8a-11ed-9b6a-0242ac120002", "41ca393d-538c-408a-ac27-cf1e038be80c", "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "cd71385d-fd9b-4691-9b98-2b1f7e508714", "c8a180d6-47a3-4345-a609-53f9c3d834fc", "044ba588-dff4-4918-9808-3f95e8160606", "1af57a4b-460a-4738-9034-db68b880c665", "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "1dd05363-104e-4b4a-b963-196a534b03a1", "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "204b17ae-4007-471b-917b-b917b315c5db", "50d66fb0-03f8-4da0-8add-84e77d12a020", "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "c2b86e67-b880-4eec-b045-50bc98ef4844", "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "e593cf51-88db-4ee1-b920-37e89012a3c9", "8202070f-edeb-4d31-a010-a26c72ac5600", "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "3268b746-88d8-4cd3-bffc-30077d02c787", "18988e1b-9087-4f8a-82fe-0414dce49878", "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "f53714ec-5077-420e-ad20-907ff9bb2958", "f117933c-980c-4f78-b384-e3d838111165", "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "a29c1813-ab1f-4dde-b489-330b952e91ae", "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "b655a06a-31c0-477a-95c2-3726b83d649d", "21d856f9-9281-4ded-9377-51a1a6e2a432", "b66474aa-bd92-4333-a16c-298155b120df", "b2309017-4235-44fe-b5af-b15363011957", "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "62510e69-616b-4078-b371-847da438cc03", "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "285b85b1-a555-4095-8652-a8a4106af63f", "84f52741-8834-4a8c-a413-2eb2269aa6c8", "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "be344333-921d-4c4d-8bb8-e584cf584780", "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "fb843269-508c-4b76-8b8d-88679db22ce7", "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "de587dce-915e-4218-aac4-835ca6af6f70", "c7942406-33dd-4377-a564-0f62db0593a3", "ab9e3b40-0c85-4ba1-aede-455d226fd124", "ef61af62-bc74-4f58-b49b-626448227652", "a20391f8-76fb-437b-abc0-dba2df1952c6", "899133d5-4d7c-4a7f-94ee-27355c879d90", "1ac8666b-046f-4201-8aba-1951aaec03a3", "1c67a717-32ba-409b-a45d-0fb704a73a81", "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "eca49c87-8a75-4f13-9c73-a5a29e845f03", "435e10e4-992a-4281-96f3-38b11106adde", "b3512211-c67e-4707-bedc-66efc7848863", "c15a46a0-07d4-4c87-b4b6-89207835a83b", "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "1f0f6176-6482-4027-b151-00071af39d7e", "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "9257c05b-4a4a-48e5-a670-b7b073cf401b", "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "99793437-3e16-439b-be0f-078782cf953d", "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "ac175779-025a-4f12-98b0-acdaeb77ea85", "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "90d50722-0483-4065-8e35-57efaadd354d", "180c7c5c-d64b-4a63-86e9-68910451bc8b", "d55b793d-f847-4eea-b59a-5ab09908ac90", "aef9d1f1-7396-4e92-a927-4567c7a495c1", "6c6d9280-e6d0-4b9d-80ac-254701b64916", "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "9212f354-7775-4e28-9c9f-8f0a4544e664", "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "ffa6861c-4461-4f59-8a41-578c39f3f23e", "a0459f02-ac51-4c09-b511-b8c9203fc429", "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "534f2ef7-e8a2-4433-816d-c91bccde289b", "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "84232095-ecca-4015-b0d7-7726507ee793", "4e2ed651-1906-4a59-a78a-18220fca1b22", "60f16a96-db70-42eb-8f76-16763e333590", "5afee48e-67dd-4e03-a783-f74259dcf998", "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "771d1eb5-9587-4568-95fb-9ec44153a012", "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "e28a5a99-da44-436d-b7a0-2afc20a5f413", "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "68d37776-61db-42f5-bf54-27e87072d17e", "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "d2b749ee-4225-417e-b20e-a8d2193cbb84", "1193d960-2369-499f-a158-7b50a31df682", "6b65c28e-11f3-46cb-902a-68f2cafaf474", "242301bc-f92f-4476-8718-78004a6efd9f", "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "52d097e2-063e-4c9c-8fbb-855c8948d135", "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "647c7b9e-d784-4fda-b9a0-45c565a7b729", "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "bb76d96b-821c-47cf-944b-7ce377864492", "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "1816994b-42e1-4fb1-afd2-134d88184f71", "12827a56-61a4-476a-a9cb-f3068f191073", "32b96012-7892-429e-b26c-ac2bf46066ff", "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "f4bbd493-b796-416e-bbf2-121235348529", "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "d06be4b9-8045-428b-a567-740a26d9db25", "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "65c3ca2c-525f-4ced-968e-246a713d164f", "347906f3-e207-4d18-ae5b-a9403d6bcdef", "a29808fd-ef50-49ff-9c7a-59a9b040b404", "e66779cc-383e-4224-a3a4-267eeb585c40", "85c312b7-f44d-4a51-a024-d671c40b49fc", "6da2c9f5-7c53-401b-aacb-92c040ce1215", "6bd75993-9888-4f91-9404-e1e4e4e34b77", "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "ff992eac-6449-4c60-8c1d-91c9722a1d48", "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "208748f7-881d-47ac-a29c-07ea84bf691d", "89ca78fd-b37c-4310-b3d3-81a023f83936", "a2910908-e86f-4687-aeba-76a5f996e652", "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "9c14c9fa-1a63-4a64-8e57-d19280559490", "221b251a-357a-49a9-920a-271802777cc0", "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "f14e169e-9978-4c69-acb3-1cff8200bc36", "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "1c8774a0-44d4-4db0-91f8-e792359c70bd", "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "9fc3072c-dc8f-4bf7-b231-18950000fadd", "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "ada4b0c4-758b-46ac-9033-9004613a150d", "584bca0f-3608-4402-80fd-4075ff6072e3", "9a132afa-654e-11eb-ae93-0242ac130002", "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "a70dcb37-3bee-453a-99df-d0c683151be6", "85b0b087-eddf-4a2b-b033-d771fa2b9775", "2267fe65-0681-42ad-9a6d-46553d3f3480", "28c8f68b-098d-45af-8d43-8089f3e35403", "cd8c163e-a19b-402e-bdd5-419ff5859f12", "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "2c28c248-7f50-417a-9186-a85b223010ee", "84972c80-251c-4c3a-9079-4f00aad93938", "434c08ba-8406-4d15-8b24-782cb071a691", "bed2a484-9348-4143-8a8a-b801c979301c", "a0d7e4d2-bede-4141-8896-bc6e237e977c", "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "1c526788-0abe-4713-862f-b520da5e5316", "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "9f107a84-532c-41af-b005-8d12a607639f", "455b9d50-15a1-4b99-853f-8d37655a4c1b", "dee0a7a3-f200-4112-a99b-952196d81e42", "79ce34ca-af29-4d0e-b832-fc1b377020db", "2afafd61-6aae-4df4-baed-139fa1f4c345", "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "f0507c0f-a3a2-40f5-acc6-7f543c334993", "970007b7-ce32-49d0-a4a4-fbef016950bd", "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "f4264e47-f522-4c38-a420-04525d5b880f", "b2ddd389-f676-4ac4-845a-e00781a48e5f", "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "4a6713f6-3331-11ed-a261-0242ac120002", "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "5cc2cda8-f261-4d88-a2de-e9e193c86716", "01c42d3c-242d-4655-85b2-34f1739632f7", "77946e79-97f1-45a2-84b4-f37b5c0d8682", "27ba3207-dd30-4812-abbf-5d20c57d474e", "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "1228c958-e64e-4e71-92ad-7d429f4138ba", "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "b1377339-fda6-477a-b455-ac0923f9ec2c", "44143844-0631-49ab-97a0-96387d6b2d7c", "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "85de1f22-d189-44e4-8239-dc276b45379b", "92626ddd-662c-49e3-ac59-f6535f12d189", "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "e56d3073-83ff-4021-90fe-c658e0709e72", "deb9b646-a508-44ee-b7c9-d8965921c6b6", "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "cea2b7ea-792b-405f-95a1-b903ea06458f", "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "730fc21b-eaff-474b-ad23-90fd265d4988", "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "48917adc-a28e-4f5d-b729-11e75da8941f", "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "0900463c-b33b-49a8-be1d-552a3b553dae", "82a6714f-4899-4f16-9c1e-9a333544d4c3", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "1e59c230-6670-45bf-83b0-98903780607e", "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "258fc8ce-8352-443a-9120-8a11e4857fa5", "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "4ae81040-fc1c-4249-bfa3-938d260214d9", "aa2efee7-34dd-446e-8a37-40790a66efd7", "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "ae215552-081e-44c7-805f-be16f975c8a2", "30bf1789-379d-4fdc-900f-55cd0a90a801", "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "4f7a6757-ff79-46db-9687-66501a02d9ec", "129966c9-de17-4334-a123-8b58172e664d", "696bfb54-227e-4602-ac5b-30d9d2053312", "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "7df1713a-1a5b-4a4b-a071-dc83b144a101", "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "814c95cc-8192-4378-a70a-f1aafd877af1", "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "99c840f2-2012-46fd-9141-c761987550ef", "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "de16d92c-c446-4d53-8938-10aeef41c8b6", "056c7317-9a09-4bd4-9067-d051312752ea", "60fc936d-2eb0-4543-8a13-911c750a1dfc", "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "114de787-4eb2-48cc-abdb-c0b449f93ea4", "207b0396-3689-42d9-8399-4222658efc99", "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "9248c7e1-2bf3-4661-a22c-600a8040b446", "146aace8-9bd6-42ba-be7a-0070d8027b76", "3d7679bd-0c00-440c-97b0-3f204273e6c7", "ea011323-7045-460b-b2d7-0f7442ea6b38", "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "e290b10b-1023-4452-a4a9-eb31a9013b3a", "ca5583e9-8f80-46ac-ab91-7f314d13b984", "cd3d1298-eb3b-476c-ac67-12847de55813", "867356ee-9352-41c9-a8f2-1be690d78216", "67f113fa-e23d-4271-befa-30113b3e08b1", "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "62b20d44-1546-4e61-afce-8e175eb9473c", "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "b6676963-0353-4f88-90f5-36c20d443c6a", "99cf1e02-00fb-4c0d-8375-563f978dfd37", "903076ff-f442-475a-b667-4f246bcc203b", "a77c1610-fc73-4019-8e29-0f51efc04a51", "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "cea72823-df4d-4567-950c-0b579eaf0846", "74a2b202-73e0-4693-9a3a-9d36146d0775", "5fc297ae-25b6-488a-8f25-cc12ac29b744", "12f6b752-042d-483e-bf9c-915a6d06ad75", "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "c1d867fe-8d95-4487-aab4-e53f2d339f90", "e13f668e-7f95-443d-98d2-1816a7648a7b", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "9c8c7000-3065-44a8-a555-79bcba5d9955", "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "ee5e119b-1f75-4b34-add8-3be976961e39", "33339be3-148b-4e16-af56-ad16ec6c7e7b", "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "646ea171-dded-4578-8a4d-65e9822892e3", "84b1706c-932a-44c4-ae28-892b28a25b94", "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "074e0ded-6ced-4ebd-8b4d-53f55908119d", "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "af491bca-e752-4b44-9c86-df5680533dbc", "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "f0f7be61-9cf5-43be-9836-99d6ef448a18", "b1f73849-6329-4069-bc8f-78a604bb8b23", "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "0b80ade5-6997-4b1d-99a1-71701778ea61", "81ebd28b-9607-4478-bf06-974ed9d53ed7", "dc4576d4-7467-424f-9eee-fd2b02855fe0", "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "e9142d84-fbe0-401d-ac50-3e519fb00c89", "b4dc61f5-6cce-468e-a608-b48b469feaa2", "e6313acd-208c-44fc-a0ff-db85d572e90e", "f3d39c45-de1a-4486-a687-ab126124f744", "97dbf6e2-e436-44d8-abee-4261b24d3e41", "729ce0ea-5d8f-4769-9762-e35de441586d", "0fc35fc3-efe6-4898-8a37-0b233339524f", "c947b146-0abc-4c87-9c64-b17e9d7274a2", "91a2c315-9ee6-4052-a853-6f6a8238f90d", "9525dc73-0327-438c-8c04-13c0e037e9da", "a4694263-59a8-4608-a3a0-6f8d3a51664c", "f37aba28-a9e6-4045-882c-d5004043b337", "5e95028c-5229-4214-afae-d653d573d0ec", "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "f7375e28-5c14-432f-b8d1-1db26c832df3", "0e0255bf-2548-47b8-9582-c0955c9283f5", "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "889719ef-dd62-43df-86c3-768fb08dc7c0", "af77cf95-c469-471c-b6a0-946c685c4798", "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "4bf943c6-5146-4273-98dd-e958fd1e3abf", "7f741dcf-fc22-4759-87b4-9ae8376676a2", "8a3038e8-9c9d-46f8-b184-66234a160f6f", "7d4aaec2-08ed-4430-8b96-28420e030e04", "75d0a94e-6252-448d-a7be-d953dff527bb", "327f48c1-a6db-4eb8-875a-f6981f1b0183", "5f03babb-12db-4eec-8c82-7b4cb5580868", "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "cd1f961e-0b96-436b-b7c6-38da4583ec00", "7b4f794b-590a-4ad4-ba18-7964a2832205", "438025f9-5856-4663-83f7-52f878a70a50", "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "213d6a77-3d55-4ce8-ba74-fcfef741974e", "aaafa146-074c-11eb-adc1-0242ac120002", "2433a154-bb3d-42e4-86c3-a26bdac91c45", "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "4f647cfa-b598-4e12-ad69-c68dd16caef8", "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "17769c90-230e-488b-a463-e05c08e9d48f", "222129f7-f4dc-4568-b0d2-22440a9639ba", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "e173ad47-4388-4012-ae62-bd13f71c18a8", "48bbc537-b652-4b4e-bd1d-281172df448f", "1edff897-9146-48d2-9066-52e8d8f80a2f", "c248c896-e412-4279-8c15-1c558067b6fa", "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "d522eca2-2973-4391-a3e0-ef0374321dae", "62e0298b-e994-4189-bc87-bc699aa62d97", "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "a537cfc3-4297-4789-92b5-345bfd845ad0", "74a12f18-505c-4114-8d0b-8448dd5485c6", "4a2a2c3e-209f-4d01-b513-4155a540b469", "32410e29-5f94-4568-b6a3-d91a8adad863", "f64e5c19-879c-4bae-b471-6d84c8339677", "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "536e2947-3729-478c-9903-745aaffe60d2", "40aa399c-7b02-4715-8e5f-73572b493f33", "883835a7-df45-43e4-bf1d-4268768afda4", "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "b57ba453-b384-4ab9-9f40-1038086b4e53", "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "3bad990e-4848-4a78-9530-b427d854aac0", "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "09576804-7a05-458e-a817-eb718ca91f54", "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "b0524451-19af-4efa-a46f-562a977f792e", "b96b2031-7c17-4473-afe7-a30ce714db29", "37c1333a-a0db-48be-b64b-7393b2386e3b", "81325ce1-be01-4250-944f-b4789644556f", "3abd6094-7027-475f-9630-8ab9be7b9725", "d9047477-0359-48c9-b8c7-792cedcdc9c4", "56d19cb4-6414-4769-9644-1ed35ffbb148", "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "5cdb711b-5740-4fb2-ba88-f7945027afac", "164eda96-11b2-430b-85ff-6a265c15bf32", "a58353df-af43-4753-bad0-cd83ef35eef5", "56321594-9087-49d9-bf10-524fe8479452"], "uberAgent 6.1": ["ec8c4047-fad9-416a-8c81-0f479353d7f6", "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "d13c43f0-f66b-4279-8b2c-5912077c1780", "d2451be2-b582-4e15-8701-4196ac180260", "f40017b3-cb2e-4335-ab5d-3babf679c1de", "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "f354eba5-623b-450f-b073-0b5b2773b6aa", "6414b5cd-b19d-447e-bb5e-9f03940b5784", "bdc64095-d59a-42a2-8588-71fd9c9d9abc", "1fbc0671-5596-4e17-8682-f020a0b995dc", "552b6b65-df37-4d3e-a258-f2fc4771ae54", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "4c21b805-4dd7-469f-b47d-7383a8fcb437", "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "4508a70e-97ef-4300-b62b-ff27992990ea", "857c8db3-c89b-42fb-882b-f681c7cf4da2", "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "3669afd2-9891-4534-a626-e5cf03810a61", "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "7417e29e-c2e7-4cf6-a2e8-767228c64837", "72ca7c75-bf85-45cd-aca7-255d360e423c", "060d5ad4-3153-47bb-8382-43e5e29eda92", "0e0bc253-07ed-43f1-816d-e1b220fe8971", "6e78b74f-c762-4800-82ad-f66787f10c8a", "84b0a8f3-680b-4096-a45b-e9a89221727c", "90ae0469-0cee-4509-b67f-e5efcef040f7", "bf9808c4-d24f-44a2-8398-b65227d406b6", "caa02837-f659-466f-bca6-48bde2826ab4", "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "4fc0deee-0057-4998-ab31-d24e46e0aba4", "e2e01011-5910-4267-9c3b-4149ed5479cf", "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "d2605a99-2218-4894-8fd3-2afb7946514d", "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "a2a3b925-7bb0-433b-b508-db9003263cc4", "68654bf0-4412-43d5-bfe8-5eaa393cd939", "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "952ed57c-8f99-453d-aee0-53a49c22f95d", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "75e508f7-932d-4ebc-af77-269237a84ce1", "ea5c131b-380d-49f9-aeb3-920694da4d4b", "a2edbce1-95c8-4291-8676-0d45146862b3", "844f8eb2-610b-42c8-89a4-47596e089663", "6360757a-d460-456c-8b13-74cf0e60cceb", "24b6cf51-6122-469e-861a-22974e9c1e5b", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "9ed5959a-c43c-4c59-84e3-d28628429456", "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "fef394cd-f44d-4040-9b18-95d92fe278c0", "48bfd177-7cf2-412b-ad77-baf923489e82", "2092cacb-d77b-4f98-ab0d-32b32f99a054", "ff0f2b05-09db-4095-b96d-1b75ca24894a", "7707a579-e0d8-4886-a853-ce47e4575aaa", "ee6cea48-c5b6-4304-a332-10fc6446f484", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "e76c8240-d68f-4773-8880-5c6f63595aaf", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "af4c4609-5755-42fe-8075-4effb49f5d44", "9ca2bf31-0570-44d8-a543-534c47c33ed7", "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "6ec86d9e-912e-4726-91a2-209359b999b9", "273a8dd8-3742-4302-bcc7-7df5a80fe425", "90217a70-13fc-48e4-b3db-0d836c5824ac", "3735d5ac-d770-4da0-99ff-156b180bc600", "948a0953-f287-4806-bbcb-3b2e396df89f", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "a1d9eec5-33b2-4177-8d24-27fe754d0812", "613c03ba-0779-4a53-8a1f-47f914a4ded3", "f356a9c4-effd-4608-bbf8-408afd5cd006", "df68f791-ad95-447f-a271-640a0dab9cf8", "e043f529-8514-4205-8ab0-7f7d2927b400", "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "065cceea-77ec-4030-9052-fc0affea7110", "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "36e037c4-c228-4866-b6a3-48eb292b9955", "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "caa06de8-fdef-4c91-826a-7f9e163eef4b", "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "2158f96f-43c2-43cb-952a-ab4580f32382", "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "d797268e-28a9-49a7-b9a8-2f5039011c5c", "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "f426547a-e0f7-441a-b63e-854ac5bdf54d", "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "6d3a3952-6530-44a3-8554-cf17c116c615", "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "a4824fca-976f-4964-b334-0621379e84c4", "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "92a974db-ab84-457f-9ec0-55db83d7a825", "f9578658-9e71-4711-b634-3f9b50cd3c06", "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "f5240972-3938-4e56-8e4b-e33893176c1f", "fff9d2b7-e11c-4a69-93d3-40ef66189767", "cc9d3712-6310-4320-b2df-7cb408274d53", "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "42a993dd-bb3e-48c8-b372-4d6684c4106c", "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "36210e0d-5b19-485d-a087-c096088885f0", "1723e720-616d-4ddc-ab02-f7e3685a4713", "90fb5e62-ca1f-4e22-b42e-cc521874c938", "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "57c4bf16-227f-4394-8ec7-1b745ee061c3", "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "0ea52357-cd59-4340-9981-c46c7e900428", "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "9719a8aa-401c-41af-8108-ced7ec9cd75c", "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "587254ee-a24b-4335-b3cd-065c0f1f4baa", "98b53e78-ebaf-46f8-be06-421aafd176d9", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "b5746143-59d6-4603-8d06-acbd60e166ee", "551d9c1f-816c-445b-a7a6-7a3864720d60", "e31033fc-33f0-4020-9a16-faf9b31cbf08", "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "8e3c7994-131e-4ba5-b6ea-804d49113a26", "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "e32d4572-9826-4738-b651-95fa63747e8a", "043c4b8b-3a54-4780-9682-081cb6b8185c", "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "c363385c-f75d-4753-a108-c1a8e28bdbda", "5cb299fc-5fb1-4d07-b989-0644c68b6043", "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "811f459f-9231-45d4-959a-0266c6311987", "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "7d6d30b8-5b91-4b90-a891-46cccaf29598", "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "087790e3-3287-436c-bccf-cbd0184a7db1", "6812a10b-60ea-420c-832f-dfcc33b646ba", "84b14121-9d14-416e-800b-f3b829c5a14d", "32e280f1-8ad4-46ef-9e80-910657611fbc", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "3f5491e2-8db8-496b-9e95-1029fce852d4", "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "02030f2f-6199-49ec-b258-ea71b07e03dc", "74403157-20f5-415d-89a7-c505779585cf", "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "4d7cda18-1b12-4e52-b45c-d28653210df8", "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "c9783e20-4793-4164-ba96-d9ee483992c4", "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "94771a71-ba41-4b6e-a757-b531372eaab6", "2f869d59-7f6a-4931-992c-cce556ff2d53", "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "1775e15e-b61b-4d14-a1a3-80981298085a", "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "42b1a5b8-353f-4f10-b256-39de4467faff", "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "9292293b-8496-4715-9db6-37028dcda4b3", "52788a70-f1da-40dd-8fbd-73b5865d6568", "349d891d-fef0-4fe4-bc53-eee623a15969", "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "6f3e2987-db24-4c78-a860-b4f4095a7095", "1ec65a5f-9473-4f12-97da-622044d6df21", "d042284c-a296-4988-9be5-f424fadcc28c", "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "1327381e-6ab0-4f38-b583-4c1b8346a56b", "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "9ec9fb1b-e059-4489-9642-f270c207923d", "058f4380-962d-40a5-afce-50207d36d7e2", "fe63010f-8823-4864-a96b-a7b4a0f7b929", "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "c86133ad-4725-4bd0-8170-210788e0a7ba", "f5d19838-41b5-476c-98d8-ba8af4929ee2", "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "82880171-b475-4201-b811-e9c826cd5eaa", "023c654f-8f16-44d9-bb2b-00ff36a62af9", "d557dc06-62e8-4468-a8e8-7984124908ce", "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "a642964e-bead-4bed-8910-1bb4d63e3b4d", "e4a6b256-3e47-40fc-89d2-7a477edd6915", "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "9fff585c-c33e-4a86-b3cd-39312079a65f", "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "fa00b701-44c6-4679-994d-5a18afa8a707", "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "313d6012-51a0-4d93-8dfc-de8553239e25", "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "b36d01a3-ddaf-4804-be18-18a6247adfcd", "aaf46cdc-934e-4284-b329-34aa701e3771", "575dce0c-8139-4e30-9295-1ee75969f7fe", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "a1473adb-5338-4a20-b4c3-126763e2d3d3", "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "241e802a-b65e-484f-88cd-c2dc10f9206d", "fd877b94-9bb5-4191-bb25-d79cbd93c167", "d047726b-c71c-4048-a99b-2e2f50dc107d", "40b95d31-1afc-469e-8d34-9a3a667d058e", "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "e6c54d94-498c-4562-a37c-b469d8e9a275", "64760eef-87f7-4ed3-93fd-655668ea9420", "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "da2738f2-fadb-4394-afa7-0a0674885afa", "88872991-7445-4a22-90b2-a3adadb0e827", "f576a613-2392-4067-9d1a-9345fb58d8d1", "431a1fdb-4799-4f3b-91c3-a683b003fc49", "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "4931188c-178e-4ee7-a348-39e8a7a56821", "85ff530b-261d-48c6-a441-facaa2e81e48", "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "8cbc9475-8d05-4e27-9c32-df960716c701", "378a05d8-963c-46c9-bcce-13c7657eac99", "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "e568650b-5dcd-4658-8f34-ded0b1e13992", "f208d6d8-d83a-4c2c-960d-877c37da84e5", "514e4c3a-c77d-4cde-a00f-046425e2301e", "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "01aeb693-138d-49d2-9403-c4f52d7d3d62", "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "83865853-59aa-449e-9600-74b9d89a6d6e", "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "b53317a0-8acf-4fd1-8de8-a5401e776b96", "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "10344bb3-7f65-46c2-b915-2d00d47be5b0", "185d7418-f250-42d0-b72e-0c8b70661e93", "379fa130-190e-4c3f-b7bc-6c8e834485f3", "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "e83e8899-c9b2-483b-b355-5decc942b959", "6385697e-9f1b-40bd-8817-f4a91f40508e", "24357373-078f-44ed-9ac4-6d334a668a11", "15619216-e993-4721-b590-4c520615a67d", "d2eb17db-1d39-41dc-b57f-301f6512fa75", "5a6e1e16-07de-48d8-8aae-faa766c05e88", "5a3164f2-b373-4152-93cf-090b13c12d27", "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "5b768e71-86f2-4879-b448-81061cbae951", "98767d61-b2e8-4d71-b661-e36783ee24c1", "a85ffc3a-e8fd-4040-93bf-78aff284d801", "88f46b67-14d4-4f45-ac2c-d66984f22191", "83809e84-4475-4b69-bc3e-4aad8568612f", "ce72ef99-22f1-43d4-8695-419dcb5d9330", "add64136-62e5-48ea-807e-88638d02df1e", "04936b66-3915-43ad-a8e5-809eadfd1141", "847d5ff3-8a31-4737-a970-aeae8fe21765", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "c49c5062-0966-4170-9efd-9968c913a6cf", "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "850d55f9-6eeb-4492-ad69-a72338f65ba4", "d87bd452-6da1-456e-8155-7dc988157b7d", "5bb68627-3198-40ca-b458-49f973db8752", "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "caf201a9-c2ce-4a26-9c3a-2b9525413711", "4e762605-34a8-406d-b72e-c1a089313320", "d3c3861d-c504-4c77-ba55-224ba82d0118", "2ddef153-167b-4e89-86b6-757a9e65dcac", "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "8a582fe2-0882-4b89-a82a-da6b2dc32937", "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "f35c5d71-b489-4e22-a115-f003df287317", "fbd7c32d-db2a-4418-b92c-566eb8911133", "87a476dc-0079-4583-a985-dee7a20a03de", "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "38879043-7e1e-47a9-8d46-6bec88e201df", "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "f9999590-1f94-4a34-a91e-951e47bedefd", "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "4eddc365-79b4-43ff-a9d7-99422dc34b93", "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "220457c1-1c9f-4c2e-afe6-9598926222c1", "bf361876-6620-407a-812f-bfe11e51e924", "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "c79da740-5030-45ec-a2e0-479e824a562c", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "a197e378-d31b-41c0-9635-cfdf1c1bb423", "737e618a-a410-49b5-bec3-9e55ff7fbc15", "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "30edb182-aa75-42c0-b0a9-e998bb29067c", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "eb1c4225-1c23-4241-8dd4-051389fde4ce", "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "e312efd0-35a1-407f-8439-b8d434b438a6", "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "ba42babc-0666-4393-a4f7-ceaf5a69191e", "c27515df-97a9-4162-8a60-dc0eeb51b775", "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "0f6da907-5854-4be6-859a-e9958747b0aa", "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "5edc2273-c26f-406c-83f3-f4d948e740dd", "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "0f0450f3-8b47-441e-a31b-15a91dc243e2", "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "817f252c-5143-4dae-b418-48c3e9f63728", "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "07e3cb2c-0608-410d-be4b-1511cb1a0448", "138d3531-8793-4f50-a2cd-f291b2863d78", "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "ddeff553-5233-4ae9-bbab-d64d2bd634be", "e212d415-0e93-435f-9e1a-f29005bb4723", "55f0a3a1-846e-40eb-8273-677371b8d912", "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "6ba5a05f-b095-4f0a-8654-b825f4f16334", "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "45d3a03d-f441-458c-8883-df101a3bb146", "871b9555-69ca-4993-99d3-35a59f9f3599", "f2c64357-b1d2-41b7-849f-34d2682c0fad", "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "12fbff88-16b5-4b42-9754-cd001a789fb3", "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "0403d67d-6227-4ea8-8145-4e72db7da120", "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "bd1c6866-65fc-44b2-be51-5588fcff82b9", "1114e048-b69c-4f41-bc20-657245ae6e3f", "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "27aec9c9-dbb0-4939-8422-1742242471d0", "727454c0-d851-48b0-8b89-385611ab0704", "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "d20ee2f4-822c-4827-9e15-41500b1fff10", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "efec536f-72e8-4656-8960-5e85d091345b", "6f4191bb-912b-48a8-9ce7-682769541e6d", "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "517490a7-115a-48c6-8862-1a481504d5a8", "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "49d9671b-0a0a-4c09-8280-d215bfd30662", "05f3c945-dcc8-4393-9f3d-af65077a8f86", "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "554601fb-9b71-4bcc-abf4-21a611be4fde", "7b10f171-7f04-47c7-9fa2-5be43c76e535", "45239e6a-b035-4aaf-b339-8ad379fcb67e", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "7be5fb68-f9ef-476d-8b51-0256ebece19e", "6e22722b-dfb1-4508-a911-49ac840b40f8", "9ccba514-7cb6-4c5c-b377-700758f2f120", "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "7a74da6b-ea76-47db-92cc-874ad90df734", "f11f2808-adb4-46c0-802a-8660db50fa99", "43e32da2-fdd0-4156-90de-50dfd62636f9", "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "a20def93-0709-4eae-9bd2-31206e21e6b2", "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "6004abd0-afa4-4557-ba90-49d172e0a299", "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "970823b7-273b-460a-8afc-3a6811998529", "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "15b75071-74cc-47e0-b4c6-b43744a62a2b", "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "f99abdf0-6283-4e71-bd2b-b5c048a94743", "0a13e132-651d-11eb-ae93-0242ac130002", "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "e9f55347-2928-4c06-88e5-1a7f8169942e", "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "6a69f62d-ce75-4b57-8dce-6351eb55b362", "8b0e12da-d3c3-49db-bb4f-256703f380e5", "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "98a96a5a-64a0-4c42-92c5-489da3866cb0", "47e4bab7-c626-47dc-967b-255608c9a920", "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "40b19fa6-d835-400c-b301-41f3a2baacaf", "f44800ac-38ec-471f-936e-3fa7d9c53100", "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "24c8392b-aa3c-46b7-a545-43f71657fe98", "88f680b8-070e-402c-ae11-d2914f2257f1", "15434e33-5027-4914-88d5-3d4145ec25a9", "b98d0db6-511d-45de-ad02-e82a98729620", "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "0bbc6369-43e3-453d-9944-cae58821c173", "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "b7966f4a-b333-455b-8370-8ca53c229762", "43fa5350-db63-4b8f-9a01-789a427074e1", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "ec290c06-9b6b-4338-8b6b-095c0f284f10", "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "d4498716-1d52-438f-8084-4a603157d131", "b222df08-0e07-11eb-adc1-0242ac120002", "e1693bc8-7168-4eab-8718-cdcaa68a1738", "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "d3b70aad-097e-409c-9df2-450f80dc476b", "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "312d0384-401c-4b8b-abdf-685ffba9a332", "cc368ed0-2411-45dc-a222-510ace303cb2", "42333b2c-b425-441c-b70e-99404a17170f", "0e4164da-94bc-450d-a7be-a4b176179f1f", "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "ebef4391-1a81-4761-a40a-1db446c0e625", "f26307d8-14cd-47e3-a26b-4b4769f24af6", "03cc0c25-389f-4bf8-b48d-11878079f1ca", "8834e2f7-6b4b-4f09-8906-d2276470ee23", "7090adee-82e2-4269-bd59-80691e7c6338", "c74c0390-3e20-41fd-a69a-128f0275a5ea", "b6457d63-d2a2-4e29-859d-4e7affc153d1", "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "5f6a601c-2ecb-498b-9c33-660362323afa", "aa8e035d-7be4-48d3-a944-102aec04400d", "b243b280-65fe-48df-ba07-6ddea7646427", "236d8e89-ed95-4789-a982-36f4643738ba", "277a4393-446c-449a-b0ed-7fdc7795244c", "4fe074b4-b833-4081-8f24-7dcfeca72b42", "68bcd73b-37ef-49cb-95fc-edc809730be6", "86588b36-c6d3-465f-9cee-8f9093e07798", "502b42de-4306-40b4-9596-6f590c81f073", "0a99eb3e-1617-41bd-b095-13dc767f3def", "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "07f8bdc2-c9b3-472a-9817-5a670b872f53", "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "28ac00d6-22d9-4a3c-927f-bbd770104573", "452bce90-6fb0-43cc-97a5-affc283139b3", "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "ce7cf472-6fcc-490a-9481-3786840b5d9b", "c6fb44c6-71f5-49e6-9462-1425d328aee3", "9c0295ce-d60d-40bd-bd74-84673b7592b1", "0a4f6091-223b-41f6-8743-f322ec84930b", "98c5aeef-32d5-492f-b174-64a691896d25", "6fe4aa1e-0531-4510-8be2-782154b73b48", "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "d78b5d61-187d-44b6-bf02-93486a80de5a", "e9b61244-893f-427c-b287-3e708f321c6b", "70bc5215-526f-4477-963c-a47a5c9ebd12", "b6e04788-29e1-4557-bb14-77f761848ab8", "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "0685b176-c816-4837-8e7b-1216f346636b", "e84d89c4-f544-41ca-a6af-4b92fd38b023", "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "023394c4-29d5-46ab-92b8-6a534c6f447b", "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "ebea773c-a8f1-42ad-a856-00cb221966e8", "0b7163dc-7eee-4960-af17-c0cd517f92da", "98dedfdd-8333-49d4-9f23-d7018cccae53", "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "f24bcaea-0cd1-11eb-adc1-0242ac120002", "ccb5742c-c248-4982-8c5c-5571b9275ad3", "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "4abc0ec4-db5a-412f-9632-26659cddf145", "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "5cddf373-ef00-4112-ad72-960ac29bac34", "37db85d1-b089-490a-a59a-c7b6f984f480", "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "f1edd233-30b5-4823-9e6a-c4171b24d316", "e92a4287-e072-4a40-9739-370c106bb750", "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "8bc64091-6875-4881-aaf9-7bd25b5dda08", "56c217c3-2de2-479b-990f-5c109ba8458f", "eee00933-a761-4cd0-be70-c42fe91731e7", "bab049ca-7471-4828-9024-38279a4c04da", "2a072a96-a086-49fa-bcb5-15cc5a619093", "883faa95-175a-4e22-8181-e5761aeb373c", "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "63d1ccc0-2a43-4f4b-9289-361b308991ff", "4f154fb6-27d1-4813-a759-78b93e0b9c48", "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "33be4333-2c6b-44f4-ae28-102cdbde0a31", "395907ee-96e5-4666-af2e-2ca91688e151", "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "b0ce780f-10bd-496d-9067-066d23dc3aa5", "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "79b06761-465f-4f88-9ef2-150e24d3d737", "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "c615d676-f655-46b9-b913-78729021e5d7", "b19146a3-25d4-41b4-928b-1e2a92641b1b", "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "e6474a1b-5390-49cd-ab41-8d88655f7394", "692f0bec-83ba-4d04-af7e-e884a96059b6", "93671f99-04eb-4ab4-a161-70d446a84003", "0d5675be-bc88-4172-86d3-1e96a4476536", "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "4281cb20-2994-4580-aa63-c8b86d019934", "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "a34f79a3-8e5f-4cc3-b765-de00695452c2", "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "5589ab4f-a767-433c-961d-c91f3f704db1", "e8a95b5e-c891-46e2-b33a-93937d3abc31", "c86500e9-a645-4680-98d7-f882c70c1ea3", "58f50261-c53b-4c88-bd12-1d71f12eda4c", "34ebb878-1b15-4895-b352-ca2eeb99b274", "7a02e22e-b885-4404-b38b-1ddc7e65258a", "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "24de4f3b-804c-4165-b442-5a06a2302c7e", "731231b9-0b5d-4219-94dd-abb6959aa7ea", "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "d7bcd677-645d-4691-a8d4-7a5602b780d1", "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "6e897651-f157-4d8f-aaeb-df8151488385", "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "9847f263-4a81-424f-970c-875dab15b79b", "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "4b046706-5789-4673-b111-66f25fe99534", "73bba97f-a82d-42ce-b315-9182e76c57b1", "646bc99f-6682-4b47-a73a-17b1b64c9d34", "6c96fc76-0eb1-11eb-adc1-0242ac120002", "7050bba1-1aed-454e-8f73-3f46f09ce56a", "744a188b-0415-4792-896f-11ddb0588dbc", "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "faa48cae-6b25-4f00-a094-08947fef582f", "70ad0861-d1fe-491c-a45f-fa48148a300d", "a16980c2-0c56-4de0-9a79-17971979efdd", "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "954f0af7-62dd-418f-b3df-a84bc2c7a774", "a7ee1722-c3c5-aeff-3212-c777e4733217", "1dde5376-a648-492e-9e54-4241dd9b0c7f", "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "10c14723-61c7-4c75-92ca-9af245723ad2", "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "41421f44-58f9-455d-838a-c398859841d4", "ae9b0bd7-8888-4606-b444-0ed7410cb728", "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "43103702-5886-11ed-9b6a-0242ac120002", "16905e21-66ee-42fe-b256-1318ada2d770", "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "a7c3d773-caef-227e-a7e7-c2f13c622329", "214641c2-c579-4ecb-8427-0cf19df6842e", "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "07aa184a-870d-413d-893a-157f317f6f58", "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "f548a603-c9f2-4c89-b511-b089f7e94549", "93199800-b52a-4dec-b762-75212c196542", "526be59f-a573-4eea-b5f7-f0973207634d", "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "25676e10-2121-446e-80a4-71ff8506af47", "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "ac1c92b4-ac81-405a-9978-4604d78cc47e", "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "bdeb2cff-af74-4094-8426-724dc937f20a", "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "a383dec4-deec-4e6e-913b-ed9249670848", "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "ac20ae82-8758-4f38-958e-b44a3140ca88", "54786ddc-5b8a-11ed-9b6a-0242ac120002", "41ca393d-538c-408a-ac27-cf1e038be80c", "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "cd71385d-fd9b-4691-9b98-2b1f7e508714", "c8a180d6-47a3-4345-a609-53f9c3d834fc", "044ba588-dff4-4918-9808-3f95e8160606", "1af57a4b-460a-4738-9034-db68b880c665", "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "1dd05363-104e-4b4a-b963-196a534b03a1", "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "204b17ae-4007-471b-917b-b917b315c5db", "50d66fb0-03f8-4da0-8add-84e77d12a020", "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "c2b86e67-b880-4eec-b045-50bc98ef4844", "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "e593cf51-88db-4ee1-b920-37e89012a3c9", "8202070f-edeb-4d31-a010-a26c72ac5600", "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "3268b746-88d8-4cd3-bffc-30077d02c787", "18988e1b-9087-4f8a-82fe-0414dce49878", "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "f53714ec-5077-420e-ad20-907ff9bb2958", "f117933c-980c-4f78-b384-e3d838111165", "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "a29c1813-ab1f-4dde-b489-330b952e91ae", "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "b655a06a-31c0-477a-95c2-3726b83d649d", "21d856f9-9281-4ded-9377-51a1a6e2a432", "b66474aa-bd92-4333-a16c-298155b120df", "b2309017-4235-44fe-b5af-b15363011957", "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "62510e69-616b-4078-b371-847da438cc03", "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "285b85b1-a555-4095-8652-a8a4106af63f", "84f52741-8834-4a8c-a413-2eb2269aa6c8", "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "be344333-921d-4c4d-8bb8-e584cf584780", "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "fb843269-508c-4b76-8b8d-88679db22ce7", "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "de587dce-915e-4218-aac4-835ca6af6f70", "c7942406-33dd-4377-a564-0f62db0593a3", "ab9e3b40-0c85-4ba1-aede-455d226fd124", "ef61af62-bc74-4f58-b49b-626448227652", "a20391f8-76fb-437b-abc0-dba2df1952c6", "899133d5-4d7c-4a7f-94ee-27355c879d90", "1ac8666b-046f-4201-8aba-1951aaec03a3", "1c67a717-32ba-409b-a45d-0fb704a73a81", "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "eca49c87-8a75-4f13-9c73-a5a29e845f03", "435e10e4-992a-4281-96f3-38b11106adde", "b3512211-c67e-4707-bedc-66efc7848863", "c15a46a0-07d4-4c87-b4b6-89207835a83b", "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "1f0f6176-6482-4027-b151-00071af39d7e", "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "9257c05b-4a4a-48e5-a670-b7b073cf401b", "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "99793437-3e16-439b-be0f-078782cf953d", "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "ac175779-025a-4f12-98b0-acdaeb77ea85", "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "90d50722-0483-4065-8e35-57efaadd354d", "180c7c5c-d64b-4a63-86e9-68910451bc8b", "d55b793d-f847-4eea-b59a-5ab09908ac90", "aef9d1f1-7396-4e92-a927-4567c7a495c1", "6c6d9280-e6d0-4b9d-80ac-254701b64916", "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "9212f354-7775-4e28-9c9f-8f0a4544e664", "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "ffa6861c-4461-4f59-8a41-578c39f3f23e", "a0459f02-ac51-4c09-b511-b8c9203fc429", "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "534f2ef7-e8a2-4433-816d-c91bccde289b", "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "84232095-ecca-4015-b0d7-7726507ee793", "4e2ed651-1906-4a59-a78a-18220fca1b22", "60f16a96-db70-42eb-8f76-16763e333590", "5afee48e-67dd-4e03-a783-f74259dcf998", "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "771d1eb5-9587-4568-95fb-9ec44153a012", "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "e28a5a99-da44-436d-b7a0-2afc20a5f413", "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "d2b749ee-4225-417e-b20e-a8d2193cbb84", "1193d960-2369-499f-a158-7b50a31df682", "6b65c28e-11f3-46cb-902a-68f2cafaf474", "242301bc-f92f-4476-8718-78004a6efd9f", "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "52d097e2-063e-4c9c-8fbb-855c8948d135", "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "647c7b9e-d784-4fda-b9a0-45c565a7b729", "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "bb76d96b-821c-47cf-944b-7ce377864492", "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "1816994b-42e1-4fb1-afd2-134d88184f71", "12827a56-61a4-476a-a9cb-f3068f191073", "32b96012-7892-429e-b26c-ac2bf46066ff", "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "f4bbd493-b796-416e-bbf2-121235348529", "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "d06be4b9-8045-428b-a567-740a26d9db25", "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "65c3ca2c-525f-4ced-968e-246a713d164f", "347906f3-e207-4d18-ae5b-a9403d6bcdef", "a29808fd-ef50-49ff-9c7a-59a9b040b404", "e66779cc-383e-4224-a3a4-267eeb585c40", "85c312b7-f44d-4a51-a024-d671c40b49fc", "6da2c9f5-7c53-401b-aacb-92c040ce1215", "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "ff992eac-6449-4c60-8c1d-91c9722a1d48", "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "208748f7-881d-47ac-a29c-07ea84bf691d", "89ca78fd-b37c-4310-b3d3-81a023f83936", "a2910908-e86f-4687-aeba-76a5f996e652", "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "9c14c9fa-1a63-4a64-8e57-d19280559490", "221b251a-357a-49a9-920a-271802777cc0", "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "f14e169e-9978-4c69-acb3-1cff8200bc36", "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "1c8774a0-44d4-4db0-91f8-e792359c70bd", "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "9fc3072c-dc8f-4bf7-b231-18950000fadd", "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "ada4b0c4-758b-46ac-9033-9004613a150d", "584bca0f-3608-4402-80fd-4075ff6072e3", "9a132afa-654e-11eb-ae93-0242ac130002", "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "a70dcb37-3bee-453a-99df-d0c683151be6", "85b0b087-eddf-4a2b-b033-d771fa2b9775", "2267fe65-0681-42ad-9a6d-46553d3f3480", "28c8f68b-098d-45af-8d43-8089f3e35403", "cd8c163e-a19b-402e-bdd5-419ff5859f12", "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "2c28c248-7f50-417a-9186-a85b223010ee", "84972c80-251c-4c3a-9079-4f00aad93938", "434c08ba-8406-4d15-8b24-782cb071a691", "bed2a484-9348-4143-8a8a-b801c979301c", "a0d7e4d2-bede-4141-8896-bc6e237e977c", "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "1c526788-0abe-4713-862f-b520da5e5316", "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "9f107a84-532c-41af-b005-8d12a607639f", "455b9d50-15a1-4b99-853f-8d37655a4c1b", "dee0a7a3-f200-4112-a99b-952196d81e42", "79ce34ca-af29-4d0e-b832-fc1b377020db", "2afafd61-6aae-4df4-baed-139fa1f4c345", "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "f0507c0f-a3a2-40f5-acc6-7f543c334993", "970007b7-ce32-49d0-a4a4-fbef016950bd", "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "b2ddd389-f676-4ac4-845a-e00781a48e5f", "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "4a6713f6-3331-11ed-a261-0242ac120002", "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "5cc2cda8-f261-4d88-a2de-e9e193c86716", "01c42d3c-242d-4655-85b2-34f1739632f7", "77946e79-97f1-45a2-84b4-f37b5c0d8682", "27ba3207-dd30-4812-abbf-5d20c57d474e", "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "1228c958-e64e-4e71-92ad-7d429f4138ba", "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "b1377339-fda6-477a-b455-ac0923f9ec2c", "44143844-0631-49ab-97a0-96387d6b2d7c", "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "85de1f22-d189-44e4-8239-dc276b45379b", "92626ddd-662c-49e3-ac59-f6535f12d189", "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "e56d3073-83ff-4021-90fe-c658e0709e72", "deb9b646-a508-44ee-b7c9-d8965921c6b6", "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "cea2b7ea-792b-405f-95a1-b903ea06458f", "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "730fc21b-eaff-474b-ad23-90fd265d4988", "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "48917adc-a28e-4f5d-b729-11e75da8941f", "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "0900463c-b33b-49a8-be1d-552a3b553dae", "82a6714f-4899-4f16-9c1e-9a333544d4c3", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "1e59c230-6670-45bf-83b0-98903780607e", "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "258fc8ce-8352-443a-9120-8a11e4857fa5", "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "4ae81040-fc1c-4249-bfa3-938d260214d9", "aa2efee7-34dd-446e-8a37-40790a66efd7", "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "ae215552-081e-44c7-805f-be16f975c8a2", "30bf1789-379d-4fdc-900f-55cd0a90a801", "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "4f7a6757-ff79-46db-9687-66501a02d9ec", "129966c9-de17-4334-a123-8b58172e664d", "696bfb54-227e-4602-ac5b-30d9d2053312", "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "7df1713a-1a5b-4a4b-a071-dc83b144a101", "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "814c95cc-8192-4378-a70a-f1aafd877af1", "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "99c840f2-2012-46fd-9141-c761987550ef", "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "de16d92c-c446-4d53-8938-10aeef41c8b6", "056c7317-9a09-4bd4-9067-d051312752ea", "60fc936d-2eb0-4543-8a13-911c750a1dfc", "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "114de787-4eb2-48cc-abdb-c0b449f93ea4", "207b0396-3689-42d9-8399-4222658efc99", "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "9248c7e1-2bf3-4661-a22c-600a8040b446", "146aace8-9bd6-42ba-be7a-0070d8027b76", "3d7679bd-0c00-440c-97b0-3f204273e6c7", "ea011323-7045-460b-b2d7-0f7442ea6b38", "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "e290b10b-1023-4452-a4a9-eb31a9013b3a", "ca5583e9-8f80-46ac-ab91-7f314d13b984", "cd3d1298-eb3b-476c-ac67-12847de55813", "867356ee-9352-41c9-a8f2-1be690d78216", "67f113fa-e23d-4271-befa-30113b3e08b1", "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "62b20d44-1546-4e61-afce-8e175eb9473c", "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "b6676963-0353-4f88-90f5-36c20d443c6a", "99cf1e02-00fb-4c0d-8375-563f978dfd37", "903076ff-f442-475a-b667-4f246bcc203b", "a77c1610-fc73-4019-8e29-0f51efc04a51", "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "cea72823-df4d-4567-950c-0b579eaf0846", "74a2b202-73e0-4693-9a3a-9d36146d0775", "5fc297ae-25b6-488a-8f25-cc12ac29b744", "12f6b752-042d-483e-bf9c-915a6d06ad75", "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "c1d867fe-8d95-4487-aab4-e53f2d339f90", "e13f668e-7f95-443d-98d2-1816a7648a7b", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "9c8c7000-3065-44a8-a555-79bcba5d9955", "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "ee5e119b-1f75-4b34-add8-3be976961e39", "33339be3-148b-4e16-af56-ad16ec6c7e7b", "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "646ea171-dded-4578-8a4d-65e9822892e3", "84b1706c-932a-44c4-ae28-892b28a25b94", "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "074e0ded-6ced-4ebd-8b4d-53f55908119d", "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "af491bca-e752-4b44-9c86-df5680533dbc", "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "f0f7be61-9cf5-43be-9836-99d6ef448a18", "b1f73849-6329-4069-bc8f-78a604bb8b23", "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "0b80ade5-6997-4b1d-99a1-71701778ea61", "81ebd28b-9607-4478-bf06-974ed9d53ed7", "dc4576d4-7467-424f-9eee-fd2b02855fe0", "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "e9142d84-fbe0-401d-ac50-3e519fb00c89", "b4dc61f5-6cce-468e-a608-b48b469feaa2", "e6313acd-208c-44fc-a0ff-db85d572e90e", "f3d39c45-de1a-4486-a687-ab126124f744", "97dbf6e2-e436-44d8-abee-4261b24d3e41", "0fc35fc3-efe6-4898-8a37-0b233339524f", "c947b146-0abc-4c87-9c64-b17e9d7274a2", "91a2c315-9ee6-4052-a853-6f6a8238f90d", "9525dc73-0327-438c-8c04-13c0e037e9da", "a4694263-59a8-4608-a3a0-6f8d3a51664c", "f37aba28-a9e6-4045-882c-d5004043b337", "5e95028c-5229-4214-afae-d653d573d0ec", "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "f7375e28-5c14-432f-b8d1-1db26c832df3", "0e0255bf-2548-47b8-9582-c0955c9283f5", "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "889719ef-dd62-43df-86c3-768fb08dc7c0", "af77cf95-c469-471c-b6a0-946c685c4798", "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "4bf943c6-5146-4273-98dd-e958fd1e3abf", "7f741dcf-fc22-4759-87b4-9ae8376676a2", "8a3038e8-9c9d-46f8-b184-66234a160f6f", "7d4aaec2-08ed-4430-8b96-28420e030e04", "75d0a94e-6252-448d-a7be-d953dff527bb", "327f48c1-a6db-4eb8-875a-f6981f1b0183", "5f03babb-12db-4eec-8c82-7b4cb5580868", "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "cd1f961e-0b96-436b-b7c6-38da4583ec00", "7b4f794b-590a-4ad4-ba18-7964a2832205", "438025f9-5856-4663-83f7-52f878a70a50", "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "213d6a77-3d55-4ce8-ba74-fcfef741974e", "aaafa146-074c-11eb-adc1-0242ac120002", "2433a154-bb3d-42e4-86c3-a26bdac91c45", "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "4f647cfa-b598-4e12-ad69-c68dd16caef8", "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "17769c90-230e-488b-a463-e05c08e9d48f", "e173ad47-4388-4012-ae62-bd13f71c18a8", "48bbc537-b652-4b4e-bd1d-281172df448f", "1edff897-9146-48d2-9066-52e8d8f80a2f", "c248c896-e412-4279-8c15-1c558067b6fa", "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "d522eca2-2973-4391-a3e0-ef0374321dae", "62e0298b-e994-4189-bc87-bc699aa62d97", "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "a537cfc3-4297-4789-92b5-345bfd845ad0", "4a2a2c3e-209f-4d01-b513-4155a540b469", "f64e5c19-879c-4bae-b471-6d84c8339677", "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "536e2947-3729-478c-9903-745aaffe60d2", "40aa399c-7b02-4715-8e5f-73572b493f33", "883835a7-df45-43e4-bf1d-4268768afda4", "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "b57ba453-b384-4ab9-9f40-1038086b4e53", "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "3bad990e-4848-4a78-9530-b427d854aac0", "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "09576804-7a05-458e-a817-eb718ca91f54", "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "b0524451-19af-4efa-a46f-562a977f792e", "b96b2031-7c17-4473-afe7-a30ce714db29", "37c1333a-a0db-48be-b64b-7393b2386e3b", "81325ce1-be01-4250-944f-b4789644556f", "3abd6094-7027-475f-9630-8ab9be7b9725", "d9047477-0359-48c9-b8c7-792cedcdc9c4", "56d19cb4-6414-4769-9644-1ed35ffbb148", "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "5cdb711b-5740-4fb2-ba88-f7945027afac", "164eda96-11b2-430b-85ff-6a265c15bf32", "a58353df-af43-4753-bad0-cd83ef35eef5", "56321594-9087-49d9-bf10-524fe8479452"], "uberAgent 6.0": ["ec8c4047-fad9-416a-8c81-0f479353d7f6", "b439f47d-ef52-4b29-9a2f-57d8a96cb6b8", "bb2ba6fb-95d4-4a25-89fc-30bb736c021a", "d13c43f0-f66b-4279-8b2c-5912077c1780", "f40017b3-cb2e-4335-ab5d-3babf679c1de", "9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed", "37774c23-25a1-4adb-bb6d-8bb9fd59c0f8", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "f354eba5-623b-450f-b073-0b5b2773b6aa", "6414b5cd-b19d-447e-bb5e-9f03940b5784", "1fbc0671-5596-4e17-8682-f020a0b995dc", "552b6b65-df37-4d3e-a258-f2fc4771ae54", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "06ce37c2-61ab-4f05-9ff5-b1a96d18ae32", "4c21b805-4dd7-469f-b47d-7383a8fcb437", "418dc89a-9808-4b87-b1d7-e5ae0cb6effc", "71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb", "cdb15e19-c2d0-432a-928e-e49c8c60dcf2", "4508a70e-97ef-4300-b62b-ff27992990ea", "05936ce2-ee05-4dae-9d03-9a391cf2d2c6", "3669afd2-9891-4534-a626-e5cf03810a61", "259dda31-b7a3-444f-b7d8-17f96e8a7d0d", "9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c", "7417e29e-c2e7-4cf6-a2e8-767228c64837", "72ca7c75-bf85-45cd-aca7-255d360e423c", "0e0bc253-07ed-43f1-816d-e1b220fe8971", "6e78b74f-c762-4800-82ad-f66787f10c8a", "84b0a8f3-680b-4096-a45b-e9a89221727c", "90ae0469-0cee-4509-b67f-e5efcef040f7", "bf9808c4-d24f-44a2-8398-b65227d406b6", "caa02837-f659-466f-bca6-48bde2826ab4", "b6188d2f-b3c4-4d2c-a17d-9706e0851af0", "4fc0deee-0057-4998-ab31-d24e46e0aba4", "e2e01011-5910-4267-9c3b-4149ed5479cf", "e4903324-1a10-4ed3-981b-f6fe3be3a2c2", "d2605a99-2218-4894-8fd3-2afb7946514d", "a2a3b925-7bb0-433b-b508-db9003263cc4", "68654bf0-4412-43d5-bfe8-5eaa393cd939", "f64c9b2d-b0ad-481d-9d03-7fc75020892a", "0fa66f66-e3f6-4a9c-93f8-4f2610b00171", "952ed57c-8f99-453d-aee0-53a49c22f95d", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "e49b5745-1064-4ac1-9a2e-f687bc2dd37e", "75e508f7-932d-4ebc-af77-269237a84ce1", "a2edbce1-95c8-4291-8676-0d45146862b3", "844f8eb2-610b-42c8-89a4-47596e089663", "6360757a-d460-456c-8b13-74cf0e60cceb", "24b6cf51-6122-469e-861a-22974e9c1e5b", "9ed5959a-c43c-4c59-84e3-d28628429456", "4f6edb78-5c21-42ab-a558-fd2a6fc1fd57", "2b140a5c-dc02-4bb8-b6b1-8bdb45714cde", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "fef394cd-f44d-4040-9b18-95d92fe278c0", "48bfd177-7cf2-412b-ad77-baf923489e82", "2092cacb-d77b-4f98-ab0d-32b32f99a054", "ff0f2b05-09db-4095-b96d-1b75ca24894a", "7707a579-e0d8-4886-a853-ce47e4575aaa", "ee6cea48-c5b6-4304-a332-10fc6446f484", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "e6ce8457-68b1-485b-9bdd-3c2b5d679aa9", "02fb90de-c321-4e63-a6b9-25f4b03dfd14", "db77ce78-7e28-4188-9337-cf30e2b3ba9f", "e76c8240-d68f-4773-8880-5c6f63595aaf", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "f9df325d-d7bc-4a32-8a1a-2cc61dcefc63", "5ba243e5-8165-4cf7-8c69-e1d3669654c1", "af4c4609-5755-42fe-8075-4effb49f5d44", "9ca2bf31-0570-44d8-a543-534c47c33ed7", "a5ea83a7-05a5-44c1-be2e-addccbbd8c03", "9ae01559-cf7e-4f8e-8e14-4c290a1b4784", "6ec86d9e-912e-4726-91a2-209359b999b9", "90217a70-13fc-48e4-b3db-0d836c5824ac", "3735d5ac-d770-4da0-99ff-156b180bc600", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "caa06de8-fdef-4c91-826a-7f9e163eef4b", "b7b19cb6-9b32-4fc4-a108-73f19acfe262", "2158f96f-43c2-43cb-952a-ab4580f32382", "76f55eaa-d27f-4213-9d45-7b0e4b60bbae", "d797268e-28a9-49a7-b9a8-2f5039011c5c", "58f4ea09-0fc2-4520-ba18-b85c540b0eaf", "f426547a-e0f7-441a-b63e-854ac5bdf54d", "932fb0d8-692b-4b0f-a26e-5643a50fe7d6", "6d3a3952-6530-44a3-8554-cf17c116c615", "c633622e-cab9-4eaa-bb13-66a1d68b3e47", "00d49ed5-4491-4271-a8db-650a4ef6f8c1", "a4824fca-976f-4964-b334-0621379e84c4", "9801abb8-e297-4dbf-9fbd-57dde0e830ad", "92a974db-ab84-457f-9ec0-55db83d7a825", "f9578658-9e71-4711-b634-3f9b50cd3c06", "c98f2a0d-e1b8-4f76-90d3-359caf88d6b9", "6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6", "d22e2925-cfd8-463f-96f6-89cec9d9bc5f", "e52cb31c-10ed-4aea-bcb7-593c9f4a315b", "f5240972-3938-4e56-8e4b-e33893176c1f", "fff9d2b7-e11c-4a69-93d3-40ef66189767", "cc9d3712-6310-4320-b2df-7cb408274d53", "51ae86a2-e2e1-4097-ad85-c46cb6851de4", "42a993dd-bb3e-48c8-b372-4d6684c4106c", "b9f0e6f5-09b4-4358-bae4-08408705bd5c", "36210e0d-5b19-485d-a087-c096088885f0", "1723e720-616d-4ddc-ab02-f7e3685a4713", "90fb5e62-ca1f-4e22-b42e-cc521874c938", "20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8", "57c4bf16-227f-4394-8ec7-1b745ee061c3", "725a9768-0f5e-4cb3-aec2-bc5719c6831a", "0ea52357-cd59-4340-9981-c46c7e900428", "05a2ab7e-ce11-4b63-86db-ab32e763e11d", "9719a8aa-401c-41af-8108-ced7ec9cd75c", "ee218c12-627a-4d27-9e30-d6fb2fe22ed2", "0b4ae027-2a2d-4b93-8c7e-962caaba5b2a", "1f1a8509-2cbb-44f5-8751-8e1571518ce2", "1e0e1a81-e79b-44bc-935b-ddb9c8006b3d", "3c1b5fb0-c72f-45ba-abd1-4d4c353144ab", "39019a4e-317f-4ce3-ae63-309a8c6b53c5", "587254ee-a24b-4335-b3cd-065c0f1f4baa", "98b53e78-ebaf-46f8-be06-421aafd176d9", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "b5746143-59d6-4603-8d06-acbd60e166ee", "551d9c1f-816c-445b-a7a6-7a3864720d60", "e31033fc-33f0-4020-9a16-faf9b31cbf08", "b730a276-6b63-41b8-bcf8-55930c8fc6ee", "4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67", "8e3c7994-131e-4ba5-b6ea-804d49113a26", "f57c58b3-ee69-4ef5-9041-455bf39aaa89", "e32d4572-9826-4738-b651-95fa63747e8a", "043c4b8b-3a54-4780-9682-081cb6b8185c", "06b401f4-107c-4ff9-947f-9ec1e7649f1e", "c363385c-f75d-4753-a108-c1a8e28bdbda", "5cb299fc-5fb1-4d07-b989-0644c68b6043", "f0e53e89-8d22-46ea-9db5-9d4796ee2f8a", "811f459f-9231-45d4-959a-0266c6311987", "9c7e131a-0f2c-4ae0-9d43-b04f4e266d43", "7d6d30b8-5b91-4b90-a891-46cccaf29598", "3b5b0213-0460-4e3f-8937-3abf98ff7dcc", "5e6a80c8-2d45-4633-9ef4-fa2671a39c5c", "cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7", "53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2", "ba3f5c1b-6272-4119-9dbd-0bc8d21c2702", "087790e3-3287-436c-bccf-cbd0184a7db1", "6812a10b-60ea-420c-832f-dfcc33b646ba", "84b14121-9d14-416e-800b-f3b829c5a14d", "32e280f1-8ad4-46ef-9e80-910657611fbc", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "c9fbe8e9-119d-40a6-9b59-dd58a5d84429", "3f5491e2-8db8-496b-9e95-1029fce852d4", "a018fdc3-46a3-44e5-9afb-2cd4af1d4b39", "02030f2f-6199-49ec-b258-ea71b07e03dc", "74403157-20f5-415d-89a7-c505779585cf", "8c0eca51-0f88-4db2-9183-fdfb10c703f9", "4d7cda18-1b12-4e52-b45c-d28653210df8", "4f73421b-5a0b-4bbf-a892-5a7fb99bea66", "05b2aa93-1210-42c8-8d9a-2fcc13b284f5", "c9783e20-4793-4164-ba96-d9ee483992c4", "f38ce0b9-5e97-4b47-a211-7dc8d8b871da", "94771a71-ba41-4b6e-a757-b531372eaab6", "2f869d59-7f6a-4931-992c-cce556ff2d53", "d80d5c81-04ba-45b4-84e4-92eba40e0ad3", "1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd", "6e30c82f-a9f8-4aab-b79c-7c12bce6f248", "aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f", "1775e15e-b61b-4d14-a1a3-80981298085a", "4627c6ae-6899-46e2-aa0c-6ebcb1becd19", "42b1a5b8-353f-4f10-b256-39de4467faff", "d2125259-ddea-4c1c-9c22-977eb5b29cf0", "9292293b-8496-4715-9db6-37028dcda4b3", "52788a70-f1da-40dd-8fbd-73b5865d6568", "349d891d-fef0-4fe4-bc53-eee623a15969", "ea0cdc3e-2239-4f26-a947-4e8f8224e464", "d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e", "6f3e2987-db24-4c78-a860-b4f4095a7095", "1ec65a5f-9473-4f12-97da-622044d6df21", "d042284c-a296-4988-9be5-f424fadcc28c", "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1", "1327381e-6ab0-4f38-b583-4c1b8346a56b", "dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0", "9ec9fb1b-e059-4489-9642-f270c207923d", "058f4380-962d-40a5-afce-50207d36d7e2", "fe63010f-8823-4864-a96b-a7b4a0f7b929", "4ebc877f-4612-45cb-b3a5-8e3834db36c9", "f26c6093-6f14-4b12-800f-0fcb46f5ffd0", "be58d2e2-06c8-4f58-b666-b99f6dc3b6cd", "2dd2c217-bf68-437a-b57c-fe9fd01d5de8", "c86133ad-4725-4bd0-8170-210788e0a7ba", "f5d19838-41b5-476c-98d8-ba8af4929ee2", "ab70c354-d9ac-4e11-bbb6-ec8e3b153357", "82880171-b475-4201-b811-e9c826cd5eaa", "023c654f-8f16-44d9-bb2b-00ff36a62af9", "d557dc06-62e8-4468-a8e8-7984124908ce", "ae9c6a7c-9521-42a6-915e-5aaa8689d529", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "b30a8bc5-e21b-4ca2-9420-0a94019ac56a", "a642964e-bead-4bed-8910-1bb4d63e3b4d", "e4a6b256-3e47-40fc-89d2-7a477edd6915", "13e6fe51-d478-4c7e-b0f2-6da9b400a829", "9f8fc146-1d1a-4dbf-b8fd-dfae15e08541", "cafeeba3-01da-4ab4-b6c4-a31b1d9730c7", "9fff585c-c33e-4a86-b3cd-39312079a65f", "2e65275c-8288-4ab4-aeb7-6274f58b6b20", "fa00b701-44c6-4679-994d-5a18afa8a707", "982e9f2d-1a85-4d5b-aea4-31f5e97c6555", "313d6012-51a0-4d93-8dfc-de8553239e25", "bd8b828d-0dca-48e1-8a63-8a58ecf2644f", "05c36dd6-79d6-4a9a-97da-3db20298ab2d", "f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd", "b36d01a3-ddaf-4804-be18-18a6247adfcd", "aaf46cdc-934e-4284-b329-34aa701e3771", "575dce0c-8139-4e30-9295-1ee75969f7fe", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "f6ecd1cf-19b8-4488-97f6-00f0924991a3", "a1473adb-5338-4a20-b4c3-126763e2d3d3", "264982dc-dbad-4dce-b707-1e0d3e0f73d9", "69ca006d-b9a9-47f5-80ff-ecd4d25d481a", "241e802a-b65e-484f-88cd-c2dc10f9206d", "fd877b94-9bb5-4191-bb25-d79cbd93c167", "d047726b-c71c-4048-a99b-2e2f50dc107d", "40b95d31-1afc-469e-8d34-9a3a667d058e", "49f2f17b-b4c8-4172-a68b-d5bf95d05130", "e6c54d94-498c-4562-a37c-b469d8e9a275", "64760eef-87f7-4ed3-93fd-655668ea9420", "8150732a-0c9d-4a99-82b9-9efb9b90c40c", "da2738f2-fadb-4394-afa7-0a0674885afa", "88872991-7445-4a22-90b2-a3adadb0e827", "f576a613-2392-4067-9d1a-9345fb58d8d1", "431a1fdb-4799-4f3b-91c3-a683b003fc49", "39b31e81-5f5f-4898-9c0e-2160cfc0f9bf", "4931188c-178e-4ee7-a348-39e8a7a56821", "85ff530b-261d-48c6-a441-facaa2e81e48", "ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e", "a9e416a8-e613-4f8b-88b8-a7d1d1af2f61", "8cbc9475-8d05-4e27-9c32-df960716c701", "378a05d8-963c-46c9-bcce-13c7657eac99", "a238b5d0-ce2d-4414-a676-7a531b3d13d6", "f7d7ebd5-a016-46e2-9c54-f9932f2d386d", "e568650b-5dcd-4658-8f34-ded0b1e13992", "f208d6d8-d83a-4c2c-960d-877c37da84e5", "514e4c3a-c77d-4cde-a00f-046425e2301e", "6b369ced-4b1d-48f1-b427-fdc0de0790bd", "01aeb693-138d-49d2-9403-c4f52d7d3d62", "cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c", "83865853-59aa-449e-9600-74b9d89a6d6e", "fb50eb7a-5ab1-43ae-bcc9-091818cb8424", "a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc", "75edd216-1939-4c73-8d61-7f3a0d85b5cc", "225274c4-8dd1-40db-9e09-71dff4f6fb3c", "b53317a0-8acf-4fd1-8de8-a5401e776b96", "ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b", "d95de845-b83c-4a9a-8a6a-4fc802ebf6c0", "10344bb3-7f65-46c2-b915-2d00d47be5b0", "185d7418-f250-42d0-b72e-0c8b70661e93", "379fa130-190e-4c3f-b7bc-6c8e834485f3", "56454143-524f-49fb-b1c6-3fb8b1ad41fb", "e83e8899-c9b2-483b-b355-5decc942b959", "6385697e-9f1b-40bd-8817-f4a91f40508e", "24357373-078f-44ed-9ac4-6d334a668a11", "15619216-e993-4721-b590-4c520615a67d", "d2eb17db-1d39-41dc-b57f-301f6512fa75", "5a6e1e16-07de-48d8-8aae-faa766c05e88", "5a3164f2-b373-4152-93cf-090b13c12d27", "c3d76afc-93df-461e-8e67-9b2bad3f2ac4", "5b768e71-86f2-4879-b448-81061cbae951", "98767d61-b2e8-4d71-b661-e36783ee24c1", "a85ffc3a-e8fd-4040-93bf-78aff284d801", "88f46b67-14d4-4f45-ac2c-d66984f22191", "83809e84-4475-4b69-bc3e-4aad8568612f", "ce72ef99-22f1-43d4-8695-419dcb5d9330", "add64136-62e5-48ea-807e-88638d02df1e", "04936b66-3915-43ad-a8e5-809eadfd1141", "847d5ff3-8a31-4737-a970-aeae8fe21765", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "c49c5062-0966-4170-9efd-9968c913a6cf", "dbc1f800-0fe0-4bc0-9c66-292c2abe3f78", "aa6f6ea6-0676-40dd-b510-6e46f02d8867", "850d55f9-6eeb-4492-ad69-a72338f65ba4", "d87bd452-6da1-456e-8155-7dc988157b7d", "5bb68627-3198-40ca-b458-49f973db8752", "fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4", "a35f5a72-f347-4e36-8895-9869b0d5fc6d", "caf201a9-c2ce-4a26-9c3a-2b9525413711", "4e762605-34a8-406d-b72e-c1a089313320", "d3c3861d-c504-4c77-ba55-224ba82d0118", "2ddef153-167b-4e89-86b6-757a9e65dcac", "9a019ffc-3580-4c9d-8d87-079f7e8d3fd4", "7b582f1a-b318-4c6a-bf4e-66fe49bf55a5", "8a582fe2-0882-4b89-a82a-da6b2dc32937", "dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795", "c260b6db-48ba-4b4a-a76f-2f67644e99d2", "f35c5d71-b489-4e22-a115-f003df287317", "fbd7c32d-db2a-4418-b92c-566eb8911133", "87a476dc-0079-4583-a985-dee7a20a03de", "ba4cfc11-d0fa-4d94-bf20-7c332c412e76", "1c0e41cd-21bb-4433-9acc-4a2cd6367b9b", "38879043-7e1e-47a9-8d46-6bec88e201df", "9e716b33-63b2-46da-86a4-bd3c3b9b5dfb", "f9999590-1f94-4a34-a91e-951e47bedefd", "089fc3d2-71e8-4763-a8a5-c97fbb0a403e", "b6b49cd1-34d6-4ead-b1bf-176e9edba9a4", "6bba49bf-7f8c-47d6-a1bb-6b4dece4640e", "9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60", "e96253b8-6b3b-4f90-9e59-3b24b99cf9b4", "4eddc365-79b4-43ff-a9d7-99422dc34b93", "21ff4ca9-f13a-41ad-b828-0077b2af2e40", "220457c1-1c9f-4c2e-afe6-9598926222c1", "bf361876-6620-407a-812f-bfe11e51e924", "21dd6d38-2b18-4453-9404-a0fe4a0cc288", "c79da740-5030-45ec-a2e0-479e824a562c", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "a197e378-d31b-41c0-9635-cfdf1c1bb423", "737e618a-a410-49b5-bec3-9e55ff7fbc15", "ab37a6ec-6068-432b-a64e-2c7bf95b1d22", "30edb182-aa75-42c0-b0a9-e998bb29067c", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "eb1c4225-1c23-4241-8dd4-051389fde4ce", "193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1", "23ceaf5c-b6f1-4a32-8559-f2ff734be516", "e312efd0-35a1-407f-8439-b8d434b438a6", "4b991083-3d0e-44ce-8fc4-b254025d8d4b", "ba42babc-0666-4393-a4f7-ceaf5a69191e", "c27515df-97a9-4162-8a60-dc0eeb51b775", "bac9fb54-2da7-44e9-988f-11e9a5edbc0c", "aae1243f-d8af-40d8-ab20-33fc6d0c55bc", "0f6da907-5854-4be6-859a-e9958747b0aa", "f63b56ee-3f79-4b8a-97fb-5c48007e8573", "5edc2273-c26f-406c-83f3-f4d948e740dd", "cec8e918-30f7-4e2d-9bfa-a59cc97ae60f", "3b6ab547-8ec2-4991-b9d2-2b06702a48d7", "0f0450f3-8b47-441e-a31b-15a91dc243e2", "19b08b1c-861d-4e75-a1ef-ea0c1baf202b", "817f252c-5143-4dae-b418-48c3e9f63728", "459f2f98-397b-4a4a-9f47-6a5ec2f1c69d", "07e3cb2c-0608-410d-be4b-1511cb1a0448", "138d3531-8793-4f50-a2cd-f291b2863d78", "43d91656-a9b2-4541-b7e2-6a9bd3a13f4e", "ddeff553-5233-4ae9-bbab-d64d2bd634be", "e212d415-0e93-435f-9e1a-f29005bb4723", "55f0a3a1-846e-40eb-8273-677371b8d912", "e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e", "9b0b7ac3-6223-47aa-a3fd-e8f211e637db", "1a0d4aba-7668-4365-9ce4-6d79ab088dfd", "3d3aa6cd-6272-44d6-8afc-7e88dfef7061", "6ba5a05f-b095-4f0a-8654-b825f4f16334", "cb7c4a03-2871-43c0-9bbb-18bbdb079896", "2d32dd6f-3196-4093-b9eb-1ad8ab088ca5", "45d3a03d-f441-458c-8883-df101a3bb146", "871b9555-69ca-4993-99d3-35a59f9f3599", "f2c64357-b1d2-41b7-849f-34d2682c0fad", "26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160", "12fbff88-16b5-4b42-9754-cd001a789fb3", "2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5", "0403d67d-6227-4ea8-8145-4e72db7da120", "7f43c430-5001-4f8b-aaa9-c3b88f18fa5c", "bd1c6866-65fc-44b2-be51-5588fcff82b9", "1114e048-b69c-4f41-bc20-657245ae6e3f", "8d01b53f-456f-48ee-90f6-bc28e67d4e35", "27aec9c9-dbb0-4939-8422-1742242471d0", "727454c0-d851-48b0-8b89-385611ab0704", "5cc90652-4cbd-4241-aa3b-4b462fa5a248", "d20ee2f4-822c-4827-9e15-41500b1fff10", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "4ae3e30b-b03f-43aa-87e3-b622f4048eed", "efec536f-72e8-4656-8960-5e85d091345b", "6f4191bb-912b-48a8-9ce7-682769541e6d", "9f546b25-5f12-4c8d-8532-5893dcb1e4b8", "517490a7-115a-48c6-8862-1a481504d5a8", "18749301-f1c5-4efc-a4c3-276ff1f5b6f8", "49d9671b-0a0a-4c09-8280-d215bfd30662", "05f3c945-dcc8-4393-9f3d-af65077a8f86", "7eedcc9d-9fdb-4d94-9c54-474e8affc0c7", "515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48", "b236190c-1c61-41e9-84b3-3fe03f6d76b0", "554601fb-9b71-4bcc-abf4-21a611be4fde", "7b10f171-7f04-47c7-9fa2-5be43c76e535", "45239e6a-b035-4aaf-b339-8ad379fcb67e", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "7be5fb68-f9ef-476d-8b51-0256ebece19e", "6e22722b-dfb1-4508-a911-49ac840b40f8", "9ccba514-7cb6-4c5c-b377-700758f2f120", "1c12727d-02bf-45ff-a9f3-d49806a3cf43", "7a74da6b-ea76-47db-92cc-874ad90df734", "f11f2808-adb4-46c0-802a-8660db50fa99", "43e32da2-fdd0-4156-90de-50dfd62636f9", "ae6f14e6-14de-45b0-9f44-c0986f50dc89", "a20def93-0709-4eae-9bd2-31206e21e6b2", "5ce0f04e-3efc-42af-839d-5b3a543b76c0", "9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f", "6004abd0-afa4-4557-ba90-49d172e0a299", "df1f26d3-bea7-4700-9ea2-ad3e990cf90e", "970823b7-273b-460a-8afc-3a6811998529", "e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d", "15b75071-74cc-47e0-b4c6-b43744a62a2b", "cc36992a-4671-4f21-a91d-6c2b72a2edf5", "6120ac2a-a34b-42c0-a9bd-1fb9f459f348", "7773b877-5abb-4a3e-b9c9-fd0369b59b00", "e7be6119-fc37-43f0-ad4f-1f3f99be2f9f", "f99abdf0-6283-4e71-bd2b-b5c048a94743", "0a13e132-651d-11eb-ae93-0242ac130002", "beaa66d6-aa1b-4e3c-80f5-e0145369bfaf", "e9f55347-2928-4c06-88e5-1a7f8169942e", "67bc0e75-c0a9-4cfc-8754-84a505b63c04", "6a69f62d-ce75-4b57-8dce-6351eb55b362", "8b0e12da-d3c3-49db-bb4f-256703f380e5", "4480827a-9799-4232-b2c4-ccc6c4e9e12b", "98a96a5a-64a0-4c42-92c5-489da3866cb0", "47e4bab7-c626-47dc-967b-255608c9a920", "51cbac1e-eee3-4a90-b1b7-358efb81fa0a", "40b19fa6-d835-400c-b301-41f3a2baacaf", "f44800ac-38ec-471f-936e-3fa7d9c53100", "f4a623c2-4ef5-4c33-b811-0642f702c9f1", "24c8392b-aa3c-46b7-a545-43f71657fe98", "88f680b8-070e-402c-ae11-d2914f2257f1", "15434e33-5027-4914-88d5-3d4145ec25a9", "b98d0db6-511d-45de-ad02-e82a98729620", "734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8", "0bbc6369-43e3-453d-9944-cae58821c173", "36480ae1-a1cb-4eaa-a0d6-29801d7e9142", "f26eb764-fd89-464b-85e2-dc4a8e6e77b8", "b7966f4a-b333-455b-8370-8ca53c229762", "43fa5350-db63-4b8f-9a01-789a427074e1", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "ec290c06-9b6b-4338-8b6b-095c0f284f10", "e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1", "53d8d3e1-ca33-4012-adf3-e05a4d652e34", "c57872c7-614f-4d7f-a40d-b78c8df2d30d", "c5c00f49-b3f9-45a6-997e-cfdecc6e1967", "d4498716-1d52-438f-8084-4a603157d131", "b222df08-0e07-11eb-adc1-0242ac120002", "e1693bc8-7168-4eab-8718-cdcaa68a1738", "3d48c9d3-1aa6-418d-98d3-8fd3c01a564e", "d3b70aad-097e-409c-9df2-450f80dc476b", "dd3ee8cc-f751-41c9-ba53-5a32ed47e563", "312d0384-401c-4b8b-abdf-685ffba9a332", "cc368ed0-2411-45dc-a222-510ace303cb2", "42333b2c-b425-441c-b70e-99404a17170f", "0e4164da-94bc-450d-a7be-a4b176179f1f", "66e563f9-1cbd-4a22-a957-d8b7c0f44372", "95022b85-ff2a-49fa-939a-d7b8f56eeb9b", "ebef4391-1a81-4761-a40a-1db446c0e625", "f26307d8-14cd-47e3-a26b-4b4769f24af6", "03cc0c25-389f-4bf8-b48d-11878079f1ca", "8834e2f7-6b4b-4f09-8906-d2276470ee23", "7090adee-82e2-4269-bd59-80691e7c6338", "c74c0390-3e20-41fd-a69a-128f0275a5ea", "b6457d63-d2a2-4e29-859d-4e7affc153d1", "7c9340a9-e2ee-4e43-94c5-c54ebbea1006", "5f6a601c-2ecb-498b-9c33-660362323afa", "aa8e035d-7be4-48d3-a944-102aec04400d", "b243b280-65fe-48df-ba07-6ddea7646427", "236d8e89-ed95-4789-a982-36f4643738ba", "277a4393-446c-449a-b0ed-7fdc7795244c", "4fe074b4-b833-4081-8f24-7dcfeca72b42", "68bcd73b-37ef-49cb-95fc-edc809730be6", "86588b36-c6d3-465f-9cee-8f9093e07798", "502b42de-4306-40b4-9596-6f590c81f073", "0a99eb3e-1617-41bd-b095-13dc767f3def", "52cad028-0ff0-4854-8f67-d25dfcbc78b4", "07f8bdc2-c9b3-472a-9817-5a670b872f53", "f89b08d0-77ad-4728-817b-9b16c5a69c7a", "28ac00d6-22d9-4a3c-927f-bbd770104573", "452bce90-6fb0-43cc-97a5-affc283139b3", "69bd9b97-2be2-41b6-9816-fb08757a4d1a", "0944e002-e3f6-4eb5-bf69-3a3067b53d73", "ce7cf472-6fcc-490a-9481-3786840b5d9b", "c6fb44c6-71f5-49e6-9462-1425d328aee3", "9c0295ce-d60d-40bd-bd74-84673b7592b1", "0a4f6091-223b-41f6-8743-f322ec84930b", "98c5aeef-32d5-492f-b174-64a691896d25", "6fe4aa1e-0531-4510-8be2-782154b73b48", "c0b40568-b1e9-4b03-8d6c-b096da6da9ab", "dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45", "d78b5d61-187d-44b6-bf02-93486a80de5a", "e9b61244-893f-427c-b287-3e708f321c6b", "70bc5215-526f-4477-963c-a47a5c9ebd12", "b6e04788-29e1-4557-bb14-77f761848ab8", "b17ea6f7-6e90-447e-a799-e6c0a493d6ce", "0685b176-c816-4837-8e7b-1216f346636b", "e84d89c4-f544-41ca-a6af-4b92fd38b023", "f91ed517-a6ba-471d-9910-b3b4a398c0f3", "ba1f7802-adc7-48b4-9ecb-81e227fddfd5", "023394c4-29d5-46ab-92b8-6a534c6f447b", "c02e96b7-c63a-4c47-bd83-4a9f74afcfb2", "ebea773c-a8f1-42ad-a856-00cb221966e8", "0b7163dc-7eee-4960-af17-c0cd517f92da", "98dedfdd-8333-49d4-9f23-d7018cccae53", "7d1aaf3d-4304-425c-b7c3-162055e0b3ab", "b2317cfa-4a47-4ead-b3ff-297438c0bc2d", "f24bcaea-0cd1-11eb-adc1-0242ac120002", "ccb5742c-c248-4982-8c5c-5571b9275ad3", "cc7abbd0-762b-41e3-8a26-57ad50d2eea3", "4abc0ec4-db5a-412f-9632-26659cddf145", "6f535e01-ca1f-40be-ab8d-45b19c0c8b7f", "8518ed3d-f7c9-4601-a26c-f361a4256a0c", "5cddf373-ef00-4112-ad72-960ac29bac34", "37db85d1-b089-490a-a59a-c7b6f984f480", "d059842b-6b9d-4ed1-b5c3-5b89143c6ede", "47147b5b-9e17-4d76-b8d2-7bac24c5ce1b", "f1edd233-30b5-4823-9e6a-c4171b24d316", "e92a4287-e072-4a40-9739-370c106bb750", "dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a", "9f50fe98-fe5c-4a2d-86c7-fad7f63ed622", "8bc64091-6875-4881-aaf9-7bd25b5dda08", "56c217c3-2de2-479b-990f-5c109ba8458f", "eee00933-a761-4cd0-be70-c42fe91731e7", "bab049ca-7471-4828-9024-38279a4c04da", "2a072a96-a086-49fa-bcb5-15cc5a619093", "883faa95-175a-4e22-8181-e5761aeb373c", "87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180", "f1f3bf22-deb2-418d-8cce-e1a45e46a5bd", "63d1ccc0-2a43-4f4b-9289-361b308991ff", "4f154fb6-27d1-4813-a759-78b93e0b9c48", "5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5", "79f4ede3-402e-41c8-bc3e-ebbf5f162581", "b5c7395f-e501-4a08-94d4-57fe7a9da9d2", "480e7e51-e797-47e3-8d72-ebfce65b6d8d", "33be4333-2c6b-44f4-ae28-102cdbde0a31", "395907ee-96e5-4666-af2e-2ca91688e151", "42a5f1e7-9603-4f6d-97ae-3f37d130d794", "b0ce780f-10bd-496d-9067-066d23dc3aa5", "cb0fe7c5-f3a3-484d-aa25-d350a7912729", "34275eb8-fa19-436b-b959-3d9ecd53fa1f", "90dcf730-1b71-4ae7-9ffc-6fcf62bd0132", "79b06761-465f-4f88-9ef2-150e24d3d737", "c7d33b50-f690-4b51-8cfb-0fb912a31e57", "c615d676-f655-46b9-b913-78729021e5d7", "b19146a3-25d4-41b4-928b-1e2a92641b1b", "3e8207c5-fcd2-4ea6-9418-15d45b4890e4", "e6474a1b-5390-49cd-ab41-8d88655f7394", "692f0bec-83ba-4d04-af7e-e884a96059b6", "93671f99-04eb-4ab4-a161-70d446a84003", "0d5675be-bc88-4172-86d3-1e96a4476536", "fdfcbd78-48f1-4a4b-90ac-d82241e368c5", "4281cb20-2994-4580-aa63-c8b86d019934", "15c7904e-6ad1-4a45-9b46-5fb25df37fd2", "7aa4e81a-a65c-4e10-9f81-b200eb229d7d", "12b8e9f5-96b2-41e1-9a42-8c6779a5c184", "a4e3d776-f12e-42c2-8510-9e6ed1f43ec3", "a34f79a3-8e5f-4cc3-b765-de00695452c2", "fa3c117a-bc0d-416e-a31b-0c0e80653efb", "5589ab4f-a767-433c-961d-c91f3f704db1", "e8a95b5e-c891-46e2-b33a-93937d3abc31", "c86500e9-a645-4680-98d7-f882c70c1ea3", "58f50261-c53b-4c88-bd12-1d71f12eda4c", "34ebb878-1b15-4895-b352-ca2eeb99b274", "7a02e22e-b885-4404-b38b-1ddc7e65258a", "3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d", "24de4f3b-804c-4165-b442-5a06a2302c7e", "731231b9-0b5d-4219-94dd-abb6959aa7ea", "5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af", "44e24481-6202-4c62-9127-5a0ae8e3fe3d", "ed5d72a6-f8f4-479d-ba79-02f6a80d7471", "d7bcd677-645d-4691-a8d4-7a5602b780d1", "bafac3d6-7de9-4dd9-8874-4a1194b493ed", "f956c7c1-0f60-4bc5-b7d7-b39ab3c08908", "fcdf69e5-a3d3-452a-9724-26f2308bf2b1", "e1561947-b4e3-4a74-9bdd-83baed21bdb5", "6e897651-f157-4d8f-aaeb-df8151488385", "9bd04a79-dabe-4f1f-a5ff-92430265c96b", "9847f263-4a81-424f-970c-875dab15b79b", "ffa28e60-bdb1-46e0-9f82-05f7a61cc06e", "cb5a2333-56cf-4562-8fcb-22ba1bca728d", "cd219ff3-fa99-45d4-8380-a7d15116c6dc", "4b046706-5789-4673-b111-66f25fe99534", "73bba97f-a82d-42ce-b315-9182e76c57b1", "646bc99f-6682-4b47-a73a-17b1b64c9d34", "6c96fc76-0eb1-11eb-adc1-0242ac120002", "7050bba1-1aed-454e-8f73-3f46f09ce56a", "744a188b-0415-4792-896f-11ddb0588dbc", "cbb9e3d1-2386-4e59-912e-62f1484f7a89", "faa48cae-6b25-4f00-a094-08947fef582f", "70ad0861-d1fe-491c-a45f-fa48148a300d", "a16980c2-0c56-4de0-9a79-17971979efdd", "ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6", "954f0af7-62dd-418f-b3df-a84bc2c7a774", "a7ee1722-c3c5-aeff-3212-c777e4733217", "1dde5376-a648-492e-9e54-4241dd9b0c7f", "60bfeac3-0d35-4302-8efb-1dd16f715bc6", "10c14723-61c7-4c75-92ca-9af245723ad2", "cf2e938e-9a3e-4fe8-a347-411642b28a9f", "c31364f7-8be6-4b77-8483-dd2b5a7b69a3", "1cdd9a09-06c9-4769-99ff-626e2b3991b8", "41421f44-58f9-455d-838a-c398859841d4", "ae9b0bd7-8888-4606-b444-0ed7410cb728", "bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2", "43103702-5886-11ed-9b6a-0242ac120002", "16905e21-66ee-42fe-b256-1318ada2d770", "30d07da2-83ab-45d8-ae75-ec7c0edcaffc", "a7c3d773-caef-227e-a7e7-c2f13c622329", "214641c2-c579-4ecb-8427-0cf19df6842e", "7efd2c8d-8b18-45b7-947d-adfe9ed04f61", "07aa184a-870d-413d-893a-157f317f6f58", "b27077d6-23e6-45d2-81a0-e2b356eea5fd", "634b00d5-ccc3-4a06-ae3b-0ec8444dd51b", "f548a603-c9f2-4c89-b511-b089f7e94549", "93199800-b52a-4dec-b762-75212c196542", "526be59f-a573-4eea-b5f7-f0973207634d", "a746c9b8-a2fb-4ee5-a428-92bee9e99060", "25676e10-2121-446e-80a4-71ff8506af47", "9aa5106d-bce3-4b13-86df-3a20f1d5cf0b", "ac1c92b4-ac81-405a-9978-4604d78cc47e", "6640f31c-01ad-49b5-beb5-83498a5cd8bd", "bdeb2cff-af74-4094-8426-724dc937f20a", "643bdcac-8b82-49f4-9fd9-25a90b929f3b", "a383dec4-deec-4e6e-913b-ed9249670848", "4beb6ae0-f85b-41e2-8f18-8668abc8af78", "ac20ae82-8758-4f38-958e-b44a3140ca88", "54786ddc-5b8a-11ed-9b6a-0242ac120002", "41ca393d-538c-408a-ac27-cf1e038be80c", "8e0bb260-d4b2-4fff-bb8d-3f82118e6892", "cd71385d-fd9b-4691-9b98-2b1f7e508714", "c8a180d6-47a3-4345-a609-53f9c3d834fc", "044ba588-dff4-4918-9808-3f95e8160606", "1af57a4b-460a-4738-9034-db68b880c665", "45a594aa-1fbd-4972-a809-ff5a99dd81b8", "1dd05363-104e-4b4a-b963-196a534b03a1", "2569ed8c-1147-498a-9b8c-2ad3656b10ed", "a95b9b42-1308-4735-a1af-abb1c5e6f5ac", "204b17ae-4007-471b-917b-b917b315c5db", "50d66fb0-03f8-4da0-8add-84e77d12a020", "cc4e02ba-9c06-48e2-b09e-2500cace9ae0", "c2b86e67-b880-4eec-b045-50bc98ef4844", "36475a7d-0f6d-4dce-9b01-6aeb473bbaf1", "b2815d0d-7481-4bf0-9b6c-a4c48a94b349", "396f6630-f3ac-44e3-bfc8-1b161bc00c4e", "edc2f8ae-2412-4dfd-b9d5-0c57727e70be", "e593cf51-88db-4ee1-b920-37e89012a3c9", "8202070f-edeb-4d31-a010-a26c72ac5600", "97a80ec7-0e2f-4d05-9ef4-65760e634f6b", "3268b746-88d8-4cd3-bffc-30077d02c787", "18988e1b-9087-4f8a-82fe-0414dce49878", "f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b", "f53714ec-5077-420e-ad20-907ff9bb2958", "f117933c-980c-4f78-b384-e3d838111165", "85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98", "a29c1813-ab1f-4dde-b489-330b952e91ae", "62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c", "b655a06a-31c0-477a-95c2-3726b83d649d", "21d856f9-9281-4ded-9377-51a1a6e2a432", "b66474aa-bd92-4333-a16c-298155b120df", "b2309017-4235-44fe-b5af-b15363011957", "cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6", "62510e69-616b-4078-b371-847da438cc03", "855bc8b5-2ae8-402e-a9ed-b889e6df1900", "37651c2a-42cd-4a69-ae0d-22a4349aa04a", "ef9dcfed-690c-4c5d-a9d1-482cd422225c", "1b3b01c7-84e9-4072-86e5-fc285a41ff23", "cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec", "285b85b1-a555-4095-8652-a8a4106af63f", "84f52741-8834-4a8c-a413-2eb2269aa6c8", "ca2092a1-c273-4878-9b4b-0d60115bf5ea", "8a4519e8-e64a-40b6-ae85-ba8ad2177559", "be344333-921d-4c4d-8bb8-e584cf584780", "b97cd4b1-30b8-4a9d-bd72-6293928d52bc", "02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf", "fb843269-508c-4b76-8b8d-88679db22ce7", "f6d1dd2f-b8ce-40ca-bc23-062efb686b34", "de587dce-915e-4218-aac4-835ca6af6f70", "c7942406-33dd-4377-a564-0f62db0593a3", "ab9e3b40-0c85-4ba1-aede-455d226fd124", "ef61af62-bc74-4f58-b49b-626448227652", "a20391f8-76fb-437b-abc0-dba2df1952c6", "899133d5-4d7c-4a7f-94ee-27355c879d90", "1ac8666b-046f-4201-8aba-1951aaec03a3", "1c67a717-32ba-409b-a45d-0fb704a73a81", "fc0e89b5-adb0-43c1-b749-c12a10ec37de", "9df0dd3a-1a5c-47e3-a2bc-30ed177646a0", "eca49c87-8a75-4f13-9c73-a5a29e845f03", "435e10e4-992a-4281-96f3-38b11106adde", "b3512211-c67e-4707-bedc-66efc7848863", "c15a46a0-07d4-4c87-b4b6-89207835a83b", "c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2", "8f70ac5f-1f6f-4f8e-b454-db19561216c5", "7124aebe-4cd7-4ccb-8df0-6d6b93c96795", "1f0f6176-6482-4027-b151-00071af39d7e", "418a3163-3247-4b7b-9933-dcfcb7c52ea9", "1412aa78-a24c-4abd-83df-767dfb2c5bbe", "7f5d1c9a-3e83-48df-95a7-2b98aae6c13c", "9257c05b-4a4a-48e5-a670-b7b073cf401b", "05ebafc8-7aa2-4bcd-a269-2aec93f9e842", "75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13", "e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a", "99793437-3e16-439b-be0f-078782cf953d", "17f0c0a8-8bd5-4ee0-8c5f-a342c0199f35", "baef1ec6-2ca9-47a3-97cc-4cf2bda10b77", "ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99", "ac175779-025a-4f12-98b0-acdaeb77ea85", "63de06b9-a385-40b5-8b32-73f2b9ef84b6", "90d50722-0483-4065-8e35-57efaadd354d", "180c7c5c-d64b-4a63-86e9-68910451bc8b", "d55b793d-f847-4eea-b59a-5ab09908ac90", "aef9d1f1-7396-4e92-a927-4567c7a495c1", "6c6d9280-e6d0-4b9d-80ac-254701b64916", "d7eb979b-c2b5-4a6f-a3a7-c87ce6763819", "9212f354-7775-4e28-9c9f-8f0a4544e664", "5e3cc4d8-3e68-43db-8656-eaaeefdec9cc", "ffa6861c-4461-4f59-8a41-578c39f3f23e", "a0459f02-ac51-4c09-b511-b8c9203fc429", "7c0dcd3d-acf8-4f71-9570-f448b0034f94", "f5e3b62f-e577-4e59-931e-0a15b2b94e1e", "5f60740a-f57b-4e76-82a1-15b6ff2cb134", "534f2ef7-e8a2-4433-816d-c91bccde289b", "322ed9ec-fcab-4f67-9a34-e7c6aef43614", "84232095-ecca-4015-b0d7-7726507ee793", "4e2ed651-1906-4a59-a78a-18220fca1b22", "60f16a96-db70-42eb-8f76-16763e333590", "5afee48e-67dd-4e03-a783-f74259dcf998", "0d34ed8b-1c12-4ff2-828c-16fc860b766d", "771d1eb5-9587-4568-95fb-9ec44153a012", "7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f", "e28a5a99-da44-436d-b7a0-2afc20a5f413", "a85f7765-698a-4088-afa0-ecfbf8d01fa4", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "c0b2768a-dd06-4671-8339-b16ca8d1f27f", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "4aa6040b-3f28-44e3-a769-9208e5feb5ec", "8a8379b8-780b-4dbf-b1e9-31c8d112fefb", "d2b749ee-4225-417e-b20e-a8d2193cbb84", "1193d960-2369-499f-a158-7b50a31df682", "6b65c28e-11f3-46cb-902a-68f2cafaf474", "242301bc-f92f-4476-8718-78004a6efd9f", "fa1a7e52-3d02-435b-81b8-00da14dd66c1", "b9cbbc17-d00d-4e3d-a827-b06d03d2380d", "52d097e2-063e-4c9c-8fbb-855c8948d135", "edadb1e5-5919-4e4c-8462-a9e643b02c4b", "647c7b9e-d784-4fda-b9a0-45c565a7b729", "e32f92d1-523e-49c3-9374-bdb13b46a3ba", "cdf05894-89e7-4ead-b2b0-0a5f97a90f2f", "bb76d96b-821c-47cf-944b-7ce377864492", "0152550d-3a26-4efd-9f0e-54a0b28ae2f3", "1816994b-42e1-4fb1-afd2-134d88184f71", "12827a56-61a4-476a-a9cb-f3068f191073", "32b96012-7892-429e-b26c-ac2bf46066ff", "7002aa10-b8d4-47ae-b5ba-51ab07e228b9", "f4bbd493-b796-416e-bbf2-121235348529", "ec88289a-7e1a-4cc3-8d18-bd1f60e4b9ba", "d06be4b9-8045-428b-a567-740a26d9db25", "114e7f1c-f137-48c8-8f54-3088c24ce4b9", "d75d6b6b-adb9-48f7-824b-ac2e786efe1f", "65c3ca2c-525f-4ced-968e-246a713d164f", "347906f3-e207-4d18-ae5b-a9403d6bcdef", "a29808fd-ef50-49ff-9c7a-59a9b040b404", "e66779cc-383e-4224-a3a4-267eeb585c40", "85c312b7-f44d-4a51-a024-d671c40b49fc", "6da2c9f5-7c53-401b-aacb-92c040ce1215", "e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144", "ff992eac-6449-4c60-8c1d-91c9722a1d48", "4a30ac0c-b9d6-4e01-b71a-5f851bbf4259", "208748f7-881d-47ac-a29c-07ea84bf691d", "89ca78fd-b37c-4310-b3d3-81a023f83936", "a2910908-e86f-4687-aeba-76a5f996e652", "d81871ef-5738-47ab-9797-7a9c90cd4bfb", "9c14c9fa-1a63-4a64-8e57-d19280559490", "221b251a-357a-49a9-920a-271802777cc0", "7e6237fe-3ddb-438f-9381-9bf9de5af8d0", "b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a", "f14e169e-9978-4c69-acb3-1cff8200bc36", "c73124a7-3e89-44a3-bdc1-25fe4df754b1", "fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd", "1c8774a0-44d4-4db0-91f8-e792359c70bd", "c83bf4b5-cdf0-437c-90fa-43d734f7c476", "9fc3072c-dc8f-4bf7-b231-18950000fadd", "ded2b07a-d12f-4284-9b76-653e37b6c8b0", "ada4b0c4-758b-46ac-9033-9004613a150d", "584bca0f-3608-4402-80fd-4075ff6072e3", "9a132afa-654e-11eb-ae93-0242ac130002", "3c89a1e8-0fba-449e-8f1b-8409d6267ec8", "a70dcb37-3bee-453a-99df-d0c683151be6", "85b0b087-eddf-4a2b-b033-d771fa2b9775", "2267fe65-0681-42ad-9a6d-46553d3f3480", "28c8f68b-098d-45af-8d43-8089f3e35403", "cd8c163e-a19b-402e-bdd5-419ff5859f12", "f57f8d16-1f39-4dcb-a604-6c73d9b54b3d", "0ba863e6-def5-4e50-9cea-4dd8c7dc46a4", "2c28c248-7f50-417a-9186-a85b223010ee", "84972c80-251c-4c3a-9079-4f00aad93938", "434c08ba-8406-4d15-8b24-782cb071a691", "bed2a484-9348-4143-8a8a-b801c979301c", "a0d7e4d2-bede-4141-8896-bc6e237e977c", "dcaa3f04-70c3-427a-80b4-b870d73c94c4", "1c526788-0abe-4713-862f-b520da5e5316", "a6fc3c46-23b8-4996-9ea2-573f4c4d88c5", "9ac94dc8-9042-493c-ba45-3b5e7c86b980", "9f107a84-532c-41af-b005-8d12a607639f", "455b9d50-15a1-4b99-853f-8d37655a4c1b", "dee0a7a3-f200-4112-a99b-952196d81e42", "79ce34ca-af29-4d0e-b832-fc1b377020db", "2afafd61-6aae-4df4-baed-139fa1f4c345", "7d4cdc5a-0076-40ca-aac8-f7e714570e47", "f0507c0f-a3a2-40f5-acc6-7f543c334993", "970007b7-ce32-49d0-a4a4-fbef016950bd", "2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25", "b2ddd389-f676-4ac4-845a-e00781a48e5f", "835e75bf-4bfd-47a4-b8a6-b766cac8bcb7", "4a6713f6-3331-11ed-a261-0242ac120002", "27ee9438-90dc-4bef-904b-d3ef927f5e7e", "5cc2cda8-f261-4d88-a2de-e9e193c86716", "01c42d3c-242d-4655-85b2-34f1739632f7", "77946e79-97f1-45a2-84b4-f37b5c0d8682", "27ba3207-dd30-4812-abbf-5d20c57d474e", "1fb76ab8-fa60-4b01-bddd-71e89bf555da", "055fb54c-a8f4-4aee-bd44-f74cf30a0d9d", "1228c958-e64e-4e71-92ad-7d429f4138ba", "7f2376f9-42ee-4dfc-9360-fecff9a88fc8", "8de89e52-f6e1-4b5b-afd1-41ecfa300d48", "b1377339-fda6-477a-b455-ac0923f9ec2c", "44143844-0631-49ab-97a0-96387d6b2d7c", "66c3b204-9f88-4d0a-a7f7-8a57d521ca55", "85de1f22-d189-44e4-8239-dc276b45379b", "92626ddd-662c-49e3-ac59-f6535f12d189", "30e92f50-bb5a-4884-98b5-d20aa80f3d7a", "c740d4cf-a1e9-41de-bb16-8a46a4f57918", "88d6e60c-759d-4ac1-a447-c0f1466c2d21", "e56d3073-83ff-4021-90fe-c658e0709e72", "deb9b646-a508-44ee-b7c9-d8965921c6b6", "4b13db67-0c45-40f1-aba8-66a1a7198a1e", "cea2b7ea-792b-405f-95a1-b903ea06458f", "aa3a6f94-890e-4e22-b634-ffdfd54792cc", "75bfe6e6-cd8e-429e-91d3-03921e1d7962", "730fc21b-eaff-474b-ad23-90fd265d4988", "022eaba8-f0bf-4dd9-9217-4604b0bb3bb0", "a7664b14-75fb-4a50-a223-cb9bc0afbacf", "15bd98ea-55f4-4d37-b09a-e7caa0fa2221", "48917adc-a28e-4f5d-b729-11e75da8941f", "f8ad2e2c-40b6-4117-84d7-20b89896ab23", "0900463c-b33b-49a8-be1d-552a3b553dae", "82a6714f-4899-4f16-9c1e-9a333544d4c3", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "1e59c230-6670-45bf-83b0-98903780607e", "6f8b3439-a203-45dc-a88b-abf57ea15ccf", "258fc8ce-8352-443a-9120-8a11e4857fa5", "1a1ed54a-2ba4-4221-94d5-01dee560d71e", "68c8acb4-1b60-4890-8e82-3ddf7a6dba84", "104cdb48-a7a8-4ca7-a453-32942c6e5dcb", "4ae81040-fc1c-4249-bfa3-938d260214d9", "aa2efee7-34dd-446e-8a37-40790a66efd7", "b1ec66c6-f4d1-4b5c-96dd-af28ccae7727", "f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb", "ae215552-081e-44c7-805f-be16f975c8a2", "30bf1789-379d-4fdc-900f-55cd0a90a801", "53d4bb30-3f36-4e8a-b078-69d36c4a79ff", "4f7a6757-ff79-46db-9687-66501a02d9ec", "129966c9-de17-4334-a123-8b58172e664d", "696bfb54-227e-4602-ac5b-30d9d2053312", "782d6f3e-4c5d-4b8c-92a3-1d05fed72e63", "7df1713a-1a5b-4a4b-a071-dc83b144a101", "7cccd811-7ae9-4ebe-9afd-cb5c406b824b", "814c95cc-8192-4378-a70a-f1aafd877af1", "5b80a791-ad9b-4b75-bcc1-ad4e1e89c200", "99c840f2-2012-46fd-9141-c761987550ef", "0e8cfe08-02c9-4815-a2f8-0d157b7ed33e", "de16d92c-c446-4d53-8938-10aeef41c8b6", "056c7317-9a09-4bd4-9067-d051312752ea", "60fc936d-2eb0-4543-8a13-911c750a1dfc", "b7e2a8d4-74bb-4b78-adc9-3f92af2d4829", "114de787-4eb2-48cc-abdb-c0b449f93ea4", "207b0396-3689-42d9-8399-4222658efc99", "59e938ff-0d6d-4dc3-b13f-36cc28734d4e", "9248c7e1-2bf3-4661-a22c-600a8040b446", "146aace8-9bd6-42ba-be7a-0070d8027b76", "3d7679bd-0c00-440c-97b0-3f204273e6c7", "ea011323-7045-460b-b2d7-0f7442ea6b38", "88a87a10-384b-4ad7-8871-2f9bf9259ce5", "e290b10b-1023-4452-a4a9-eb31a9013b3a", "ca5583e9-8f80-46ac-ab91-7f314d13b984", "cd3d1298-eb3b-476c-ac67-12847de55813", "867356ee-9352-41c9-a8f2-1be690d78216", "67f113fa-e23d-4271-befa-30113b3e08b1", "3b3c7f55-f771-4dd6-8a6e-08d057a17caf", "49be8799-7b4d-4fda-ad23-cafbefdebbc5", "2c1486f5-02e8-4f86-9099-b97f2da4ed77", "62b20d44-1546-4e61-afce-8e175eb9473c", "0ef56343-059e-4cb6-adc1-4c3c967c5e46", "ad720b90-25ad-43ff-9b5e-5c841facc8e5", "949f1ffb-6e85-4f00-ae1e-c3c5b190d605", "e5d36acd-acb4-4c6f-a13f-9eb203d50099", "b6676963-0353-4f88-90f5-36c20d443c6a", "99cf1e02-00fb-4c0d-8375-563f978dfd37", "903076ff-f442-475a-b667-4f246bcc203b", "a77c1610-fc73-4019-8e29-0f51efc04a51", "fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c", "b2b048b0-7857-4380-b0fb-d3f0ab820b71", "cea72823-df4d-4567-950c-0b579eaf0846", "74a2b202-73e0-4693-9a3a-9d36146d0775", "5fc297ae-25b6-488a-8f25-cc12ac29b744", "12f6b752-042d-483e-bf9c-915a6d06ad75", "9386d78a-7207-4048-9c9f-a93a7c2d1c05", "c1d867fe-8d95-4487-aab4-e53f2d339f90", "e13f668e-7f95-443d-98d2-1816a7648a7b", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "8b93a509-1cb8-42e1-97aa-ee24224cdc15", "9c8c7000-3065-44a8-a555-79bcba5d9955", "fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd", "ee5e119b-1f75-4b34-add8-3be976961e39", "33339be3-148b-4e16-af56-ad16ec6c7e7b", "6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca", "ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31", "646ea171-dded-4578-8a4d-65e9822892e3", "84b1706c-932a-44c4-ae28-892b28a25b94", "1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c", "1e53dd56-8d83-4eb4-a43e-b790a05510aa", "074e0ded-6ced-4ebd-8b4d-53f55908119d", "1a5fefe6-734f-452e-a07d-fc1c35bce4b2", "c30fb093-1109-4dc8-88a8-b30d11c95a5d", "3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5", "af491bca-e752-4b44-9c86-df5680533dbc", "bb58aa4a-b80b-415a-a2c0-2f65a4c81009", "3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b", "f0f7be61-9cf5-43be-9836-99d6ef448a18", "b1f73849-6329-4069-bc8f-78a604bb8b23", "b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c", "10fb649c-3600-4d37-b1e6-56ea90bb7e09", "82343930-652f-43f5-ab70-2ee9fdd6d5e9", "81bcb81b-5b1f-474b-b373-52c871aaa7b1", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2", "9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d", "9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0", "0b80ade5-6997-4b1d-99a1-71701778ea61", "81ebd28b-9607-4478-bf06-974ed9d53ed7", "dc4576d4-7467-424f-9eee-fd2b02855fe0", "91edcfb1-2529-4ac2-9ecc-7617f895c7e4", "e9142d84-fbe0-401d-ac50-3e519fb00c89", "b4dc61f5-6cce-468e-a608-b48b469feaa2", "e6313acd-208c-44fc-a0ff-db85d572e90e", "f3d39c45-de1a-4486-a687-ab126124f744", "97dbf6e2-e436-44d8-abee-4261b24d3e41", "0fc35fc3-efe6-4898-8a37-0b233339524f", "c947b146-0abc-4c87-9c64-b17e9d7274a2", "91a2c315-9ee6-4052-a853-6f6a8238f90d", "9525dc73-0327-438c-8c04-13c0e037e9da", "a4694263-59a8-4608-a3a0-6f8d3a51664c", "f37aba28-a9e6-4045-882c-d5004043b337", "5e95028c-5229-4214-afae-d653d573d0ec", "9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70", "7c8af9b2-dcae-41a2-a9db-b28c288b5f08", "869b9ca7-9ea2-4a5a-8325-e80e62f75445", "efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6", "f7375e28-5c14-432f-b8d1-1db26c832df3", "0e0255bf-2548-47b8-9582-c0955c9283f5", "99b7460d-c9f1-40d7-a316-1f36f61d52ee", "c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78", "889719ef-dd62-43df-86c3-768fb08dc7c0", "af77cf95-c469-471c-b6a0-946c685c4798", "4f2cd9b6-4a17-440f-bb2a-687abb65993a", "ec0722a3-eb5c-4a56-8ab2-bf6f20708592", "4bf943c6-5146-4273-98dd-e958fd1e3abf", "7f741dcf-fc22-4759-87b4-9ae8376676a2", "8a3038e8-9c9d-46f8-b184-66234a160f6f", "7d4aaec2-08ed-4430-8b96-28420e030e04", "75d0a94e-6252-448d-a7be-d953dff527bb", "327f48c1-a6db-4eb8-875a-f6981f1b0183", "5f03babb-12db-4eec-8c82-7b4cb5580868", "89f75308-5b1b-4390-b2d8-d6b2340efaf8", "f7b5f842-a6af-4da5-9e95-e32478f3cd2f", "cd1f961e-0b96-436b-b7c6-38da4583ec00", "7b4f794b-590a-4ad4-ba18-7964a2832205", "438025f9-5856-4663-83f7-52f878a70a50", "9465ddf4-f9e4-4ebd-8d98-702df3a93239", "213d6a77-3d55-4ce8-ba74-fcfef741974e", "aaafa146-074c-11eb-adc1-0242ac120002", "2433a154-bb3d-42e4-86c3-a26bdac91c45", "95e60a2b-4705-444b-b7da-ba0ea81a3ee2", "4f647cfa-b598-4e12-ad69-c68dd16caef8", "961e0abb-1b1e-4c84-a453-aafe56ad0d34", "17769c90-230e-488b-a463-e05c08e9d48f", "e173ad47-4388-4012-ae62-bd13f71c18a8", "48bbc537-b652-4b4e-bd1d-281172df448f", "1edff897-9146-48d2-9066-52e8d8f80a2f", "c248c896-e412-4279-8c15-1c558067b6fa", "b124ddf4-778d-418e-907f-6dd3fc0d31cd", "2d3cdeec-c0db-45b4-aa86-082f7eb75701", "ad691d92-15f2-4181-9aa4-723c74f9ddc3", "d522eca2-2973-4391-a3e0-ef0374321dae", "62e0298b-e994-4189-bc87-bc699aa62d97", "62b7ccc9-23b4-471e-aa15-6da3663c4d59", "17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8", "8f88e3f6-2a49-48f5-a5c4-2f7eedf78710", "a537cfc3-4297-4789-92b5-345bfd845ad0", "4a2a2c3e-209f-4d01-b513-4155a540b469", "f64e5c19-879c-4bae-b471-6d84c8339677", "3dfd06d2-eaf4-4532-9555-68aca59f57c4", "9cc85849-3b02-4cb5-b371-3a1ff54f2218", "536e2947-3729-478c-9903-745aaffe60d2", "40aa399c-7b02-4715-8e5f-73572b493f33", "883835a7-df45-43e4-bf1d-4268768afda4", "30fc8de7-d833-40c4-96b6-28319fbc4f6c", "a01b8329-5953-4f73-ae2d-aa01e1f35f00", "3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f", "b57ba453-b384-4ab9-9f40-1038086b4e53", "e9f8f8cc-07cc-4e81-b724-f387db9175e4", "3bad990e-4848-4a78-9530-b427d854aac0", "b9aeac14-2ffd-4ad3-b967-1354a4e628c3", "b8b1b304-a60f-4999-9a6e-c547bde03ffd", "09576804-7a05-458e-a817-eb718ca91f54", "c2c76b77-32be-4d1f-82c9-7e544bdfe0eb", "b0524451-19af-4efa-a46f-562a977f792e", "b96b2031-7c17-4473-afe7-a30ce714db29", "37c1333a-a0db-48be-b64b-7393b2386e3b", "81325ce1-be01-4250-944f-b4789644556f", "3abd6094-7027-475f-9630-8ab9be7b9725", "d9047477-0359-48c9-b8c7-792cedcdc9c4", "56d19cb4-6414-4769-9644-1ed35ffbb148", "a6a39bdb-935c-4f0a-ab77-35f4bbf44d33", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "b3d34dc5-2efd-4ae3-845f-8ec14921f449", "5cdb711b-5740-4fb2-ba88-f7945027afac", "164eda96-11b2-430b-85ff-6a265c15bf32", "a58353df-af43-4753-bad0-cd83ef35eef5", "56321594-9087-49d9-bf10-524fe8479452"]}, "errors": {"uberAgent (develop)": {"missing_field": {"dst_port": {"refs": ["d7fb8f0e-bd5f-45c2-b467-19571c490d7e"], "logsource.categories": ["firewall"], "logsource.products": [null]}, "EventID": {"refs": ["f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7"], "logsource.categories": ["registry_event"], "logsource.products": ["windows"]}, "User": {"refs": ["f674e36a-4b91-431e-8aef-f8a96c2aca35", "944e8941-f6f6-4ee8-ac05-1c224e923c0e"], "logsource.categories": ["registry_set"], "logsource.products": ["windows"]}, "Description": {"refs": ["092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "cbb56d62-4060-40f7-9466-d8aaf3123f83", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "754ed792-634f-40ae-b3bc-e0448d33f695", "145322e4-0fd3-486b-81ca-9addc75736d8", "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "52ff7941-8211-46f9-84f8-9903efb7077d", "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "b1876533-4ed5-4a83-90f3-b8645840a413", "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "758ff488-18d5-4cbe-8ec4-02b6285a434f", "d08a2711-ee8b-4323-bdec-b7d85e892b31", "46123129-1024-423e-9fae-43af4a0fa9a5", "6938366d-8954-4ddc-baff-c830b3ba8fcd", "0ba1da6d-b6ce-4366-828c-18826c9de23e", "9fbf5927-5261-4284-a71d-f681029ea574", "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "54773c5f-f1cc-4703-9126-2f797d96a69d", "d679950c-abb7-43a6-80fb-2a480c4fc450", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "03552375-cc2c-4883-bbe4-7958d5a980be", "87911521-7098-470b-a459-9a57fc80bdfd", "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "48a61b29-389f-4032-b317-b30de6b95314", "0b0cd537-fc77-4e6e-a973-e53495c1083d", "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "fca949cc-79ca-446e-8064-01aa7e52ece5", "e37db05d-d1f9-49c8-b464-cee1a4b11638", "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "9d5a1274-922a-49d0-87f3-8c653483b909", "7530cd3d-7671-43e3-b209-976966f6ea48", "41f407b5-3096-44ea-a74f-96d04fbc41be", "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "5722dff1-4bdd-4949-86ab-fbaf707e767a", "eb2d07d4-49cb-4523-801a-da002df36602", "811e0002-b13b-4a15-9d00-a613fce66e42", "762f2482-ff21-4970-8939-0aa317a886bb", "38646daa-e78f-4ace-9de0-55547b2d30da", "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "c4e49831-1496-40cf-8ce1-b53f942b02f9", "2c32b543-1058-4808-91c6-5b31b8bed6c5", "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "b52e84a3-029e-4529-b09b-71d19dd27e94", "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "198effb6-6c98-4d0c-9ea3-451fa143c45c", "d85873ef-a0f8-4c48-a53a-6b621f11729d", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "f38a82d2-fba3-4781-b549-525efbec8506", "57bff678-25d1-4d6c-8211-8ca106d12053", "037dcd71-33a8-4392-bb01-293c94663e5a", "afe52666-401e-4a02-b4ff-5d128990b8cb", "4ede543c-e098-43d9-a28f-dd784a13132f", "bb780e0c-16cf-4383-8383-1e5471db6cf9", "148431ce-4b70-403d-8525-fcc2993f29ea"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Product": {"refs": ["d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "9ef27c24-4903-4192-881a-3adde7ff92a5", "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "b37998de-a70b-4f33-b219-ec36bf433dc0", "26488ad0-f9fd-4536-876f-52fea846a2e4", "c625d754-6a3d-4f65-9c9a-536aea960d37", "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "24c77512-782b-448a-8950-eddb0785fc71", "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "e01fa958-6893-41d4-ae03-182477c5e77d", "a96970af-f126-420d-90e1-d37bf25e50e1", "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "0afbd410-de03-4078-8491-f132303cb67d", "37e8d358-6408-4853-82f4-98333fca7014", "ca387a8e-1c84-4da3-9993-028b45342d30", "4833155a-4053-4c9c-a997-777fcea0baa7", "88656cec-6c3b-487c-82c0-f73ebb805503", "cd764533-2e07-40d6-a718-cfeec7f2da7f"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "PreviousCreationUtcTime": {"refs": ["558eebe5-f2ba-4104-b339-36f7902bcc1a"], "logsource.categories": ["file_change"], "logsource.products": ["windows"]}, "Initiated": {"refs": ["5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4", "d58ba5c6-0ed7-4b9d-a433-6878379efda9", "7610a4ea-c06d-495f-a2ac-0a696abcfd3b", "3ab65069-d82a-4d44-a759-466661a082d1", "5c80b618-0dbb-46e6-acbb-03d90bcb6d83", "c539afac-c12a-46ed-b1bd-5a5567c9f045", "cdc8da7d-c303-42f8-b08c-b4ab47230263", "3b5ba899-9842-4bc2-acc2-12308498bf42", "9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4", "8d7e392e-9b28-49e1-831d-5949c6281228", "5205613d-2a63-4412-a895-3a2458b587b3", "786cdae8-fefb-4eb2-9227-04e34060db01", "b1e5da3b-ca8e-4adf-915c-9921f3d85481", "e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97", "b3ad3c0f-c949-47a1-a30e-b0491ccae876", "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7", "18249279-932f-45e2-b37a-8925f2597670", "50e54b8d-ad73-43f8-96a1-5191685b17a4", "9e02c8ec-02b9-43e8-81eb-34a475ba7965", "ed74fe75-7594-4b4b-ae38-e38e3fd2eb23", "08249dc0-a28d-4555-8ba5-9255a198e08c", "7b434893-c57d-4f41-908d-6a17bf1ae98f", "7cd1dcdc-6edf-4896-86dc-d1f19ad64903", "992a6cae-db6a-43c8-9cec-76d7195c96fc", "4b657234-038e-4ad5-997c-4be42340bce4", "bef0bc5a-b9ae-425d-85c6-7b2d705980c6", "efafe0bf-4238-479e-af8f-797bd3490d2d", "75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84", "0531e43a-d77d-47c2-b89f-5fe50321c805", "e54979bd-c5f9-4d6c-967b-a04b19ac4c74", "4b89abaa-99fe-4232-afdd-8f9aa4d20382", "07837ab9-60e1-481f-a74d-c31fb496a94c", "c7e91a02-d771-4a6d-a700-42587e0b1095", "37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1", "0dba975d-a193-4ed1-a067-424df57570d1", "9976fa64-2804-423c-8a5b-646ade840773", "20384606-a124-4fec-acbb-8bd373728613", "25eabf56-22f0-4915-a1ed-056b8dae0a68", "6d8c3d20-a5e1-494f-8412-4571d716cf5c", "fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4"], "logsource.categories": ["network_connection"], "logsource.products": ["windows"]}, "Type": {"refs": ["c4b890e5-8d8c-4496-8c66-c805753817cd"], "logsource.categories": ["process_tampering"], "logsource.products": ["windows"]}, "SourceImage": {"refs": ["2e4e488a-6164-4811-9ea1-f960c7359c40", "66d31e5f-52d6-40a4-9615-002d3789a119", "02d1d718-dd13-41af-989d-ea85c7fab93f", "99b97608-3e21-4bfe-8217-2a127c396a0e", "c15e99a3-c474-48ab-b9a7-84549a7a9d16", "a1a144b7-5c9b-4853-a559-2172be8d4a03", "c0aac16a-b1e7-4330-bab0-3c27bb4987c7", "fb656378-f909-47c1-8747-278bf09f4f4f"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "StartAddress": {"refs": ["6309645e-122d-4c5b-bb2b-22e4f9c2fa42"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "IntegrityLevel": {"refs": ["0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "3c05e90d-7eba-4324-9972-5d7f711a60a8", "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "3037d961-21e9-4732-b27a-637bcc7bf539", "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "40f9af16-589d-4984-b78d-8c2aec023197", "4cbef972-f347-4170-b62a-8253f6168e6d", "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "853e74f9-9392-4935-ad3b-2e8c040dae86", "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "89a9a0e0-f61a-42e5-8957-b1479565a658", "a743ceba-c771-4d75-97eb-8a90f7f4844c", "b697e69c-746f-4a86-9f59-7bfff8eab881", "7a01183d-71a2-46ad-ad5c-acd989ac1793", "224f140f-3553-4cd1-af78-13d81bf9f7cc", "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "80fc36aa-945e-4181-89f2-2f907ab6775d", "d937b75f-a665-4480-88a5-2f20e9f9b22a", "1ca6bd18-0ba0-44ca-851c-92ed89a61085"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "CurrentDirectory": {"refs": ["631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "95eadcb2-92e4-4ed1-9031-92547773a6db", "ed825c86-c009-4014-b413-b76003e33d35", "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "02b18447-ea83-4b1b-8805-714a8a34546a", "3a6586ad-127a-4d3b-a677-1e6eacdf8fde"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Provider_Name": {"refs": ["7dc2dedd-7603-461a-bc13-15803d132355"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "ParentUser": {"refs": ["590a5f4c-6c8c-4f10-8307-89afe9453a9d", "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "LogonId": {"refs": ["d21374ff-f574-44a7-9998-4a8c8bf33d7d", "178e615d-e666-498b-9630-9ed363038101"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}}}, "uberAgent 7.3": {"missing_field": {"dst_port": {"refs": ["d7fb8f0e-bd5f-45c2-b467-19571c490d7e"], "logsource.categories": ["firewall"], "logsource.products": [null]}, "EventID": {"refs": ["f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7"], "logsource.categories": ["registry_event"], "logsource.products": ["windows"]}, "User": {"refs": ["f674e36a-4b91-431e-8aef-f8a96c2aca35", "944e8941-f6f6-4ee8-ac05-1c224e923c0e"], "logsource.categories": ["registry_set"], "logsource.products": ["windows"]}, "Description": {"refs": ["092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "cbb56d62-4060-40f7-9466-d8aaf3123f83", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "754ed792-634f-40ae-b3bc-e0448d33f695", "145322e4-0fd3-486b-81ca-9addc75736d8", "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "52ff7941-8211-46f9-84f8-9903efb7077d", "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "b1876533-4ed5-4a83-90f3-b8645840a413", "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "758ff488-18d5-4cbe-8ec4-02b6285a434f", "d08a2711-ee8b-4323-bdec-b7d85e892b31", "46123129-1024-423e-9fae-43af4a0fa9a5", "6938366d-8954-4ddc-baff-c830b3ba8fcd", "0ba1da6d-b6ce-4366-828c-18826c9de23e", "9fbf5927-5261-4284-a71d-f681029ea574", "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "54773c5f-f1cc-4703-9126-2f797d96a69d", "d679950c-abb7-43a6-80fb-2a480c4fc450", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "03552375-cc2c-4883-bbe4-7958d5a980be", "87911521-7098-470b-a459-9a57fc80bdfd", "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "48a61b29-389f-4032-b317-b30de6b95314", "0b0cd537-fc77-4e6e-a973-e53495c1083d", "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "fca949cc-79ca-446e-8064-01aa7e52ece5", "e37db05d-d1f9-49c8-b464-cee1a4b11638", "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "9d5a1274-922a-49d0-87f3-8c653483b909", "7530cd3d-7671-43e3-b209-976966f6ea48", "41f407b5-3096-44ea-a74f-96d04fbc41be", "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "5722dff1-4bdd-4949-86ab-fbaf707e767a", "eb2d07d4-49cb-4523-801a-da002df36602", "811e0002-b13b-4a15-9d00-a613fce66e42", "762f2482-ff21-4970-8939-0aa317a886bb", "38646daa-e78f-4ace-9de0-55547b2d30da", "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "c4e49831-1496-40cf-8ce1-b53f942b02f9", "2c32b543-1058-4808-91c6-5b31b8bed6c5", "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "b52e84a3-029e-4529-b09b-71d19dd27e94", "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "198effb6-6c98-4d0c-9ea3-451fa143c45c", "d85873ef-a0f8-4c48-a53a-6b621f11729d", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "f38a82d2-fba3-4781-b549-525efbec8506", "57bff678-25d1-4d6c-8211-8ca106d12053", "037dcd71-33a8-4392-bb01-293c94663e5a", "afe52666-401e-4a02-b4ff-5d128990b8cb", "4ede543c-e098-43d9-a28f-dd784a13132f", "bb780e0c-16cf-4383-8383-1e5471db6cf9", "148431ce-4b70-403d-8525-fcc2993f29ea"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Product": {"refs": ["d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "9ef27c24-4903-4192-881a-3adde7ff92a5", "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "b37998de-a70b-4f33-b219-ec36bf433dc0", "26488ad0-f9fd-4536-876f-52fea846a2e4", "c625d754-6a3d-4f65-9c9a-536aea960d37", "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "24c77512-782b-448a-8950-eddb0785fc71", "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "e01fa958-6893-41d4-ae03-182477c5e77d", "a96970af-f126-420d-90e1-d37bf25e50e1", "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "0afbd410-de03-4078-8491-f132303cb67d", "37e8d358-6408-4853-82f4-98333fca7014", "ca387a8e-1c84-4da3-9993-028b45342d30", "4833155a-4053-4c9c-a997-777fcea0baa7", "88656cec-6c3b-487c-82c0-f73ebb805503", "cd764533-2e07-40d6-a718-cfeec7f2da7f"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "PreviousCreationUtcTime": {"refs": ["558eebe5-f2ba-4104-b339-36f7902bcc1a"], "logsource.categories": ["file_change"], "logsource.products": ["windows"]}, "Initiated": {"refs": ["5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4", "d58ba5c6-0ed7-4b9d-a433-6878379efda9", "7610a4ea-c06d-495f-a2ac-0a696abcfd3b", "3ab65069-d82a-4d44-a759-466661a082d1", "5c80b618-0dbb-46e6-acbb-03d90bcb6d83", "c539afac-c12a-46ed-b1bd-5a5567c9f045", "cdc8da7d-c303-42f8-b08c-b4ab47230263", "3b5ba899-9842-4bc2-acc2-12308498bf42", "9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4", "8d7e392e-9b28-49e1-831d-5949c6281228", "5205613d-2a63-4412-a895-3a2458b587b3", "786cdae8-fefb-4eb2-9227-04e34060db01", "b1e5da3b-ca8e-4adf-915c-9921f3d85481", "e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97", "b3ad3c0f-c949-47a1-a30e-b0491ccae876", "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7", "18249279-932f-45e2-b37a-8925f2597670", "50e54b8d-ad73-43f8-96a1-5191685b17a4", "9e02c8ec-02b9-43e8-81eb-34a475ba7965", "ed74fe75-7594-4b4b-ae38-e38e3fd2eb23", "08249dc0-a28d-4555-8ba5-9255a198e08c", "7b434893-c57d-4f41-908d-6a17bf1ae98f", "7cd1dcdc-6edf-4896-86dc-d1f19ad64903", "992a6cae-db6a-43c8-9cec-76d7195c96fc", "4b657234-038e-4ad5-997c-4be42340bce4", "bef0bc5a-b9ae-425d-85c6-7b2d705980c6", "efafe0bf-4238-479e-af8f-797bd3490d2d", "75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84", "0531e43a-d77d-47c2-b89f-5fe50321c805", "e54979bd-c5f9-4d6c-967b-a04b19ac4c74", "4b89abaa-99fe-4232-afdd-8f9aa4d20382", "07837ab9-60e1-481f-a74d-c31fb496a94c", "c7e91a02-d771-4a6d-a700-42587e0b1095", "37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1", "0dba975d-a193-4ed1-a067-424df57570d1", "9976fa64-2804-423c-8a5b-646ade840773", "20384606-a124-4fec-acbb-8bd373728613", "25eabf56-22f0-4915-a1ed-056b8dae0a68", "6d8c3d20-a5e1-494f-8412-4571d716cf5c", "fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4"], "logsource.categories": ["network_connection"], "logsource.products": ["windows"]}, "Type": {"refs": ["c4b890e5-8d8c-4496-8c66-c805753817cd"], "logsource.categories": ["process_tampering"], "logsource.products": ["windows"]}, "SourceImage": {"refs": ["2e4e488a-6164-4811-9ea1-f960c7359c40", "66d31e5f-52d6-40a4-9615-002d3789a119", "02d1d718-dd13-41af-989d-ea85c7fab93f", "99b97608-3e21-4bfe-8217-2a127c396a0e", "c15e99a3-c474-48ab-b9a7-84549a7a9d16", "a1a144b7-5c9b-4853-a559-2172be8d4a03", "c0aac16a-b1e7-4330-bab0-3c27bb4987c7", "fb656378-f909-47c1-8747-278bf09f4f4f"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "StartAddress": {"refs": ["6309645e-122d-4c5b-bb2b-22e4f9c2fa42"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "IntegrityLevel": {"refs": ["0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "3c05e90d-7eba-4324-9972-5d7f711a60a8", "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "3037d961-21e9-4732-b27a-637bcc7bf539", "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "40f9af16-589d-4984-b78d-8c2aec023197", "4cbef972-f347-4170-b62a-8253f6168e6d", "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "853e74f9-9392-4935-ad3b-2e8c040dae86", "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "89a9a0e0-f61a-42e5-8957-b1479565a658", "a743ceba-c771-4d75-97eb-8a90f7f4844c", "b697e69c-746f-4a86-9f59-7bfff8eab881", "7a01183d-71a2-46ad-ad5c-acd989ac1793", "224f140f-3553-4cd1-af78-13d81bf9f7cc", "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "80fc36aa-945e-4181-89f2-2f907ab6775d", "d937b75f-a665-4480-88a5-2f20e9f9b22a", "1ca6bd18-0ba0-44ca-851c-92ed89a61085"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "CurrentDirectory": {"refs": ["631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "95eadcb2-92e4-4ed1-9031-92547773a6db", "ed825c86-c009-4014-b413-b76003e33d35", "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "02b18447-ea83-4b1b-8805-714a8a34546a", "3a6586ad-127a-4d3b-a677-1e6eacdf8fde"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Provider_Name": {"refs": ["7dc2dedd-7603-461a-bc13-15803d132355"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "ParentUser": {"refs": ["590a5f4c-6c8c-4f10-8307-89afe9453a9d", "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "LogonId": {"refs": ["d21374ff-f574-44a7-9998-4a8c8bf33d7d", "178e615d-e666-498b-9630-9ed363038101"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}}}, "uberAgent 7.2": {"missing_field": {"dst_port": {"refs": ["d7fb8f0e-bd5f-45c2-b467-19571c490d7e"], "logsource.categories": ["firewall"], "logsource.products": [null]}, "EventID": {"refs": ["f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7"], "logsource.categories": ["registry_event"], "logsource.products": ["windows"]}, "User": {"refs": ["f674e36a-4b91-431e-8aef-f8a96c2aca35", "944e8941-f6f6-4ee8-ac05-1c224e923c0e"], "logsource.categories": ["registry_set"], "logsource.products": ["windows"]}, "Description": {"refs": ["092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "cbb56d62-4060-40f7-9466-d8aaf3123f83", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "754ed792-634f-40ae-b3bc-e0448d33f695", "145322e4-0fd3-486b-81ca-9addc75736d8", "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "52ff7941-8211-46f9-84f8-9903efb7077d", "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "b1876533-4ed5-4a83-90f3-b8645840a413", "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "758ff488-18d5-4cbe-8ec4-02b6285a434f", "d08a2711-ee8b-4323-bdec-b7d85e892b31", "46123129-1024-423e-9fae-43af4a0fa9a5", "6938366d-8954-4ddc-baff-c830b3ba8fcd", "0ba1da6d-b6ce-4366-828c-18826c9de23e", "9fbf5927-5261-4284-a71d-f681029ea574", "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "54773c5f-f1cc-4703-9126-2f797d96a69d", "d679950c-abb7-43a6-80fb-2a480c4fc450", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "03552375-cc2c-4883-bbe4-7958d5a980be", "87911521-7098-470b-a459-9a57fc80bdfd", "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "48a61b29-389f-4032-b317-b30de6b95314", "0b0cd537-fc77-4e6e-a973-e53495c1083d", "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "fca949cc-79ca-446e-8064-01aa7e52ece5", "e37db05d-d1f9-49c8-b464-cee1a4b11638", "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "9d5a1274-922a-49d0-87f3-8c653483b909", "7530cd3d-7671-43e3-b209-976966f6ea48", "41f407b5-3096-44ea-a74f-96d04fbc41be", "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "5722dff1-4bdd-4949-86ab-fbaf707e767a", "eb2d07d4-49cb-4523-801a-da002df36602", "811e0002-b13b-4a15-9d00-a613fce66e42", "762f2482-ff21-4970-8939-0aa317a886bb", "38646daa-e78f-4ace-9de0-55547b2d30da", "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "c4e49831-1496-40cf-8ce1-b53f942b02f9", "2c32b543-1058-4808-91c6-5b31b8bed6c5", "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "b52e84a3-029e-4529-b09b-71d19dd27e94", "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "198effb6-6c98-4d0c-9ea3-451fa143c45c", "d85873ef-a0f8-4c48-a53a-6b621f11729d", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "f38a82d2-fba3-4781-b549-525efbec8506", "57bff678-25d1-4d6c-8211-8ca106d12053", "037dcd71-33a8-4392-bb01-293c94663e5a", "afe52666-401e-4a02-b4ff-5d128990b8cb", "4ede543c-e098-43d9-a28f-dd784a13132f", "bb780e0c-16cf-4383-8383-1e5471db6cf9", "148431ce-4b70-403d-8525-fcc2993f29ea"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Product": {"refs": ["d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "9ef27c24-4903-4192-881a-3adde7ff92a5", "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "b37998de-a70b-4f33-b219-ec36bf433dc0", "26488ad0-f9fd-4536-876f-52fea846a2e4", "c625d754-6a3d-4f65-9c9a-536aea960d37", "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "24c77512-782b-448a-8950-eddb0785fc71", "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "e01fa958-6893-41d4-ae03-182477c5e77d", "a96970af-f126-420d-90e1-d37bf25e50e1", "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "0afbd410-de03-4078-8491-f132303cb67d", "37e8d358-6408-4853-82f4-98333fca7014", "ca387a8e-1c84-4da3-9993-028b45342d30", "4833155a-4053-4c9c-a997-777fcea0baa7", "88656cec-6c3b-487c-82c0-f73ebb805503", "cd764533-2e07-40d6-a718-cfeec7f2da7f"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "PreviousCreationUtcTime": {"refs": ["558eebe5-f2ba-4104-b339-36f7902bcc1a"], "logsource.categories": ["file_change"], "logsource.products": ["windows"]}, "Initiated": {"refs": ["5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4", "d58ba5c6-0ed7-4b9d-a433-6878379efda9", "7610a4ea-c06d-495f-a2ac-0a696abcfd3b", "3ab65069-d82a-4d44-a759-466661a082d1", "5c80b618-0dbb-46e6-acbb-03d90bcb6d83", "c539afac-c12a-46ed-b1bd-5a5567c9f045", "cdc8da7d-c303-42f8-b08c-b4ab47230263", "3b5ba899-9842-4bc2-acc2-12308498bf42", "9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4", "8d7e392e-9b28-49e1-831d-5949c6281228", "5205613d-2a63-4412-a895-3a2458b587b3", "786cdae8-fefb-4eb2-9227-04e34060db01", "b1e5da3b-ca8e-4adf-915c-9921f3d85481", "e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97", "b3ad3c0f-c949-47a1-a30e-b0491ccae876", "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7", "18249279-932f-45e2-b37a-8925f2597670", "50e54b8d-ad73-43f8-96a1-5191685b17a4", "9e02c8ec-02b9-43e8-81eb-34a475ba7965", "ed74fe75-7594-4b4b-ae38-e38e3fd2eb23", "08249dc0-a28d-4555-8ba5-9255a198e08c", "7b434893-c57d-4f41-908d-6a17bf1ae98f", "7cd1dcdc-6edf-4896-86dc-d1f19ad64903", "992a6cae-db6a-43c8-9cec-76d7195c96fc", "4b657234-038e-4ad5-997c-4be42340bce4", "bef0bc5a-b9ae-425d-85c6-7b2d705980c6", "efafe0bf-4238-479e-af8f-797bd3490d2d", "75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84", "0531e43a-d77d-47c2-b89f-5fe50321c805", "e54979bd-c5f9-4d6c-967b-a04b19ac4c74", "4b89abaa-99fe-4232-afdd-8f9aa4d20382", "07837ab9-60e1-481f-a74d-c31fb496a94c", "c7e91a02-d771-4a6d-a700-42587e0b1095", "37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1", "0dba975d-a193-4ed1-a067-424df57570d1", "9976fa64-2804-423c-8a5b-646ade840773", "20384606-a124-4fec-acbb-8bd373728613", "25eabf56-22f0-4915-a1ed-056b8dae0a68", "6d8c3d20-a5e1-494f-8412-4571d716cf5c", "fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4"], "logsource.categories": ["network_connection"], "logsource.products": ["windows"]}, "Type": {"refs": ["c4b890e5-8d8c-4496-8c66-c805753817cd"], "logsource.categories": ["process_tampering"], "logsource.products": ["windows"]}, "SourceImage": {"refs": ["2e4e488a-6164-4811-9ea1-f960c7359c40", "66d31e5f-52d6-40a4-9615-002d3789a119", "02d1d718-dd13-41af-989d-ea85c7fab93f", "99b97608-3e21-4bfe-8217-2a127c396a0e", "c15e99a3-c474-48ab-b9a7-84549a7a9d16", "a1a144b7-5c9b-4853-a559-2172be8d4a03", "c0aac16a-b1e7-4330-bab0-3c27bb4987c7", "fb656378-f909-47c1-8747-278bf09f4f4f"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "StartAddress": {"refs": ["6309645e-122d-4c5b-bb2b-22e4f9c2fa42"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "IntegrityLevel": {"refs": ["0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "3c05e90d-7eba-4324-9972-5d7f711a60a8", "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "3037d961-21e9-4732-b27a-637bcc7bf539", "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "40f9af16-589d-4984-b78d-8c2aec023197", "4cbef972-f347-4170-b62a-8253f6168e6d", "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "853e74f9-9392-4935-ad3b-2e8c040dae86", "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "89a9a0e0-f61a-42e5-8957-b1479565a658", "a743ceba-c771-4d75-97eb-8a90f7f4844c", "b697e69c-746f-4a86-9f59-7bfff8eab881", "7a01183d-71a2-46ad-ad5c-acd989ac1793", "224f140f-3553-4cd1-af78-13d81bf9f7cc", "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "80fc36aa-945e-4181-89f2-2f907ab6775d", "d937b75f-a665-4480-88a5-2f20e9f9b22a", "1ca6bd18-0ba0-44ca-851c-92ed89a61085"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "CurrentDirectory": {"refs": ["631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "95eadcb2-92e4-4ed1-9031-92547773a6db", "ed825c86-c009-4014-b413-b76003e33d35", "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "02b18447-ea83-4b1b-8805-714a8a34546a", "3a6586ad-127a-4d3b-a677-1e6eacdf8fde"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Provider_Name": {"refs": ["7dc2dedd-7603-461a-bc13-15803d132355"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "ParentUser": {"refs": ["590a5f4c-6c8c-4f10-8307-89afe9453a9d", "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "LogonId": {"refs": ["d21374ff-f574-44a7-9998-4a8c8bf33d7d", "178e615d-e666-498b-9630-9ed363038101"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}}}, "uberAgent 7.1": {"missing_field": {"dst_port": {"refs": ["d7fb8f0e-bd5f-45c2-b467-19571c490d7e"], "logsource.categories": ["firewall"], "logsource.products": [null]}, "TargetObject": {"refs": ["47e0852a-cf81-4494-a8e6-31864f8c86ed", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "295a59c1-7b79-4b47-a930-df12c15fc9c2", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "5aad0995-46ab-41bd-a9ff-724f41114971", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "4d431012-2ab5-4db7-a84e-b29809da2172", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "b3503044-60ce-4bf4-bbcb-e3db98788823", "a6b33c02-8305-488f-8585-03cb2a7763f2", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "55e29995-75e7-451a-bef0-6225e2f13597", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "b6d235fc-1d38-4b12-adbe-325f06728f37", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "6ea3bf32-9680-422d-9f50-e90716b12a66", "baca5663-583c-45f9-b5dc-ea96a22ce542", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "62120148-6b7a-42be-8b91-271c04e281a3", "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "92772523-d9c1-4c93-9547-b0ca500baba3", "790317c0-0a36-4a6a-a105-6e576bf99a14", "707e097c-e20f-4f67-8807-1f72ff4500d6", "396ae3eb-4174-4b9b-880e-dc0364d78a19", "e61e8a88-59a9-451c-874e-70fcc9740d67", "48437c39-9e5f-47fb-af95-3d663c3f2919", "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "509e84b9-a71a-40e0-834f-05470369bd1e", "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "7d9263bd-dc47-4a58-bc92-5474abab390c", "c5f6a85d-b647-40f7-bbad-c10b66bab038", "8ffc5407-52e3-478f-9596-0a7371eafe13", "bf344fea-d947-4ef4-9192-34d008315d3a", "5a93eb65-dffa-4543-b761-94aa60098fb6", "7c81fec3-1c1d-43b0-996a-46753041b1b6", "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "e3fdf743-f05b-4051-990a-b66919be1743", "6b6976a3-b0e6-4723-ac24-ae38a737af41", "f7997770-92c3-4ec9-b112-774c4ef96f96", "966315ef-c5e1-4767-ba25-fce9c8de3660", "e7b18879-676e-4a0e-ae18-27039185a8e7", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "8023f872-3f1d-4301-a384-801889917ab4", "44a22d59-b175-4f13-8c16-cbaef5b581ff", "fe20dda1-6f37-4379-bbe0-a98d400cae90", "b7916c2a-fa2f-4795-9477-32b731f70f11", "b86852fb-4c77-48f9-8519-eb1b2c308b59", "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "dc5c24af-6995-49b2-86eb-a9ff62199e82", "92b0b372-a939-44ed-a11b-5136cf680e27", "1c3121ed-041b-4d97-a075-07f54f20fb4a", "9df5f547-c86a-433e-b533-f2794357e242", "46490193-1b22-4c29-bdd6-5bf63907216f", "fa277e82-9b78-42dd-b05c-05555c7b6015", "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "91239011-fe3c-4b54-9f24-15c86bb65913", "2f78da12-f7c7-430b-8b19-a28f269b77a3", "18f2065c-d36c-464a-a748-bcf909acb2e3", "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "7f2954d2-99c2-4d42-a065-ca36740f187b", "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "83314318-052a-4c90-a1ad-660ece38d276", "07743f65-7ec9-404a-a519-913db7118a8d", "f674e36a-4b91-431e-8aef-f8a96c2aca35", "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "555155a2-03bf-4fe7-af74-d176b3fdbe16", "df4dc653-1029-47ba-8231-3c44238cc0ae", "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "1547e27c-3974-43e2-a7d7-7f484fb928ec", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "fad91067-08c5-4d1a-8d8c-d96a21b37814", "a982fc9c-6333-4ffb-a51d-addb04e8b529", "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "90f342e1-1aaa-4e43-b092-39fda57ed11e", "02ee49e2-e294-4d0f-9278-f5b3212fc588", "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "0eb46774-f1ab-4a74-8238-1155855f2263", "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "c90362e0-2df3-4e61-94fe-b37615814cb1", "974515da-6cc5-4c95-ae65-f97f9150ec7f", "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "c420410f-c2d8-4010-856b-dffe21866437", "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "f37b4bce-49d0-4087-9f5b-58bffda77316", "9827ae57-3802-418f-994b-d5ecf5cd974b", "93d298a1-d28f-47f1-a468-d971e7796679", "46dd5308-4572-4d12-aa43-8938f0184d4f", "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "f742bde7-9528-42e5-bd82-84f51a8387d2", "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "8d85cf08-bf97-4260-ba49-986a2a65129c", "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "2ff692c2-4594-41ec-8fcb-46587de769e0", "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "b23818c7-e575-4d13-8012-332075ec0a2b", "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "160d2780-31f7-4922-8b3a-efce30e63e96", "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "ab567429-1dfb-4674-b6d2-979fd2f9d125", "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "cbf93e5d-ca6c-4722-8bea-e9119007c248", "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "275641a5-a492-45e2-a817-7c81e9d9d3e9", "961e33d1-4f86-4fcf-80ab-930a708b2f82", "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "ad89044a-8f49-4673-9a55-cbd88a1b374f", "086ae989-9ca6-4fe7-895a-759c5544f247", "5de03871-5d46-4539-a82d-3aa992a69a83", "28036918-04d3-423d-91c0-55ecf99fb892", "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "046218bd-e0d8-4113-a3c3-895a12b2b298", "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "a80f662f-022f-4429-9b8c-b1a41aaa6688", "612e47e9-8a59-43a6-b404-f48683f45bd6", "833ef470-fa01-4631-a79b-6f291c9ac498", "9d8f9bb8-01af-4e15-a3a2-349071530530", "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "5df86130-4e95-4a54-90f7-26541b40aec2", "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "f10ed525-97fe-4fed-be7c-2feecca941b1", "5f9db380-ea57-4d1e-beab-8a2d33397e93", "487bb375-12ef-41f6-baae-c6a1572b4dd1", "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "8218c875-90b9-42e2-b60d-0b0069816d10", "f2485272-a156-4773-82d7-1d178bc4905b", "724ea201-6514-4f38-9739-e5973c34f49a", "6c304b02-06e6-402d-8be4-d5833cdf8198", "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "4916a35e-bfc4-47d0-8e25-a003d7067061", "73a883d0-0348-4be4-a8d8-51031c2564f8", "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "d223b46b-5621-4037-88fe-fda32eead684", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "480421f9-417f-4d3b-9552-fd2728443ec8", "60936b49-fca0-4f32-993d-7415edcf9a5d", "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "6597be7b-ac61-4ac8-bef4-d3ec88174853", "5b872a46-3b90-45c1-8419-f675db8053aa", "092af964-4233-4373-b4ba-d86ea2890288", "b64a026b-8deb-4c1d-92fd-98893209dff1", "a7df0e9e-91a5-459a-a003-4cde67c2ff5d", "34aa0252-6039-40ff-951f-939fd6ce47d8", "63647769-326d-4dde-a419-b925cc0caf42", "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "9d15044a-7cfe-4d23-8085-6ebc11df7685", "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "976dd1f2-a484-45ec-aa1d-0e87e882262b", "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "944e8941-f6f6-4ee8-ac05-1c224e923c0e", "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "439957a7-ad86-4a8f-9705-a28131c6821b", "5a5152f1-463f-436b-b2f5-8eceb3964b42", "e0813366-0407-449a-9869-a2db1119dc41", "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "bf9e1387-b040-4393-9851-1598f8ecfae9", "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "9c226817-8dc9-46c2-a58d-66655aafd7dc", "7021255e-5db3-4946-a8b9-0ba7a4644a69", "36803969-5421-41ec-b92f-8500f79c23b0", "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "42205c73-75c8-4a63-9db1-e3782e06fda0", "41f6531d-af6e-4c6e-918f-b946f2b85a36", "e2482f8d-3443-4237-b906-cc145d87a076", "8b9606c9-28be-4a38-b146-0e313cc232c1", "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "4f281b83-0200-4b34-bf35-d24687ea57c2", "243380fa-11eb-4141-af92-e14925e77c1b", "baecf8fb-edbf-429f-9ade-31fc3f22b970", "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "0d7ceeef-3539-4392-8953-3dc664912714", "fc014922-5def-4da9-a0fc-28c973f41bfb", "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7"], "logsource.categories": ["registry_event", "registry_set"], "logsource.products": ["windows"]}, "EventType": {"refs": ["f663a6d9-9d1b-49b8-b2b1-0637914d199a", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "277efb8f-60be-4f10-b4d3-037802f37167", "41d1058a-aea7-4952-9293-29eaaf516465", "96f697b0-b499-4e5d-9908-a67bec11cdb6", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "acd74772-5f88-45c7-956b-6a7b36c294d2", "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "0cf2e1c6-8d10-4273-8059-738778f981ad", "cd277474-5c52-4423-a52b-ac2d7969902f", "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "53330955-dc52-487f-a3a2-da24dcff99b5", "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "9ace0707-b560-49b8-b6ca-5148b42f39fb", "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "9b0f8a61-91b2-464f-aceb-0527e0a45020", "1d218616-71b0-4c40-855b-9dbe75510f7f", "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "25ffa65d-76d8-4da5-a832-3f2b0136e133", "f50f3c09-557d-492d-81db-9064a8d4e211"], "logsource.categories": ["registry_event", "registry_delete", "registry_set", "registry_add"], "logsource.products": ["windows"]}, "EventID": {"refs": ["f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7"], "logsource.categories": ["registry_event"], "logsource.products": ["windows"]}, "Description": {"refs": ["092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "cbb56d62-4060-40f7-9466-d8aaf3123f83", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "754ed792-634f-40ae-b3bc-e0448d33f695", "145322e4-0fd3-486b-81ca-9addc75736d8", "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "52ff7941-8211-46f9-84f8-9903efb7077d", "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "b1876533-4ed5-4a83-90f3-b8645840a413", "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "758ff488-18d5-4cbe-8ec4-02b6285a434f", "d08a2711-ee8b-4323-bdec-b7d85e892b31", "46123129-1024-423e-9fae-43af4a0fa9a5", "6938366d-8954-4ddc-baff-c830b3ba8fcd", "0ba1da6d-b6ce-4366-828c-18826c9de23e", "9fbf5927-5261-4284-a71d-f681029ea574", "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "54773c5f-f1cc-4703-9126-2f797d96a69d", "d679950c-abb7-43a6-80fb-2a480c4fc450", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "03552375-cc2c-4883-bbe4-7958d5a980be", "87911521-7098-470b-a459-9a57fc80bdfd", "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "48a61b29-389f-4032-b317-b30de6b95314", "0b0cd537-fc77-4e6e-a973-e53495c1083d", "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "fca949cc-79ca-446e-8064-01aa7e52ece5", "e37db05d-d1f9-49c8-b464-cee1a4b11638", "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "9d5a1274-922a-49d0-87f3-8c653483b909", "7530cd3d-7671-43e3-b209-976966f6ea48", "41f407b5-3096-44ea-a74f-96d04fbc41be", "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "5722dff1-4bdd-4949-86ab-fbaf707e767a", "eb2d07d4-49cb-4523-801a-da002df36602", "811e0002-b13b-4a15-9d00-a613fce66e42", "762f2482-ff21-4970-8939-0aa317a886bb", "38646daa-e78f-4ace-9de0-55547b2d30da", "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "c4e49831-1496-40cf-8ce1-b53f942b02f9", "2c32b543-1058-4808-91c6-5b31b8bed6c5", "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "b52e84a3-029e-4529-b09b-71d19dd27e94", "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "198effb6-6c98-4d0c-9ea3-451fa143c45c", "d85873ef-a0f8-4c48-a53a-6b621f11729d", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "f38a82d2-fba3-4781-b549-525efbec8506", "57bff678-25d1-4d6c-8211-8ca106d12053", "037dcd71-33a8-4392-bb01-293c94663e5a", "afe52666-401e-4a02-b4ff-5d128990b8cb", "4ede543c-e098-43d9-a28f-dd784a13132f", "bb780e0c-16cf-4383-8383-1e5471db6cf9", "148431ce-4b70-403d-8525-fcc2993f29ea"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Product": {"refs": ["d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "9ef27c24-4903-4192-881a-3adde7ff92a5", "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "b37998de-a70b-4f33-b219-ec36bf433dc0", "26488ad0-f9fd-4536-876f-52fea846a2e4", "c625d754-6a3d-4f65-9c9a-536aea960d37", "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "24c77512-782b-448a-8950-eddb0785fc71", "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "e01fa958-6893-41d4-ae03-182477c5e77d", "a96970af-f126-420d-90e1-d37bf25e50e1", "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "0afbd410-de03-4078-8491-f132303cb67d", "37e8d358-6408-4853-82f4-98333fca7014", "ca387a8e-1c84-4da3-9993-028b45342d30", "4833155a-4053-4c9c-a997-777fcea0baa7", "88656cec-6c3b-487c-82c0-f73ebb805503", "cd764533-2e07-40d6-a718-cfeec7f2da7f"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "PreviousCreationUtcTime": {"refs": ["558eebe5-f2ba-4104-b339-36f7902bcc1a"], "logsource.categories": ["file_change"], "logsource.products": ["windows"]}, "Initiated": {"refs": ["5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4", "d58ba5c6-0ed7-4b9d-a433-6878379efda9", "7610a4ea-c06d-495f-a2ac-0a696abcfd3b", "3ab65069-d82a-4d44-a759-466661a082d1", "5c80b618-0dbb-46e6-acbb-03d90bcb6d83", "c539afac-c12a-46ed-b1bd-5a5567c9f045", "cdc8da7d-c303-42f8-b08c-b4ab47230263", "3b5ba899-9842-4bc2-acc2-12308498bf42", "9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4", "8d7e392e-9b28-49e1-831d-5949c6281228", "5205613d-2a63-4412-a895-3a2458b587b3", "786cdae8-fefb-4eb2-9227-04e34060db01", "b1e5da3b-ca8e-4adf-915c-9921f3d85481", "e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97", "b3ad3c0f-c949-47a1-a30e-b0491ccae876", "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7", "18249279-932f-45e2-b37a-8925f2597670", "50e54b8d-ad73-43f8-96a1-5191685b17a4", "9e02c8ec-02b9-43e8-81eb-34a475ba7965", "ed74fe75-7594-4b4b-ae38-e38e3fd2eb23", "08249dc0-a28d-4555-8ba5-9255a198e08c", "7b434893-c57d-4f41-908d-6a17bf1ae98f", "7cd1dcdc-6edf-4896-86dc-d1f19ad64903", "992a6cae-db6a-43c8-9cec-76d7195c96fc", "4b657234-038e-4ad5-997c-4be42340bce4", "bef0bc5a-b9ae-425d-85c6-7b2d705980c6", "efafe0bf-4238-479e-af8f-797bd3490d2d", "75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84", "0531e43a-d77d-47c2-b89f-5fe50321c805", "e54979bd-c5f9-4d6c-967b-a04b19ac4c74", "4b89abaa-99fe-4232-afdd-8f9aa4d20382", "07837ab9-60e1-481f-a74d-c31fb496a94c", "c7e91a02-d771-4a6d-a700-42587e0b1095", "37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1", "0dba975d-a193-4ed1-a067-424df57570d1", "9976fa64-2804-423c-8a5b-646ade840773", "20384606-a124-4fec-acbb-8bd373728613", "25eabf56-22f0-4915-a1ed-056b8dae0a68", "6d8c3d20-a5e1-494f-8412-4571d716cf5c", "fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4"], "logsource.categories": ["network_connection"], "logsource.products": ["windows"]}, "Type": {"refs": ["c4b890e5-8d8c-4496-8c66-c805753817cd"], "logsource.categories": ["process_tampering"], "logsource.products": ["windows"]}, "SourceImage": {"refs": ["2e4e488a-6164-4811-9ea1-f960c7359c40", "66d31e5f-52d6-40a4-9615-002d3789a119", "02d1d718-dd13-41af-989d-ea85c7fab93f", "99b97608-3e21-4bfe-8217-2a127c396a0e", "c15e99a3-c474-48ab-b9a7-84549a7a9d16", "a1a144b7-5c9b-4853-a559-2172be8d4a03", "c0aac16a-b1e7-4330-bab0-3c27bb4987c7", "fb656378-f909-47c1-8747-278bf09f4f4f"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "StartAddress": {"refs": ["6309645e-122d-4c5b-bb2b-22e4f9c2fa42"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "IntegrityLevel": {"refs": ["0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "3c05e90d-7eba-4324-9972-5d7f711a60a8", "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "3037d961-21e9-4732-b27a-637bcc7bf539", "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "40f9af16-589d-4984-b78d-8c2aec023197", "4cbef972-f347-4170-b62a-8253f6168e6d", "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "853e74f9-9392-4935-ad3b-2e8c040dae86", "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "89a9a0e0-f61a-42e5-8957-b1479565a658", "a743ceba-c771-4d75-97eb-8a90f7f4844c", "b697e69c-746f-4a86-9f59-7bfff8eab881", "7a01183d-71a2-46ad-ad5c-acd989ac1793", "224f140f-3553-4cd1-af78-13d81bf9f7cc", "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "80fc36aa-945e-4181-89f2-2f907ab6775d", "d937b75f-a665-4480-88a5-2f20e9f9b22a", "1ca6bd18-0ba0-44ca-851c-92ed89a61085"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "CurrentDirectory": {"refs": ["631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "95eadcb2-92e4-4ed1-9031-92547773a6db", "ed825c86-c009-4014-b413-b76003e33d35", "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "02b18447-ea83-4b1b-8805-714a8a34546a", "3a6586ad-127a-4d3b-a677-1e6eacdf8fde"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Provider_Name": {"refs": ["7dc2dedd-7603-461a-bc13-15803d132355"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "ParentUser": {"refs": ["590a5f4c-6c8c-4f10-8307-89afe9453a9d", "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "LogonId": {"refs": ["d21374ff-f574-44a7-9998-4a8c8bf33d7d", "178e615d-e666-498b-9630-9ed363038101"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}}}, "uberAgent 7.0": {"missing_field": {"dst_port": {"refs": ["d7fb8f0e-bd5f-45c2-b467-19571c490d7e"], "logsource.categories": ["firewall"], "logsource.products": [null]}, "TargetObject": {"refs": ["47e0852a-cf81-4494-a8e6-31864f8c86ed", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "295a59c1-7b79-4b47-a930-df12c15fc9c2", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "5aad0995-46ab-41bd-a9ff-724f41114971", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "4d431012-2ab5-4db7-a84e-b29809da2172", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "b3503044-60ce-4bf4-bbcb-e3db98788823", "a6b33c02-8305-488f-8585-03cb2a7763f2", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "55e29995-75e7-451a-bef0-6225e2f13597", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "b6d235fc-1d38-4b12-adbe-325f06728f37", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "6ea3bf32-9680-422d-9f50-e90716b12a66", "baca5663-583c-45f9-b5dc-ea96a22ce542", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "62120148-6b7a-42be-8b91-271c04e281a3", "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "92772523-d9c1-4c93-9547-b0ca500baba3", "790317c0-0a36-4a6a-a105-6e576bf99a14", "707e097c-e20f-4f67-8807-1f72ff4500d6", "396ae3eb-4174-4b9b-880e-dc0364d78a19", "e61e8a88-59a9-451c-874e-70fcc9740d67", "48437c39-9e5f-47fb-af95-3d663c3f2919", "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "509e84b9-a71a-40e0-834f-05470369bd1e", "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "7d9263bd-dc47-4a58-bc92-5474abab390c", "c5f6a85d-b647-40f7-bbad-c10b66bab038", "8ffc5407-52e3-478f-9596-0a7371eafe13", "bf344fea-d947-4ef4-9192-34d008315d3a", "5a93eb65-dffa-4543-b761-94aa60098fb6", "7c81fec3-1c1d-43b0-996a-46753041b1b6", "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "e3fdf743-f05b-4051-990a-b66919be1743", "6b6976a3-b0e6-4723-ac24-ae38a737af41", "f7997770-92c3-4ec9-b112-774c4ef96f96", "966315ef-c5e1-4767-ba25-fce9c8de3660", "e7b18879-676e-4a0e-ae18-27039185a8e7", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "8023f872-3f1d-4301-a384-801889917ab4", "44a22d59-b175-4f13-8c16-cbaef5b581ff", "fe20dda1-6f37-4379-bbe0-a98d400cae90", "b7916c2a-fa2f-4795-9477-32b731f70f11", "b86852fb-4c77-48f9-8519-eb1b2c308b59", "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "dc5c24af-6995-49b2-86eb-a9ff62199e82", "92b0b372-a939-44ed-a11b-5136cf680e27", "1c3121ed-041b-4d97-a075-07f54f20fb4a", "9df5f547-c86a-433e-b533-f2794357e242", "46490193-1b22-4c29-bdd6-5bf63907216f", "fa277e82-9b78-42dd-b05c-05555c7b6015", "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "91239011-fe3c-4b54-9f24-15c86bb65913", "2f78da12-f7c7-430b-8b19-a28f269b77a3", "18f2065c-d36c-464a-a748-bcf909acb2e3", "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "7f2954d2-99c2-4d42-a065-ca36740f187b", "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "83314318-052a-4c90-a1ad-660ece38d276", "07743f65-7ec9-404a-a519-913db7118a8d", "f674e36a-4b91-431e-8aef-f8a96c2aca35", "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "555155a2-03bf-4fe7-af74-d176b3fdbe16", "df4dc653-1029-47ba-8231-3c44238cc0ae", "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "1547e27c-3974-43e2-a7d7-7f484fb928ec", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "fad91067-08c5-4d1a-8d8c-d96a21b37814", "a982fc9c-6333-4ffb-a51d-addb04e8b529", "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "90f342e1-1aaa-4e43-b092-39fda57ed11e", "02ee49e2-e294-4d0f-9278-f5b3212fc588", "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "0eb46774-f1ab-4a74-8238-1155855f2263", "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "c90362e0-2df3-4e61-94fe-b37615814cb1", "974515da-6cc5-4c95-ae65-f97f9150ec7f", "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "c420410f-c2d8-4010-856b-dffe21866437", "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "f37b4bce-49d0-4087-9f5b-58bffda77316", "9827ae57-3802-418f-994b-d5ecf5cd974b", "93d298a1-d28f-47f1-a468-d971e7796679", "46dd5308-4572-4d12-aa43-8938f0184d4f", "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "f742bde7-9528-42e5-bd82-84f51a8387d2", "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "8d85cf08-bf97-4260-ba49-986a2a65129c", "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "2ff692c2-4594-41ec-8fcb-46587de769e0", "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "b23818c7-e575-4d13-8012-332075ec0a2b", "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "160d2780-31f7-4922-8b3a-efce30e63e96", "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "ab567429-1dfb-4674-b6d2-979fd2f9d125", "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "cbf93e5d-ca6c-4722-8bea-e9119007c248", "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "275641a5-a492-45e2-a817-7c81e9d9d3e9", "961e33d1-4f86-4fcf-80ab-930a708b2f82", "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "ad89044a-8f49-4673-9a55-cbd88a1b374f", "086ae989-9ca6-4fe7-895a-759c5544f247", "5de03871-5d46-4539-a82d-3aa992a69a83", "28036918-04d3-423d-91c0-55ecf99fb892", "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "046218bd-e0d8-4113-a3c3-895a12b2b298", "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "a80f662f-022f-4429-9b8c-b1a41aaa6688", "612e47e9-8a59-43a6-b404-f48683f45bd6", "833ef470-fa01-4631-a79b-6f291c9ac498", "9d8f9bb8-01af-4e15-a3a2-349071530530", "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "5df86130-4e95-4a54-90f7-26541b40aec2", "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "f10ed525-97fe-4fed-be7c-2feecca941b1", "5f9db380-ea57-4d1e-beab-8a2d33397e93", "487bb375-12ef-41f6-baae-c6a1572b4dd1", "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "8218c875-90b9-42e2-b60d-0b0069816d10", "f2485272-a156-4773-82d7-1d178bc4905b", "724ea201-6514-4f38-9739-e5973c34f49a", "6c304b02-06e6-402d-8be4-d5833cdf8198", "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "4916a35e-bfc4-47d0-8e25-a003d7067061", "73a883d0-0348-4be4-a8d8-51031c2564f8", "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "d223b46b-5621-4037-88fe-fda32eead684", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "480421f9-417f-4d3b-9552-fd2728443ec8", "60936b49-fca0-4f32-993d-7415edcf9a5d", "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "6597be7b-ac61-4ac8-bef4-d3ec88174853", "5b872a46-3b90-45c1-8419-f675db8053aa", "092af964-4233-4373-b4ba-d86ea2890288", "b64a026b-8deb-4c1d-92fd-98893209dff1", "a7df0e9e-91a5-459a-a003-4cde67c2ff5d", "34aa0252-6039-40ff-951f-939fd6ce47d8", "63647769-326d-4dde-a419-b925cc0caf42", "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "9d15044a-7cfe-4d23-8085-6ebc11df7685", "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "976dd1f2-a484-45ec-aa1d-0e87e882262b", "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "944e8941-f6f6-4ee8-ac05-1c224e923c0e", "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "439957a7-ad86-4a8f-9705-a28131c6821b", "5a5152f1-463f-436b-b2f5-8eceb3964b42", "e0813366-0407-449a-9869-a2db1119dc41", "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "bf9e1387-b040-4393-9851-1598f8ecfae9", "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "9c226817-8dc9-46c2-a58d-66655aafd7dc", "7021255e-5db3-4946-a8b9-0ba7a4644a69", "36803969-5421-41ec-b92f-8500f79c23b0", "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "42205c73-75c8-4a63-9db1-e3782e06fda0", "41f6531d-af6e-4c6e-918f-b946f2b85a36", "e2482f8d-3443-4237-b906-cc145d87a076", "8b9606c9-28be-4a38-b146-0e313cc232c1", "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "4f281b83-0200-4b34-bf35-d24687ea57c2", "243380fa-11eb-4141-af92-e14925e77c1b", "baecf8fb-edbf-429f-9ade-31fc3f22b970", "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "0d7ceeef-3539-4392-8953-3dc664912714", "fc014922-5def-4da9-a0fc-28c973f41bfb", "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7"], "logsource.categories": ["registry_event", "registry_set"], "logsource.products": ["windows"]}, "EventType": {"refs": ["f663a6d9-9d1b-49b8-b2b1-0637914d199a", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "277efb8f-60be-4f10-b4d3-037802f37167", "41d1058a-aea7-4952-9293-29eaaf516465", "96f697b0-b499-4e5d-9908-a67bec11cdb6", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "acd74772-5f88-45c7-956b-6a7b36c294d2", "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "0cf2e1c6-8d10-4273-8059-738778f981ad", "cd277474-5c52-4423-a52b-ac2d7969902f", "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "53330955-dc52-487f-a3a2-da24dcff99b5", "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "9ace0707-b560-49b8-b6ca-5148b42f39fb", "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "9b0f8a61-91b2-464f-aceb-0527e0a45020", "1d218616-71b0-4c40-855b-9dbe75510f7f", "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "25ffa65d-76d8-4da5-a832-3f2b0136e133", "f50f3c09-557d-492d-81db-9064a8d4e211"], "logsource.categories": ["registry_event", "registry_delete", "registry_set", "registry_add"], "logsource.products": ["windows"]}, "EventID": {"refs": ["f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7"], "logsource.categories": ["registry_event"], "logsource.products": ["windows"]}, "Description": {"refs": ["092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "cbb56d62-4060-40f7-9466-d8aaf3123f83", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "754ed792-634f-40ae-b3bc-e0448d33f695", "145322e4-0fd3-486b-81ca-9addc75736d8", "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "52ff7941-8211-46f9-84f8-9903efb7077d", "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "b1876533-4ed5-4a83-90f3-b8645840a413", "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "758ff488-18d5-4cbe-8ec4-02b6285a434f", "d08a2711-ee8b-4323-bdec-b7d85e892b31", "46123129-1024-423e-9fae-43af4a0fa9a5", "6938366d-8954-4ddc-baff-c830b3ba8fcd", "0ba1da6d-b6ce-4366-828c-18826c9de23e", "9fbf5927-5261-4284-a71d-f681029ea574", "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "54773c5f-f1cc-4703-9126-2f797d96a69d", "d679950c-abb7-43a6-80fb-2a480c4fc450", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "03552375-cc2c-4883-bbe4-7958d5a980be", "87911521-7098-470b-a459-9a57fc80bdfd", "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "48a61b29-389f-4032-b317-b30de6b95314", "0b0cd537-fc77-4e6e-a973-e53495c1083d", "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "fca949cc-79ca-446e-8064-01aa7e52ece5", "e37db05d-d1f9-49c8-b464-cee1a4b11638", "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "9d5a1274-922a-49d0-87f3-8c653483b909", "7530cd3d-7671-43e3-b209-976966f6ea48", "41f407b5-3096-44ea-a74f-96d04fbc41be", "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "5722dff1-4bdd-4949-86ab-fbaf707e767a", "eb2d07d4-49cb-4523-801a-da002df36602", "811e0002-b13b-4a15-9d00-a613fce66e42", "762f2482-ff21-4970-8939-0aa317a886bb", "38646daa-e78f-4ace-9de0-55547b2d30da", "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "c4e49831-1496-40cf-8ce1-b53f942b02f9", "2c32b543-1058-4808-91c6-5b31b8bed6c5", "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "b52e84a3-029e-4529-b09b-71d19dd27e94", "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "198effb6-6c98-4d0c-9ea3-451fa143c45c", "d85873ef-a0f8-4c48-a53a-6b621f11729d", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "f38a82d2-fba3-4781-b549-525efbec8506", "57bff678-25d1-4d6c-8211-8ca106d12053", "037dcd71-33a8-4392-bb01-293c94663e5a", "afe52666-401e-4a02-b4ff-5d128990b8cb", "4ede543c-e098-43d9-a28f-dd784a13132f", "bb780e0c-16cf-4383-8383-1e5471db6cf9", "148431ce-4b70-403d-8525-fcc2993f29ea"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Product": {"refs": ["d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "9ef27c24-4903-4192-881a-3adde7ff92a5", "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "b37998de-a70b-4f33-b219-ec36bf433dc0", "26488ad0-f9fd-4536-876f-52fea846a2e4", "c625d754-6a3d-4f65-9c9a-536aea960d37", "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "24c77512-782b-448a-8950-eddb0785fc71", "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "e01fa958-6893-41d4-ae03-182477c5e77d", "a96970af-f126-420d-90e1-d37bf25e50e1", "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "0afbd410-de03-4078-8491-f132303cb67d", "37e8d358-6408-4853-82f4-98333fca7014", "ca387a8e-1c84-4da3-9993-028b45342d30", "4833155a-4053-4c9c-a997-777fcea0baa7", "88656cec-6c3b-487c-82c0-f73ebb805503", "cd764533-2e07-40d6-a718-cfeec7f2da7f"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Initiated": {"refs": ["5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4", "d58ba5c6-0ed7-4b9d-a433-6878379efda9", "7610a4ea-c06d-495f-a2ac-0a696abcfd3b", "3ab65069-d82a-4d44-a759-466661a082d1", "5c80b618-0dbb-46e6-acbb-03d90bcb6d83", "c539afac-c12a-46ed-b1bd-5a5567c9f045", "cdc8da7d-c303-42f8-b08c-b4ab47230263", "3b5ba899-9842-4bc2-acc2-12308498bf42", "9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4", "8d7e392e-9b28-49e1-831d-5949c6281228", "5205613d-2a63-4412-a895-3a2458b587b3", "786cdae8-fefb-4eb2-9227-04e34060db01", "b1e5da3b-ca8e-4adf-915c-9921f3d85481", "e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97", "b3ad3c0f-c949-47a1-a30e-b0491ccae876", "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7", "18249279-932f-45e2-b37a-8925f2597670", "50e54b8d-ad73-43f8-96a1-5191685b17a4", "9e02c8ec-02b9-43e8-81eb-34a475ba7965", "ed74fe75-7594-4b4b-ae38-e38e3fd2eb23", "08249dc0-a28d-4555-8ba5-9255a198e08c", "7b434893-c57d-4f41-908d-6a17bf1ae98f", "7cd1dcdc-6edf-4896-86dc-d1f19ad64903", "992a6cae-db6a-43c8-9cec-76d7195c96fc", "4b657234-038e-4ad5-997c-4be42340bce4", "bef0bc5a-b9ae-425d-85c6-7b2d705980c6", "efafe0bf-4238-479e-af8f-797bd3490d2d", "75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84", "0531e43a-d77d-47c2-b89f-5fe50321c805", "e54979bd-c5f9-4d6c-967b-a04b19ac4c74", "4b89abaa-99fe-4232-afdd-8f9aa4d20382", "07837ab9-60e1-481f-a74d-c31fb496a94c", "c7e91a02-d771-4a6d-a700-42587e0b1095", "37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1", "0dba975d-a193-4ed1-a067-424df57570d1", "9976fa64-2804-423c-8a5b-646ade840773", "20384606-a124-4fec-acbb-8bd373728613", "25eabf56-22f0-4915-a1ed-056b8dae0a68", "6d8c3d20-a5e1-494f-8412-4571d716cf5c", "fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4"], "logsource.categories": ["network_connection"], "logsource.products": ["windows"]}, "Type": {"refs": ["c4b890e5-8d8c-4496-8c66-c805753817cd"], "logsource.categories": ["process_tampering"], "logsource.products": ["windows"]}, "SourceImage": {"refs": ["2e4e488a-6164-4811-9ea1-f960c7359c40", "66d31e5f-52d6-40a4-9615-002d3789a119", "02d1d718-dd13-41af-989d-ea85c7fab93f", "99b97608-3e21-4bfe-8217-2a127c396a0e", "c15e99a3-c474-48ab-b9a7-84549a7a9d16", "a1a144b7-5c9b-4853-a559-2172be8d4a03", "c0aac16a-b1e7-4330-bab0-3c27bb4987c7", "fb656378-f909-47c1-8747-278bf09f4f4f"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "StartAddress": {"refs": ["6309645e-122d-4c5b-bb2b-22e4f9c2fa42"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "IntegrityLevel": {"refs": ["0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "3c05e90d-7eba-4324-9972-5d7f711a60a8", "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "3037d961-21e9-4732-b27a-637bcc7bf539", "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "40f9af16-589d-4984-b78d-8c2aec023197", "4cbef972-f347-4170-b62a-8253f6168e6d", "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "853e74f9-9392-4935-ad3b-2e8c040dae86", "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "89a9a0e0-f61a-42e5-8957-b1479565a658", "a743ceba-c771-4d75-97eb-8a90f7f4844c", "b697e69c-746f-4a86-9f59-7bfff8eab881", "7a01183d-71a2-46ad-ad5c-acd989ac1793", "224f140f-3553-4cd1-af78-13d81bf9f7cc", "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "80fc36aa-945e-4181-89f2-2f907ab6775d", "d937b75f-a665-4480-88a5-2f20e9f9b22a", "1ca6bd18-0ba0-44ca-851c-92ed89a61085"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "CurrentDirectory": {"refs": ["631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "95eadcb2-92e4-4ed1-9031-92547773a6db", "ed825c86-c009-4014-b413-b76003e33d35", "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "02b18447-ea83-4b1b-8805-714a8a34546a", "3a6586ad-127a-4d3b-a677-1e6eacdf8fde"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Provider_Name": {"refs": ["7dc2dedd-7603-461a-bc13-15803d132355"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "ParentUser": {"refs": ["590a5f4c-6c8c-4f10-8307-89afe9453a9d", "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "LogonId": {"refs": ["d21374ff-f574-44a7-9998-4a8c8bf33d7d", "178e615d-e666-498b-9630-9ed363038101"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}}}, "uberAgent 6.2": {"missing_field": {"dst_port": {"refs": ["d7fb8f0e-bd5f-45c2-b467-19571c490d7e"], "logsource.categories": ["firewall"], "logsource.products": [null]}, "TargetObject": {"refs": ["47e0852a-cf81-4494-a8e6-31864f8c86ed", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "295a59c1-7b79-4b47-a930-df12c15fc9c2", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "5aad0995-46ab-41bd-a9ff-724f41114971", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "4d431012-2ab5-4db7-a84e-b29809da2172", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "b3503044-60ce-4bf4-bbcb-e3db98788823", "a6b33c02-8305-488f-8585-03cb2a7763f2", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "55e29995-75e7-451a-bef0-6225e2f13597", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "b6d235fc-1d38-4b12-adbe-325f06728f37", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "6ea3bf32-9680-422d-9f50-e90716b12a66", "baca5663-583c-45f9-b5dc-ea96a22ce542", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "62120148-6b7a-42be-8b91-271c04e281a3", "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "92772523-d9c1-4c93-9547-b0ca500baba3", "790317c0-0a36-4a6a-a105-6e576bf99a14", "707e097c-e20f-4f67-8807-1f72ff4500d6", "396ae3eb-4174-4b9b-880e-dc0364d78a19", "e61e8a88-59a9-451c-874e-70fcc9740d67", "48437c39-9e5f-47fb-af95-3d663c3f2919", "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "509e84b9-a71a-40e0-834f-05470369bd1e", "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "7d9263bd-dc47-4a58-bc92-5474abab390c", "c5f6a85d-b647-40f7-bbad-c10b66bab038", "8ffc5407-52e3-478f-9596-0a7371eafe13", "bf344fea-d947-4ef4-9192-34d008315d3a", "5a93eb65-dffa-4543-b761-94aa60098fb6", "7c81fec3-1c1d-43b0-996a-46753041b1b6", "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "e3fdf743-f05b-4051-990a-b66919be1743", "6b6976a3-b0e6-4723-ac24-ae38a737af41", "f7997770-92c3-4ec9-b112-774c4ef96f96", "966315ef-c5e1-4767-ba25-fce9c8de3660", "e7b18879-676e-4a0e-ae18-27039185a8e7", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "8023f872-3f1d-4301-a384-801889917ab4", "44a22d59-b175-4f13-8c16-cbaef5b581ff", "fe20dda1-6f37-4379-bbe0-a98d400cae90", "b7916c2a-fa2f-4795-9477-32b731f70f11", "b86852fb-4c77-48f9-8519-eb1b2c308b59", "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "dc5c24af-6995-49b2-86eb-a9ff62199e82", "92b0b372-a939-44ed-a11b-5136cf680e27", "1c3121ed-041b-4d97-a075-07f54f20fb4a", "9df5f547-c86a-433e-b533-f2794357e242", "46490193-1b22-4c29-bdd6-5bf63907216f", "fa277e82-9b78-42dd-b05c-05555c7b6015", "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "91239011-fe3c-4b54-9f24-15c86bb65913", "2f78da12-f7c7-430b-8b19-a28f269b77a3", "18f2065c-d36c-464a-a748-bcf909acb2e3", "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "7f2954d2-99c2-4d42-a065-ca36740f187b", "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "83314318-052a-4c90-a1ad-660ece38d276", "07743f65-7ec9-404a-a519-913db7118a8d", "f674e36a-4b91-431e-8aef-f8a96c2aca35", "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "555155a2-03bf-4fe7-af74-d176b3fdbe16", "df4dc653-1029-47ba-8231-3c44238cc0ae", "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "1547e27c-3974-43e2-a7d7-7f484fb928ec", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "fad91067-08c5-4d1a-8d8c-d96a21b37814", "a982fc9c-6333-4ffb-a51d-addb04e8b529", "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "90f342e1-1aaa-4e43-b092-39fda57ed11e", "02ee49e2-e294-4d0f-9278-f5b3212fc588", "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "0eb46774-f1ab-4a74-8238-1155855f2263", "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "c90362e0-2df3-4e61-94fe-b37615814cb1", "974515da-6cc5-4c95-ae65-f97f9150ec7f", "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "c420410f-c2d8-4010-856b-dffe21866437", "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "f37b4bce-49d0-4087-9f5b-58bffda77316", "9827ae57-3802-418f-994b-d5ecf5cd974b", "93d298a1-d28f-47f1-a468-d971e7796679", "46dd5308-4572-4d12-aa43-8938f0184d4f", "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "f742bde7-9528-42e5-bd82-84f51a8387d2", "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "8d85cf08-bf97-4260-ba49-986a2a65129c", "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "2ff692c2-4594-41ec-8fcb-46587de769e0", "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "b23818c7-e575-4d13-8012-332075ec0a2b", "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "160d2780-31f7-4922-8b3a-efce30e63e96", "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "ab567429-1dfb-4674-b6d2-979fd2f9d125", "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "cbf93e5d-ca6c-4722-8bea-e9119007c248", "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "275641a5-a492-45e2-a817-7c81e9d9d3e9", "961e33d1-4f86-4fcf-80ab-930a708b2f82", "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "ad89044a-8f49-4673-9a55-cbd88a1b374f", "086ae989-9ca6-4fe7-895a-759c5544f247", "5de03871-5d46-4539-a82d-3aa992a69a83", "28036918-04d3-423d-91c0-55ecf99fb892", "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "046218bd-e0d8-4113-a3c3-895a12b2b298", "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "a80f662f-022f-4429-9b8c-b1a41aaa6688", "612e47e9-8a59-43a6-b404-f48683f45bd6", "833ef470-fa01-4631-a79b-6f291c9ac498", "9d8f9bb8-01af-4e15-a3a2-349071530530", "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "5df86130-4e95-4a54-90f7-26541b40aec2", "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "f10ed525-97fe-4fed-be7c-2feecca941b1", "5f9db380-ea57-4d1e-beab-8a2d33397e93", "487bb375-12ef-41f6-baae-c6a1572b4dd1", "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "8218c875-90b9-42e2-b60d-0b0069816d10", "f2485272-a156-4773-82d7-1d178bc4905b", "724ea201-6514-4f38-9739-e5973c34f49a", "6c304b02-06e6-402d-8be4-d5833cdf8198", "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "4916a35e-bfc4-47d0-8e25-a003d7067061", "73a883d0-0348-4be4-a8d8-51031c2564f8", "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "d223b46b-5621-4037-88fe-fda32eead684", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "480421f9-417f-4d3b-9552-fd2728443ec8", "60936b49-fca0-4f32-993d-7415edcf9a5d", "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "6597be7b-ac61-4ac8-bef4-d3ec88174853", "5b872a46-3b90-45c1-8419-f675db8053aa", "092af964-4233-4373-b4ba-d86ea2890288", "b64a026b-8deb-4c1d-92fd-98893209dff1", "a7df0e9e-91a5-459a-a003-4cde67c2ff5d", "34aa0252-6039-40ff-951f-939fd6ce47d8", "63647769-326d-4dde-a419-b925cc0caf42", "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "9d15044a-7cfe-4d23-8085-6ebc11df7685", "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "976dd1f2-a484-45ec-aa1d-0e87e882262b", "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "944e8941-f6f6-4ee8-ac05-1c224e923c0e", "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "439957a7-ad86-4a8f-9705-a28131c6821b", "5a5152f1-463f-436b-b2f5-8eceb3964b42", "e0813366-0407-449a-9869-a2db1119dc41", "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "bf9e1387-b040-4393-9851-1598f8ecfae9", "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "9c226817-8dc9-46c2-a58d-66655aafd7dc", "7021255e-5db3-4946-a8b9-0ba7a4644a69", "36803969-5421-41ec-b92f-8500f79c23b0", "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "42205c73-75c8-4a63-9db1-e3782e06fda0", "41f6531d-af6e-4c6e-918f-b946f2b85a36", "e2482f8d-3443-4237-b906-cc145d87a076", "8b9606c9-28be-4a38-b146-0e313cc232c1", "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "4f281b83-0200-4b34-bf35-d24687ea57c2", "243380fa-11eb-4141-af92-e14925e77c1b", "baecf8fb-edbf-429f-9ade-31fc3f22b970", "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "0d7ceeef-3539-4392-8953-3dc664912714", "fc014922-5def-4da9-a0fc-28c973f41bfb", "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7"], "logsource.categories": ["registry_event", "registry_set"], "logsource.products": ["windows"]}, "EventType": {"refs": ["f663a6d9-9d1b-49b8-b2b1-0637914d199a", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "277efb8f-60be-4f10-b4d3-037802f37167", "41d1058a-aea7-4952-9293-29eaaf516465", "96f697b0-b499-4e5d-9908-a67bec11cdb6", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "acd74772-5f88-45c7-956b-6a7b36c294d2", "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "0cf2e1c6-8d10-4273-8059-738778f981ad", "cd277474-5c52-4423-a52b-ac2d7969902f", "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "53330955-dc52-487f-a3a2-da24dcff99b5", "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "9ace0707-b560-49b8-b6ca-5148b42f39fb", "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "9b0f8a61-91b2-464f-aceb-0527e0a45020", "1d218616-71b0-4c40-855b-9dbe75510f7f", "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "25ffa65d-76d8-4da5-a832-3f2b0136e133", "f50f3c09-557d-492d-81db-9064a8d4e211"], "logsource.categories": ["registry_event", "registry_delete", "registry_set", "registry_add"], "logsource.products": ["windows"]}, "EventID": {"refs": ["f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7"], "logsource.categories": ["registry_event"], "logsource.products": ["windows"]}, "Description": {"refs": ["092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "cbb56d62-4060-40f7-9466-d8aaf3123f83", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "754ed792-634f-40ae-b3bc-e0448d33f695", "145322e4-0fd3-486b-81ca-9addc75736d8", "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "52ff7941-8211-46f9-84f8-9903efb7077d", "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "b1876533-4ed5-4a83-90f3-b8645840a413", "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "758ff488-18d5-4cbe-8ec4-02b6285a434f", "d08a2711-ee8b-4323-bdec-b7d85e892b31", "46123129-1024-423e-9fae-43af4a0fa9a5", "6938366d-8954-4ddc-baff-c830b3ba8fcd", "0ba1da6d-b6ce-4366-828c-18826c9de23e", "9fbf5927-5261-4284-a71d-f681029ea574", "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "54773c5f-f1cc-4703-9126-2f797d96a69d", "d679950c-abb7-43a6-80fb-2a480c4fc450", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "03552375-cc2c-4883-bbe4-7958d5a980be", "87911521-7098-470b-a459-9a57fc80bdfd", "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "48a61b29-389f-4032-b317-b30de6b95314", "0b0cd537-fc77-4e6e-a973-e53495c1083d", "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "fca949cc-79ca-446e-8064-01aa7e52ece5", "e37db05d-d1f9-49c8-b464-cee1a4b11638", "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "9d5a1274-922a-49d0-87f3-8c653483b909", "7530cd3d-7671-43e3-b209-976966f6ea48", "41f407b5-3096-44ea-a74f-96d04fbc41be", "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "5722dff1-4bdd-4949-86ab-fbaf707e767a", "eb2d07d4-49cb-4523-801a-da002df36602", "811e0002-b13b-4a15-9d00-a613fce66e42", "762f2482-ff21-4970-8939-0aa317a886bb", "38646daa-e78f-4ace-9de0-55547b2d30da", "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "c4e49831-1496-40cf-8ce1-b53f942b02f9", "2c32b543-1058-4808-91c6-5b31b8bed6c5", "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "b52e84a3-029e-4529-b09b-71d19dd27e94", "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "198effb6-6c98-4d0c-9ea3-451fa143c45c", "d85873ef-a0f8-4c48-a53a-6b621f11729d", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "f38a82d2-fba3-4781-b549-525efbec8506", "57bff678-25d1-4d6c-8211-8ca106d12053", "037dcd71-33a8-4392-bb01-293c94663e5a", "afe52666-401e-4a02-b4ff-5d128990b8cb", "4ede543c-e098-43d9-a28f-dd784a13132f", "bb780e0c-16cf-4383-8383-1e5471db6cf9", "148431ce-4b70-403d-8525-fcc2993f29ea"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Product": {"refs": ["d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "9ef27c24-4903-4192-881a-3adde7ff92a5", "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "b37998de-a70b-4f33-b219-ec36bf433dc0", "26488ad0-f9fd-4536-876f-52fea846a2e4", "c625d754-6a3d-4f65-9c9a-536aea960d37", "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "24c77512-782b-448a-8950-eddb0785fc71", "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "e01fa958-6893-41d4-ae03-182477c5e77d", "a96970af-f126-420d-90e1-d37bf25e50e1", "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "0afbd410-de03-4078-8491-f132303cb67d", "37e8d358-6408-4853-82f4-98333fca7014", "ca387a8e-1c84-4da3-9993-028b45342d30", "4833155a-4053-4c9c-a997-777fcea0baa7", "88656cec-6c3b-487c-82c0-f73ebb805503", "cd764533-2e07-40d6-a718-cfeec7f2da7f"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Initiated": {"refs": ["5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4", "d58ba5c6-0ed7-4b9d-a433-6878379efda9", "7610a4ea-c06d-495f-a2ac-0a696abcfd3b", "3ab65069-d82a-4d44-a759-466661a082d1", "5c80b618-0dbb-46e6-acbb-03d90bcb6d83", "c539afac-c12a-46ed-b1bd-5a5567c9f045", "cdc8da7d-c303-42f8-b08c-b4ab47230263", "3b5ba899-9842-4bc2-acc2-12308498bf42", "9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4", "8d7e392e-9b28-49e1-831d-5949c6281228", "5205613d-2a63-4412-a895-3a2458b587b3", "786cdae8-fefb-4eb2-9227-04e34060db01", "b1e5da3b-ca8e-4adf-915c-9921f3d85481", "e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97", "b3ad3c0f-c949-47a1-a30e-b0491ccae876", "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7", "18249279-932f-45e2-b37a-8925f2597670", "50e54b8d-ad73-43f8-96a1-5191685b17a4", "9e02c8ec-02b9-43e8-81eb-34a475ba7965", "ed74fe75-7594-4b4b-ae38-e38e3fd2eb23", "08249dc0-a28d-4555-8ba5-9255a198e08c", "7b434893-c57d-4f41-908d-6a17bf1ae98f", "7cd1dcdc-6edf-4896-86dc-d1f19ad64903", "992a6cae-db6a-43c8-9cec-76d7195c96fc", "4b657234-038e-4ad5-997c-4be42340bce4", "bef0bc5a-b9ae-425d-85c6-7b2d705980c6", "efafe0bf-4238-479e-af8f-797bd3490d2d", "75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84", "0531e43a-d77d-47c2-b89f-5fe50321c805", "e54979bd-c5f9-4d6c-967b-a04b19ac4c74", "4b89abaa-99fe-4232-afdd-8f9aa4d20382", "07837ab9-60e1-481f-a74d-c31fb496a94c", "c7e91a02-d771-4a6d-a700-42587e0b1095", "37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1", "0dba975d-a193-4ed1-a067-424df57570d1", "9976fa64-2804-423c-8a5b-646ade840773", "20384606-a124-4fec-acbb-8bd373728613", "25eabf56-22f0-4915-a1ed-056b8dae0a68", "6d8c3d20-a5e1-494f-8412-4571d716cf5c", "fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4"], "logsource.categories": ["network_connection"], "logsource.products": ["windows"]}, "Type": {"refs": ["c4b890e5-8d8c-4496-8c66-c805753817cd"], "logsource.categories": ["process_tampering"], "logsource.products": ["windows"]}, "SourceImage": {"refs": ["2e4e488a-6164-4811-9ea1-f960c7359c40", "66d31e5f-52d6-40a4-9615-002d3789a119", "02d1d718-dd13-41af-989d-ea85c7fab93f", "99b97608-3e21-4bfe-8217-2a127c396a0e", "c15e99a3-c474-48ab-b9a7-84549a7a9d16", "a1a144b7-5c9b-4853-a559-2172be8d4a03", "c0aac16a-b1e7-4330-bab0-3c27bb4987c7", "fb656378-f909-47c1-8747-278bf09f4f4f"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "StartAddress": {"refs": ["6309645e-122d-4c5b-bb2b-22e4f9c2fa42"], "logsource.categories": ["create_remote_thread"], "logsource.products": ["windows"]}, "IntegrityLevel": {"refs": ["0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "3c05e90d-7eba-4324-9972-5d7f711a60a8", "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "3037d961-21e9-4732-b27a-637bcc7bf539", "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "40f9af16-589d-4984-b78d-8c2aec023197", "4cbef972-f347-4170-b62a-8253f6168e6d", "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "853e74f9-9392-4935-ad3b-2e8c040dae86", "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "89a9a0e0-f61a-42e5-8957-b1479565a658", "a743ceba-c771-4d75-97eb-8a90f7f4844c", "b697e69c-746f-4a86-9f59-7bfff8eab881", "7a01183d-71a2-46ad-ad5c-acd989ac1793", "224f140f-3553-4cd1-af78-13d81bf9f7cc", "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "80fc36aa-945e-4181-89f2-2f907ab6775d", "d937b75f-a665-4480-88a5-2f20e9f9b22a", "1ca6bd18-0ba0-44ca-851c-92ed89a61085"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "CurrentDirectory": {"refs": ["631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "95eadcb2-92e4-4ed1-9031-92547773a6db", "ed825c86-c009-4014-b413-b76003e33d35", "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "02b18447-ea83-4b1b-8805-714a8a34546a", "3a6586ad-127a-4d3b-a677-1e6eacdf8fde"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Provider_Name": {"refs": ["7dc2dedd-7603-461a-bc13-15803d132355"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "ParentUser": {"refs": ["590a5f4c-6c8c-4f10-8307-89afe9453a9d", "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "LogonId": {"refs": ["d21374ff-f574-44a7-9998-4a8c8bf33d7d", "178e615d-e666-498b-9630-9ed363038101"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}}}, "uberAgent 6.1": {"missing_field": {"TargetObject": {"refs": ["47e0852a-cf81-4494-a8e6-31864f8c86ed", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "295a59c1-7b79-4b47-a930-df12c15fc9c2", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "5aad0995-46ab-41bd-a9ff-724f41114971", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "4d431012-2ab5-4db7-a84e-b29809da2172", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "b3503044-60ce-4bf4-bbcb-e3db98788823", "a6b33c02-8305-488f-8585-03cb2a7763f2", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "55e29995-75e7-451a-bef0-6225e2f13597", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "b6d235fc-1d38-4b12-adbe-325f06728f37", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "6ea3bf32-9680-422d-9f50-e90716b12a66", "baca5663-583c-45f9-b5dc-ea96a22ce542", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "62120148-6b7a-42be-8b91-271c04e281a3", "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "92772523-d9c1-4c93-9547-b0ca500baba3", "790317c0-0a36-4a6a-a105-6e576bf99a14", "707e097c-e20f-4f67-8807-1f72ff4500d6", "396ae3eb-4174-4b9b-880e-dc0364d78a19", "e61e8a88-59a9-451c-874e-70fcc9740d67", "48437c39-9e5f-47fb-af95-3d663c3f2919", "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "509e84b9-a71a-40e0-834f-05470369bd1e", "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "7d9263bd-dc47-4a58-bc92-5474abab390c", "c5f6a85d-b647-40f7-bbad-c10b66bab038", "8ffc5407-52e3-478f-9596-0a7371eafe13", "bf344fea-d947-4ef4-9192-34d008315d3a", "5a93eb65-dffa-4543-b761-94aa60098fb6", "7c81fec3-1c1d-43b0-996a-46753041b1b6", "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "e3fdf743-f05b-4051-990a-b66919be1743", "6b6976a3-b0e6-4723-ac24-ae38a737af41", "f7997770-92c3-4ec9-b112-774c4ef96f96", "966315ef-c5e1-4767-ba25-fce9c8de3660", "e7b18879-676e-4a0e-ae18-27039185a8e7", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "8023f872-3f1d-4301-a384-801889917ab4", "44a22d59-b175-4f13-8c16-cbaef5b581ff", "fe20dda1-6f37-4379-bbe0-a98d400cae90", "b7916c2a-fa2f-4795-9477-32b731f70f11", "b86852fb-4c77-48f9-8519-eb1b2c308b59", "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "dc5c24af-6995-49b2-86eb-a9ff62199e82", "92b0b372-a939-44ed-a11b-5136cf680e27", "1c3121ed-041b-4d97-a075-07f54f20fb4a", "9df5f547-c86a-433e-b533-f2794357e242", "46490193-1b22-4c29-bdd6-5bf63907216f", "fa277e82-9b78-42dd-b05c-05555c7b6015", "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "91239011-fe3c-4b54-9f24-15c86bb65913", "2f78da12-f7c7-430b-8b19-a28f269b77a3", "18f2065c-d36c-464a-a748-bcf909acb2e3", "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "7f2954d2-99c2-4d42-a065-ca36740f187b", "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "83314318-052a-4c90-a1ad-660ece38d276", "07743f65-7ec9-404a-a519-913db7118a8d", "f674e36a-4b91-431e-8aef-f8a96c2aca35", "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "555155a2-03bf-4fe7-af74-d176b3fdbe16", "df4dc653-1029-47ba-8231-3c44238cc0ae", "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "1547e27c-3974-43e2-a7d7-7f484fb928ec", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "fad91067-08c5-4d1a-8d8c-d96a21b37814", "a982fc9c-6333-4ffb-a51d-addb04e8b529", "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "90f342e1-1aaa-4e43-b092-39fda57ed11e", "02ee49e2-e294-4d0f-9278-f5b3212fc588", "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "0eb46774-f1ab-4a74-8238-1155855f2263", "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "c90362e0-2df3-4e61-94fe-b37615814cb1", "974515da-6cc5-4c95-ae65-f97f9150ec7f", "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "c420410f-c2d8-4010-856b-dffe21866437", "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "f37b4bce-49d0-4087-9f5b-58bffda77316", "9827ae57-3802-418f-994b-d5ecf5cd974b", "93d298a1-d28f-47f1-a468-d971e7796679", "46dd5308-4572-4d12-aa43-8938f0184d4f", "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "f742bde7-9528-42e5-bd82-84f51a8387d2", "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "8d85cf08-bf97-4260-ba49-986a2a65129c", "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "2ff692c2-4594-41ec-8fcb-46587de769e0", "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "b23818c7-e575-4d13-8012-332075ec0a2b", "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "160d2780-31f7-4922-8b3a-efce30e63e96", "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "ab567429-1dfb-4674-b6d2-979fd2f9d125", "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "cbf93e5d-ca6c-4722-8bea-e9119007c248", "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "275641a5-a492-45e2-a817-7c81e9d9d3e9", "961e33d1-4f86-4fcf-80ab-930a708b2f82", "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "ad89044a-8f49-4673-9a55-cbd88a1b374f", "086ae989-9ca6-4fe7-895a-759c5544f247", "5de03871-5d46-4539-a82d-3aa992a69a83", "28036918-04d3-423d-91c0-55ecf99fb892", "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "046218bd-e0d8-4113-a3c3-895a12b2b298", "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "a80f662f-022f-4429-9b8c-b1a41aaa6688", "612e47e9-8a59-43a6-b404-f48683f45bd6", "833ef470-fa01-4631-a79b-6f291c9ac498", "9d8f9bb8-01af-4e15-a3a2-349071530530", "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "5df86130-4e95-4a54-90f7-26541b40aec2", "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "f10ed525-97fe-4fed-be7c-2feecca941b1", "5f9db380-ea57-4d1e-beab-8a2d33397e93", "487bb375-12ef-41f6-baae-c6a1572b4dd1", "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "8218c875-90b9-42e2-b60d-0b0069816d10", "f2485272-a156-4773-82d7-1d178bc4905b", "724ea201-6514-4f38-9739-e5973c34f49a", "6c304b02-06e6-402d-8be4-d5833cdf8198", "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "4916a35e-bfc4-47d0-8e25-a003d7067061", "73a883d0-0348-4be4-a8d8-51031c2564f8", "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "d223b46b-5621-4037-88fe-fda32eead684", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "480421f9-417f-4d3b-9552-fd2728443ec8", "60936b49-fca0-4f32-993d-7415edcf9a5d", "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "6597be7b-ac61-4ac8-bef4-d3ec88174853", "5b872a46-3b90-45c1-8419-f675db8053aa", "092af964-4233-4373-b4ba-d86ea2890288", "b64a026b-8deb-4c1d-92fd-98893209dff1", "a7df0e9e-91a5-459a-a003-4cde67c2ff5d", "34aa0252-6039-40ff-951f-939fd6ce47d8", "63647769-326d-4dde-a419-b925cc0caf42", "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "9d15044a-7cfe-4d23-8085-6ebc11df7685", "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "976dd1f2-a484-45ec-aa1d-0e87e882262b", "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "944e8941-f6f6-4ee8-ac05-1c224e923c0e", "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "439957a7-ad86-4a8f-9705-a28131c6821b", "5a5152f1-463f-436b-b2f5-8eceb3964b42", "e0813366-0407-449a-9869-a2db1119dc41", "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "bf9e1387-b040-4393-9851-1598f8ecfae9", "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "9c226817-8dc9-46c2-a58d-66655aafd7dc", "7021255e-5db3-4946-a8b9-0ba7a4644a69", "36803969-5421-41ec-b92f-8500f79c23b0", "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "42205c73-75c8-4a63-9db1-e3782e06fda0", "41f6531d-af6e-4c6e-918f-b946f2b85a36", "e2482f8d-3443-4237-b906-cc145d87a076", "8b9606c9-28be-4a38-b146-0e313cc232c1", "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "4f281b83-0200-4b34-bf35-d24687ea57c2", "243380fa-11eb-4141-af92-e14925e77c1b", "baecf8fb-edbf-429f-9ade-31fc3f22b970", "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "0d7ceeef-3539-4392-8953-3dc664912714", "fc014922-5def-4da9-a0fc-28c973f41bfb", "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7"], "logsource.categories": ["registry_event", "registry_set"], "logsource.products": ["windows"]}, "EventType": {"refs": ["f663a6d9-9d1b-49b8-b2b1-0637914d199a", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "277efb8f-60be-4f10-b4d3-037802f37167", "41d1058a-aea7-4952-9293-29eaaf516465", "96f697b0-b499-4e5d-9908-a67bec11cdb6", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "acd74772-5f88-45c7-956b-6a7b36c294d2", "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "0cf2e1c6-8d10-4273-8059-738778f981ad", "cd277474-5c52-4423-a52b-ac2d7969902f", "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "53330955-dc52-487f-a3a2-da24dcff99b5", "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "9ace0707-b560-49b8-b6ca-5148b42f39fb", "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "9b0f8a61-91b2-464f-aceb-0527e0a45020", "1d218616-71b0-4c40-855b-9dbe75510f7f", "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "25ffa65d-76d8-4da5-a832-3f2b0136e133", "f50f3c09-557d-492d-81db-9064a8d4e211"], "logsource.categories": ["registry_event", "registry_delete", "registry_set", "registry_add"], "logsource.products": ["windows"]}, "EventID": {"refs": ["f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7"], "logsource.categories": ["registry_event"], "logsource.products": ["windows"]}, "Description": {"refs": ["092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "cbb56d62-4060-40f7-9466-d8aaf3123f83", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "754ed792-634f-40ae-b3bc-e0448d33f695", "145322e4-0fd3-486b-81ca-9addc75736d8", "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "52ff7941-8211-46f9-84f8-9903efb7077d", "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "b1876533-4ed5-4a83-90f3-b8645840a413", "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "758ff488-18d5-4cbe-8ec4-02b6285a434f", "d08a2711-ee8b-4323-bdec-b7d85e892b31", "46123129-1024-423e-9fae-43af4a0fa9a5", "6938366d-8954-4ddc-baff-c830b3ba8fcd", "0ba1da6d-b6ce-4366-828c-18826c9de23e", "9fbf5927-5261-4284-a71d-f681029ea574", "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "54773c5f-f1cc-4703-9126-2f797d96a69d", "d679950c-abb7-43a6-80fb-2a480c4fc450", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "03552375-cc2c-4883-bbe4-7958d5a980be", "87911521-7098-470b-a459-9a57fc80bdfd", "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "48a61b29-389f-4032-b317-b30de6b95314", "0b0cd537-fc77-4e6e-a973-e53495c1083d", "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "fca949cc-79ca-446e-8064-01aa7e52ece5", "e37db05d-d1f9-49c8-b464-cee1a4b11638", "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "9d5a1274-922a-49d0-87f3-8c653483b909", "7530cd3d-7671-43e3-b209-976966f6ea48", "41f407b5-3096-44ea-a74f-96d04fbc41be", "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "5722dff1-4bdd-4949-86ab-fbaf707e767a", "eb2d07d4-49cb-4523-801a-da002df36602", "811e0002-b13b-4a15-9d00-a613fce66e42", "762f2482-ff21-4970-8939-0aa317a886bb", "38646daa-e78f-4ace-9de0-55547b2d30da", "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "c4e49831-1496-40cf-8ce1-b53f942b02f9", "2c32b543-1058-4808-91c6-5b31b8bed6c5", "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "b52e84a3-029e-4529-b09b-71d19dd27e94", "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "198effb6-6c98-4d0c-9ea3-451fa143c45c", "d85873ef-a0f8-4c48-a53a-6b621f11729d", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "f38a82d2-fba3-4781-b549-525efbec8506", "57bff678-25d1-4d6c-8211-8ca106d12053", "037dcd71-33a8-4392-bb01-293c94663e5a", "afe52666-401e-4a02-b4ff-5d128990b8cb", "4ede543c-e098-43d9-a28f-dd784a13132f", "bb780e0c-16cf-4383-8383-1e5471db6cf9", "148431ce-4b70-403d-8525-fcc2993f29ea"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Hashes": {"refs": ["8cde342c-ba48-4b74-b615-172c330f2e93", "49329257-089d-46e6-af37-4afce4290685", "7aa7009a-28b9-4344-8c1f-159489a390df", "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "8d63dadf-b91b-4187-87b6-34a1114577ea", "e8d34729-86a4-4140-adfd-0a29c2106307", "ca621ba5-54ab-4035-9942-d378e6fcde3c", "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "d7654f02-e04b-4934-9838-65c46f187ebc", "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "6345b048-8441-43a7-9bed-541133633d7a", "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "68d37776-61db-42f5-bf54-27e87072d17e", "6bd75993-9888-4f91-9404-e1e4e4e34b77", "f4264e47-f522-4c38-a420-04525d5b880f", "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "729ce0ea-5d8f-4769-9762-e35de441586d", "222129f7-f4dc-4568-b0d2-22440a9639ba", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "74a12f18-505c-4114-8d0b-8448dd5485c6", "32410e29-5f94-4568-b6a3-d91a8adad863"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Product": {"refs": ["d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "9ef27c24-4903-4192-881a-3adde7ff92a5", "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "b37998de-a70b-4f33-b219-ec36bf433dc0", "26488ad0-f9fd-4536-876f-52fea846a2e4", "c625d754-6a3d-4f65-9c9a-536aea960d37", "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "24c77512-782b-448a-8950-eddb0785fc71", "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "e01fa958-6893-41d4-ae03-182477c5e77d", "a96970af-f126-420d-90e1-d37bf25e50e1", "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "0afbd410-de03-4078-8491-f132303cb67d", "37e8d358-6408-4853-82f4-98333fca7014", "ca387a8e-1c84-4da3-9993-028b45342d30", "4833155a-4053-4c9c-a997-777fcea0baa7", "88656cec-6c3b-487c-82c0-f73ebb805503", "cd764533-2e07-40d6-a718-cfeec7f2da7f"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "IntegrityLevel": {"refs": ["0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "3c05e90d-7eba-4324-9972-5d7f711a60a8", "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "3037d961-21e9-4732-b27a-637bcc7bf539", "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "40f9af16-589d-4984-b78d-8c2aec023197", "4cbef972-f347-4170-b62a-8253f6168e6d", "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "853e74f9-9392-4935-ad3b-2e8c040dae86", "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "89a9a0e0-f61a-42e5-8957-b1479565a658", "a743ceba-c771-4d75-97eb-8a90f7f4844c", "b697e69c-746f-4a86-9f59-7bfff8eab881", "7a01183d-71a2-46ad-ad5c-acd989ac1793", "224f140f-3553-4cd1-af78-13d81bf9f7cc", "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "80fc36aa-945e-4181-89f2-2f907ab6775d", "d937b75f-a665-4480-88a5-2f20e9f9b22a", "1ca6bd18-0ba0-44ca-851c-92ed89a61085"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "CurrentDirectory": {"refs": ["631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "95eadcb2-92e4-4ed1-9031-92547773a6db", "ed825c86-c009-4014-b413-b76003e33d35", "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "02b18447-ea83-4b1b-8805-714a8a34546a", "3a6586ad-127a-4d3b-a677-1e6eacdf8fde"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Provider_Name": {"refs": ["7dc2dedd-7603-461a-bc13-15803d132355"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "ParentUser": {"refs": ["590a5f4c-6c8c-4f10-8307-89afe9453a9d", "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "LogonId": {"refs": ["d21374ff-f574-44a7-9998-4a8c8bf33d7d", "178e615d-e666-498b-9630-9ed363038101"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}}}, "uberAgent 6.0": {"missing_field": {"TargetObject": {"refs": ["47e0852a-cf81-4494-a8e6-31864f8c86ed", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "295a59c1-7b79-4b47-a930-df12c15fc9c2", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "5aad0995-46ab-41bd-a9ff-724f41114971", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "4d431012-2ab5-4db7-a84e-b29809da2172", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "b3503044-60ce-4bf4-bbcb-e3db98788823", "a6b33c02-8305-488f-8585-03cb2a7763f2", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "55e29995-75e7-451a-bef0-6225e2f13597", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "b6d235fc-1d38-4b12-adbe-325f06728f37", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "6ea3bf32-9680-422d-9f50-e90716b12a66", "baca5663-583c-45f9-b5dc-ea96a22ce542", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "62120148-6b7a-42be-8b91-271c04e281a3", "ba6b9e43-1d45-4d3c-a504-1043a64c8469", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "92772523-d9c1-4c93-9547-b0ca500baba3", "790317c0-0a36-4a6a-a105-6e576bf99a14", "707e097c-e20f-4f67-8807-1f72ff4500d6", "396ae3eb-4174-4b9b-880e-dc0364d78a19", "e61e8a88-59a9-451c-874e-70fcc9740d67", "48437c39-9e5f-47fb-af95-3d663c3f2919", "6763c6c8-bd01-4687-bc8d-4fa52cf8ba08", "509e84b9-a71a-40e0-834f-05470369bd1e", "04b45a8a-d11d-49e4-9acc-4a1b524407a5", "7d9263bd-dc47-4a58-bc92-5474abab390c", "c5f6a85d-b647-40f7-bbad-c10b66bab038", "8ffc5407-52e3-478f-9596-0a7371eafe13", "bf344fea-d947-4ef4-9192-34d008315d3a", "5a93eb65-dffa-4543-b761-94aa60098fb6", "7c81fec3-1c1d-43b0-996a-46753041b1b6", "d88d0ab2-e696-4d40-a2ed-9790064e66b3", "e3fdf743-f05b-4051-990a-b66919be1743", "6b6976a3-b0e6-4723-ac24-ae38a737af41", "f7997770-92c3-4ec9-b112-774c4ef96f96", "966315ef-c5e1-4767-ba25-fce9c8de3660", "e7b18879-676e-4a0e-ae18-27039185a8e7", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "ac9159cc-c364-4304-8f0a-d63fc1a0aabb", "8023f872-3f1d-4301-a384-801889917ab4", "44a22d59-b175-4f13-8c16-cbaef5b581ff", "fe20dda1-6f37-4379-bbe0-a98d400cae90", "b7916c2a-fa2f-4795-9477-32b731f70f11", "b86852fb-4c77-48f9-8519-eb1b2c308b59", "ddd171b5-2cc6-4975-9e78-f0eccd08cc76", "dc5c24af-6995-49b2-86eb-a9ff62199e82", "92b0b372-a939-44ed-a11b-5136cf680e27", "1c3121ed-041b-4d97-a075-07f54f20fb4a", "9df5f547-c86a-433e-b533-f2794357e242", "46490193-1b22-4c29-bdd6-5bf63907216f", "fa277e82-9b78-42dd-b05c-05555c7b6015", "33efc23c-6ea2-4503-8cfe-bdf82ce8f719", "91239011-fe3c-4b54-9f24-15c86bb65913", "2f78da12-f7c7-430b-8b19-a28f269b77a3", "18f2065c-d36c-464a-a748-bcf909acb2e3", "4720b7df-40c3-48fd-bbdf-fd4b3c464f0d", "c3cefdf4-6703-4e1c-bad8-bf422fc5015a", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "a07f0359-4c90-4dc4-a681-8ffea40b4f47", "7f2954d2-99c2-4d42-a065-ca36740f187b", "f59c3faf-50f3-464b-9f4c-1b67ab512d99", "0e6a9e62-627e-496c-aef5-bfa39da29b5e", "83314318-052a-4c90-a1ad-660ece38d276", "07743f65-7ec9-404a-a519-913db7118a8d", "f674e36a-4b91-431e-8aef-f8a96c2aca35", "a1e11042-a74a-46e6-b07c-c4ce8ecc239b", "dfb5b4e8-91d0-4291-b40a-e3b0d3942c45", "555155a2-03bf-4fe7-af74-d176b3fdbe16", "df4dc653-1029-47ba-8231-3c44238cc0ae", "e78c408a-e2ea-43cd-b5ea-51975cf358c0", "1547e27c-3974-43e2-a7d7-7f484fb928ec", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "e3b50fa5-3c3f-444e-937b-0a99d33731cd", "fad91067-08c5-4d1a-8d8c-d96a21b37814", "a982fc9c-6333-4ffb-a51d-addb04e8b529", "b61e87c0-50db-4b2e-8986-6a2be94b33b0", "1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf", "e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4", "90f342e1-1aaa-4e43-b092-39fda57ed11e", "02ee49e2-e294-4d0f-9278-f5b3212fc588", "a2863fbc-d5cb-48d5-83fb-d976d4b1743b", "0eb46774-f1ab-4a74-8238-1155855f2263", "17e53739-a1fc-4a62-b1b9-87711c2d5e44", "c90362e0-2df3-4e61-94fe-b37615814cb1", "974515da-6cc5-4c95-ae65-f97f9150ec7f", "40b6e656-4e11-4c0c-8772-c1cc6dae34ce", "c420410f-c2d8-4010-856b-dffe21866437", "e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1", "f37b4bce-49d0-4087-9f5b-58bffda77316", "9827ae57-3802-418f-994b-d5ecf5cd974b", "93d298a1-d28f-47f1-a468-d971e7796679", "46dd5308-4572-4d12-aa43-8938f0184d4f", "3ae1a046-f7db-439d-b7ce-b8b366b81fa6", "61a7697c-cb79-42a8-a2ff-5f0cdfae0130", "f742bde7-9528-42e5-bd82-84f51a8387d2", "7d995e63-ec83-4aa3-89d5-8a17b5c87c86", "8d85cf08-bf97-4260-ba49-986a2a65129c", "a1b1fd53-9c4a-444c-bae0-34a330fc7aa8", "d6a9b252-c666-4de6-8806-5561bbbd3bdc", "2ff692c2-4594-41ec-8fcb-46587de769e0", "a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47", "85b88e05-dadc-430b-8a9e-53ff1cd30aae", "b23818c7-e575-4d13-8012-332075ec0a2b", "b110ebaf-697f-4da1-afd5-b536fa27a2c1", "160d2780-31f7-4922-8b3a-efce30e63e96", "e88a6ddc-74f7-463b-9b26-f69fc0d2ce85", "ab567429-1dfb-4674-b6d2-979fd2f9d125", "3390fbef-c98d-4bdd-a863-d65ed7c610dd", "b29aed60-ebd1-442b-9cb5-16a1d0324adb", "e1aa95de-610a-427d-b9e7-9b46cfafbe6a", "b888e3f2-224d-4435-b00b-9dd66e9ea1f1", "cbf93e5d-ca6c-4722-8bea-e9119007c248", "0cb8d736-995d-4ce7-a31e-1e8d452a1459", "275641a5-a492-45e2-a817-7c81e9d9d3e9", "961e33d1-4f86-4fcf-80ab-930a708b2f82", "4a5f5a5e-ac01-474b-9b4e-d61298c9df1d", "ad89044a-8f49-4673-9a55-cbd88a1b374f", "086ae989-9ca6-4fe7-895a-759c5544f247", "5de03871-5d46-4539-a82d-3aa992a69a83", "28036918-04d3-423d-91c0-55ecf99fb892", "ab871450-37dc-4a3a-997f-6662aa8ae0f1", "8b7273a4-ba5d-4d8a-b04f-11f2900d043a", "5b16df71-8615-4f7f-ac9b-6c43c0509e61", "5a2b21ee-6aaa-4234-ac9d-59a59edf90a1", "046218bd-e0d8-4113-a3c3-895a12b2b298", "20f0ee37-5942-4e45-b7d5-c5b5db9df5cd", "a5c7a43f-6009-4a8c-80c5-32abf1c53ecc", "fdbf0b9d-0182-4c43-893b-a1eaab92d085", "a80f662f-022f-4429-9b8c-b1a41aaa6688", "612e47e9-8a59-43a6-b404-f48683f45bd6", "833ef470-fa01-4631-a79b-6f291c9ac498", "9d8f9bb8-01af-4e15-a3a2-349071530530", "0442defa-b4a2-41c9-ae2c-ea7042fc4701", "5df86130-4e95-4a54-90f7-26541b40aec2", "6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236", "f10ed525-97fe-4fed-be7c-2feecca941b1", "5f9db380-ea57-4d1e-beab-8a2d33397e93", "487bb375-12ef-41f6-baae-c6a1572b4dd1", "37b437cf-3fc5-4c8e-9c94-1d7c9aff842b", "8218c875-90b9-42e2-b60d-0b0069816d10", "f2485272-a156-4773-82d7-1d178bc4905b", "724ea201-6514-4f38-9739-e5973c34f49a", "6c304b02-06e6-402d-8be4-d5833cdf8198", "9f4662ac-17ca-43aa-8f12-5d7b989d0101", "4916a35e-bfc4-47d0-8e25-a003d7067061", "73a883d0-0348-4be4-a8d8-51031c2564f8", "bf4fc428-dcc3-4bbd-99fe-2422aeee2544", "d223b46b-5621-4037-88fe-fda32eead684", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "0c93308a-3f1b-40a9-b649-57ea1a1c1d63", "480421f9-417f-4d3b-9552-fd2728443ec8", "60936b49-fca0-4f32-993d-7415edcf9a5d", "d6ce7ebd-260b-4323-9768-a9631c8d4db2", "6597be7b-ac61-4ac8-bef4-d3ec88174853", "5b872a46-3b90-45c1-8419-f675db8053aa", "092af964-4233-4373-b4ba-d86ea2890288", "b64a026b-8deb-4c1d-92fd-98893209dff1", "a7df0e9e-91a5-459a-a003-4cde67c2ff5d", "34aa0252-6039-40ff-951f-939fd6ce47d8", "63647769-326d-4dde-a419-b925cc0caf42", "a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd", "3fd4c8d7-8362-4557-a8e6-83b29cc0d724", "ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a", "9d15044a-7cfe-4d23-8085-6ebc11df7685", "d4e2745c-f0c6-4bde-a3ab-b553b3f693cc", "976dd1f2-a484-45ec-aa1d-0e87e882262b", "75180c5f-4ea1-461a-a4f6-6e4700c065d4", "944e8941-f6f6-4ee8-ac05-1c224e923c0e", "973ef012-8f1a-4c40-93b4-7e659a5cd17f", "439957a7-ad86-4a8f-9705-a28131c6821b", "5a5152f1-463f-436b-b2f5-8eceb3964b42", "e0813366-0407-449a-9869-a2db1119dc41", "d6c2ce7e-afb5-4337-9ca4-4b5254ed0565", "3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d", "bf9e1387-b040-4393-9851-1598f8ecfae9", "8fbe98a8-8f9d-44f8-aa71-8c572e29ef06", "c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e", "9c226817-8dc9-46c2-a58d-66655aafd7dc", "7021255e-5db3-4946-a8b9-0ba7a4644a69", "36803969-5421-41ec-b92f-8500f79c23b0", "bbf59793-6efb-4fa1-95ca-a7d288e52c88", "0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b", "42205c73-75c8-4a63-9db1-e3782e06fda0", "41f6531d-af6e-4c6e-918f-b946f2b85a36", "e2482f8d-3443-4237-b906-cc145d87a076", "8b9606c9-28be-4a38-b146-0e313cc232c1", "45e112d0-7759-4c2a-aa36-9f8fb79d3393", "3f6b7b62-61aa-45db-96bd-9c31b36b653c", "4f281b83-0200-4b34-bf35-d24687ea57c2", "243380fa-11eb-4141-af92-e14925e77c1b", "baecf8fb-edbf-429f-9ade-31fc3f22b970", "fcddca7c-b9c0-4ddf-98da-e1e2d18b0157", "0d7ceeef-3539-4392-8953-3dc664912714", "fc014922-5def-4da9-a0fc-28c973f41bfb", "e6fe26ee-d063-4f5b-b007-39e90aaf50e3", "fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7"], "logsource.categories": ["registry_event", "registry_set"], "logsource.products": ["windows"]}, "EventType": {"refs": ["f663a6d9-9d1b-49b8-b2b1-0637914d199a", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "277efb8f-60be-4f10-b4d3-037802f37167", "41d1058a-aea7-4952-9293-29eaaf516465", "96f697b0-b499-4e5d-9908-a67bec11cdb6", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "07bdd2f5-9c58-4f38-aec8-e101bb79ef8d", "acd74772-5f88-45c7-956b-6a7b36c294d2", "526cc8bc-1cdc-48ad-8b26-f19bff969cec", "5dfc1465-8f65-4fde-8eb5-6194380c6a62", "0cf2e1c6-8d10-4273-8059-738778f981ad", "cd277474-5c52-4423-a52b-ac2d7969902f", "f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd", "992dd79f-dde8-4bb0-9085-6350ba97cfb3", "53330955-dc52-487f-a3a2-da24dcff99b5", "4eec988f-7bf0-49f1-8675-1e6a510b3a2a", "d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a", "9ace0707-b560-49b8-b6ca-5148b42f39fb", "c7da8edc-49ae-45a2-9e61-9fd860e4e73d", "9b0f8a61-91b2-464f-aceb-0527e0a45020", "1d218616-71b0-4c40-855b-9dbe75510f7f", "33efc23c-6ea2-4503-8cfe-bdf82ce8f705", "25ffa65d-76d8-4da5-a832-3f2b0136e133", "f50f3c09-557d-492d-81db-9064a8d4e211"], "logsource.categories": ["registry_event", "registry_delete", "registry_set", "registry_add"], "logsource.products": ["windows"]}, "EventID": {"refs": ["f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7"], "logsource.categories": ["registry_event"], "logsource.products": ["windows"]}, "Signature": {"refs": ["d2451be2-b582-4e15-8701-4196ac180260"], "logsource.categories": ["image_load"], "logsource.products": ["windows"]}, "Signed": {"refs": ["bdc64095-d59a-42a2-8588-71fd9c9d9abc", "857c8db3-c89b-42fb-882b-f681c7cf4da2", "060d5ad4-3153-47bb-8382-43e5e29eda92", "70e8e9b4-6a93-4cb7-8cde-da69502e7aff", "ea5c131b-380d-49f9-aeb3-920694da4d4b", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "98ffaed4-aec2-4e04-9b07-31492fe68b3d", "b5de0c9a-6f19-43e0-af4e-55ad01f550af", "273a8dd8-3742-4302-bcc7-7df5a80fe425"], "logsource.categories": ["image_load"], "logsource.products": ["windows"]}, "Description": {"refs": ["092bc4b9-3d1d-43b4-a6b4-8c8acd83522f", "cbb56d62-4060-40f7-9466-d8aaf3123f83", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "754ed792-634f-40ae-b3bc-e0448d33f695", "145322e4-0fd3-486b-81ca-9addc75736d8", "ec570e53-4c76-45a9-804d-dc3f355ff7a7", "1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc", "52ff7941-8211-46f9-84f8-9903efb7077d", "550bbb84-ce5d-4e61-84ad-e590f0024dcd", "b1876533-4ed5-4a83-90f3-b8645840a413", "7a4d9232-92fc-404d-8ce1-4c92e7caf539", "758ff488-18d5-4cbe-8ec4-02b6285a434f", "d08a2711-ee8b-4323-bdec-b7d85e892b31", "46123129-1024-423e-9fae-43af4a0fa9a5", "6938366d-8954-4ddc-baff-c830b3ba8fcd", "0ba1da6d-b6ce-4366-828c-18826c9de23e", "9fbf5927-5261-4284-a71d-f681029ea574", "b6d98a4f-cef0-4abf-bbf6-24132854a83d", "54773c5f-f1cc-4703-9126-2f797d96a69d", "d679950c-abb7-43a6-80fb-2a480c4fc450", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "d0dae994-26c6-4d2d-83b5-b3c8b79ae513", "03552375-cc2c-4883-bbe4-7958d5a980be", "87911521-7098-470b-a459-9a57fc80bdfd", "edd8a48c-1b9f-4ba1-83aa-490338cd1ccb", "1eeed653-dbc8-4187-ad0c-eeebb20e6599", "9637e8a5-7131-4f7f-bdc7-2b05d8670c43", "5817e76f-4804-41e6-8f1d-5fa0b3ecae2d", "77df53a5-1d78-4f32-bc5a-0e7465bd8f41", "48a61b29-389f-4032-b317-b30de6b95314", "0b0cd537-fc77-4e6e-a973-e53495c1083d", "f0ca6c24-3225-47d5-b1f5-352bf07ecfa7", "fca949cc-79ca-446e-8064-01aa7e52ece5", "e37db05d-d1f9-49c8-b464-cee1a4b11638", "bdeeabc9-ff2a-4a51-be59-bb253aac7891", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "9d5a1274-922a-49d0-87f3-8c653483b909", "7530cd3d-7671-43e3-b209-976966f6ea48", "41f407b5-3096-44ea-a74f-96d04fbc41be", "bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c", "5722dff1-4bdd-4949-86ab-fbaf707e767a", "eb2d07d4-49cb-4523-801a-da002df36602", "811e0002-b13b-4a15-9d00-a613fce66e42", "762f2482-ff21-4970-8939-0aa317a886bb", "38646daa-e78f-4ace-9de0-55547b2d30da", "6a5f68d1-c4b5-46b9-94ee-5324892ea939", "c4e49831-1496-40cf-8ce1-b53f942b02f9", "2c32b543-1058-4808-91c6-5b31b8bed6c5", "bef37fa2-f205-4a7b-b484-0759bfd5f86f", "065b00ca-5d5c-4557-ac95-64a6d0b64d86", "b52e84a3-029e-4529-b09b-71d19dd27e94", "0c92f2e6-f08f-4b73-9216-ecb0ca634689", "198effb6-6c98-4d0c-9ea3-451fa143c45c", "d85873ef-a0f8-4c48-a53a-6b621f11729d", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "f38a82d2-fba3-4781-b549-525efbec8506", "57bff678-25d1-4d6c-8211-8ca106d12053", "037dcd71-33a8-4392-bb01-293c94663e5a", "afe52666-401e-4a02-b4ff-5d128990b8cb", "4ede543c-e098-43d9-a28f-dd784a13132f", "bb780e0c-16cf-4383-8383-1e5471db6cf9", "148431ce-4b70-403d-8525-fcc2993f29ea"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Hashes": {"refs": ["8cde342c-ba48-4b74-b615-172c330f2e93", "49329257-089d-46e6-af37-4afce4290685", "cf0c254b-22f1-4b2b-8221-e137b3c0af94", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "340a090b-c4e9-412e-bb36-b4b16fe96f9b", "d7654f02-e04b-4934-9838-65c46f187ebc", "9082ff1f-88ab-4678-a3cc-5bcff99fc74d", "6345b048-8441-43a7-9bed-541133633d7a", "b1cb4ab6-ac31-43f4-adf1-d9d08957419c", "68d37776-61db-42f5-bf54-27e87072d17e", "6bd75993-9888-4f91-9404-e1e4e4e34b77", "e0c69ebd-b54f-4aed-8ae3-e3467843f3f0", "222129f7-f4dc-4568-b0d2-22440a9639ba", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "74a12f18-505c-4114-8d0b-8448dd5485c6", "32410e29-5f94-4568-b6a3-d91a8adad863"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "Product": {"refs": ["d36f7c12-14a3-4d48-b6b8-774b9c66f44d", "cf93e05e-d798-4d9e-b522-b0248dc61eaf", "d38d2fa4-98e6-4a24-aff1-410b0c9ad177", "f376c8a7-a2d0-4ddc-aa0c-16c17236d962", "9ef27c24-4903-4192-881a-3adde7ff92a5", "c9192ad9-75e5-43eb-8647-82a0a5b493e3", "d9367cbb-c2e0-47ce-bdc0-128cb6da898d", "b37998de-a70b-4f33-b219-ec36bf433dc0", "26488ad0-f9fd-4536-876f-52fea846a2e4", "c625d754-6a3d-4f65-9c9a-536aea960d37", "0f16d9cf-0616-45c8-8fad-becc11b5a41c", "24c77512-782b-448a-8950-eddb0785fc71", "e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d", "e01fa958-6893-41d4-ae03-182477c5e77d", "a96970af-f126-420d-90e1-d37bf25e50e1", "e218595b-bbe7-4ee5-8a96-f32a24ad3468", "0afbd410-de03-4078-8491-f132303cb67d", "37e8d358-6408-4853-82f4-98333fca7014", "ca387a8e-1c84-4da3-9993-028b45342d30", "4833155a-4053-4c9c-a997-777fcea0baa7", "88656cec-6c3b-487c-82c0-f73ebb805503", "cd764533-2e07-40d6-a718-cfeec7f2da7f"], "logsource.categories": ["image_load", "process_creation"], "logsource.products": ["windows"]}, "SignatureStatus": {"refs": ["948a0953-f287-4806-bbcb-3b2e396df89f"], "logsource.categories": ["image_load"], "logsource.products": ["windows"]}, "IntegrityLevel": {"refs": ["0058b9e5-bcd7-40d4-9205-95ca5a16d7b2", "79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5", "ad92e3f9-7eb6-460e-96b1-582b0ccbb980", "3c05e90d-7eba-4324-9972-5d7f711a60a8", "39ed3c80-e6a1-431b-9df3-911ac53d08a7", "cd951fdc-4b2f-47f5-ba99-a33bf61e3770", "2617e7ed-adb7-40ba-b0f3-8f9945fe6c09", "3037d961-21e9-4732-b27a-637bcc7bf539", "0f9c21f1-6a73-4b0e-9809-cb562cb8d981", "40f9af16-589d-4984-b78d-8c2aec023197", "4cbef972-f347-4170-b62a-8253f6168e6d", "dcdbc940-0bff-46b2-95f3-2d73f848e33b", "853e74f9-9392-4935-ad3b-2e8c040dae86", "503d581c-7df0-4bbe-b9be-5840c0ecc1fc", "4b60e6f2-bf39-47b4-b4ea-398e33cfe253", "8f02c935-effe-45b3-8fc9-ef8696a9e41d", "89a9a0e0-f61a-42e5-8957-b1479565a658", "a743ceba-c771-4d75-97eb-8a90f7f4844c", "b697e69c-746f-4a86-9f59-7bfff8eab881", "7a01183d-71a2-46ad-ad5c-acd989ac1793", "224f140f-3553-4cd1-af78-13d81bf9f7cc", "dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c", "80fc36aa-945e-4181-89f2-2f907ab6775d", "d937b75f-a665-4480-88a5-2f20e9f9b22a", "1ca6bd18-0ba0-44ca-851c-92ed89a61085"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Imphash": {"refs": ["7aa7009a-28b9-4344-8c1f-159489a390df", "36d88494-1d43-4dc0-b3fa-35c8fea0ca9d", "8d63dadf-b91b-4187-87b6-34a1114577ea", "e8d34729-86a4-4140-adfd-0a29c2106307", "ca621ba5-54ab-4035-9942-d378e6fcde3c", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "f4264e47-f522-4c38-a420-04525d5b880f", "df55196f-f105-44d3-a675-e9dfb6cc2f2b", "729ce0ea-5d8f-4769-9762-e35de441586d"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "CurrentDirectory": {"refs": ["631b22a4-70f4-4e2f-9ea8-42f84d9df6d8", "d4ca7c59-e9e4-42d8-bf57-91a776efcb87", "95eadcb2-92e4-4ed1-9031-92547773a6db", "ed825c86-c009-4014-b413-b76003e33d35", "d3bf399f-b0cf-4250-8bb4-dfc192ab81dc", "02b18447-ea83-4b1b-8805-714a8a34546a", "3a6586ad-127a-4d3b-a677-1e6eacdf8fde"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "Provider_Name": {"refs": ["7dc2dedd-7603-461a-bc13-15803d132355"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "ParentUser": {"refs": ["590a5f4c-6c8c-4f10-8307-89afe9453a9d", "9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}, "LogonId": {"refs": ["d21374ff-f574-44a7-9998-4a8c8bf33d7d", "178e615d-e666-498b-9630-9ed363038101"], "logsource.categories": ["process_creation"], "logsource.products": ["windows"]}}}}} \ No newline at end of file