{ "cells": [ { "cell_type": "markdown", "id": "7087c10d-f964-45a2-a7f9-a96322882441", "metadata": {}, "source": [ "

Using Python to unearth a goldmine of threat intelligence from leaked chat logs

\n", "\n", "

Author: Thomas Roccia |@fr0gger_

" ] }, { "cell_type": "markdown", "id": "b9da4fcc-4575-45bf-9a5d-3f4dea060ac6", "metadata": {}, "source": [ "# Introduction" ] }, { "cell_type": "markdown", "id": "d1da37d1-8bb3-499b-b7d0-fc05dda9e86b", "metadata": {}, "source": [ "Dealing with a great amount of data can be time consuming, thus using Python can be very powerful to help analysts sort information and extract the most relevant data for their investigation. The open-source tools library, MSTICpy, for example, is a tool dedicated to threat intelligence. It aims to help threat analysts acquire, enrich, analyze, and visualize data. In this notebook, we will explore the data in depth using Python. We will dissect the available information and learn more about their process and operation. Eventually, we will see how we can take advantage of the available information to pivot and hunt for additional context and threat intelligence using the MSTICpy library. \n", "\n", "This notebook will allow analysts to reuse the code and continue to search for the extracted information on their own. Additionally, it offers an out-of-the-box methodology for analyzing chat logs, extracting indicators of compromise, and improving threat intelligence and defense process using Python." ] }, { "cell_type": "markdown", "id": "2e619fd0-e67e-4cc4-b40e-23f3616c85f3", "metadata": {}, "source": [ "# What is the goal of this Notebook?\n", "Through this notebook, we will explore the Conti Jabber leaks and provide a workflow of analysis using Python.\n", "\n", "The notebook is composed of the following parts:\n", "- The first part of this notebook will provide details of the available data as well as how to transform them for using it with Python and for Interpretation. \n", "- The second part will provide details about the Jabber logs as well as some visualization.\n", "- The third part will be dedicated to threat intelligence, extracting relevant IOCs and pivoting with the extracted data. " ] }, { "cell_type": "markdown", "id": "50110e5f-728a-4781-9d19-9072ca0b3100", "metadata": {}, "source": [ "# Configuration\n", "To use this notebook several library must be installed here is the list of the module, you can install them using pip. \n", "* pandas\n", "* msticpy\n", "* bokeh\n", "* pyvis\n", "* matplotlib\n", "* treelib\n", "* textsearch\n", "* ipywidgets\n", "* GoogleTranslator" ] }, { "cell_type": "markdown", "id": "83390cca-9002-4a4d-b18b-7afbd97cd337", "metadata": {}, "source": [ "# Exploring the Jabber Logs\n" ] }, { "cell_type": "markdown", "id": "2eabbc02-0be4-4c00-a3b9-ad1141ae6315", "metadata": {}, "source": [ "## Compiling and translating the data\n", "\n", "The leaked chat logs are written in the Russian language, requiring the data to be translated to English for analysis. We adopted the translation methodology published [here](https://twitter.com/AZobec/status/1498273950593392650?s=20&t=vHjpKwApde73B3x47Fk9Zg).. \n", "\n", "Since raw Jabber logs are saved using a file per day, they will need to be compiled in one JSON file so they can easily be manipulated with Python.\n", "`cat *.json | jq -cr > ../merged.json`\n", "\n", "Once the data is merged, they can be translated using the deep translator library. " ] }, { "cell_type": "code", "execution_count": null, "id": "439423ac-51a1-47f7-a19d-ee40ac61a747", "metadata": {}, "outputs": [], "source": [ "# Code borrowed and adapted from @azobec\n", "import json\n", "from deep_translator import GoogleTranslator\n", "\n", "# Creating the list\n", "chatList = []\n", "\n", "# opening the file merged.json\n", "with open('merged2.json', encoding=\"utf8\") as f:\n", " for jsonObj in f:\n", " logs = json.loads(jsonObj)\n", " chatList.append(logs)\n", "\n", "# Creating and adding the translated logs into translated_log.json.\n", "with open('translated_log3.json', 'a+', encoding=\"utf8\") as outfile:\n", " outfile.write(\"[\") \n", " for line in chatList:\n", " try:\n", " translation = GoogleTranslator(source='auto', target='en').translate(line[\"body\"])\n", " line[\"LANG-EN\"] = translation\n", " \n", " # When a translation is not possible we handle the error and write a message\n", " except Exception as e:\n", " line[\"LANG-EN\"] = \"Error during Translation\"\n", " \n", " outfile.write(json.dumps(line, ensure_ascii = False).encode('utf8').decode())\n", " outfile.write(\",\")\n", " outfile.write(\"]\") " ] }, { "cell_type": "markdown", "id": "d74ad0d0-2618-4268-9de2-20b76eef43f5", "metadata": {}, "source": [ " After the logs are translated and loaded into a new file, it’s then possible to load the data into a dataframe for manipulation and exploration." ] }, { "cell_type": "markdown", "id": "bb4c6a51-d7a2-4ba6-bbd2-54ec5b15072a", "metadata": {}, "source": [ "## Loading the translated logs into a dataframe" ] }, { "cell_type": "code", "execution_count": 1, "id": "e11bd9e9-ff4f-4a7f-88b2-8f9884727333", "metadata": {}, "outputs": [], "source": [ "# Loading the data in a dataframe\n", "import codecs\n", "import pandas as pd\n", "from IPython.display import Image\n", "\n", "df = pd.read_json(codecs.open('translated_Log2.json', 'r', 'utf-8'))" ] }, { "cell_type": "code", "execution_count": 2, "id": "419ed969-1fc6-47d9-a2f9-c3c53ffa6219", "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
tsfromtobodyLANG-EN
02021-01-29T00:06:46.929363mango@q3mcco35auwcstmt.onionstern@q3mcco35auwcstmt.onionпро битки не забудь, кош выше, я спать)don't forget about cue balls, kosh is higher, ...
12021-01-29T04:04:39.308133mango@q3mcco35auwcstmt.onionstern@q3mcco35auwcstmt.onionприветHey
22021-01-29T04:04:43.474243mango@q3mcco35auwcstmt.onionstern@q3mcco35auwcstmt.onionбитков не хватит на все..bits are not enough for everything ..
32021-01-29T04:32:02.648304price@q3mcco35auwcstmt.oniongreen@q3mcco35auwcstmt.onionпривет!!!Hey!!!
42021-01-29T04:32:16.858754price@q3mcco35auwcstmt.oniongreen@q3mcco35auwcstmt.onionопять прокладки сменились??? нет связи!have the pads changed again? no connection!
\n", "
" ], "text/plain": [ " ts from \\\n", "0 2021-01-29T00:06:46.929363 mango@q3mcco35auwcstmt.onion \n", "1 2021-01-29T04:04:39.308133 mango@q3mcco35auwcstmt.onion \n", "2 2021-01-29T04:04:43.474243 mango@q3mcco35auwcstmt.onion \n", "3 2021-01-29T04:32:02.648304 price@q3mcco35auwcstmt.onion \n", "4 2021-01-29T04:32:16.858754 price@q3mcco35auwcstmt.onion \n", "\n", " to body \\\n", "0 stern@q3mcco35auwcstmt.onion про битки не забудь, кош выше, я спать) \n", "1 stern@q3mcco35auwcstmt.onion привет \n", "2 stern@q3mcco35auwcstmt.onion битков не хватит на все.. \n", "3 green@q3mcco35auwcstmt.onion привет!!! \n", "4 green@q3mcco35auwcstmt.onion опять прокладки сменились??? нет связи! \n", "\n", " LANG-EN \n", "0 don't forget about cue balls, kosh is higher, ... \n", "1 Hey \n", "2 bits are not enough for everything .. \n", "3 Hey!!! \n", "4 have the pads changed again? no connection! " ] }, "execution_count": 2, "metadata": {}, "output_type": "execute_result" } ], "source": [ "# Print some information about the loaded dataframe\n", "df.head()" ] }, { "cell_type": "markdown", "id": "014e36d7-c6d5-4b54-99ac-ce538412101a", "metadata": {}, "source": [ "## Slang translation" ] }, { "cell_type": "markdown", "id": "409d4486-6d08-4668-b4fa-302faffb31ee", "metadata": {}, "source": [ "Russian slang words not properly translated by the automated process can be translated by creating a dictionary. A dictionary off a list proposed [here](https://twitter.com/seadev3/status/1498783071969099777?s=20&t=tIrZJsDdonKfyxAoEKJOQw) was used in this case to correctly translate the slang: " ] }, { "cell_type": "code", "execution_count": 3, "id": "9442693b-8f33-466e-9fac-8135871d9e62", "metadata": {}, "outputs": [ { "data": { "text/plain": [ "0 don't forget about bitcoin, cash is higher, I'...\n", "1 Hey\n", "2 bits are not enough for everything ..\n", "3 Hey!!!\n", "4 have the pads changed again? no connection!\n", "5 Hey\n", "6 hello sn today I'm waiting for cash and the am...\n", "7 Hey\n", "8 bc1qy2083z665ux68zda3tfuh5xed2493uaj8whdwv - 0...\n", "9 moment\n", "Name: LANG-EN, dtype: object" ] }, "execution_count": 3, "metadata": {}, "output_type": "execute_result" } ], "source": [ "# Creating a dictionnary with the translated slang words\n", "slang = {\"Hell\": \"AD\", \"YES\": \"DA\", \"wheelbarrow\": \"host\", \"cars\": \"hosts\", \"cue balls\": \"bitcoin\", \"credits\":\"credentials\", \"vmik\":\"WMIC\", \"grid\":\"network\", \"facial expressions\":\"mimikatz\", \"firework\":\"firewall\", \"whining\":\"SQL\", \"school\":\"SQL\", \"balls\":\"shares\", \"zithers\":\"Citrix\", \"food\":\"FUD\", \"silkcode\":\"shellcode\", \"kosh\":\"cash\", \"toad\":\"jabber\", \"booze\":\"Emotet\", \"the trick or trick\": \"Trickbot\", \"BC\":\"BazarBackdoor\", \"backpack\":\"Ryuk\", \"lock\":\"ransomware\"}\n", "\n", "# Replacing the words in the translated column\n", "df['LANG-EN'] = df['LANG-EN'].replace(slang, regex=True)\n", "df['LANG-EN'].head(10)" ] }, { "cell_type": "markdown", "id": "cdfc3b4d-bec5-41f2-8043-6d73709367ba", "metadata": {}, "source": [ "## Analyzing the chat activity timeline " ] }, { "cell_type": "code", "execution_count": 4, "id": "72323abf-d8e8-4c8e-bc4e-c053c19b85e0", "metadata": {}, "outputs": [ { "data": { "text/plain": [ "" ] }, "execution_count": 4, "metadata": {}, "output_type": "execute_result" }, { "data": { "image/png": "iVBORw0KGgoAAAANSUhEUgAAFfoAAAK8CAYAAAAZ08rsAAAAOXRFWHRTb2Z0d2FyZQBNYXRwbG90bGliIHZlcnNpb24zLjQuMywgaHR0cHM6Ly9tYXRwbG90bGliLm9yZy/MnkTPAAAACXBIWXMAAAsTAAALEwEAmpwYAADoo0lEQVR4nOzcf7SdVX3n8c/3cpEoUMAQqSGUxII1UnTGib+1Y8EqFAVnlrpASEGoFseK0mVr1DVDR2uNi3bwV9FxRESroMvWkSW2Co7UsQU1tAyK6JBihCBoTEBFjRrd88d9whyvuSS5O8nJDa/XWnflnP3s/Zzvc+/5M+tdrbUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAszMx7gEAAAAAAAAAAAAAAAAAAAAAAAAAAABgLhP6BQAAAAAAAAAAAAAAAAAAAAAAAAAAgA5CvwAAAAAAAAAAAAAAAAAAAAAAAAAAANBB6BcAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CP0CAAAAAAAAAAAAAAAAAAAAAAAAAABAB6FfAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CD0CwAAAAAAAAAAAMD9SlW9t6r+bEyfXVV1cVXdVVVf2Ib9i6uqVdXk8P7vqur0nT/ptqmqX6uqe6pqr3HP0quq1lTV08c9BwAAAAAAAAAAAABz0+S4BwAAAAAAAAAAAADg/q2q1iR5UJIlrbUfDGu/n+S01trTxjjazvCUJL+TZNHmZ90erbXjd/xIs9dauzXJfuOeAwAAAAAAAAAAAADGbWLcAwAAAAAAAAAAAABAkr2SvHzcQ2yvqtprO48cnmTNbCK/zE5VTY57BgAAAAAAAAAAAAD2fEK/AAAAAAAAAAAAAOwOzk/yyqo6cPqFqlpcVW002FpVV1fV7w+vz6iqf6yqC6rq7qq6paqeNKzfVlXfrqrTp9324Kq6sqq+X1X/UFWHj9z7EcO1DVX1tap6/si191bVO6rqE1X1gyS/vYV5F1bV5cP51VX1omH9rCTvTvLEqrqnqv7rFs7uVVV/UVXfqapbkpww7frocx8xzP7dYf+HRvYdNfIM36qq14zM/2cj+55WVWtH3r+qqm4ffi9fq6pjh/XHVdWqqvrecL//tqW/zUzPPlz706r6cFW9b7j/jVW1bPrvYGR/q6pzhr/nd6rq/KqaGLl+ZlXdVFV3VdUnp/0NW1W9tKpuTnLzDPdfXlXfqKr1VfXaadceV1XXDN+nO6rq7VX1gOHaX1XVX07bf3lVnTvTswAAAAAAAAAAAACw5xP6BQAAAAAAAAAAAGB3sCrJ1UleOcvzj09yQ5L5ST6Y5LIkj01yRJLTkry9qvYb2X9qktcnOTjJ9Uk+kCRVtW+SK4d7PCTJyUkurKpHjpx9QZI3JNk/yee2MMtlSdYmWZjkuUn+vKqOaa1dlOTsJNe01vZrrZ23hbMvSvKsJP82ybLh/Exen+RTSQ5KsijJ24Zn2D/JVUn+fpjhiCSfvo/7ZDj3G0n+MMljW2v7J3lmkjXD5bckeUtr7VeS/HqSD89wmy0++8j1E4c9Bya5PMnbtzLWf8jU7+ExSU5KcuYw60lJXpPkPyZZkOR/J7l02tnnZOp78chp6xn+nu9IsnyYdX6mfoeb/SzJuZn6fjwxybFJ/tNw7ZIkp2yODlfVwUmenqnvDAAAAAAAAAAAAAD3U0K/AAAAAAAAAAAAAOwu/kuSl1XVglmc/Xpr7eLW2s+SfCjJYUle11r7cWvtU0l+kqng7WZXtNY+21r7cZLXJnliVR2WqcjumuFem1pr/5Lkb5I8b+Tsx1pr/9ha+3lrbePoEMM9npzkVa21ja2165O8O8nvbeNzPD/Jm1trt7XWNiR5433s/WmSw5MsHD5rc3T4WUnubK395bD+/dba57fhs3+WZJ8kj6yqvVtra1pr/zryWUdU1cGttXtaa9dOP7yNz/651tonhr/T+5M8eiszvam1tqG1dmuSNyc5ZVg/O8kbW2s3tdY2JfnzJP+mqg4fOfvG4eyPtnDf5yb5+Mh34D8n+fnmi62161pr1w7fgTVJ/nuSfz9c+0KS72Yq/ptMxaCvbq19ayvPAgAAAAAAAAAAAMAeTOgXAAAAAAAAAAAAgN1Ca+3LST6eZMUsjo9GVn803G/62n4j728b+dx7kmxIsjBT4dzHV9Xdm3+SnJrkV7d0dgsWJtnQWvv+yNo3khy6jc+xcNr9v3Efe/8kSSX5QlXdWFVnDuuHJfnXmY9tWWttdZJXJPnTJN+uqsuqauFw+awkD0/y1ar6YlU9a4bZt/bsd468/mGSeVU1eR9jTf9dbJ7n8CRvGfkbbcjU7+LQGc5uadbR78APkqzf/L6qHl5VH6+qO6vqe5kKCR88cv6SJKcNr0/LVLQYAAAAAAAAAAAAgPsxoV8AAAAAAAAAAAAAdifnJXlRfjHY+oPh3weNrI2Gd2fjsM0vqmq/JA9O8s1MxV//obV24MjPfq21l4ycbfdx328meXBV7T+y9mtJbt/Gue4YnW04u0WttTtbay9qrS1M8gdJLqyqI4ZneNgMx36Q+/g9ttY+2Fp7SqZCui3Jm4b1m1trpyR5yLD2karad9q9e599S6b/Lr45vL4tyR9M+zs9sLX2T6OPcx/3/YXfc1U9KMn8kevvSPLVJEe21n4lyWsyFRLe7K+TnFRVj06yNMn/3L7HAgAAAAAAAAAAAGBPI/QLAAAAAAAAAAAAwG6jtbY6yYeSnDOyti5TsdjTqmqvqjozya93ftTvVtVTquoBSV6f5NrW2m1JPp7k4VW1vKr2Hn4eW1VLt3H+25L8U5I3VtW8qnpUkrMyFYbdFh9Ock5VLaqqg5KsmGljVT2vqhYNb+/KVNj258MzPLSqXlFV+1TV/lX1+GHf9cOzP7iqfjXJK0bu9xtVdUxV7ZNkY5IfDfdLVZ1WVQtaaz9Pcvdw5Oc7+Nm35I+r6qCqOizJyzP13UiSdyZ5dVUdNcx3QFU9bzvu+5Ekzxr5Drwuv/h/q/dP8r0k91TVI5KMhp7TWlub5ItJ3p/kb1prP5rFswEAAAAAAAAAAACwBxH6BQAAAAAAAAAAAGB387ok+05be1GSP06yPslRmQrK9vhgkvOSbEjy75KcliStte8neUaSk5N8M8mdSd6UZJ/tuPcpSRYP5z+a5LzW2lXbePZ/JPlkkv+T5J+T/O197H1sks9X1T1JLk/y8tbaLcMz/E6SZw/z35zkt4cz7x/uvSbJp/L/w7nJ1DOuTPKd4dxDkrx6uHZckhuHz3pLkpNniNv2PPuWfCzJdZkKFF+R5KIkaa19NFN/l8uq6ntJvpzk+G29aWvtxiQvzdT34I5MhZLXjmx5ZZIXJPl+pv4mH5p+jySXJDk6U79TAAAAAAAAAAAAAO7nqrU27hkAAAAAAAAAAAAAAH5BVbUkR7bWVo97li2pqt9K8tdJDm/+UzYAAAAAAAAAAADA/d7EuAcAAAAAAAAAAAAAAJhLqmrvJC9P8m6RXwAAAAAAAAAAAAASoV8AAAAAAAAAAAAAgG1WVUuT3J3koUnePNZhAAAAAAAAAAAAANhtVGtt3DMAAAAAAAAAAAAAAAAAAAAAAAAAAADAnDUx7gEAAAAAAAAAAAAAAAAAAAAAAAAAAABgLhP6BQAAAAAAAAAAAAAAAAAAAAAAAAAAgA6T4x7gvhx88MFt8eLF4x4DAAAAAAAAAAAAAAAAAAAAAAAAAACA+7nrrrvuO621BVu6tluHfhcvXpxVq1aNewwAAAAAAAAAAAAAAAAAAAAAAAAAAADu56rqGzNdm9iVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAMCeRugXAAAAAAAAAAAAAAAAAAAAAAAAAAAAOgj9AgAAAAAAAAAAAAAAAAAAAAAAAAAAQIfJcQ8AAAAAAAAAAAAAAAAAAAAAAAAAAADA7u+nP/1p1q5dm40bN457lJ1q3rx5WbRoUfbee+9tPiP0CwAAAAAAAAAAAAAAAAAAAAAAAAAAwFatXbs2+++/fxYvXpyqGvc4O0VrLevXr8/atWuzZMmSbT43sRNnAgAAAAAAAAAAAAAAAAAAAAAAAAAAYA+xcePGzJ8/f4+N/CZJVWX+/PnZuHHjdp0T+gUAAAAAAAAAAAAAAAAAAAAAAAAAAGCb7MmR381m84xCvwAAAAAAAAAAAAAAAAAAAAAAAAAAAMwZb33rW7N06dKceuqp4x7lXpPjHgAAAAAAAAAAAAAAAAAAAAAAAAAAAIC5Z/GKK3bo/dasPGGb9l144YW56qqrsmjRonvXNm3alMnJ8eV2J8b2yQAAAAAAAAAAAAAAAAAAAAAAAAAAALAdzj777Nxyyy05/vjjc8ABB2T58uV58pOfnOXLl2fNmjU55phj8qhHPSrHHntsbr311iTJGWeckZe85CV5whOekIc97GG5+uqrc+aZZ2bp0qU544wzdshcQr8AAAAAAAAAAAAAAAAAAAAAAAAAAADMCe985zuzcOHCfOYzn8m5556br3zlK7nqqqty6aWX5mUve1lOP/303HDDDTn11FNzzjnn3HvurrvuyjXXXJMLLrggJ554Ys4999zceOON+dKXvpTrr7++ey6hXwAAAAAAAAAAAAAAAAAAAAAAAAAAAOakE088MQ984AOTJNdcc01e8IIXJEmWL1+ez33uc/fue/azn52qytFHH51DDjkkRx99dCYmJnLUUUdlzZo13XMI/QIAAAAAAAAAAAAAAAAAAAAAAAAAADAn7bvvvtu0b5999kmSTExM3Pt68/tNmzZ1zyH0CwAAAAAAAAAAAAAAAAAAAAAAAAAAwJz3pCc9KZdddlmS5AMf+ECe+tSn7rLPntxlnwQAAAAAAAAAAAAAAAAAAAAAAAAAAAA7ydve9ra88IUvzPnnn58FCxbk4osv3mWfXa21XfZh22vZsmVt1apV4x4DAAAAAAAAAAAAAAAAAAAAAAAAAADgfu+mm27K0qVLxz3GLrGlZ62q61pry7a0f2KXTAUAAAAAAAAAAAAAAAAAAAAAAAAAAAB7KKFfAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CD0CwAAAAAAAAAAAAAAAAAAAAAAAAAAAB2EfgEAAAAAAAAAAAAAAAAAAAAAAAAAANgmrbVxj7DTzeYZhX4BAAAAAAAAAAAAAAAAAAAAAAAAAADYqnnz5mX9+vV7dOy3tZb169dn3rx523VucifNAwAAAAAAAAAAAAAAAAAAAAAAAAAAwB5k0aJFWbt2bdatWzfuUXaqefPmZdGiRdt1RugXAAAAAAAAAAAAAAAAAAAAAAAAAACArdp7772zZMmScY+xW5oY9wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwl02OewAAAAAAAAAAAAAAAHZvi1dcMeO1NStP2IWTAAAAAAAAAAAAAOyeJsY9AAAAAAAAAAAAAAAAAAAAAAAAAAAAAMxlQr8AAAAAAAAAAAAAAAAAAAAAAAAAAADQQegXAAAAAAAAAAAAAAAAAAAAAAAAAAAAOgj9AgAAAAAAAAAAAAAAAAAAAAAAAAAAQAehXwAAAAAAAAAAAAAAAAAAAAAAAAAAAOgg9AsAAAAAAAAAAAAAAAAAAAAAAAAAAAAdhH4BAAAAAAAAAAAAAAAAAAAAAAAAAACgg9AvAAAAAAAAAAAAAAAAAAAAAAAAAAAAdBD6BQAAAAAAAAAAAAAAAAAAAAAAAAAAgA5CvwAAAAAAAAAAAAAAAAAAAAAAAAAAANBB6BcAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CP0CAAAAAAAAAAAAAAAAAAAAAAAAAABAB6FfAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CD0CwAAAAAAAAAAAAAAAAAAAAAAAAAAAB2EfgEAAAAAAAAAAAAAAAAAAAAAAAAAAKCD0C8AAAAAAAAAAAAAAAAAAAAAAAAAAAB0EPoFAAAAAAAAAAAAAAAAAAAAAAAAAACADkK/AAAAAAAAAAAAAAAAAAAAAAAAAAAA0EHoFwAAAAAAAAAAAAAAAAAAAAAAAAAAADoI/QIAAAAAAAAAAAAAAAAAAAAAAAAAAEAHoV8AAAAAAAAAAAAAAAAAAAAAAAAAAADoIPQLAAAAAAAAAAAAAAAAAAAAAAAAAAAAHYR+AQAAAAAAAAAAAAAAAAAAAAAAAAAAoIPQLwAAAAAAAAAAAAAAAAAAAAAAAAAAAHQQ+gUAAAAAAAAAAAAAAAAAAAAAAAAAAIAOQr8AAAAAAAAAAAAAAAAAAAAAAAAAAADQQegXAAAAAAAAAAAAAAAAAAAAAAAAAAAAOgj9AgAAAAAAAAAAAAAAAAAAAAAAAAAAQAehXwAAAAAAAAAAAAAAAAAAAAAAAAAAAOgg9AsAAAAAAAAAAAAAAAAAAAAAAAAAAAAdhH4BAAAAAAAAAAAAAAAAAAAAAAAAAACgw1ZDv1X1nqr6dlV9eWTt/Kr6alXdUFUfraoDR669uqpWV9XXquqZI+vHDWurq2rFDn8SAAAAAAAAAAAAAAAAAAAAAAAAAAAAGIOthn6TvDfJcdPWrkzym621RyX5v0lenSRV9cgkJyc5ajhzYVXtVVV7JfmrJMcneWSSU4a9AAAAAAAAAAAAAAAAAAAAAAAAAAAAMKdtNfTbWvtskg3T1j7VWts0vL02yaLh9UlJLmut/bi19vUkq5M8bvhZ3Vq7pbX2kySXDXsBAAAAAAAAAAAAAAAAAAAAAAAAAABgTttq6HcbnJnk74bXhya5beTa2mFtpnUAAAAAAAAAAAAAAAAAAAAAAAAAAACY07pCv1X12iSbknxgx4yTVNWLq2pVVa1at27djrotAAAAAAAAAAAAAAAAAAAAAAAAAAAA7BSzDv1W1RlJnpXk1NZaG5ZvT3LYyLZFw9pM67+ktfau1tqy1tqyBQsWzHY8AAAAAAAAAAAAAAAAAAAAAAAAAAAA2CVmFfqtquOS/EmSE1trPxy5dHmSk6tqn6pakuTIJF9I8sUkR1bVkqp6QJKTh70AAAAAAAAAAAAAAAAAAAAAAAAAAAAwp01ubUNVXZrkaUkOrqq1Sc5L8uok+yS5sqqS5NrW2tmttRur6sNJvpJkU5KXttZ+NtznD5N8MsleSd7TWrtxJzwPAAAAAAAAAAAAAAAAAAAAAAAAAAAA7FJbDf221k7ZwvJF97H/DUnesIX1TyT5xHZNBwAAAAAAAAAAAAAAAAAAAAAAAAAAALu5iXEPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHOZ0C8AAAAAAAAAAAAAAAAAAAAAAAAAAAB0EPoFAAAAAAAAAAAAAAAAAAAAAAAAAACADkK/AAAAAAAAAAAAAAAAAAAAAAAAAAAA0EHoFwAAAAAAAAAAAAAAAAAAAAAAAAAAADoI/QIAAAAAAAAAAAAAAAAAAAAAAAAAAEAHoV8AAAAAAAAAAAAAAAAAAAAAAAAAAADoIPQLAAAAAAAAAAAAAAAAAAAAAAAAAAAAHYR+AQAAAAAAAAAAAAAAAAAAAAAAAAAAoIPQLwAAAAAAAAAAAAAAAAAAAAAAAAAAAHQQ+gUAAAAAAAAAAAAAAAAAAAAAAAAAAIAOQr8AAAAAAAAAAAAAAAAAAAAAAAAAAADQYXLcAwAAAAAAAAAAAAAAwDgtXnHFjNfWrDxhF04CAAAAAAAAAAAAzFUT4x4AAAAAAAAAAAAAAAAAAAAAAAAAAAAA5jKhXwAAAAAAAAAAAAAAAAAAAAAAAAAAAOgg9AsAAAAAAAAAAAAAAAAAAAAAAAAAAAAdhH4BAAAAAAAAAAAAAAAAAAAAAAAAAACgg9AvAAAAAAAAAAAAAAAAAAAAAAAAAAAAdBD6BQAAAAAAAAAAAAAAAAAAAAAAAAAAgA5CvwAAAAAAAAAAAAAAAAAAAAAAAAAAANBB6BcAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CP0CAAAAAAAAAAAAAAAAAAAAAAAAAABAB6FfAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CD0CwAAAAAAAAAAAAAAAAAAAAAAAAAAAB2EfgEAAAAAAAAAAAAAAAAAAAAAAAAAAKCD0C8AAAAAAAAAAAAAAAAAAAAAAAAAAAB0EPoFAAAAAAAAAAAAAAAAAAAAAAAAAACADkK/AAAAAAAAAAAAAAAAAAAAAAAAAAAA0EHoFwAAAAAAAAAAAAAAAAAAAAAAAAAAADoI/QIAAAAAAAAAAAAAAAAAAAAAAAAAAEAHoV8AAAAAAAAAAAAAAAAAAAAAAAAAAADoIPQLAAAAAAAAAAAAAAAAAAAAAAAAAAAAHYR+AQAAAAAAAAAAAAAAAAAAAAAAAAAAoIPQLwAAAAAAAAAAAAAAAAAAAAAAAAAAAHQQ+gUAAAAAAAAAAAAAAAAAAAAAAAAAAIAOQr8AAAAAAAAAAAAAAAAAAAAAAAAAAADQQegXAAAAAAAAAAAAAAAAAAAAAAAAAAAAOgj9AgAAAAAAAAAAAAAAAAAAAAAAAAAAQAehXwAAAAAAAAAAAAAAAAAAAAAAAAAAAOgg9AsAAAAAAAAAAAAAAAAAAAAAAAAAAAAdhH4BAAAAAAAAAAAAAAAAAAAAAAAAAACgg9AvAAAAAAAAAAAAAAAAAAAAAAAAAAAAdBD6BQAAAAAAAAAAAAAAAAAAAAAAAAAAgA5CvwAAAAAAAAAAAAAAAAAAAAAAAAAAANBB6BcAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CP0CAAAAAAAAAAAAAAAAAAAAAAAAAABAB6FfAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CD0CwAAAAAAAAAAAAAAAAAAAAAAAAAAAB2EfgEAAAAAAAAAAAAAAAAAAAAAAAAAAKCD0C8AAAAAAAAAAAAAAAAAAAAAAAAAAAB0EPoFAAAAAAAAAAAAAAAAAAAAAAAAAACADkK/AAAAAAAAAAAAAAAAAAAAAAAAAAAA0EHoFwAAAAAAAAAAAAAAAAAAAAAAAAAAADoI/QIAAAAAAAAAAAAAAAAAAAAAAAAAAEAHoV8AAAAAAAAAAAAAAAAAAAAAAAAAAADoIPQLAAAAAAAAAAAAAAAAAAAAAAAAAAAAHYR+AQAAAAAAAAAAAAAAAAAAAAAAAAAAoIPQLwAAAAAAAAAAAAAAAAAAAAAAAAAAAHQQ+gUAAAAAAAAAAAAAAAAAAAAAAAAAAIAOQr8AAAAAAAAAAAAAAAAAAAAAAAAAAADQQegXAAAAAAAAAAAAAAAAAAAAAAAAAAAAOgj9AgAAAAAAAAAAAAAAAAAAAAAAAAAAQAehXwAAAAAAAAAAAAAAAAAAAAAAAAAAAOgg9AsAAAAAAAAAAAAAAAAAAAAAAAAAAAAdhH4BAAAAAAAAAAAAAAAAAAAAAAAAAACgg9AvAAAAAAAAAAAAAAAAAAAAAAAAAAAAdBD6BQAAAAAAAAAAAAAAAAAAAAAAAAAAgA5CvwAAAAAAAAAAAAAAAAAAAAAAAAAAANBB6BcAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CP0CAAAAAAAAAAAAAAAAAAAAAAAAAABAB6FfAAAAAAAAAAAAAAAAAAAAAAAAAAAA6LDV0G9Vvaeqvl1VXx5Ze3BVXVlVNw//HjSsV1W9tapWV9UNVfWYkTOnD/tvrqrTd87jAAAAAAAAAAAAAAAAAAAAAAAAAAAAwK611dBvkvcmOW7a2ookn26tHZnk08P7JDk+yZHDz4uTvCOZCgMnOS/J45M8Lsl5m+PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMJdtNfTbWvtskg3Tlk9Kcsnw+pIkzxlZf1+bcm2SA6vqoUmemeTK1tqG1tpdSa7ML8eDAQAAAAAAAAAAAAAAAAAAAAAAAAAAYM7Zauh3Boe01u4YXt+Z5JDh9aFJbhvZt3ZYm2kdAAAAAAAAAAAAAAAAAAAAAAAAAAAA5rTZhn7v1VprSdoOmCVJUlUvrqpVVbVq3bp1O+q2AAAAAAAAAAAAAAAAAAAAAAAAAAAAsFPMNvT7rap6aJIM/357WL89yWEj+xYNazOt/5LW2rtaa8taa8sWLFgwy/EAAAAAAAAAAAAAAAAAAAAAAAAAAABg15ht6PfyJKcPr09P8rGR9d+rKU9I8t3W2h1JPpnkGVV1UFUdlOQZwxoAAAAAAAAAAAAAAAAAAAAAAAAAAADMaZNb21BVlyZ5WpKDq2ptkvOSrEzy4ao6K8k3kjx/2P6JJL+bZHWSHyZ5YZK01jZU1euTfHHY97rW2oYd+BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAwFlsN/bbWTpnh0rFb2NuSvHSG+7wnyXu2azoAAAAAAAAAAAAAAAAAAAAAAAAAAADYzU2MewAAAAAAAAAAAAAAAAAAAAAAAAAAAACYy4R+AQAAAAAAAAAAAAAAAAAAAAAAAAAAoIPQLwAAAAAAAAAAAAAAAAAAAAAAAAAAAHQQ+gUAAAAAAAAAAAAAAAAAAAAAAAAAAIAOQr8AAAAAAAAAAAAAAAAAAAAAAAAAAADQYXLcAwAAAAAAAAAAAAAAwI6weMUVM15bs/KEXTgJAAAAAAAAAAAAcH8zMe4BAAAAAAAAAAAAAAAAAAAAAAAAAAAAYC6bHPcAAAAAAAAAAAAAAAAAAAAAALC7WrziihmvrVl5wi6cBAAAAADYnU2MewAAAAAAAAAAAAAAAAAAAAAAAAAAAACYy4R+AQAAAAAAAAAAAAAAAAAAAAAAAAAAoIPQLwAAAAAAAAAAAAAAAAAAAAAAAAAAAHQQ+gUAAAAAAAAAAAAAAAAAAAAAAAAAAIAOQr8AAAAAAAAAAAAAAAAAAAAAAAAAAADQQegXAAAAAAAAAAAAAAAAAAAAAAAAAAAAOgj9AgAAAAAAAAAAAAAAAAAAAAAAAAAAQAehXwAAAAAAAAAAAAAAAAAAAAAAAAAAAOgg9AsAAAAAAAAAAAAAAAAAAAAAAAAAAAAdhH4BAAAAAAAAAAAAAAAAAAAAAAAAAACgg9AvAAAAAAAAAAAAAAAAAAAAAAAAAAAAdBD6BQAAAAAAAAAAAAAAAAAAAAAAAAAAgA5CvwAAAAAAAAAAAAAAAAAAAAAAAAAAANBB6BcAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CP0CAAAAAAAAAAAAAAAAAAAAAAAAAABAB6FfAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CD0CwAAAAAAAAAAAAAAAAAAAAAAAAAAAB2EfgEAAAAAAAAAAAAAAAAAAAAAAAAAAKCD0C8AAAAAAAAAAAAAAAAAAAAAAAAAAAB0EPoFAAAAAAAAAAAAAAAAAAAAAAAAAACADkK/AAAAAAAAAAAAAAAAAAAAAAAAAAAA0EHoFwAAAAAAAAAAAAAAAAAAAAAAAAAAADoI/QIAAAAAAAAAAAAAAAAAAAAAAAAAAEAHoV8AAAAAAAAAAAAAAAAAAAAAAAAAAADoIPQLAAAAAAAAAAAAAAAAAAAAAAAAAAAAHYR+AQAAAAAAAAAAAAAAAAAAAAAAAAAAoIPQLwAAAAAAAAAAAAAAAAAAAAAAAAAAAHQQ+gUAAAAAAAAAAAAAAAAAAAAAAAAAAIAOQr8AAAAAAAAAAAAAAAAAAAAAAAAAAADQQegXAAAAAAAAAAAAAAAAAAAAAAAAAAAAOgj9AgAAAAAAAAAAAAAAAAAAAAAAAAAAQAehXwAAAAAAAAAAAAAAAAAAAAAAAAAAAOgg9AsAAAAAAAAAAAAAAAAAAAAAAAAAAAAdhH4BAAAAAAAAAAAAAAAAAAAAAAAAAACgg9AvAAAAAAAAAAAAAAAAAAAAAAAAAAAAdBD6BQAAAAAAAAAAAAAAAAAAAAAAAAAAgA5CvwAAAAAAAAAAAAAAAAAAAAAAAAAAANBB6BcAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CP0CAAAAAAAAAAAAAAAAAAAAAAAAAABAB6FfAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CD0CwAAAAAAAAAAAAAAAAAAAAAAAAAAAB2EfgEAAAAAAAAAAAAAAAAAAAAAAAAAAKCD0C8AAAAAAAAAAAAAAAAAAAAAAAAAAAB0EPoFAAAAAAAAAAAAAAAAAAAAAAAAAACADkK/AAAAAAAAAAAAAAAAAAAAAAAAAAAA0EHoFwAAAAAAAAAAAAAAAAAAAAAAAAAAADpMjnsAAAAAAAAAAAAAAAAAAAD2XItXXDHjtTUrT9iFkwAAAAAAAADsPBPjHgAAAAAAAAAAAAAAAAAAAAAAAAAAAADmMqFfAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CD0CwAAAAAAAAAAAAAAAAAAAAAAAAAAAB2EfgEAAAAAAAAAAAAAAAAAAAAAAAAAAKCD0C8AAAAAAAAAAAAAAAAAAAAAAAAAAAB0EPoFAAAAAAAAAAAAAAAAAAAAAAAAAACADkK/AAAAAAAAAAAAAAAAAAAAAAAAAAAA0EHoFwAAAAAAAAAAAAAAAAAAAAAAAAAAADoI/QIAAAAAAAAAAAAAAAAAAAAAAAAAAEAHoV8AAAAAAAAAAAAAAAAAAAAAAAAAAADoIPQLAAAAAAAAAAAAAAAAAAAAAAAAAAAAHYR+AQAAAAAAAAAAAAAAAAAAAAAAAAAAoIPQLwAAAAAAAAAAAAAAAAAAAAAAAAAAAHQQ+gUAAAAAAAAAAAAAAAAAAAAAAAAAAIAOQr8AAAAAAAAAAAAAAAAAAAAAAAAAAADQQegXAAAAAAAAAAAAAAAAAAAAAAAAAAAAOnSFfqvq3Kq6saq+XFWXVtW8qlpSVZ+vqtVV9aGqesCwd5/h/erh+uId8gQAAAAAAAAAAAAAAAAAAAAAAAAAAAAwRrMO/VbVoUnOSbKstfabSfZKcnKSNyW5oLV2RJK7kpw1HDkryV3D+gXDPgAAAAAAAAAAAAAAAAAAAAAAAAAAAJjTZh36HUwmeWBVTSZ5UJI7khyT5CPD9UuSPGd4fdLwPsP1Y6uqOj8fAAAAAAAAAAAAAAAAAAAAAAAAAAAAxmrWod/W2u1J/iLJrZkK/H43yXVJ7m6tbRq2rU1y6PD60CS3DWc3Dfvnz/bzAQAAAAAAAAAAAAAAAAAAAAAAAAAAYHcw69BvVR2U5KQkS5IsTLJvkuN6B6qqF1fVqqpatW7dut7bAQAAAAAAAAAAAAAAAAAAAAAAAAAAwE4169Bvkqcn+XprbV1r7adJ/jbJk5McWFWTw55FSW4fXt+e5LAkGa4fkGT99Ju21t7VWlvWWlu2YMGCjvEAAAAAAAAAAAAAAAAAAAAAAAAAAABg5+sJ/d6a5AlV9aCqqiTHJvlKks8kee6w5/QkHxteXz68z3D9f7XWWsfnAwAAAAAAAAAAAAAAAAAAAAAAAAAAwNjNOvTbWvt8ko8k+eckXxru9a4kr0ryR1W1Osn8JBcNRy5KMn9Y/6MkKzrmBgAAAAAAAAAAAAAAAAAAAAAAAAAAgN3CZM/h1tp5Sc6btnxLksdtYe/GJM/r+TwAAAAAAAAAAAAAAAAAAAAAAAAAAADY3UyMewAAAAAAAAAAAAAAAAAAAAAAAAAAAACYy4R+AQAAAAAAAAAAAAAAAAAAAAAAAAAAoIPQLwAAAAAAAAAAAAAAAAAAAAAAAAAAAHQQ+gUAAAAAAAAAAAAAAAAAAAAAAAAAAIAOQr8AAAAAAAAAAAAAAAAAAAAAAAAAAADQQegXAAAAAAAAAAAAAAAAAAAAAAAAAAAAOgj9AgAAAAAAAAAAAAAAAAAAAAAAAAAAQAehXwAAAAAAAAAAAAAAAAAAAAAAAAAAAOgg9AsAAAAAAAAAAAAAAAAAAAAAAAAAAAAdhH4BAAAAAAAAAAAAAAAAAAAAAAAAAACgg9AvAAAAAAAAAAAAAAAAAAAAAAAAAAAAdBD6BQAAAAAAAAAAAAAAAAAAAAAAAAAAgA5CvwAAAAAAAAAAAAAAAAAAAAAAAAAAANBB6BcAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CP0CAAAAAAAAAAAAAAAAAAAAAAAAAABAB6FfAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CD0CwAAAAAAAAAAAAAAAAAAAAAAAAAAAB2EfgEAAAAAAAAAAAAAAAAAAAAAAAAAAKCD0C8AAAAAAAAAAAAAAAAAAAAAAAAAAAB0EPoFAAAAAAAAAAAAAAAAAAAAAAAAAACADkK/AAAAAAAAAAAAAAAAAAAAAAAAAAAA0EHoFwAAAAAAAAAAAAAAAAAAAAAAAAAAADoI/QIAAAAAAAAAAAAAAAAAAAAAAAAAAECHyXEPAAAAAAAAAAAAAAAAAAAAALCnWrziihmvrVl5wi6cBAAAAACAnWli3AMAAAAAAAAAAAAAAAAAAAAAAAAAAADAXCb0CwAAAAAAAAAAAAAAAAAAAAAAAAAAAB2EfgEAAAAAAAAAAAAAAAAAAAAAAAAAAKCD0C8AAAAAAAAAAAAAAAAAAAAAAAAAAAB0EPoFAAAAAAAAAAAAAAAAAAAAAAAAAACADkK/AAAAAAAAAAAAAAAAAAAAAAAAAAAA0EHoFwAAAAAAAAAAAAAAAAAAAAAAAAAAADoI/QIAAAAAAAAAAAAAAAAAAAAAAAAAAEAHoV8AAAAAAAAAAAAAAAAAAAAAAAAAAADoMDnuAQAAAAAAAAAAAAAA4P5k8YorZry2ZuUJu3ASAAAAAAAAAAAAYEeZGPcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMJcJ/QIAAAAAAAAAAAAAAAAAAAAAAAAAAEAHoV8AAAAAAAAAAAAAAAAAAAAAAAAAAADoIPQLAAAAAAAAAAAAAAAAAAAAAAAAAAAAHYR+AQAAAAAAAAAAAAAAAAAAAAAAAAAAoIPQLwAAAAAAAAAAAAAAAAAAAAAAAAAAAHQQ+gUAAAAAAAAAAAAAAAAAAAAAAAAAAIAOQr8AAAAAAAAAAAAAAAAAAAAAAAAAAADQQegXAAAAAAAAAAAAAAAAAAAAAAAAAAAAOgj9AgAAAAAAAAAAAAAAAAAAAAAAAAAAQAehXwAAAAAAAAAAAAAAAAAAAAAAAAAAAOgg9AsAAAAAAAAAAAAAAAAAAAAAAAAAAAAdhH4BAAAAAAAAAAAAAAAAAAAAAAAAAACgg9AvAAAAAAAAAAAAAAAAAAAAAAAAAAAAdBD6BQAAAAAAAAAAAAAAAAAAAAAAAAAAgA5CvwAAAAAAAAAAAAAAAAAAAAAAAAAAANBB6BcAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CP0CAAAAAAAAAAAAAAAAAAAAAAAAAABAB6FfAAAAAAAAAAAAAAAAAAAAAAAAAAAA6CD0CwAAAAAAAAAAAAAAAAAAAAAAAAAAAB2EfgEAAAAAAAAAAAAAAAAAAAAAAAAAAKCD0C8AAAAAAAAAAAAAAAAAAAAAAAAAAAB0EPoFAAAAAAAAAAAAAAAAAAAAAAAAAACADkK/AAAAAAAAAAAAAAAAAAAAAAAAAAAA0EHoFwAAAAAAAAAAAAAAAAAAAAAAAAAAADoI/QIAAAAAAAAAAAAAAAAAAAAAAAAAAEAHoV8AAAAAAAAAAAAAAAAAAAAAAAAAAADoIPQLAAAAAAAAAAAAAAAAAAAAAAAAAAAAHYR+AQAAAAAAAAAAAAAAAAAAAAAAAAAAoIPQLwAAAAAAAAAAAAAAAAAAAAAAAAAAAHQQ+gUAAAAAAAAAAAAAAAAAAAAAAAAAAIAOQr8AAAAAAAAAAAAAAAAAAAAAAAAAAADQQegXAAAAAAAAAAAAAAAAAAAAAAAAAAAAOgj9AgAAAAAAAAAAAAAAAAAAAAAAAAAAQAehXwAAAAAAAAAAAAAAAAAAAAAAAAAAAOgg9AsAAAAAAAAAAAAAAAAAAAAAAAAAAAAdJsc9AAAAAAAAAAAAbLZ4xRUzXluz8oRdOAkAAAAAAAAAAAAAAADAtpsY9wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwl3WFfqvqwKr6SFV9tapuqqonVtWDq+rKqrp5+PegYW9V1VuranVV3VBVj9kxjwAAAAAAAAAAAAAAAAAAAAAAAAAAAADj0xX6TfKWJH/fWntEkkcnuSnJiiSfbq0dmeTTw/skOT7JkcPPi5O8o/OzAQAAAAAAAAAAAAAAAAAAAAAAAAAAYOxmHfqtqgOS/FaSi5KktfaT1trdSU5Kcsmw7ZIkzxlen5TkfW3KtUkOrKqHzvbzAQAAAAAAAAAAAAAAAAAAAAAAAAAAYHcw69BvkiVJ1iW5uKr+pareXVX7JjmktXbHsOfOJIcMrw9NctvI+bXDGgAAAAAA/4+9u4u1dTvvwv6829vmgoITh9RJ/NEdKUDgytAkTsUFiCgfsBEOEiGOKmwjt2kJqTiiEt70hoMQ0g4X5XBRQyMcyZYQJ4hWimEntimBi0okOB+mqDkktuhG9lG+GttpVRQE9tuLM0+8vT3X2meP8a4x3v87fz/pyF5r7v8Z4xnzWWPM+c613wMAAAAAAAAAAAAAAAAAAABArJ4b/d6uqt9fVX9rXdffV1X/X1Xde/QPrOu6VtX6NP/SZVm+d1mWn1qW5ad+9Vd/tWN6AAAAAAAAAAAAAAAAAAAAAAAAAAAAcPN6bvT7qar61LquP3n6+h/USzf+/eVlWb66qur0v79yevzFqnrTI/k3nr73RdZ1/cF1Xb9hXddv+Mqv/MqO6QEAAAAAAAAAAAAAAAAAAAAAAAAAAMDNa77R77quv1RVn1yW5XefvvUtVfVzVfXBqnrn6XvvrKofOf3/D1bVO5aXfHNV/fq6rr/YOj4AAAAAAAAAAAAAAAAAAAAAAAAAAADswe3O/H9XVX93WZbXVNW/qao/Uy/dPPjvL8vy7qr6t1X1p05/9ker6o9W1Seq6t+d/iwAAAAAAAAAAAAAAAAAAAAAAAAAAABE67rR77quH6uqbzjz0Lec+bNrVf25nvEAAAAAAAAAAAAAAAAAAAAAAAAAAABgb27NngAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkc6NfAAAAAAAAAAAAAAAAAAAAAAAAAAAA6OBGvwAAAAAAAAAAAAAAAAAAAAAAAAAAANDh9uwJAAAAAAAAAAAAAAAAAADw9O7ce3DlYw/v3x04EwAAAAAAAABuzZ4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAJLs9ewIAAAAAAAAAAAAAAAAAAAAw2p17D6587OH9uwNnAgAAAAAAHIEb/QIAAAAAAAAAAAAAAAAAAABweG7wDQAAAADcpFuzJwAAAAAAAAAAAAAAAAAAAAAAAAAAAADJ3OgXAAAAAAAAAAAAAAAAAAAAAAAAAAAAOrjRLwAAAAAAAAAAAAAAAAAAAAAAAAAAAHS4PXsCAAAAAAAAAAAAAAAAAAAAAECWO/ceXPnYw/t3B84EAAAAAPbh1uwJAAAAAAAAAAAAAAAAAAAAAAAAAAAAQDI3+gUAAAAAAAAAAAAAAAAAAAAAAAAAAIAObvQLAAAAAAAAAAAAAAAAAAAAAAAAAAAAHdzoFwAAAAAAAAAAAAAAAAAAAAAAAAAAADq40S8AAAAAAAAAAAAAAAAAAAAAAAAAAAB0cKNfAAAAAAAAAAAAAAAAAAAAAAAAAAAA6OBGvwAAAAAAAAAAAAAAAAAAAAAAAAAAANDBjX4BAAAAAAAAAAAAAAAAAAAAAAAAAACgw+3ZEwAAAAAAAAAAmO3OvQdXPvbw/t2BMwEAAAAAAAAAAAAAAAAg0a3ZEwAAAAAAAAAAAAAAAAAAAAAAAAAAAIBkbvQLAAAAAAAAAAAAAAAAAAAAAAAAAAAAHdzoFwAAAAAAAAAAAAAAAAAAAAAAAAAAADq40S8AAAAAAAAAAAAAAAAAAAAAAAAAAAB0cKNfAAAAAAAAAAAAAAAAAAAAAAAAAAAA6OBGvwAAAAAAAAAAAAAAAAAAAAAAAAAAANDBjX4BAAAAAAAAAAAAAAAAAAAAAAAAAACggxv9AgAAAAAAAAAAAAAAAAAAAAAAAAAAQAc3+gUAAAAAAAAAAAAAAAAAAAAAAAAAAIAOt2dPAAAAAAAAAAAAAAAAgH25c+/BlY89vH934EwAAAAAAAAAAAAy3Jo9AQAAAAAAAAAAAAAAAAAAAAAAAAAAAEjmRr8AAAAAAAAAAAAAAAAAAAAAAAAAAADQwY1+AQAAAAAAAAAAAAAAAAAAAAAAAAAAoIMb/QIAAAAAAAAAAAAAAAAAAAAAAAAAAECH27MnAAAAAAAAAAAAAAAAAAAAAACwJ3fuPbjysYf37w6cCQAAAAApbs2eAAAAAAAAAAAAAAAAAAAAAAAAAAAAACRzo18AAAAAAAAAAAAAAAAAAAAAAAAAAADocHv2BAAAAAAAAAAAAAAAAAAAAKDVnXsPrnzs4f27A2cCjOBnHgAAAADYq1uzJwAAAAAAAAAAAAAAAAAAAAAAAAAAAADJ3OgXAAAAAAAAAAAAAAAAAAAAAAAAAAAAOtyePQEAAAAAAAAAAAAAAAAAAAAAANrcuffgysce3r87cCYAAAAAl+3W7AkAAAAAAAAAAAAAAAAAAAAAAAAAAABAstuzJwAAAAAAAAAAAAAAAAAAAAAAXIY79x5c+djD+3cHzgQAAAAAtnVr9gQAAAAAAAAAAAAAAAAAAAAAAAAAAAAgmRv9AgAAAAAAAAAAAAAAAAAAAAAAAAAAQAc3+gUAAAAAAAAAAAAAAAAAAAAAAAAAAIAOt2dPAAAAAAAAAAAAAAAAAABu0p17D6587OH9uwNnwkiedwAAAAAAAABGcqNfAAAAAAAAAAAAAAAAAAAAgJ3xHy4AAAAAAMjiRr8AAAAAAAAAAAAAAAAAAADANG5oCwAAAADAEdyaPQEAAAAAAAAAAAAAAAAAAAAAAAAAAABI5ka/AAAAAAAAAAAAAAAAAAAAAAAAAAAA0MGNfgEAAAAAAAAAAAAAAAAAAAAAAAAAAKCDG/0CAAAAAAAAAAAAAAAAAAAAAAAAAABABzf6BQAAAAAAAAAAAAAAAAAAAAAAAAAAgA5u9AsAAAAAAAAAAAAAAAAAAAAAAAAAAAAd3OgXAAAAAAAAAAAAAAAAAAAAAAAAAAAAOrjRLwAAAAAAAAAAAAAAAAAAAAAAAAAAAHRwo18AAAAAAAAAAAAAAAAAAAAAAAAAAADo4Ea/AAAAAAAAAAAAAAAAAAAAAAAAAAAA0OH27AkAAAAAAAAAAAAAAAAAADnu3Htw5WMP798dOBMAAAAAAAAA2I9bsycAAAAAAAAAAAAAAAAAAAAAAAAAAAAAydzoFwAAAAAAAAAAAAAAAAAAAAAAAAAAADrcnj0BAAAAAAAAAAAAAAAAAAAAADiaO/ceXPnYw/t3B84EAAAAABjh1uwJAAAAAAAAAAAAAAAAAAAAAAAAAAAAQDI3+gUAAAAAAAAAAAAAAAAAAAAAAAAAAIAObvQLAAAAAAAAAAAAAAAAAAAAAAAAAAAAHdzoFwAAAAAAAAAAAAAAAAAAAAAAAAAAADq40S8AAAAAAAAAAAAAAAAAAAAAAAAAAAB0cKNfAAAAAAAAAAAAAAAAAAAAAAAAAAAA6HB79gQAAAAAAAAAXok79x5c+djD+3cHzgQAAAAAAAAAAAAAAAAAAL7YrdkTAAAAAAAAAAAAAAAAAAAAAAAAAAAAgGTdN/pdluVVy7L87LIs/+j09dcuy/KTy7J8YlmWH16W5TWn7/+W09efOD1+p3dsAAAAAAAAAAAAAAAAAAAAAAAAAAAAmK37Rr9V9eer6oVHvv6Bqvob67p+XVV9pqreffr+u6vqM6fv/43TnwMAAAAAAAAAAAAAAAAAAAAAAAAAAIBoXTf6XZbljVV1t6r+zunrpar+cFX9g9MfeX9Vfefp/7/t9HWdHv+W058HAAAAAAAAAAAAAAAAAAAAAAAAAACAWF03+q2q56rqL1bV509ff0VVfXZd1/94+vpTVfWG0/9/Q1V9sqrq9Pivn/48AAAAAAAAAAAAAAAAAAAAAAAAAAAAxLrdGlyW5Y9V1a+s6/rTy7L8oa0mtCzL91bV91ZVvfnNb97qXwsAAAAAAAAAAAAAAAAAAAAAsFt37j248rGH9+8OnAkAAAAALW51ZP9AVf3xZVkeVtXzVfWHq+pvVtWXLcvy8g2E31hVL57+/4tV9aaqqtPjr62qX3v8X7qu6w+u6/oN67p+w1d+5Vd2TA8AAAAAAAAAAAAAAAAAAAAAAAAAAABuXvONftd1/Uvrur5xXdc7VfX2qvrxdV3/y6r6p1X1J09/7J1V9SOn///B09d1evzH13VdW8cHAAAAAAAAAAAAAAAAAAAAAAAAAACAPWi+0e813lNVf2FZlk9U1VdU1ftO339fVX3F6ft/oaru3cDYAAAAAAAAAAAAAAAAAAAAAAAAAAAAMNTtLf4l67r+s6r6Z6f//2+q6pvO/JnfqKrv2mI8AAAAAAAAAAAAAAAAAAAAAAAAAAAA2ItbsycAAAAAAAAAAAAAAAAAAAAAAAAAAAAAydzoFwAAAAAAAAAAAAAAAAAAAAAAAAAAADq40S8AAAAAAAAAAAAAAAAAAAAAAAAAAAB0cKNfAAAAAAAAAAAAAAAAAAAAAAAAAAAA6OBGvwAAAAAAAAAAAAAAAAAAAAAAAAAAANDh9uwJAAAAAAAAAAAAjHbn3oMrH3t4/+7AmQAAAAAAAMD1fLYFAAAAAAAZ3OgXAAAAAIBN+WVyAAAAAAAAAAAgkd99AgAAAAAAAHrcmj0BAAAAAAAAAAAAAAAAAAAAAAAAAAAASHZ79gQAAAAAAAAAbtKdew+ufOzh/bsDZwIAAAAAAAAAAAAAAAAAwFHdmj0BAAAAAAAAAAAAAAAAAAAAAAAAAAAASHZ79gQAAAAAAAAAAAAAAAAAAACAbd259+DKxx7evztwJgAAAAAAcBnc6BcAAAAAAAAAAGCn/OVrAAAAAOAmuPYIAAAAAAAAsL1bsycAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyW7PngAAAAAAAAAAAAAAAAAAAAAAc9259+DKxx7evztwJgAAAAAAmdzoFwAAAAAAAAAAAAAAAAAAAAB2wk2XAQAAACCTG/0CAAAAAAAAAAAAAAAAMIwbVgEAAAAAAAAAR3Rr9gQAAAAAAAAAAAAAAAAAAAAAAAAAAAAgmRv9AgAAAAAAAAAAAAAAAAAAAAAAAAAAQIfbsycAAAAAAAAAAAAAAAAAAAAAd+49uPKxh/fvDpwJAAAAAADA07s1ewIAAAAAAAAAAAAAAAAAAAAAAAAAAACQ7PbsCQAAAAAA+3bn3oMrH3t4/+7AmQAAAAAAAAAAAFvyu0EAAAAAAAAAsJ1bsycAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyW7PngAAAAAAAAAAAAAAAAAAAADA3t259+DKxx7evztwJgAAAAAA7NGt2RMAAAAAAAAAAAAAAAAAAAAAAAAAAACAZG70CwAAAAAAAAAAAAAAAAAAAAAAAAAAAB3c6BcAAAAAAAAAAAAAAAAAAAAAAAAAAAA6uNEvAAAAAAAAAAAAAAAAAAAAAAAAAAAAdLg9ewIAAAAAAAAAAAAAAMArc+fegysfe3j/7sCZkEC/AADsm9drAAAAAAAAcCxu9AsAwMXxi3AAAAAAAAAAAAAAAAAAAAAAAADAlm7NngAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkuz17AgAAAAAAAAAAAAAAAAAAkOrOvQdXPvbw/t2BMwEAAAAAAABmcqNfAAAAAAAAAAAAAAjlRkIAAAAAAAAAAAAAsA+3Zk8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAkt2ePQEAAAAAAAAAAAAAAMa4c+/BlY89vH934EwAAAAAAAAAAAAAjsWNfgEAAAAAAAAAAAAAAADYPf/RAgAAAAAAAABgz9zoFwAAAAAAAAAAAAAe4wZiAAAAAAAAAAAAAMDTcKNfAAAAAAAAAAAAAAAAAAAAAADgEPyHXQEAAJjFjX4BAAAAAAAAAAAAAAAAAAAAAAAAiOHG7gDAHt2aPQEAAAAAAAAAAAAAAAAAAAAAAAAAAABIdnv2BAAAAAAAAAAAAAAAAAAA2L879x5c+djD+3cHzgQAAAAAAABgf27NngAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkuz17AgAAAAAAAADAcd259+DKxx7evztwJgAAAAAAAAA8LZ/5AgAAAAAAvHK3Zk8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAkt2ePQEAAAAAAAAAAAAAAEh0596DKx97eP/uwJkAAAAAAAAAAAAAs7nRLwAAAAAAAAAAAAAAsAtungwAAAAAAAAAAEAqN/oFAAAAAAAAhnKjDgAAAAAAAAAAAAAAAAAAjsaNfgEAAAAA2AU3fQQAAAAAAAAAAAAAaOd3sgEAAABgrluzJwAAAAAAAAAAAAAAAAAAAAAAAAAAAADJbs+eAAAAAAAAAAAAAAAAAAAAwMvu3Htw5WMP798dOBMAAAAAAAB45W7NngAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkuz17AgAAAAAAAAAAAAAAAAAAAABs4869B1c+9vD+3YEzAfhi9icAAADg6NzoFwDYDR/MAAAAAAAAAAAAAADAcfl7AwCQwZkNAAAAAABt3OgXAAAAAAAAAAAAboi/CA8AAAAAMI5rsgAAQA/vKQAAAOjlRr8AAAAAAAAAAEAsf7kGAADgGLy/AwAAAAAAAAAA0rnRLwAAAAAAAAAAAAAAAADARG56DwAAAAAAAJDv1uwJAAAAAAAAAAAAAAAAAAAAAAAAAAAAQDI3+gUAAAAAAAAAAAAAAAAAAAAAAAAAAIAObvQLAAAAAAAAAAAAAAAAAAAAAAAAAAAAHW7PngAAAAAAAAAAAAAAl+HOvQdXPvbw/t2BMwEAAAAAAAAAAAAA2JYb/QIAAAAAANDFDXoAAAAAAAAAAAAAAAAAAIBL50a/AAAAAAAAsCNunAwAAAAAAAAAAAAAAAAAAHnc6BcAAAAAAAAAAIDf5D8+AQAAAAAAr4xr6gAAAAAAADzKjX4BAAAAAAAAAAAAAACegpt5AQAAAAAAAAAA8LhbsycAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyW7PngAAAAAAAAAAAPS6c+/BlY89vH934EwAAAAAgCNx7REAAAC4aa4/AAAAwHG40S8AAAAAAAAAu+WX1wEAAAAAAAAAAAAAAACABG70CwAAAAAwmJvVAQAAAPAkriEBAAAAAAAAAAAAAECWW7MnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMluz54AAAAAAAAAAAAAMNedew+ufOzh/bsDZwKM4uceAAAAAAAAAAAAALblRr8AAAAAAHBQbtQBAAAk8R4GAAAAAFwnAwAAAAAAAIBkbvQLAAD8Jr8YDAAAALm8r4fL4+ceAAAAAAAAAAAAAAAAYFv+3hY9mm/0uyzLm6rqA1X1+qpaq+oH13X9m8uyvK6qfriq7lTVw6r6U+u6fmZZlqWq/mZV/dGq+ndV9a51XX+mb/oAAAAAAAAAAJfFLwsBe2V/AgAAAAAAXuZzAwAAAAAA4BI13+i3qv5jVf3367r+zLIsv62qfnpZln9cVe+qqn+yruv9ZVnuVdW9qnpPVf2Rqvqdp3/eWlV/6/S/AAAAAACR/BI6AAAAAAAAZPOZH/BK2S8AAAAAAAAAAHiS5hv9ruv6i1X1i6f///8uy/JCVb2hqt5WVX/o9MfeX1X/rF660e/bquoD67quVfUTy7J82bIsX3369wAAAMH88joAAAAAAABH5zMxAAAAAACA6/k8BQAAAACAS3dri3/Jsix3qur3VdVPVtXrH7l57y9V1etP//8NVfXJR2KfOn0PAAAAAAAAAAAAAAAAAAAAAAAAAAAAYnXf6HdZlv+kqv6XqnpmXdf/59HH1nVdq2p9yn/f9y7L8lPLsvzUr/7qr/ZODwAAAAAAAAAAAAAAAAAAAAAAAAAAAG7U7Z7wsiyvrpdu8vt313X9X0/f/uVlWb56XddfXJblq6vqV07ff7Gq3vRI/I2n732RdV1/sKp+sKrqG77hG57qJsEAAAAAAAAA7NOdew+ufOzh/bsDZwIAcGxedwEAAAAAPD3XVgEAAAAAANhC841+l2VZqup9VfXCuq7/4yMPfbCq3llV90//+yOPfP/7l2V5vqreWlW/vq7rL7aODwAAAAAAPfzFDAAAANgH79EBAAAAAAAAAAAAAIAjaL7Rb1X9gar601X1r5Zl+djpe/9DvXSD37+/LMu7q+rfVtWfOj32o1X1R6vqE1X176rqz3SMDQAAAAAAAAAAAAAAAAAAAAAAAAAAALvQfKPfdV3/96parnj4W878+bWq/lzreMB8d+49uPKxh/fvDpwJAAAAAAAAAAAAALBno3/32O86AwAASbyHAQAAAADXyQA4puYb/QIA8PRcXAD2yv4EAAAAAAAAAAAAAAAAAAAAAADQ7tbsCQAAAAAAAAAAAAAAAAAAAAAAAAAAAECy27MnAAAAAAAAAADAzbtz78GVjz28f3fgTAAAAACAJ3E9DwAAAAAAAAAgjxv9AgAAAAAAAAAAAAAAAG4uCwAAAAAAAAAAHdzoFwAAAHbCX5IBAAA4Bu/vAAAAAAAAAAAAAAAAAAAujxv9AgAAAAAAAAAAAAAAAAAAAADAhbhz78GVjz28f3fgTAAAAOBY3OgXAAAAAACYyi8IAgAAAAAAAAAAAAAAAAAAkO7W7AkAAAAAAAAAAAAAAAAAAAAAAAAAAABAstuzJwAAAAAAAOzLnXsPrnzs4f27A2cCANwEZz0AAJDEexiAPPZugJfYDwEAAAAAAADg8rjRLwBM4Bf22Ds9CgAAAPN5fw4AAAAAAHAcPvsBAAAAAAAAAIDjc6NfAACAG+IvZgAAAAAAAABwND4L52npGQAAgJvh/RYAAAAAAADsjxv9AofklxTgsviZBwAALoX3PwAAT8frJwAAAAAAAIAv5nNUAAAAAAAAuDlu9AsAQfwiDQAAAADkcD2Po9LbAC+xH17N2gCwN84mAABm8noUAAAAAABI4/MNAIB2bvQLAAAAAAAAAAAAwK75y0MAAAAAAAAAAAAAwN650S8AAAAAAAAAQAc3ncvm+QMAAAAAAAAAAAAAAAC24Ea/AAAAAAAAAAAAB+Mm1gAAAAAAAAAAAADAkfgdaSCBG/0CAAAAAAAAAAAAADfKX7AAAAAAAAB6+bwBAAAAgL1zo18AADbjA1LgptlnAAAAAADGcU0WoI99FAAAAAAAAAAAgB5+D21b1hOAEdzoFwAugDeYAABwLF7jb8t6AgBX8ToBAAAAAAAAAAAAAAAAAIBXyo1+AS6IGxIAXA57PgB74lwCAAAAAAAAAGAv/C4LAAAAwBe4VgIAMIbXXQBwOdzoFwAAAIBXxAdIANDGGQoAAAAAAAAAAAAAAAAAAHB8bvQLwBO5EQkAkM7rGY5KbwPMYf8Fjsa+BgAAAAAAAAAAAACZ/C4wAAAA7Isb/QIAAAAAAAAAAAAAAAAAAAAAh+RGqAAAAACM4ka/AAAAAAAAAAAAwOH5y7sAAAAAAAAAAAAAANwkN/oFAAA4CH8xGQAAAACyuKYHAAAAAAAAAAAAAAAAcBxu9AsAAAAAAERyYzwAAAAAAAAAuAx+RwAAAOCyeV8IAOyF1yUAwJO40S8AAAAAAAAAAAAAAAAAAAAAAAAAAARyI3LYDzf6BQAA2BkXTgAAAAAAAOBqPk8DAAAAAAAAAACAq/k9O0bRawBfyo1+AbgxXoADAAAAwHiuywEAAAAAAAAAAAAAAADANvydPQCehhv9AgAAAAA3wodWAABwLF7jAwAAAAAAAAAAAAC08zvZAADH50a/AABM13oh8hIuYF5CjQCM53wBAACqvDcAAAAAAIAjcv0fAAAAAAAAAGAeN/oFAACm8cvkwE2zzwBcBvs9AACQxHsYAAC24rUlAAAAAAAAAAAAwL640S8AQAN/SQYAAAAAAAAAAHiU3ykCAAAAAAAuhc9FAAAAAM5zo18AAAAAAAAAAACAnfAXYgEAAAAAAAAAAAAAMrnRLwBwsfzFOOCVsl/wtPQMAACpvJYFAACAL+X9MgAAAAAAAAAAAAAAr4Qb/QIAAAA8xl/YBwAAAAAAAABgD/weCwAAHIvX+AAAAAAAcGxu9AsAAAA8lZ5fLPRLiQAAAAAAAAAAAAAAAAAAAMfj75IDXA57PlzNjX4BAAAAAAAAAAAAAADgQPyFOgAAHuX1IQAAAAAA3DzX46mqujV7AgAAAAAAAAAAAAAAAAAAAAAAAAAAAJDMjX4BAAAAAAAAAAAAAAAAAAAAAAAAAACgw+3ZEwAAAAB4kjv3Hlz52MP7dwfOBACAS+T1KAAAAAAAs7lWDQAAAAAAAAAAsH9u9AsAAAAAAAAAAAAAAAAAAAAAAAAAABfEf3watudGvwAAAAAAAAAAAAAAAAAAAAAAAAA75CaMAAA53Oj3ALwABwAAAAAAAAAAAAAAAAAAAABgj9wfBzL52QUAgKfnRr8AAAAAAAAAAAAAAAAAAAAAAABwQG7YCxyNfY2j0ttwDG70CwAAAACdXDAHAAAAAAAAAAAAAAAAAADgUaP/Hrq/9w4wnxv9AgAAAAAAAMBEfokKAAAAAAAAAADgWPxeGFwWP/OwHT9PAHPYfwG240a/ANDBmxMAAAAAAAAAAAAAAAAAAADA/QcAAACAW7MnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMluz54AX+C/ygQAAAAAQDLXuQEAAAAAYL9cx+eo9DYAAAAAAMC++PwGAODpXMLrp0uo8WVu9AsAAAAAAAAAAAAAAAAAAAAAAFzrkm7MBAAAAC3c6BcAAAAAJvGLLQAAAAAApHKNGwCAR3l9CMDeOJsAAAAAgOu4hggA3JSoG/2mvChKmSck8PMEAMBMXo8CAAAAAAAAAAAAAAAAAAAAwHbczwM4sqgb/XK5HMb5PIfnWRf2To8CAABJvIcBAAAARnANAgAAAAAAAPL53A8AAAAAgJvgRr8AAAAA7JJfnNyeNQUAAAAAAAAAAAAAAAAAAACAm+FGvwAAAAAAAAAAAAAAAAAAAAAAAECkO/ceXPnYw/t3B84EAIBL50a/NPGmBgDglfPaCQAAAABgHNdkAQAAAACAXj5vAAAAAAAAAKCFG/1yaH6hAnil7BcAAAAAAAAAAAAAAAAAAAAAAAAAQCs3+gUAAOK4QTsAAABwRK55AAAAAAAAAADA0/E7NwAAAAAA7Ikb/QIE8qEjAAAAAAAAAAAAHIPfCQQAAAAAAAD27uifax69PgAAYBw3+r1w3mDug+cBAAAAAAAAAAAAAAD2z+//AwAAAAAAkMJnWwAchTONJG70CwAAAAAAwEXwQS4AAAAAAABsy2dwAAAAAAAAAABf4Ea/AAAAAAAARPGXhQEug/0evpSfCwAAAAAAII3PNwAAAAAgh+t5wE2zz+yD5+FmudEvAAAAAAAAAAAAAAAAAAAAAABAADflAgAA2C83+oUzXMwAADgmr/MAAAAAAAAAAAAAgJvkd5Y5Kr0NwHWcEwAAAMCeuXbBUentfXKjX9iQjQ4AAAAAYP9cywUAAAAAAAAAAAAAOD6/Ow4AAACM5ka/AAAAABvxix8AAAAAAFwa18bhS/m5gG34WQIAAIAv5f0yADfFGQNwGS5hv0+pMWWeAADA03OjXwCAAC7SAgAAALA3rlkBAAAAAAAAAADQw++hAXDpnIUAL7EfwpfycwGQy41+AQAAAIBd8cETwOWw5wMAcEm8/gUAAAD2zLULYK/sT8Be2Z8AAMbwugsAAIA0F3GjX2/Y4Yv5mQAAAAAAAICr+TwNOBr7GgAAAAAAAAAAAAAAANy8i7jRL8BN85ciAQAAAAAAAAAAAIAn8XvH++G5yOc5BAAAAAA4LteAAQCAqvb3BjPfU7jRL8AjXOQBAAAAAAAAAAASJf4SK9wkPxMAAAAAAAAA8/kMdlvWEwDg6Xj9tD1r+mTDb/S7LMt3VNXfrKpXVdXfWdf1/ug5vFIaCGAO+28+zyEAAAAAwDiuyQIAAAAAkMx1bgAAAAAAUrnGnc9/SBi24WeCo9LbcHm2+LkfeqPfZVleVVX/U1V9a1V9qqo+uizLB9d1/bmR84CjcPgDAABV3hsA8GR+2WAfrGc+zyEAAMC+eJ8GHI19DQAAAAAAAAAAAPL5fUC4bENv9FtV31RVn1jX9d9UVS3L8nxVva2q3OgXAOAGeMMH7JX9Cb6Yn4ntWVMAAGAG70U4Kv/xEABuirMCADI4swEggzMbAAAAAAAAAOYbfaPfN1TVJx/5+lNV9dbBc2AivzAC3DT7DHCT7DHwpfxcZPP8wZfycwHslf0JAAAAtuN9NgAAAAAAAABwHb9bAAAAALRa1nUdN9iy/Mmq+o51Xf+r09d/uqreuq7r9z/yZ763qr739OXvrqqfv+Jf9zuq6v9unEprVk5u72PKXWZuxphyl5mbMabcZeZmjCl3mbkZY8pdZm7GmHKXmZsxptxl5maMKXeZuRljyl1mbsaYcpeZmzGm3GXmZowpd5m5GWPKXWZuxphyl5mbMabcZeZmjCl3mbkZY8pdZm7GmHKXmZsxptxl5maMKXeZuRljyl1mbsaYcpeZmzGm3GXmZowpd5m5GWPKXWZuxphyl5mbMabcZeZmjCl3mbkZY8pdZm7GmHKXmZsxptxl5maMKXeZuRljyl1mbsaYcpeZmzGm3P5z/9m6rl959pF1XYf9U1X/RVV9+JGv/1JV/aXGf9dPdcyjKSsnt/cx5S4zlzRXuexc0lzlsnNJc5XLziXNVS47lzRXuexc0lzlsnNJc5XLziXNVS47lzRXuexc0lzlsnNJc5XLziXNVS47lzRXuexc0lzlsnNJc5XLziXNVS47lzRXuexc0lzlsnNJc5XLziXNVS47lzRXuexc0lzlsnNJc5XLziXNVS47lzRXuexc0lzlsnNJc5XLziXNVS47lzRXuexc0lzlsnNJc5XLziXNVS47lzRXuexc0lzl9pG7VWN9tKp+57IsX7ssy2uq6u1V9cHBcwAAAAAAAAAAAAAAAAAAAAAAAAAAAIDN3B452Lqu/3FZlu+vqg9X1auq6ofWdf0/R84BAAAAAAAAAAAAAAAAAAAAAAAAAAAAtjT0Rr9VVeu6/mhV/egG/6ofnJCVk9v7mHKXmZsxptxl5maMKXeZuRljyl1mbsaYcpeZmzGm3GXmZowpd5m5GWPKXWZuxphyl5mbMabcZeZmjCl3mbkZY8pdZm7GmHKXmZsxptxl5maMKXeZuRljyl1mbsaYcpeZmzGm3GXmZowpd5m5GWPKXWZuxphyl5mbMabcZeZmjCl3mbkZY8pdZm7GmHKXmZsxptxl5maMKXeZuRljyl1mbsaYcpeZmzGm3GXmZowpd5m5GWPKXWZuxphyl5mbMabcZeZmjCkXnFvWdW0cDwAAAAAAAAAAAAAAAAAAAAAAAAAAALg1ewIAAAAAAAAAAAAAAAAAAAAAAAAAAACQzI1+AQAAAAAAAAAAAAAAAAAAAAAAAAAAoMPt2RN4JZZleW1VfUdVveH0rRer6sPrun72FeZf/2h2XddffgWZpaq+6bEx/8W6ruuecqfsU9fXmkupb9I8m/q0I9da4+h5ptQXsZ6dc42ocfRzeMoO20cfyb6uqmpd10+/0kxrrnOeEWvjLNwuN6m+iNcJo8fTM9vmHskP7ZlTftf7Wk/ulN39mTZjXU75Xddof9pH7pRtXRdn2oa5o/dM73l2+nc81b6WsjatOT1zI/OMuJbgGkv2eJPmqmc2HO+UTdnXnGkb5k7ZhPp8brCf3KHPtNHz7MnqmWuzu9/XWufZmXM2bZtL+VlKem8Qsc/omc3nmfQ+NOJsah2vJ3fKHvazrQ2yu64x5axvzSW9Bjrld79f6Jl95E7Z4Z+HnvJD9rWwNd19fUm9lvKa9ALqS3q9nbKmeuZ8LuI9WudcnU0b5k7ZhPqSrnnYZ7LH83no9rmIsynleeica0SNKb3Wkfv6qnrbY7kPruv6wg3lZpyho2scujZB442eZ0+v6ZnzuZR9LeJc6sk6mzbPHbq+zjGdTdvOM6W+nl47+tkUcZ2sNZd0/fCUT6gx5axPqW/ouswYM2VtguqLeP4eySfsa860DXOn7OjfJUv5+bU/nc9FvP7tHFPPbJuL2LfP/nte4fuCaZZleUdV/eWq+ki9tLBVVW+sqm+tqr+yrusHrsm+par+dlW99rHsZ6vq+9Z1/Zkrct9WVe+tqo8/lvu6U+4jO8m11teaS6lv6DxP2aY+7ci11jh6nin1Raxn51wjapzwHL6lxu6jb66qv15V33L6s0tV/faq+vGqureu68ONc03z7KyxNTe0xpQz5uj1dY45usbR4+mZDXOTakzZ11pzEWfa6FxYjfanfeSa6psxZsraBNUX8fydsq37WsratOb0zIa5UzblWoJrLMHjTZqrntl2vLdUzr7mTNs2l1Kfzw0ud39KWc8Z+5qeOZ97S2Xsa63zbMpNqtHZtG0uor7OGlP2GT2zg/o6xzz62dQ6Xmvu0J9tdY4ZUWPQWZ9SX9Jn76PH0zPb5prq6xxz9L4WsaZB9SX1WsRr0guoL+L19owx9cxu1mXoe7TOuTqbts2l1Jd0zcM+kz2ez0Pze+YtNXZf02uX22utufdU1fdU1fNV9alHcm+vqufXdb2/cW7GGTq6xqFrEzTe6Hn29JqeOZ9L2dcizqXOGp1N2+YOXV/nmM6mbeeZUl9Prx39bEq5Ttaai7h+GFZjylmfUt+M3wE/+usuPbOD+k7Zt1TGvuZM2zY3tL7Ouab8HKbUF7E/TTpD9cy2uYh9+0rruu76n6r6+ar6sjPf//Kq+oUnZD9WVW898/1vrqp/eU3uhaq6c+b7X1tVL+wo11pfyrpEzLOnTztyrTWOnmdKfRHr2TnXiBonPIet+0xr7p9X1XdX1ase+d6r6qULtD9xA7mmeYatzeh5ppyFEfVNWpuU8fTM9r02usaUfa01F3Gmjc6F1Wh/2keup9ecadn1RTx/pz/Tuq+lrI2e2cE8T38m5VqCayzB4+mZQ/TMxypnX3Om7WNdDv2zewk1duQOfaaNnmdYjSnP4ccqY19rnWdTblKNzqZtcxH1ha1NyniH7plJvXb0s6l1vNbcoT/bmrQ2o5/DlLM+pb6kz95T1lTPbFhf55ij97WINQ2qL6nXIl6TXkB9Ea+3w9ZUz+yjvo9Vzr7WNNeO3KHPppSfwZ5sSo0XsM9ErKee2dVz+LEau6/ptf3kUur7hap69Znvv6aqPn4DuRln6Ogah65N0Hij59nTa3rmfC5lX4s4l8LWxtkUXN+ktUkZT89s32tHP5tSrpO15iKuH4bVmHLWp9Q343fAj/66S8/soL7Tn/lYZexrzrR9rMsl/N0W+9M+6vP33vdT36HvLXjVP7dq/5aqWs98//Onx67zW9d1/cnHv7mu609U1W+9Jne7vvBfyHnUi1X16h3lWutLWZeUeVa192lrrnWuo+eZUl/KelaN7++j98zoffR3rOv6w+u6fu6RzOfWdX2+qr7iBnKt8+zJjl4bZ+G2uRlnaMrrhJQ1PXrP9PTa6BpT9rWjn2mjc1U5Ndqf9pHr6TVn2ra5o/dMzxnauq+lrI2e2cc8q3KuJbjGkj1eT1bPnDe6vqR9zZm2bS6lPp8b7Cd39DNt9Dx7snrmvJR9bcb1NWfTtrmUn6Wk9wYp+4yeOW/G67WU5zDl81efbW2fTakx5axPqS/ps/eUNdUz5814bzB6X0tZ05T6knot5TXp0etLeb09Y0w9s20u5T1aVc4e7GzaxzyTrnnYZ7LH83no9rmUsynleajSa1dJqe/zVfU1Z77/1afHts7NOENH1zh6bVLGGz3Pnl7TM+el7Gsp51JP1tm0be7o9fVknU3nHb1nenrt6GdTynWylOtrSZ+9p5yhR69v9LrMGDNlbVLqS3n+qnL2NWfatrkZf+895efX/nReyuvfnjH1zLa5lH37rNtPG5jgr1XVzyzL8pGq+uTpe2+uqm+tqr/6hOyPLcvyoKo+8Ej2TVX1jqr60DW5H6qqjy7L8vxjubdX1ft2lGutL2VdUuZZ1d6nrbnWuY6eZ0p9KevZM9eUGkc/h6P30Z9eluW9VfX+x3LvrKqfvYFc6zx7sqPXxlm4bW7GGZryOiFlTY/eMz29NrrGlH3t6Gfa6FxVTo32p33kenrNmbZt7ug903OGtu5rKWujZ/Yxz6qcawmusWSPN2Ouembb8ZL2NWfatrmU+nxusJ/c0c+00fPsyeqZ81L2tRnX15xN2+ZSfpaS3huk7DN6Ztt5Jr0PTTmbfLa1ba4nm1JjylmfUl/Pe4OU/ULP7CM3473B6H0tZU1T6kvqtZTXpEevL+X19owx9cy2uZT3aD1zdTZtm0upL+mah30mezyfh26fSzmbUp6Hnrmm1JjSa625Z6rqnyzL8vHHcl9XVd9/A7kZZ2jrXEfnRteXsp4z9rXWuY7OjX4OU/a1lHOpJ+ts2jZ39Pp6ss6mbeeZUl9rrur4Z1PKdbKU62utuaqcGlPO+pT6Rq/LjDFT1ialvpTnrypnX3OmbZub8ffeU35+7U/npbz+7RlTz2ybS9m3z1rW9dzNjfdlWZYvr6pvr6o3nL71YlV9eF3Xz7yC7B+pqrc9lv3guq4/+oTc762qP34m93M7y7XWl7IuEfM8ZZv6tCPXWuPoeabUF7GenXONqHHCczhsH12W5TVV9e5zuap637qu/37LXE99PdmRazN6nqdcylkYUV/nmKNrjFjTo/dMZ68NqzFsXzv0mTYhl1Sj/WkfuZ7Xa860bXOH7pmO8Xr2tZS10TM7mOcpm3ItwTWW4PEmzVXPbDte0r7mTNs2l1Kfzw32kzv0mTZ6nj1ZPXNlLmVfG3oudc41ZW2Ovm9H1NeTDdpn9My280x6H5pyNvlsa8NcazapxqCzPqW+iM/eJ42nZ7bNDX1vMGlfi1jToPoieq0z5zX3PnIz3oemrKmeOZ+LeI/WOVdn07a5lPqSrnnYZ7LH83no9rmIsynleeica0SNQb3WmrtVVd/0WO6j67p+7oZyM87Q0TUOXZug8UbPs6fX9Mz5XMq+FnEu9WSdTZvnDl1f55jOpm3nmVJfT68d/WxKuU6Wcn0t6bP3lDP06PXN+B3wo7/u0jPnczPeG6Tsa860bXND6+uca8rPYUp9EfvTpDNUz2ybi9i3z/671oAb/VZVLcvy+nqk4HVdf3nQuK+rqlrX9dN7zo2WUt+E56+pT3v6u2Wuo+eZUt/o8Xr3tZH9ffSegRYpZ2GrGfWlvE4YPZ6e2TbXI+W5gKeV9HPYwv60n/H0zLa5Vkk9qme2zbVyfW3b3NGvsYSNp2c2zJ2yQ5/DVpdwzaOVM227nM8N9pM7ZQ97ps36PCWhxpTnsEfK/tvD2bRdLuVnqTU3471B0j6jZ7abZ9L70KSzCZ5Wylnf6uivgWaMmbQ2LfTMfiStaQu9tm3Oa+595E7Z4a+3E9a0dZ6tOT1zM5L24BZHP5sSfgY3yO6+xkvYZxLWs2eurTk9s72E56Fnrq05vbZdblmWpb70pmr/Yl2v/0v0rbnWefZkR9c4em1SxpvRMx05PXN9ftf7Ws88W3M+e982l/Kz1JqbVF/MPhO0poftmQ3OiUOfTa3j9eRGO/r1w54x936G9syzNXf09+czxgxbm93Xl/L89bqEvbvF0delZ7yEn9/Webbm7E/bjtczpp7ZNnfKRuzbX2Rd113/U1VvqaqfqKoXquofV9X/VlX/+vS93/+E7Gur6v4p++mq+rXT/79fVV92Te7NVfV8Vf1KVX28qj5x+v/PV9WdHeVa60tZl4h59vRpR661xtHzTKkvYj0n/RwevWdG76O3q+q/qaofq6r/4/TPj1XVf1tVr76BXNM8w9bGWRhc36S1SRlPz2zfa6NrTNnXDn2mjc6F1Wh/2keup9ecadn1RTx/p2zrvpayNnpmB/M8Zd9SGdcSXGMJHk/PHKJnkvY1Z9o+1uXQP7uXUGNH7tBn2uh5htWY8hym7Gszrq85m/bRo625iPrC1iZlvEP3zKReO/rZNPq9z6E/25q0Nkd//3r0+pI+e09ZUz2zYX2dY47e1yLWNKi+pF6LeE16AfWNXpem8cLWVM/so76kfc3ZlF1fU4/aZw6xz0Ssp57Z1XM4el/Ta/vJpdT3bae5/VhV/Z3TPx86fe/bbiDX02spNQ5dm6DxRs+zp9f0zPlcyr4WcS6Frc3oeab8LEXUF7bPRKzp0Xums9dG15hyTcD1ww1zYTW29lpKj46ub+i6THouItYmqL6I5++UTdnXnGn7WJdL+Lst9qd91DfjDNUz+1iXofv2lf++pw2M/qeqPlZVbz3z/W+uqn/5hOyHq+o9VfVVj3zvq6rqXlV95JrcP6+q766qVz3yvVdV1dur6id2lGutL2VdIubZ06cdudYaR88zpb6I9ZzR3xfQM6P30b9XVX/rVM8bT/988+l7P3wDuaZ5hq2NszC4vklrkzKentm+10bXmLKvHfpMG50Lq9H+tI9cT68507Lri3j+Tn+udV9LWRs9s4N5nv7cxyrjWoJrLMHj6ZlD9EzSvuZM28e6HPpn9xJq7Mgd+kwbPc+wGlOew5R9bcb1NWfTPnp09M9S0nuD0WuTMt6he2ZSrx39bPLZ1oa5SWtz9PevR6+v571Byn6hZ/aRm/HeYPS+FrGmQfUl9VrEa9ILqG/0ujSNF7amemYf9SXta86m7PqaenTSz5N9Jnu8nl7TM/uob/S+ptf2k0up74U68xf6q+prq+qFG8j19FpKjUPXJmi80fPs6TU9cz6Xsq9FnEthazN6nik/SxH1TVqblPH0zPa9NrrGlGsCrh9umAursbXXUnp0dH1D12XScxGxNkH1RTx/pz+Tsq850/axLj37WsrPr/1pH/XNOEP1zD7WZfjvcp/99z1tYPQ/VfXxax77xBOyP9/42HVj7umx1vpS1iVinq8ge2Wf3lCu9bHR80ypbzfreYNz3U2NE57D0fvoLwx+rGmeYWvjLAyub9LapIynZzZ8bFKNKfvaoc+00Y+F1Wh/2sdjPb3mTMuuL+L5Oz3euq+lrI2e2cE8X0F2T9cSXGMJHm+Hc9UzTz/eUfY1Z9q4ddlTDT432E8u/kwbPc8D1bin5zBlX5txfW1P+5qzadvcbuo70NqkjBffMzvstSOcTT7b2vCxSWtz9PevR6+v571Byn6hZ/bx2Iz3BqP3tYg1DaovqdciXpNeeH27eb19oDXVM+PqS9rXnE3HrS/pmod9Jns8n4dmPId72tf02n5yu6qvqm6f+f5rbirXMs+0GkeuTdJ4o+fZ02t65qnH29W+tqPHfPbemEv5WUqob9bapIynZ7bvtR31TMo1AdcPn/KxA9WYctan1Dfjd8BT9ic9s491edIZeoR9zZk2bl1ual9L+fm1P+2jvhlnqJ4Zty7Df5f73D+3a/9+bFmWB1X1gar65Ol7b6qqd1TVh56Q/bfLsvzFqnr/uq6/XFW1LMvrq+pdj/y7zvnpZVneW1Xvf2zMd1bVz+4o11pfyrqkzLOqvU9bc61zHT3PlPpS1rNnrik1jn4OR++jn16W5buq6n9Z1/Xzp9ytqvquqvrMDeRa59mTHb02zsJtczPO0JTXCSlrevSe6em10TWm7GtHP9NG55JqtD/tI9fTa860bXNH75meM7R1X0tZGz2zj3lW5VxLcI0le7wZc9Uz246XtK8507bNpdTnc4P95I5+po2eZ09Wz5yXsq/NuL7mbNo2l/KzlPTeIGWf0TPbzjPpfWjK2TT6jDn6Z1s92ZQaU876lPqSPntPWVM9c96M9waj97WUNU2pL6nXUl6THr2+lNfbM8bUM9vmUt6j9czV2bRtLqW+pGse9pns8Xweun0u5WxKeR565ppSY0qvteZ+qKo+uizL84/l3l5V77uB3IwzdHSNo9cmZbzR8+zpNT1zXsq+lnIu9WSdTdvmjl5fT9bZtO08U+rr6bWjn00p18lSrq8lffaecoYevb4ZvwN+9Nddeua8Ge8NUvY1Z9q2udH19WRTfg5T6kvZn/y99+3nmbIuo/fts5bTHYJ3bVmWP1JVb6uqN5y+9WJVfXBd1x99Qu7Lq+reKfv6qlqr6per6oNV9QPrun76itxrqurdj435qar6h1X1vnVd//1Ocq31paxLxDwfybf26VPneuY6cp6tudH1ha3n8P4+cs9M2EfvVNUPVNUfri/8pYEvq6p/WlX31nX9vzbONc2zs8bRa+MsDK6vc8zRNUas6dF7prPXRtd4pzL2tUOfaaNzYTXan/aR6+k1Z1p2fRHP3yl7p9r2tZS10TM7mOcj+YRrCa6xBI83Y656ZvOeidnXnGmXe6b53OBGakzYnyLWc8a+NrrG1pwzbR/n0qQanU0b5pLq68mG7DN6Zgf19WQv4Gzy2daGuc4xI2oMOutT6kv67D1lTfXMhvV1jnmnxu5rEWsaVF9Sr0W8Jj16fa25SfVFrKmeuTIT8R6tZ67Opt2sS8zPYGs2qcaD7zNJ66lnzmcizqaw50Gvnc8k1fd7rsj93A3lZnxGNbrGoWsTNN7oefb0mp750kzEvpZ0LvVknU2b5w5dX+eYzqZt55lSX0+vHfZsCrpOFnF9rfP5i6jxlN39WZ9SX2uup74ZYyasTUp9rblJ9UXsa8603axLT49G/Pzan67MRLz+7Rlz9Fz1zD727Svnvwbc6BcAjmZZlq+oqlrX9ddG5JJcQo3AZTn6vuZMu9ol1AhcFvsaAAAAAJDOZ1tXu4QagctiXwMAAAAAAAAAAABmuDV7Ak9jWZbvve7rJ2R//3VfX5P7Y9d9vaNca30p6xIxz9OfberTjlxrjaPnmVJfxHqem9uAn8Oj98zQfbSqXv3oXyBYluWrbjLXMc+YtXEWbp6bcYamvE6IWNOj90xnrw2tsXL2tUOfaRPWpSqnRvvTPnI9r9ecadvmDt0zPWdote9rKWujZ7Yd7xKur7nGEjxeT1bPXJkbXV/SvuZM2zaXUp/PDfaTO/SZNnqePVk9c2UuZV8bfn3N2bR5LuVnKem9Qco+o2fO52a8Xkt5DlM+f/XZ1vbZiBqDzvqU+mI+ew9aUz1zPjf8vUGN39ci1jSovpheS3lNegH1RbzenjGmntk8F/Ee7dzc9roHO5s2Hy/p+lpEjRewz0Ss57m56Znf/HMRZ1PK83BubnrtN/9cSn3PXvf1DeRmnKHPXvf1jnKj60tZzxn72rPXfb2j3OjnMGVfiziXerLOps1zh66vc0xn0/ncoXums9eOfjalXCdLub6W9Nl7yhl69PqGrsuMMVPWJqi+iOfv9GdT9jVn2ra54X/vPejn1/50Phfx+rdzTD2zbS5i337UracNTLY84evr/NknfH2Vb3zC13vJtdaXsi4p86xq79PWXOtcR88zpb6U9awa399H75nR++j7nvD11rnWefZkR6+Ns3Db3IwzNOV1QsqaHr1nenptdI0p+9rRz7TRuaqcGu1P+8j19Jozbdvc0Xum5wxt3ddS1kbPbDveJVxfc40le7yerJ45b3R9SfuaM23bXEp9PjfYT+7oZ9roefZk9cx5KfvajOtrzqZtcyk/S0nvDVL2GT1z3ozXaynPYcrnrz7b2j6bUmPKWZ9SX9Jn7ylrqmfOm/HeYPS+lrKmKfUl9VrKa9Kj15fyenvGmHpm21zKe7SqnD3Y2bTteEnX11JqPPo+k7KeVXrmKilnU8rzUKXXrpJS308/4eutczPO0NE1jl6blPFGz7On1/TMeSn7Wsq51JN1Nm2bO3p9PVln03lH75meXjv62ZRynSzl+lrSZ+8pZ+jR6xu9LjPGTFmblPpSnr+qnH3NmbZtbsbfe0/5+bU/nZfy+rdnTD2zbS5l3/5Ny7quT5sBAAAAAAAAAAAAAAAAAAAAAAAAAAAATm7PnsArsSzLt1fVd1bVG07ferGqfmRd1w+9guxrq+o7Hst+eF3Xzz4h9/VV9bbHch9c1/WFneVa60tZl4h5nrJNfdqRa61x9DxT6otYz865RtQ44TkcvY8uVfVNj+X+xfqEO+935Jrm2ZOdsDbOwm1zM87QlNcJEWt69J7p7LXRNabsa4c+00bnTtmUGu1P+8j19JozbdvcoXum8wxt3ddS1kbP7GCep2zKtQTXWILHmzRXPbPteEn7mjNt21xKfT432E/u0Gfa6Hn2ZPXMlbmUfW3G9TVn07a5lJ+lpPcGKfuMntl2nknvQ1POJp9tbZjrHDOixqCzPqW+nvcGKfuFntlHbsZ7g9H7WsSaBtWX1GsRr0kvoL6I19szxtQzm+ci3qN1ztXZtG0upb6kax72mezxfB66fS7ibEp5HjrnGlFjUK89dW5ZlttV9e6q+hNV9TWP5qrqfeu6/octcz31tWZH1zh6bVLGm9EzHTk9c3V29/ta5zyT3hs4mzbKXUh9SftMypoetmd61mV0jadsyjUB1w83zJ2yKTWmnPUp9Q1dlxljpqxNUH0Rz98pm7KvOdO2zQ2tr3OuKT+HKfVF7E+TzlA9s20uYt8+++9ar/+dxemWZXmuqn5XVX2gqj51+vYbq+odVfXxdV3//DXZd1TVX66qj9RLi/Ry9lur6q+s6/qBK3LvqarvqarnHxvz7VX1/Lqu93eSa60vZV0i5nnKPlcNfdqRa61x9DxT6otYz865RtQ44TkcvY9+W1W9t6o+/lju66rq+9Z1/cjGuaZ5dtY4em2chcH1dY45usaINT16z3T22ugaU/a1Q59po3NhNdqf9pHr6TVnWnZ9Ec/fKdu6r6WsjZ7ZwTxP2ecq41qCayzB402aq57Zdrykfc2Ztm0upb7nyucGl7o/paznjH1tdI2tOWfatvOccc0jZW2Ovm9H1NdZY2vO2bTtPCPq6xzz6GeTz7Y2zHWOGVFj0FmfUl/SZ+8pa6pnNqyvc8zR+1rEmgbVl9RrEa9JL6C+1tyM96Epa6pn9lFf0r7mbMqu77nKueZhn8kerynXOdeIGoOew9H7Wus8m3Kdc42oMajXWnN/r6o+W1Xvfyz3zqp63bqu371xrmmeYTUOXZug8UbPsyk3qcaU5zBlX4s4lzprbM2lPIcpP0sR9XWOObrG0ePpmQ1zk2pMuSbg+uGGubAan6uMsz6lvtZcT68NHTNlbYLqa83NeG+Qsq8507bNDa2vc67PVcbPYUp9rbmI17+dYw6dq57Zx759pXVdd/1PVf3CFd9f6qUn5rrsz1fVl535/pdf9e99ecyqevWZ77/mujEn5FrrS1mXiHn29GlPrrXG0fNMqS9hPXvnmlDjhOdw9D76QlXdOfP9r62qF24g1zTPsLVxFgbXN2ltUsbTM9v32ugaU/a1Q59po3NhNdqf9pHr6TVnWnZ9Ec/f6c+07mspa6NndjDPl7NXfH9v1xJcYwkeT8/kP4dp+1rjmM608Pqu+L7PDY6/P8Ws54R9Tc+cfzxlX5txfc3ZtI8ePfTr5rS1SRnvyD0zq9cG15jy+avPtvazNkd//3r0+pI+e09ZUz2zYX2dY47e1yLWNKi+pF6LeE16CfWNXpeW8dLWVM/sor6kfc3ZFF5fS4/2ZFNqvIB9JmI99cyu6hu+r+m1/eSS6xv92CvtteQab2pt0scbPc+eXkt57Cafw5R9rXWeI+tLW5vR89zDY0epb09rkzLepffMTfTaTdY4el9rHa8x5/rhAWps7bWQHt3FfnhT6zLruUhYm6T6Ep6/05+J2dcac860HdTXW+MV39/dz2FKfaPXZeR4aWujZ87mhv8u97l/btX+/cayLN945vvfWFW/8YTsUlXrme9//vTYVT5fVV9z5vtffXpsL7nW+lLWJWWeVe192pprnevoeabUl7KeVeP7++g9M3ofvV1f+K8CPOrFqnr1DeRa59mTHb02zsJtczPO0JTXCSlrevSe6em10TWm7GtHP9NG56pyarQ/7SPX02vOtG1zR++ZnjO0dV9LWRs9s+14l3B9zTWW7PF6snrmvNH1Je1rzrRtcyn1+dxgP7mjn2mj59mT1TPnpexrM66vOZu2zaX8LCW9N0jZZ/TMeTNer6U8hymfv/psa/tsSo0pZ31KfT3vDVL2Cz2zj9yM9waj97WUNU2pL6nXUl6THr2+lNfbM8bUM9vmUt6jvfxnEvZgZ9O24yVdX0up8ej7TMp6VumZq6ScTSnPQ5Veu0pKfZ9eluW7lmX5zb8zvyzLrWVZvruqPnMDuRln6OgaR69Nynij59nTa3rmvJR9LeVc6sk6m7bNHb2+nqyzadt5ptTX02tHP5tSrpOlXF9L+uw95Qw9en0zfgf86K+79Mx5M94bpOxrzrRtczP+3nvKz6/96byU1789Y+qZbXMp+/ZZt582MMG7qupvLcvy2+oLv3j5pqr69dNj1/lrVfUzy7J8pKo+efrem6vqW6vqr16Te6aq/smyLB9/LPd1VfX9O8q11peyLinzrGrv09Zc61xHz7M190yNrW/0eK25nrm25lrnOjr3TGXsoz9UVR9dluX5R3Jvqqq3V9X7biDXOs+e7Oi1cRZum2udZ2uuJzu6xpQ1PXrPtOaqxteYsq8d/UwbnavKqfGZsj/tIdfTa6PHbB1v9DxT6mvNja6vqn1fax2zNadnzkupryrnWkJrrnWeo3PP1LGvy82Ya2uudZ6jc8/U2PqS9rXWrDPtvJT63lU+N9hL7pk69pk2ep492da5js49U860Lec545rH6FzKc/iuyvhZas21zrMn25p7ppxNW86zNdc6z9ZcT/aZOvbZ5LOtbXM92ZQan6mMsz6lvtZcVc5+0Tre6Hmm1Neam/HeYPS+1jrP1pxeOy/pfei7ymvuPeSeqfHvQ0eP2ZprnWdrrnWeo3PPVMZ7tJ65tuacTeel1Peuyrnm0Zprnefo3DPl+uHWc23Ntc51dO6ZyjibRs+zNdcz19Zc61xH556pjPreXlU/UFXvXZblM/XSX7b/sqr68dNjW+da59mTHV3j6LVJGW/0PFtzPXNNWZvW8Z6pjH2tdZ6tudZ59mRbc89UxnOY8rPUmhtdX0/2XeVs2nKerbmUc6nq+GdT63itOdcPr5ZS47sq46xvzbXOc3TumRr/d/Zax2wdb/Q8W3Ot8xyde6bGvzdI2ddac86082b8vffW7Lsq4+ewNdc6z9G5Zyrj9W/PmKPn2pprnefo3DOVsW+ftazruZsG78+yLF9VVW84ffniuq6/9ApzX15V3/5otqo+vK7rtf+VneWl/0rONz2W++i6rp/bWa61vpR1iZjnI/nWPn3qXM9cR86zNTe6vrD1HN7fR+6ZCfvo762qP/5Y7oPruv7cDeWa5tmTnbA2zsJtczP2mJTXCRFrevSe6ey10TWm7GuHPtNG507ZlBrtT/vI9fSaM23b3KF7pvMMbd3XUtZGz+xgno/kE64luMYSPN6MueqZzceL2decaZvnIuo7ZX1usIPcJZxpE+YZUWNrzpm2+TxnXPNIWZtD79tJ9fVkQ/YZPbPhPHtyrdkLOJt8trVhrnPMiBqDzvqU+pI+e09ZUz1zPjfjvcHofS1iTYPqS+q1iNekR6+vNTepvog11TNXZiLeo/XM1dm0eS6ivlM24pqHfSZ7vM6cnjmfiTibwp4HvXY+E1PfKfsVVVXruv7aK8205mZ8RtU619G50fWlrOeMn4nWuY7OjXwOU/a1pHOpJ+ts2jZ39Pp6ss6mbeeZUl9n7rBnU9B1sojra53PX0SNp+zuz/qU+lpzPfXNGDNhbVLqa81Nqi9iX3OmbZ6bce044ufX/nRlJuL1b8+Yo+eqZ67MDf9d7sfdftrADMuyvLaq/mA9UvCyLB9e1/WzT8qu6/qZZVn+aX3xk/pKFmp95J+Xv/783nKt9aWsS8o8q9r7tKO/m+Y6ep4p9Y0er2dfa51ra+7oPTN6H11f+ssCP7csy+tOX3/6SZnOXOs+mrQ2zsINc63z7Mg1Z0fXmLKmF9Azzb02oWci9rWjn2kTfiZiaiz70y5yPb02YcyItUmprzU3ob7mfa1jTD2zYS6ovphrCa25o19jCRpPz2ycq8H1Je1rrVln2hWhkPp8brCfXB38TJtwnjVn9cwVg4XsazOur7XOdXQu5TlM+Vlqzc14b5Cyz4we7+g9k/Q+NOVs8tnWtrnOMVNqjDjrU+rryMXsF63jjZ5nSn2tuUmfh47+XbuINU2przWX9D7Ua+595GpwfTPG1DPb5mpwfUn7mrPpilBIfUnXPFpz9pl9jOfz0O1zlXM2RTwPPXNtzem1zXNfX1Vvezm3LMuLVfUj67r+6xvKDT9DJ9Q4dG2Cxhs9z55e0zPnRexrrfNszU3a15xN2+YOXV/nmM6mbeeZUl9Prx36bGodrzXn+uE1wZAaU8761tzR35/PGDNobSLqS3n+qnL2tdacM+2K0IS/996aTfk5bM3Zn7Ydr2dMPbNtrnL27S+xrOv65D810bIs76iqv1xVH6mqF0/ffmNVfWtV/ZV1XT9wTfYtVfW3q+q1VfWpqlpO2c9W1fet6/ozV+S+rareW1Uff2zMrzvlPrKTXGt9rbmU+obO85Rt6tOOXGuNo+eZUl/EenbONaLGCc/hW2rsPvrmqvrrVfWHq+rXT7nfXlU/XlX31nV9uHGuaZ6dNbbmhtaYcsYcvb7OMUfXOHo8PbNhblKNKftaay7iTBudC6vR/rSPXFN9M8ZMWZug+iKev1O2dV9LWZvWnJ7ZMHfKplxLcI0leLxJc9Uz2473lsrZ15xp2+ZS6vO5weXuTynrOWNf0zPnc2+pjH2tdZ5NuUk1Opu2zUXU11ljyj6jZ3ZQX+eYRz+bWsdrzR36s63OMSNqDDrrU+pL+ux99Hh6ZttcU32dY47e1yLWNKi+pF6LeE16AfVFvN6eMaae2c26DH2P1jlXZ9O2uZT6kq552Geyx/N5aH7PvKXG7mt67XJ7rTX3nqr6nqp6vl7q0Zdzb6+q59d1vb9xbsYZOrrGoWsTNN7oefb0mp45n0vZ1yLOpc4anU3b5g5dX+eYzqZt55lSX0+vHf1sSrlO1pqLuH4YVmPKWZ9S34zfAT/66y49s4P6Ttm3VMa+5kzbNje0vs65pvwcptQXsT9NOkP1zLa5iH37Suu67vqfqvr5qvqyM9//8qr6hSdkP1ZVbz3z/W+uqn95Te6Fqrpz5vtfW1Uv7CjXWl/KukTMs6dPO3KtNY6eZ0p9EevZOdeIGic8h637TGvun1fVd1fVqx753qvqpQu0P3EDuaZ5hq3N6HmmnIUR9U1am5Tx9Mz2vTa6xpR9rTUXcaaNzoXVaH/aR66n15xp2fVFPH+nP9O6r6WsjZ7ZwTxPfyblWoJrLMHj6ZlD9MzHKmdfc6btY10O/bN7CTV25A59po2eZ1iNKc/hxypjX2udZ1NuUo3Opm1zEfWFrU3KeIfumUm9dvSzqXW81tyhP9uatDajn8OUsz6lvqTP3lPWVM9sWF/nmKP3tYg1DaovqdciXpNeQH0Rr7fD1lTP7KO+j1XOvtY0147coc+mlJ/BnmxKjRewz0Ssp57Z1XP4sRq7r+m1/eRS6vuFqnr1me+/pqo+fgO5GWfo6BqHrk3QeKPn2dNreuZ8LmVfiziXwtbG2RRc36S1SRlPz2zfa0c/m1Kuk7XmIq4fhtWYctan1Dfjd8CP/rpLz+ygvtOf+Vhl7GvOtH2syyX83Rb70z7q8/fe91Pfoe8teNU/t2r/lqpaz3z/86fHrvNb13X9yce/ua7rT1TVb70md7u+8F/IedSLVfXqHeVa60tZl5R5VrX3aWuuda6j55lSX8p6Vo3v76P3zOh99Hes6/rD67p+7pHM59Z1fb6qvuIGcq3z7MmOXhtn4ba5GWdoyuuElDU9es/09NroGlP2taOfaaNzVTk12p/2kevpNWfatrmj90zPGdq6r6WsjZ7Zxzyrcq4luMaSPV5PVs+cN7q+pH3NmbZtLqU+nxvsJ3f0M230PHuyeua8lH1txvU1Z9O2uZSfpaT3Bin7jJ45b8brtZTnMOXzV59tbZ9NqTHlrE+pL+mz95Q11TPnzXhvMHpfS1nTlPqSei3lNenR60t5vT1jTD2zbS7lPVpVzh7sbNrHPJOuedhnssfzeej2uZSzKeV5qNJrV0mp7/NV9TVnvv/Vp8e2zs04Q0fXOHptUsYbPc+eXtMz56XsaynnUk/W2bRt7uj19WSdTecdvWd6eu3oZ1PKdbKU62tJn72nnKFHr2/0uswYM2VtUupLef6qcvY1Z9q2uRl/7z3l59f+dF7K69+eMfXMtrmUffus208bmOCvVdXPLMvykar65Ol7b66qb62qv/qE7I8ty/Kgqj7wSPZNVfWOqvrQNbkfqqqPLsvy/GO5t1fV+3aUa60vZV1S5lnV3qetuda5jp5nSn0p69kz15QaRz+Ho/fRn16W5b1V9f7Hcu+sqp+9gVzrPHuyo9fGWbhtbsYZmvI6IWVNj94zPb02usaUfe3oZ9roXFVOjfanfeR6es2Ztm3u6D3Tc4a27mspa6Nn9jHPqpxrCa6xZI83Y656ZtvxkvY1Z9q2uZT6fG6wn9zRz7TR8+zJ6pnzUva1GdfXnE3b5lJ+lpLeG6TsM3pm23kmvQ9NOZt8trVtriebUmPKWZ9SX897g5T9Qs/sIzfjvcHofS1lTVPqS+q1lNekR68v5fX2jDH1zLa5lPdoPXN1Nm2bS6kv6ZqHfSZ7PJ+Hbp9LOZtSnoeeuabUmNJrrblnquqfLMvy8cdyX1dV338DuRlnaOtcR+dG15eynjP2tda5js6Nfg5T9rWUc6kn62zaNnf0+nqyzqZt55lSX2uu6vhnU8p1spTra625qpwaU876lPpGr8uMMVPWJqW+lOevKmdfc6Ztm5vx995Tfn7tT+elvP7tGVPPbJtL2bfPWtb13M2N92VZli+vqm+vqjecvvViVX14XdfPvILsH6mqtz2W/eC6rj/6hNzvuSL3czvLtdaXsi4R8zxlm/q0I9da4+h5ptQXsZ6dc42occJzOGwfXZblNVX17sdyn6qqf1hV71vX9d9vmeupryc7cm1Gz/OUSzkLI+rrHHN0jRFrevSe6ey1YTWG7WuHPtMm5JJqtD/tI9fzes2Ztm3u0D3TMV7PvpayNnpmB/M8ZVOuJbjGEjzepLnqmW3HS9rXnGnb5lLq87nBfnKHPtNGz7Mnq2euzKXsa0PPpc65pqzN0fftiPp6skH7jJ7Zdp5J70NTziafbW2Ya80m1Rh01qfUF/HZ+6Tx9My2uaHvDSbtaxFrGlRfRK915rzm3kduxvvQlDXVM+dzEe/ROufqbNo2l1Jf0jUP+0z2eD4P3T4XcTalPA+dc42oMajXWnO3quqbHst9dF3Xz91QbsYZOrrGoWsTNN7oefb0mp45n0vZ1yLOpZ6ss2nz3KHr6xzT2bTtPFPq6+m1o59NKdfJUq6vJX32nnKGHr2+Gb8DfvTXXXrmfG7Ge4OUfc2Ztm1uaH2dc035OUypL2J/mnSG6pltcxH79tl/1xpwo18AAAAAAAAAAAAAAAAAAAAAAAAAAADYq1uzJ/A0lmX5weu+fkL2e6/7+prcs9d9vaNca30p6xIxz9OfberTjtyz1319A+Mdvb7R4/Xsa89e9/UN5I7eM6P30T923dc3kGuaZ092wto4C7fNPXvd11vnOsccXWPEmh69Zzp7bXSNKfvaoc+00bnTn02p8dnrvr6B3NHra8319NrQMVPWJqi+1tzQ+k5/tnVfaxpTz2yei6jv9GdTriW05o5+jSVivJ6snrky9+x1X9/AeEn7WuuYzrTzuZT6fG6wn9yz1319gPGGzrMnq2euzKXsazOurz173dc7yqU8hyk/S625Ge8NUvaZ0eMdumcm9dqz1319A+OlfP7qs63tx4yoMeisT6mvKXf6syn7Ret4rTk9cz43473B6H3t2eu+voGcXjufS3of6jX3PnLPXvf11uPNGFPPbJ579rqvb2C8pH3N2XQ+l1Jf0jWP1px9Zh/j+Tx0+9yz1319A+ON3tf02n5yz1739Q2M15r7R9d9fQO5GWfo6BqHrk3QeKPn2dNreuZ87tnrvr4ml7L/tuZ89r59LuVnKaK+zjGdTedzh+6Zzl47+tnUOl5rzvXDq7MpNaac9a25Q78/nzFmytoE1Rfx/J3+bMq+1ppzpp3Pzfh7703ZoJ/D1pz9acPxOsfUM9vmnr3u62tyw3+X+2VRN/qtqv/5CV9fZ3nC11f56Sd8vZdca30p65Iyz6r2Pm3Ntc519DxT6ktZz6rx/X30nhm9j37jE77eOtc6z57s6LVxFm6bm3GGprxOSFnTo/dMT6+NrjFlXzv6mTY6V5VTo/1pH7meXnOmbZs7es/0nKGt+1rK2uiZbce7hOtrrrFkj9eT1TPnja4vaV9zpm2bS6nP5wb7yR39TBs9z56snjkvZV+bcX3N2bRtLuVnKem9Qco+o2fOm/F6LeU5TPn81Wdb22dTakw561PqS/rsPWVN9cx5M94bjN7XUtY0pb6kXkt5TXr0+lJeb88YU89sm0t5j1aVswc7m7YdL+n6WkqNR99nUtazSs9cJeVsSnkeqvTaVVLq+6+f8PXWuRln6OgaR69Nynij59nTa3rmvJR9LeVc6sk6m7bNHb2+nqyz6byj90xPrx39bEq5TpZyfS3ps/eUM/To9Y1elxljpqxNSn0pz19Vzr7mTNs2N+Pvvaf8/Nqfzkt5/dszpp7ZNpeyb38hsK7r02YAAAAAAAAAAAAAAAAAAABgF5ZleV1V1bqunx6Rm2F0jaPXJmU8PbN9rlXSc8FlSvlZajWjvqPvM3pmH7keKc8FAAAAN2v3N/pdluW1VfWXquo7q+o/raq1qn6lqn6kqu6v6/rZJ+S//ZR9w+lbL1bVj6zr+qFrMrer6t1V9Seq6msezVXV+9Z1/Q97yLXW15pLqW/SPJv6tCPXWuPoeabUF7GenXONqHH0c3jKDttHT7mvr6q3PZb74LquL9xQrmmePdkJa+MszK4v4nXC6PH0zPbrMrrGU3b3+1pnLuJMG507ZXdfo/1pP/tTx7o404LrS3n+Hsk/9b6WsjatOT1z0dfXXGMJHm/SXPXMhuOdsin7mjNtw1xQfT43uND9KWg9h+9reuYQZ9ro63LOpm1zKT9LSe8NIvYZPbOP+jrHPPTZ1DpeZ+7Qn211jrn7GlPO+pT6NvjcYPf7hZ7ZT8+Mfm9wyg7b18LWdPf1JfVaymvSC6gv6fV2yprqmR3Ud8pG7Gudc3U2za8v6ZqHfSZ7PJ+HhvfMKTtyX9NrF9prHbk3V9Vfr6pvqarPVtVSVb+9qn68qu6t6/pw49yMM3R0jUPXJmi80fPs6TU9cz6Xsq9FnEudNTqbts0dur7OMZ1N284zpb6eXjv62RRxnaw1l3T9MKjGlLM+pb6h6zJjzJS1Caov4vl7JJ+wrznTNsyNrq+zxpSfw5T6IvanSWeontk2F7FvX/nvWvd/o98P10tvXN+/rusvnb73VVX1zqr6lnVdv+2a7HNV9buq6gNV9anTt99YVe+oqo+v6/rnr8j9vXrpjfP7H8u9s6pet67rd+8k11pfay6lvqHzPGWb+rQj11rj6Hmm1Bexnp1zjahxwnP4XI3dR99TVd9TVc8/lnt7VT2/ruv9jXNN8+yssTU3tMaUM+bo9XWOObrG0ePpmQ1zk2pM2ddacxFn2uhcWI32p33kmuqbMWbK2gTVF/H8nbKt+1rK2rTm9MyGuVM25VqCayzB402aq57ZdrznKmdfc6Ztm0upz+cGl7s/paznjH1Nz5zPPVcZ+1rrPJtyk2p0Nm2bi6ivs8aUfUbP7KC+zjGPfja1jteaO/RnW51jRtQYdNan1Nfz3mB0jaPH0zPb5prq6xxz9L4WsaZB9SX1WsRr0guoL+L19owx9cxu1mXoe7TOuTqbts2l1Jd0zcM+kz2ez0Pze+a5Gruv6bXL7bXW3D+vqueq6h+s6/q50/deVVXfVVXPrOv6zRvnZpyho2scujZB442eZ0+v6ZnzuZR9LeJc6qzR2bRt7tD1TVqblPH0zIa5STWmXBNw/XDDXFiNKWd9Sn0zfgf86K+79MwO6jv9uecqY19zpm2bG1pf51xTfg5T6ovYnyadoXpm21zEvn2ldV13/U9V/XzLY6fHf+GK7y+nxXqqXMpjrfWlrMve5nl6vKlPOx5rrWP0PFPqi1jPzrlG1DjhORy+j1bVq898/zU3lWuZZ9rajJ7nHh47Sn17WpuU8S69Z26i126yxuR97Sb37SOvyxFqHP3Y0eu7qXXZ03Oxt7VJr29vz9/Lj2+5r6WsjZ5xfe0GHtvTdZQ9XScbOp6eOW7P7HRf28Xevbe12cu63OBjPjfYz2O72J92uJ4z9rU99cWensOUfW3K9bXkx3b4HKb8LCW9N4jeZ/TMlNdrKc/hLva1mzpjquM6Z2tuZH2z1mb0c7iHx45e35Me21ONKWt66T1zE/vaK3lsD/va3tY0vb699lrjY15z7+OxGe9DU9ZUz+yjvqR9zdmUXV/SNQ/7TPZ4Pg/Nfw5H72t6bT+PpdR3XR/exGMzztDRNQ5dm6DxRs+zp9f21Bd7eg5T9rWIcylsbZxNwfVNWpuU8fTMho9NqnEX7+9GP1YXfv0wrMaUsz6lvqHrMum5iFiboPoinr/r/r073NecaTtelyc91jnXlJ/DlPoi9qfOXktZGz3zFI/d1L591T+3av/+7bIsf3FZlte//I1lWV6/LMt7quqTT8j+xrIs33jm+99YVb9xTe7Ty7J817Isv7k+y7LcWpblu6vqMzvKtdaXsi4p86xq79PWXOtcR88zpb6U9eyZa0qNo5/D0fvo56vqa858/6tPj22da51nT3b02jgLt83NOENTXiekrOnRe6an10bXmLKvHf1MG52ryqnR/rSPXE+vOdO2zR29Z3rO0NZ9LWVt9Mw+5lmVcy3BNZbs8WbMVc9sO17SvuZM2zaXUt/on8GeuabUmLI/paznjH1Nz5yXsq/NuL7mbNo2l/KzlPTeIGWf0TP7qK8ne/SzyWdb2+Z6sik1ppz1KfUlffaesqZ65rwZ7w1G72spa5pSX1KvpbwmPXp9o9eldbwZY+qZbXMp79F65ups2jaXUl/Pvmaf2Tbn+uH2c02pMeU5HL2v6bX95FLq++llWd67LMtbl2X5mtM/b12W5b1V9bM3kOvptZQaR69Nynij59nTa3rmvJR9LeVc6smOXpvR80z5WUqpryc7usaUNT16z/T02ugaU64JuH64ba4qp8bR+8XR6xu9LjPGTFmblPpSnr+qnH3NmbZtbsbfe0/5+bU/7aM+f+99P/WNXpcZv8v9pZ72zsCj/6mqL6+qH6iqf10vLehnquqF0/de94Ts76+qn6yqn6uqj5z+eaGqfqKq/vNrcneq6oer6ler6heq6uOn///DVfW1O8q11peyLhHz7OnTjlxrjaPnmVJfxHpO+jk8es+M3ke/o6o+UVU/VlU/ePrnQ6fvfccN5JrmGbY2zsLg+iatTcp4emb7XhtdY8q+dugzbXQurMbW3m7NHb2+oesy6bmIWJug+iKev1O2dV9LWRs9s4N5nrIp1xJac0e/xhIxnp45RM8k7WutYzrTsuvzucF+cqPrS1nPpnmG1ZjyHKbsazOur42ucfTajJ5nys/S0PrC1iZlvEP3zKReG11jyuevPtvaz9oc/f3r0etryoXtF3pmH7kZ7w1G72sRaxpUX1Kvtea85t5Hbmh9YWuqZ/ZRX9K+5mzKri/pmsfQGifkRtcXsZ56ZlfP4eh9Ta/tJ5dS32uq6s/WS9cA/tXpnw9V1fdV1W+5gdyMM3R0jUPXJmi80fPs6TU9cz53pzL2tdZ5Dq0vbG2cTcH1he0zEWt69J7p7LWjn02t47XmXD/MrzHlrE+pb8bvgB/9dZee2UF9p2zKvtaac6btoL6wn9/Rz4X9afteS1kbPbPt/tT8+xrn/llO/9JDW5blq6rqDacvX1zX9ZeeIvsVVVXruv7aU445LNdaX8q6pMxzlqS5thhdX9J6XkJ/t9j7Pnr6LwN806O5qvrouq6fu4lc6zx7syPXZvQ8H8nu/ixMqa8nO7rGlDW9hJ7pyA2rMWlfO/qZNiEXU+Mpa3+anOupb8aYCWuTUl9rbsJroOZ9rXXMjrnqmfOZmPpmuIQaW7gudzU9c97I+tL2NWfadrmk+ma4hBpbONPOG72vJXGmbTfPGdc8RudSnsMZjl5fD2fTeXrmakc+m3y2tW2uNRtY4+7P+pT6OnMR+0XreKPnmVJfa270e4MZ+1rLPHtyeu3KTNT70NGOXl+rGfWlrKmeOS/lPdopv/s92Nm0j3nOcgk1tnD98Gp65ryUsynpedBr5x29PuDypOxrzqWrXUKNwGVJuSbg+uHmuZgaRzt6fa18tnU1PXPehPMlZl9zpm2Xm3XtOOXn1/50Xsrr3xn0zHkp+/ajbreERluW5dur6jvri3/h8kfWdf3QK8i+tqr+4KPZZVk+vK7rZ5+Q+/qqetvLuWVZXh7zX+8s11pfyrpEzPP0Z5v6tCPXWuPoeabUF7GenXONqHHCczh0H62q9ZF/Xv7680/INOc65hmzNs7CzXMzztCU1wkRa3r0nunstaE1Vs6+dugzbcK6VOXUaH/aR67n9ZozbdvcoXum5wyt9n0tZW30zA7mefqzKdcSXGMJHm/SXPXMtuMl7WvOtG1zKfX53GA/uUOfaaPn2ZPVM1fmUva14dfXnE2b51J+lpLeG6TsM3pm23kmvQ9NOZt8trVhrjMbUWPQWZ9SX897g5T9Qs/sIzf8vUGN39ci1jSovpheS3lNegH1RbzenjGmntk8F/EerXOuzqZtcyn1JV3zsM9kj+fz0O1zEWdTyvPQOdeIGoN67alzy7Lcrqp3n8tV1fvWdf0PW+Z66mvNjq5x9NqkjDejZzpyeubq7O73tc55Jr03cDZtlLuQ+pL2mZQ1PWzP9KzL6BpP2ZRrAq4fbpg7/dmUGlPO+pT6ZvwO+GFfd3XOM6W+iOfvlE3Z15xp2+aG1tc515Sfw5T6IvanSWeontk2F7Fvn/13rev65D810bIsz1XV76qqD1TVp07ffmNVvaOqPr6u65+/JvuOqvrLVfWReunJfDn7rVX1V9Z1/cAVufdU1fdU1fOPjfn2qnp+Xdf7O8m11peyLhHzPGWfq4Y+7ci11jh6nin1Raxn51wjapzwHI7eR7+tqt5bVR9/LPd1VfV967p+ZONc0zw7axy9Ns7C4Po6xxxdY8SaHr1nOnttdI0p+9qhz7TRubAa7U/7yPX0mjMtu76I5++Ubd3XUtZGz+xgnqfsc5VxLcE1luDxJs1Vz2w7XtK+5kzbNpdS33Plc4NL3Z9S1nPGvja6xtacM23bec645pGyNkfftyPq66yxNeds2naeEfV1jnn0s8lnWxvmOseMqDHorE+pL+mz95Q11TMb1tc55uh9LWJNg+pL6rWI16QXUF9rbsb70JQ11TP7qC9pX3M2Zdf3XOVc87DPZI/XlOuca0SNQc/h6H2tdZ5Nuc65RtQY1Gutub9XVZ+tqvc/lntnVb1uXdfv3jjXNM+wGoeuTdB4o+fZlJtUY8pzmLKvRZxLnTW25lKew5SfpYj6OsccXePo8fTMhrlJNaZcE3D9cMNcWI3PVcZZn1Jfa66n14aOmbI2QfW15ma8N0jZ15xp2+aG1tc51+cq4+cwpb7WXMTr384xh85Vz+xj3/7/23vzsNmusk7795ycBAghI5gwhWCQSUEIo0I3YBCCnxJkEORySNMqTuABFPg+aaVFxm5l0mAjM6gQQZEOJIAQZOqQQM5JAiYhyJCYNgxJkOAHbUxW/1HrNZVK1X7f2lW11/rtdd/XVdepU6vuen571/OuVbV3vfUuJKVU9UXS5xfcHpo8MV3uRZIOnXP7YYsed6umpP3n3H5AV80CXt/tc9kvFjlX6dNVvL7bOHROl+1z2J+rZnXYxgLP4dDz6AWSjplz+x0lXbABr1dOs33DWmi8fYX2jUs9emb9vTb0NrrMa6Ne04b2zLaR+akOb5VeY03z3j6L5y/fp++85rJv6JkKcm65C26v7VgCx1iM69Ez/s+h27zWsyZrmvn2Lbid8wbjn59s9meBeY2emT/uMq+VOL7G2lRHj476dbPbvnGpN+aeKdVrA2+jy/lXzm3Vs2/G/v517NvndO7dZZ/SM2vcvhVrDj2vWexTo+1z6jWL16QtbN/Q+6VPPbd9Ss9UsX1O8xprk/n29enRVVyXbWxgnrHYn/RMVds3+LxGr9XjOW/f0GM77TXnbdzUvnGvN3TOVXrNZWyTz6HLvNY355Db57Zvhs5Zw9hYtq+mfeNSr/We2USvbXIbh57X+tbr6XH8cATb2LfXTHq0ivlwU/ul1HPhsG+cts/h+cv3sZnXenqsaRVs36rbuOD26n4OXbZv6P0yZD23fUPPzPUG/yz3vMsu1c93I+J+c26/n6TvbuOGpDTn9uvy2CKuk3SbObffOo/V4vXdPpf94pJT6t+nfb2+WYfO6bJ9LvtTGr6/x94zQ8+ju3X9XwWY5jJJ+2/A65tzFXfofcNauF6vxBrq8jrBZZ+OvWdW6bWht9FlXhv7mja0J/lsI/NTHd4qvcaatl5v7D2zyhrad15z2Tf0zHrrtXB8jWMs3vVWcemZ+Qy9fU7zGmvaej2X7eO8QT3e2Ne0oXOu4tIz83GZ10ocX2NtWq/n8rPk9N7AZZ6hZ+ZT4vWay3Pocv6Vc1vrd1220WWtd9m+Vd4buMwX9EwdXon3BkPPay771GX7nHrN5TXp2LfP5fV2iZr0zHo9l/doW/dxmINZm9Zbz+n4mss2jn2ecdmfEj2zCJe1yeV5kOi1Rbhs35UR8YSI+PffmY+IXRHxRElXbcArsYYOvY1D7xuXekPnXKXX6Jn5uMxrLuvSKi5r03q9sW/fKi5r03pzumzfKr029rXJ5TiZy/E1p3PvLmvo2LevxGfAx/66i56ZT4n3Bi7zGmvaer0Sv/fu8vPL/DQfl9e/q9SkZ9bruczbc9m9rFCAkyS9JiJuoes/eHl7Sf+cx7p4oaRzIuIDki7Ntx0t6UclvaDD2yPpQxFx8Yx3J0m/XpHXd/tc9otLTql/n/b1+mYdOmdfb4+G3b6h6/X1Vsna1+ubdWhvjzzm0TdIOjsi3j7l3V7SkyS9fgNe35yruEPvG9bC9Xp9c/b1VnGH3kaXfTr2nunrScNvo8u8NvY1bWhP8tnGPWJ+qsFbpdeGrtm33tA5Xbavrzf09kn957W+Nft69Mx8XLZP8jmW0Nfrm3Nob4/GfVyuRNa+Xt+cQ3t7NOz2Oc1rfV3WtPm4bN9J4rxBLd4ejXtNGzrnKm7frEN7e8Sats6cJY55DO25PIcnyeNnqa/XN+cqbl9vj1ib1pmzr9c3Z19vFXePxr02cW5rvd4qrss27pHHWu+yfX09yWe+6Ftv6Jwu29fXK/HeYOh5rW/Ovh69Nh+n96EnidfcNXh7NPz70KFr9vX65uzr9c05tLdHHu/RVsna12Ntmo/L9p0kn2Mefb2+OYf29ojjh+vO2tfrm3Vob4881qahc/b1Vsna1+ubdWhvjzy270mSXirp5IjY+hK1QyWdkcfW7fXNuYo79DYOvW9c6g2ds6+3SlaXfdO33h55zGt9c/b1+uZcxe3r7ZHHc+jys9TXG3r7VnFPEmvTOnP29VzWJWn8a1Pfen09jh8uxmUbT5LHWt/X65tzaG+Phv+dvb41+9YbOmdfr2/Oob09Gv69gcu81tdjTZtPid977+ueJI+fw75e35xDe3vk8fp3lZpDZ+3r9c05tLdHHvP2XCKleV8aXB8RcZSk2+b/XpZSunyH3mGSHjntSnp/Sqnzr+zE5K/k3H/GOzuldG1lXt/tc9kvFjmn/L59urS3StYhc/b1ht4+s/05eH+PuWcKzKN3k3TijPeelNLfb8jrlXMVt8C+YS1cr1dijnF5nWCxT8feMyv22tDb6DKvjXpNG9rLrss2Mj/V4a3Sa6xp6/VG3TMrrqF95zWXfUPPVJBzync4lsAxFuN6JbLSM2uvZzOvsaat3bPYvuxy3qACr4U1rUBOi23s67GmrT1niWMeLvtm1PO20/at4prMM/TMGnOu4vV1G1ibOLe1Rm/FmhbbaLTWu2yf07l3l31Kz8z3Srw3GHpes9inRtvn1GsWr0nHvn19vULbZ7FP6ZmFjsV7tFWysjat3bPYvuxaHPNgnvGut6JHz8x3LNYms+eBXpvv2Gxfdo+QpJTSFTt1+nolzlH1zTq0N/T2uezPEj8TfbMO7Q35HLrMa07r0ioua9N6vbFv3youa9N6c7ps34reaNcmo+NkFsfXVnz+LLYxu9Wv9S7b19dbZftK1HTYNy7b19crtH0W8xpr2tq9EseOLX5+mZ8WOhavf1epOXRWemahN/hnuW/0WMnki34BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAamRX6QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzvBFvwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArYPNFvxFxq4i4d0TcMyIO6uEfHhGHbyLbGIiI4wasdXBE3CciDuvh3nLJ+x8WEQcv6RwZEcfly5HLJZz7eEv3a886j+7pLf1zERF3iojHRcTdt7nfoX0yZXf31PWDIuK+O83ad75Y53M/1POea/Wa2+gZbyLiewrUPGLomkPQymsEl7V+xbobf52QPXpm/bVG3TPQzdBr2ljXM4n5aUO1Bp+flp2bssOa1gE9c6P7s55tAz1zo/u3dHyNYyziuNyStegZlemZ7DbxWmYVWNNudP+iaxrz042cUc5Pjj2zylxKz9zAZU3bhiHXpVyPtWn7x6p6nhlyjsneKOcZemYz9XbaL/m+h/bJlV3WpgoJzm2tjVZ6bezvz3NdPq+xRsbeM8v2S3Z69Qx0Q6/NdXif1u1V95rb9PU2PbOBeiPvmSZeA0msTXPu38S6lGsxz4jjh0vWomfU7tpEr93IGV2vxYQHRMRj8+UBEREr5L/rDu6z/5zbOtfuiNgVEbvy9QPyXNq3Z361h3NQrnnoNvc7YHr/RcTDIuJZEfGobbx7Lptpyj16K1dEHBMRj4+IH9ihe9+I+MmIePROnrvsNNUzffole/TMDT2710EO61L2WJu2f7zRzTObnmPyfW3mGXpmR06161L2WZsqJEZ+/DDX5Rji/DrVvw6q/TVQdpo5hkjP/Ltb5Phh9ps5v9WHsa9pQ6xn2WN+2kC9sc5P6+yX/Hj0zPVO1T1TnJRS1RdJd5f0t5K+IOlfJX1K0pckvUnSIdu4R0t6u6SvS7o4P8bX8m3H9Mxz/ro9SbfPmT4m6f+TtP/U2Ls7vLtKOk3SeyUdm/fJNyWdJeluHd5xM5f7SPpHSfeWdFyH95Sp67eT9KFc75OS7tzhvU3SLfP1R0q6JD+nX5H0hA7vUfm5/njO9jlJ/5CzHt/h3UbSWyT9s6Rrc71LJD1/et/O8e4l6UxJF+R8fyvpwnzbwv2yg+f+ko6xe+THv1TSayUdNjV2Vof32JnL4yRdvvX/Du95Mz9bn8/7+MuSHtDhnTH1HP5s9l4n6XxJT+vw/i3vx/8s6dAl9tlJkq7IdR4l6Yu53y6V9NMdXq/5YhPP/Sae9zz+oJzzc5IeIOmD+efiUkk/RM8s1zPbPOZpHWMHS3qxpLdKevLM2Mkd3lGSXiPpjyUdocm8dL6kUyTdusM7fOZyRH4ODpN0eId3wtT1QyS9XtJ5kv5c0pHbbP9Lpp7D++Z9+gVN5u6HdHjnSHqepGOX3N/3zX3zNk3WxQ9qMo+fLeneHd5Bkn4v/0z8syZr/pmSTtqm3qCvEcRa37XfrtRkfjheUiyxv4d+nUDPVNAzffulUM8coslcemHOfYUma/hLtMQaN/OYC9emvp5GvqZp4PVsqg5r2o095qf5Xq+5KbusafTMxtez7G5iTaNnRtoz8jq+xjGW+d5JGvFxOXpmFD1jcd4nj7OmzfeaXdPEeYOxz08WPdO3X+gZ/zVNJutSdlmb5nv30ojnGQ08x+T7j32eoWfW2DN9+8WsZ2p6v8W5rcn1HZ/byvfn8xrzxyxeB8nkNVB2+bwGPVP7+dBDVM/nNei1cffavcRr7nkex4LoGXpmDT2jDbwGyo/L2pTqXptksi7lceaZ+Z7LPDNoz/TtF3qmqp6p6fghvTbuXntEdk7L2/U6Safn2x6xgZ55mCbr8zckfWC6nyWd0+E9RtJXJf2TpBPz9n0oP9ZPbJPnmTOXZ+X6z5T0zA7v5KnrD9bkNcIZ+bn4sQ7v3K2fBUm/pcnrpuflHn9xh3etJj/vL5B09yX293Pzc32hpF/I/74+/2x1bd9DJH06981Vkk6V9AlJH5F0+1Z7pm+/0DOdPXMvGbwOksm6lO/P2rTenrGYZzTwHJPv7zLP0DMV9EzffinUM/fSwMd1OjyOH06uj/Xc+6C9ppG/DpLJa6Cp7RrtMUR6Zr0907dfslvTMUTWtDTMmqYyv/d+LzE/zfOYnwbqF3rGo2e2ecy1f1Z94eP1bbKhLrlZ75Kv31/Sm/P1X5T0zm3c/yXpiZL2m7ptP0lPknTmEk073bxf34D3QUm/nCeEV2uymB6Rx/Z2eB+V9BOSflqThfRJkiLf9qEO77pc44ypy3fyvx/u8M6Zun6KpF+StEvST25T7/yp659UfuEl6ZaSzu3w9km6m6Qfyj9kD8y3303dB5U+LOmhU8/JyyXdXNLvS3rtNvVuNLlIemBXznyf2QNS0wemruzwPi7pBEmHSvpNTSbYY3fw3F+jyYGdN0h6Y75cnf99ww6fw/dKetTUz9YnO7zPTl0/e6o/D5R0XtdzL+nHJf1Zfg7/JvfpzbbZn+fn/rijpG9N7ZMjt6nXa77o+9wP/bzn8bM0Wch/SJODng/Otx8n6RP0zNI9M/tmaPpN0T91eO/S5IP/j5H0nvz/m8zuszne6ZKepskB3vMkPUeTN4BPk/Q3Hd51mrwImr5ck//94g6fv9dpMg/eQdIz1PHmcmufTl0/Q9L98vU7S/p0h/clSf9dkzdPZ+Vat+mqNdXbj9JkTbtU0uPz7cdL+l8d3t9o8mLsdpr8/P0XSd8n6c2SXtThDf0agbV+sXuRpF/X5GTFZZJeqbzmb+Pt07CvE+iZCnqmb78U6pn3azLPHzV121H5tg90eH3XJta07Xtt4+tZdlnT5nvMT/O9feoxN+X7sKbRMxtfz/L9+65p9EyDPSOv42scY1nsjfa4HD0zip6xOO+TXda0+d6o1zRx3qDl+cmiZ/r2Cz0zijXNYl2a0zOsTTesN9p5RgPPMfk+Y59n6Jk19kzffjHrmaHXJs5tLXjep66foR2e28r3+ZL4vMY8z+J1kExeA2V3n/i8Bj1T9/nQoT+vQa+122v7xGvu7XqGY0H0DD0z8Hu0fD/WpgXP4dT1atcmmaxL2WWeWdBr8phnBu2Zvv1Cz1TVM0O/P6fX2u21CzTni19y/Qs6vFctuLxa0rc6vLMlfX++/nhNvoRma91e2DOS9mpyvGFrv2xt6x20/bHcqyW9Q9LvSPrdfLlq6/oOe+YM5S+hkPS9XTVneubTW8+5pN3bPId7Jf2ApBdq8uUZ52pyjP1Gz8+M9zlJN9PkD+ddLelW+fabT2dZUG/rvneU9Nf5+o+q+5jOqHumb7/QM509s08Gr4Nksi7N6RnWpuvHRz3PaOA5ZmobHeYZeqaCnunbL4V6Zp+GXZs4fjjfa+Hc+9C9NurXQTJ5DZTvM+pjiPTMenumb7/k+1j8zpdY0xZ5FufEpmoyP3X3DPPTiv1Cz4yiZ45bcNnIZ9UXPt6ywtCX2R+EmcZYeCAjj1/cc+waTb6l+41zLldvwNs38/+f2frB7HpSp39gJX1h0X6a4z1O0t9t/VDl2760g+diet/PZt7b4X1O0sH5+scl7Zoe22G9S7v22TY985mp6xf27IkvLBrL49/V5K85/e6cyzeXyPow5YNn2zyH99PkG8V/ZYXncO/MWNdzuFfSbfP1MyTdNF/fb4nn8GaSfkrSX2kyyf55h7dv6vr/nhnrmlh7zRd9n/uhn/fZ52l2m+iZXj1zrSYv/M+Yc/nOTurl//+2Jm9UjtjmeZh+/i7pesyZsWdp8ktn91jh+ZvNvLDeVn9J2p2vnzkz1vWXa6Zr/gdJJ2vyFx7OkPRLPfdNV6/N/jydnf/dpf5z/iZeI8zuf9b6+TWPlvRsSedo8tczun75r6bXCfTMQD3Tt18K9cxFPcf6rk2safO9QdezHeybvR0ea9p8b9Tzk3rOTQt6hjWNnlnYM337JY/3XdPomQZ7Rl7H16Z7hmMsc/pCIzwuR8+MvmeqOe8zu2/y/1nTblxvdGuaOG/Q1TMtz0/V9EzffqFnRrGm7Zv5f5Xr0px9OJu7q2dYm+aPWcwzGniO2RpXu/MMPbNkz/TtlxH1zCbWJs5tzfd6nduaU5PPayze/1W+DtqmZ7qehxbOvdMzxj3Tt19W7JmhP69Br7Xba7zm3v652Lsoy7ycGvF7NHqGnlm2Z7bpl4VjeZy1ab5nsTbN6Zkq16UFWZlnblzPdZ6pZl2iZ2x6ZhPvz+m1hntN+RjpzO0HqHt+ulqTLzv5+TmXbyyR8/s1+VKTx2zzvE/3y2dnxrbrtaMl/aWkl0o6MN/2xSV75jM7ranJF7r8QL5+uqTD8vWbzmbvekxNvtzhDyX9o7q/5OG8qZ78mm74uqur3nlT1/eb2d6u3h51z/TtF3qmu2c6xqp5HSSTdWlrXKxN87xRzzMaeI6Z97iqeJ6hZ8r3TN9+KdUzHWObWJs4fjjfa/3cO6+D5vTINj1j8RpowXMxqmOI9Mx6e6Zvv+ygZ6r5nS+xpu2kXrXnxHbQT8xPc3pkm54Z9fzUt1/omVH0zKCfVV902a36+YeI+C+a7KzHavLt2IqI/TX5UHgXn4mIkyW9WdKl+bbba3IwY2+Hd56k/55S+uzsQEQ8fAPe/hFx05TSdyUppfS2iLhc0vs1+Zb5Rew3df0PZ8YOWCSllN4VEe+X9IKIeIomv5CQOupscbuIeJUmf0ngVhGxf0rpmq1t6PD+q6QzIuKPNWnWv4yI92gy+Zze4X0zIp4q6WBJV0XEMzT56wIPl/TtDu/rEfEzmvwwPVbSlyUpIkLdPXNaRLxX0lt0w375uW1ySpMXJe9OKX1mdiAifqFLjIhDUkr/LEkppTMi4nGafIP34YuclNLZEfGjkp4WEWdIeo529hx+b973ocnzeWBK6f/PY13P4TMkfSAi3qXJi7kP5x56sCYvbhdu3lTm72jy/J0SEYdocnBwEZdExIsl3ULShRHxB5pMyA+X9E8dXt/5ou9zP+jznpnejv93Zqzr556emc8Fkp6aUrr4RkEiLp1z/y1uEhG7UkrX5awvjIjLNPnrKwd1eNPP31s6xm5ASukPIuIdkl6ec/2udvb8fU9EPFOT/XpwRETKrx666mVOlvS+iHiJpNMj4pWa7NMfUf7Z2o6U0sckfSwinqbJX5t7oqTXLrj7dyPiEZIOkZQi4jEppXdHxEM0edG0iH+JiAenlD4eEY+WdGWufV2e9xcx9GsE1vrFTP/cXyLpZZJeFhF31aRnFjH06wR6Zj5D90zffpGG75mvRMSzNfkrQF/NzpGSTtL1PTSPvmsTa9p8hl7PJNa0RTA/zafv3CSxps2FnllI336R+q9p9Mx8xt4zNsfXxDGWRYz+uFy+Dz1zY1x6xuW8j8Satoixr2mcN1jM2Ocnl57p1S+5Bj0zH5c1zWVdklibFjHqeabAHCONf56hZ+Yz9Lok+fTM0GsT57bms/K5rZybz2tcj8vrIJfXQBKf11gEPTOfEudDvxLDfl6DXptPC73Ga+75cCxoMfTMfOiZ+fR9DSSxNi3CZW2yWZfyfZhnbozLPOOyLkn0zCJc1qa+6xK9tpix99obJJ0dEW/XDXvtSZJe3+GdrcmXrn1ydiAint/hXRMRR6WULpeklNLnIuJ4Sadq8uUuC4nrj1U/Zeq2/bT9ufdLJD0hIk6U9MGIeHnX/ae4a0Scp8lzeUxEHJZSuioidm1T85cl/VlEnKvJF9V9OiI+Kukekl7U4d3gOG9K6SxJZ0XEsyT9xw7vnIj4c01eQ35I0psj4nRNjnP/fYf36Yh4vSY982hJH5GkiDhQN3zNOcuoe2aFfpHomUW4vA5yWZck1qZFjH2eGXqOkXzmGXpmPi7rkjT+tYnjh/Np4dw7r4PmM/b359L4jyHSM/MpcT7U5Xe+WNPm43JOTGJ+WgTz03z4vffFjL1nhv6s+nzSkt8MPPRF0qGaTPqnSnqhpFvk2w+R9MBt3AMk/YomP0zn58vpkn5V0k06vP8g6egFY/fdgPcMSQ+Zc/u9JX2ww3uqpIPm3H4nSa/Y4f49TpPF7us7uO/Pz1y2/trRUdr+L8l8nyZ/lemvJf1PSa+R9MhtnNtL+h+S/iTXeIakz0p6r6S7dXhHa/ID/FlJb5N063z7EZIet03NR+V6/zNf/kTSj+1g39xF0i0XjB3Z4T15Xh/nbfjTHT6Ht8nbu5O/dPWQmctBWxkl/do27iH55+nlkl6tyWR+122c39zJNszxDtZkoXmuJhPb4/Ic8Mdbz+cCb5X5YunnPj/vtxryedfkoN6Bc24/VtKzd7h/b0vP/Lv3eEl3WTD2mA7vZZIePuf2E9T9Vxx+T4vn7XfucFtPlHSmpMt3cN/fnbncKt9+lKS37MB/mKR3aPKG+XxJp2my9uzf4by953P4g5q86T1N0l0lvVLSNzV5MffDHd49JZ2V7/vxredT0q0kPb3Dm/ca4TRt7jVCybX+3pqs9V/bwX1XWevvpCXX+uz9Yc+e2Xqd8BoN8DqBnqmjZ/r2S6GeOSxv34Wa/FLrlZq8CXyppMM7vL5rE2vaYnew9Sy7rGnzPean+V6vuSm7rGn0zFDHSvquaY49U/NxslV7huNrNx5fxzEWjstd7x0qg+NyFfQMx+VW7BmZnPfJ46xp851Rr2kqcL5IrGmLvFGvaX17Zh39ku/PmrZiz2j4Nc1iXcr3Z21a7Fa/NsloXcr3G+08s2LPWK1NqnhdcuoZDb82cW5rsbv0ua3s8XmN+WOcp5jvOJ17p2eMe6Zvv6zYM0N/XsOx1zh+uIZey/fhfdqN7zvoa26ZvN5eQ8/wPq2xnlHP92jZZW1a7Fa/NslkXcrjrE3zHYt5ZsWe4feoGuwZDX/8sMVe23ouau+1x+f+OXkTvZbvc7dc79X58lxJd9/GOXze87eD7Xu4pB9csI9/u8O7n6Sbzrn9GEk/s0T9m0v6b5I+uoP73mHmsn++/ZaSHruNu58m8/5vaPJlMk+UdOg2zpN79sxuST+tyZcZ7pb0w5L+SNKzJd28w9s/zyl/JOkXJe2Xb7+ZpDtsU/PuLfTMMv1Cz2zbMz+myl8HyWhdStf/DLA23dAZ9Twz9ByTPad5hrWpcM/07ZeCPTPk2sTxw8XuYMcPszvqY4ji+OEiZ9BjQdk9VCM+hrimnuH44Xr6xeJ3vsSatsixOSeW78eaduP7Mj+tsV+meoY1zbdnBv2s+qJLZBkaJn+L/S1SSt8qnQUAALYnIm4m6dg056/KAMyDtR6WhZ6BoWBNg2VhfoJloWdgWegZAAAYC6xpAABQE6xLAAAwFji3BcvC6yBYFnoGhoJeAwCA2mBtAgAAAAAAAAAAgEVw/BAAAMYCaxoAQFvsKh1gOyJiv4h4akS8ICJ+eGbsedu4B0bEsyPityLiphHx8xHxnoh4WUQctIR30g693Tnr6RFxXr6cFhG/HBH71+pJOlfSO5bwTutZb13eUzdRr4uIeG0fbxUXbziv7zwz4z1o016Jmmvyat+nj4yI1+R5/j35+gldTmlP0jsk/dom65XexinvkZvcxgWP9ztj89KEbw1Vbx1eiZrbebnX/nNE3GHm9qfs0DvGxZvpmU3XG2R/Dp01JvxURDwhXz8+Il4VEb8aEQvfh/X1pnKWnrerW9OG9jpc1rQ1eI5r2tDeTtyh5+CS3hjXtAI5e61NwXGyTXl9t4/ja3hVejHwMaRVXFOv2uNyK+S0OO+zirsuT6xpK+XsIiqaR2ur2bJnOv86raEu+3SINW3U77VmXNamHRIVzYdj8ErU3IRnOo+6eMt+fs0iawz8fiu7Fud+wuTc1gZqcm5rDV5L57Y2WTP8zsX09ji3tXrWmDDY5zVi5O/TYuTv0VbJus1jVvPeAK8eL3iftknPZX9u/D1adlmbNuNx/LDimnjLey7zaImaBeZ8l5xDf17jkIh4SURcGBFXRsQVEXFBvu3QdXslajbkXbDsc9HxmKeN2StRcwxeRBwcES+OiLdGxE/PjJ28Q+/JY/PWUPMlI96nR8XkfMYfR8QREfH8mLzuPiUibt3huc2/rKGLPdamkXklanZ5wdq0CW+wdWkNWYdcm+Z55+/A4/jhZrxVft+guWOIeHV427nhebzLxXPZn3zX3wY8jWxN66g3+HqWH9diDsYbzltxXnNcY6pdK4bOmccfGQN/lvtGj5VS6uMNRkS8TtKBks6S9LOS/i6l9Mw8dk5K6bgO9xRJl0q6maS7SLpAkw/bP1rSUSmln12z9xeSvinpzZL+Md98O0k/L+nwlNIT8ar2Dp93u6SQdG5K6XYLxnu7eNV4veaZoT2nrEbeKyTdWdJbdMP54uckXZxS+o0WPaesq2zjIiLikpTS0XhlvRI1u7yIeJGkB0s6R9JPSHpFSunVeaxrnunrvVjSgwb0hs45aL0Va/b1Tpb0PZIOkPQtSTeR9B5J/4+kr3bMa329V8hg/h27V6pmR5Zq5lG8etZQ1rRm6/Xy8njftcnleBDeej2Or+Et63F8DW9Zz+K8zyouXjWexTzqlLUBz2UeZQ2tx+MzCQtwycra5O05ZWVt8vacshZ4v/UKGZz7cfHcsnZsg8W5GLxhawbntpqst2LWoT+v4fKeAm8BvE/DG8LLrst7A7w6vF7vtbJrMQfjeR8/LFETr83jh05ZG/CGPn74fkkflvTmlNLl+bajNJkPj08pPWKdXomaI/BOkvQjG6i3aD4ISaemlOZ+YZmL55TVyHuXpIslnSnpKZKukfTklNL/2WZeG7XnlLWAd7qk90q6uaQnS/ozSX8u6TGSHp5SOnGBV8v8W5VXWdaTxNo0Ws8pq9F8iLcAo7Wpr+dyvGvUXqGsLset8NborVjT5bgVXgVeHrf4nS88by+7FnMwXjUe56ja9V6hGj4fnVKq+iLpvKnruyW9VtJfafIByr3buPvyvyHpcunfv9g4ph93jd7nGbMeu1bSFyV9aeqy9f9/3abXerl41Xi95pmhPaesRt7cOUGT+f7iVj2nrCt431pwuVrSv+EN4zlllXS+pN35+qGS3ifp5fn/e/Hq9kplzf/uL+kKSQfk/+9W93uKvp7L/Dtqr1BWl3kUb43eijUt5m68OrwtN/+7lrWJsdGPcXwNb1mP42t4y3r78r9Vn/dZxWWsmjGLedQpawOeyzzKGlqPty//y2cSKs5T2ZjLfGjhOWVdwXOZD0ftOWVVJe+3VNm5HxfPKatMzsXgdfYan9fA27i3as38b9HPazDmMbbi47q8N8CrwMuuy3sDvDq8ffnfpd5r5ftUM88yNugYx9fwlvUs5kOnrA14+/K/Qx0/vGjIsRI1GVs4dq0mX8J4xpzLd9w9p6xG3r6Z//+2pE9IOkLSOa16TlkLeHunrl/S9ZgzYzXNldWM1ZZnQ2Mu8+GoPaess3OJ6p0P8Sqpqf5rU1+vpmNazY4VyuNy3Apvjd6KNV2OW+FV4OX778v/Vv07X4x5j+VxizkYrxqPc1TteoN/lnuut6ww9EXShXNu+x1N3tBu9+H1fVPX3zAzdu4GvDMlPUHSrqnbdkl6oqRP4VXvXSzp6AVjl27Ta71cvGq8XvPM0J5TViPvPEn3m3P7/ZU/uN+i55R1Be8SSUcuGOuaL/DW6DlllXTBzP/3k/R6SX8p6XN4dXuFsu6dun76zNi+DXgu8++ovUJZXeZRvDV6K9a0mLvx6vDyffdOXV9mbXI5HoS3Xo/ja3jLehxfw1vW2zd1vdrzPqu4eNV4FvOoU9YGPJd5lDW0Hm/f1HU+k2CYtYDnMh9aeE5ZV/Bc5sNRe05ZNfz7LYtzPy6eU1aZnIvB6+w1Pq+Bt3FvxZp7p64P8XkNl/cUeOuv6fLeAK8CL4+7vDfAq8PbN3V9x++18rjFHIy3do/ja3jLehbzoVPWBrx9U9eHOH74AUnP1tSxBElHSnqOpL9dt1eiJt5C77OSvm/BWNe8ZuE5ZTXyLtDUa6d820mSPifpK616TlkLeOdOXf/9mbGuL5BymUdZQ9fvucyHo/acsspnPsSrpKb6r019PZfjXaP2CmV1OW6Ft0ZvxZoux63wKvDy/fZNXa/2d77wvL18P4s5GK8aj3NU7XqDf5Z77uMtKwx9kfQ2SSfMuf0XJF2zjfs6SQfNuf1YSR/fgHeMpHdI+rqkz+fL1/Ntd8Sr3vs1ST+4YOxp2/RaLxevGq/XPDO055TVyDtO0qck/b0mJ2k+oMlB1DMl3adVzynrCt7vS7r/grGX4g3jOWWVdKqkhyx4vOvw6vYKZT1N899THCXprA14LvPvqL1CWV3mUbw1eivWtJi78erw8n36rk3HyON4EN56PY6v4S3rcXwNb1nP4rzPKi5eNZ7FPOqUtQHPZR5lDa3H4zMJldQ08lzmQwvPKesKnst8OGrPKauGf79lce7HxXPKKpNzMXidvcbnNfA27q1Yc+jPaxwjj/cUeOuv6fLeAK8CL4+7vDfAq8Pr9V4r36fvvIbn7XF8DW9Zz2I+dMragDf08cPDJL1U0oWSrsyXC/Jth6/bK1ETb6H3eEl3WTD2GHfPKauR9zJJD59z+wnq/pKHUXtOWQt4v6f5a9OdJL2zw3OZR1lD1++5zIej9pyyymc+xKukpvqvTX29Y+RxvGvUXqGsLset8NborVjT5bgVXgVevo/F73zheXvZtZiD8arxOEfVrjf4Z7nnXSI/aHNERKQeG79TLyKOkKSU0hVLPj5eBR4AtEVEHCXptvm/l6WULsfzyrrKNgLshIi4mSSllL4zZ+y2KaXL8Or1StVc8Hg3l3TzlNLXNuG5zL9j90rVBNgJLnM3Xh1eF8usaS7Hg/DW6wEADE2t531WcfHq8AAAhobPJJSr6eIBAAzNJt9vuZz7cfHcsgLsBJdzKnj1fM6j4/E2+nmNfF+L9xR4m3EBAIZimfdoLnMw3no9AICh2fTnNQAAAAAAAGAzuBzvGrtXqiYAwJDU+jtfeN4eAMBOKP356F19pNJExGtXdZdd+Jf1UkpXpJSuWDYrXh3eFuvoNTy8TXolao7RSyldnlL6TErpM5J+Gc8v6yrbuEVEPB+vvFei5k68lNJ3Zn9xaMvr+sUhvDq8UjVniYjnp5T+pccvje3Yc5l/x+6VqrlFjfMo3ua9nbouczdeHd4ill3TXI4H4a3X24JjHni1eyVq4m3GS6nO8z6ruHh1eFu4eCVq4rXplajZirfptcnFK1HTxdsCb71eiZp4bXolatb8fsvl3I+L55Z1C5dzMXhlarqcU8Fbr7eqO8uy57b6ei7vKfA240p+r/PwynolauKNw1vmPZrLHIy3Xm8L5jW8sXolauJ1e5s8fjjjnbrM/Vf1StTEa9MrUROvTa9ETbw2vRI18dr0StTEa9MrUXMoz+V419i9UjUlv2MQeOvxStTEa9Obdjd9DNFlzsdbrzeNy88FnrdXoibe6l7Jz0dLpl/0K+m+BVw8vNpr4rXplag5du/ReNXUxGvTK1ETr02vRE28Nr0SNfHa9ErUxGvTW8V1eV+IV4dXoiZem16JmnhteiVq4rXplaiJ16ZXoiZem16JmnhteiVq4rXplajp4rkcI3XxStTEa9MrUROvTa9ETc6JtemVqInXpleiJl6bXomaeG16JWritemVqIlXh3fbgb0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHa9ErUHNpzeV84dq9ETbw2vRI18dr0StTEa9MrUROvTa9ETbz1eoN/5tH1i36/VsDFw6u9Jl6bXomaY/cCr5qaeG16JWritemVqInXpleiJl6bXomaeG16q7gu7wvx6vBK1MRr0ytRE69Nr0RNvDa9EjXx2vRK1MRr0ytRE69Nr0RNvDa9EjVdPJdjpC5eiZp4bXolauK16ZWoyTmxNr0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHq8PYO7JWoidemV6ImXpteiZp4bXolauK16ZWoidemV6Lm0J7L+8KxeyVq4rXplaiJ16ZXoiZem16JmnhteiVq4q3XG/wzj5FS6usCAACMjojYlVK6Dq98Tbw2vRI18dr0StTEa9MrUROvTa9ETbw2vVVdAAAAAAAAAAAAgHlERKQeH2bEq6cmXpteiZp4bXolaq6SFQAAAAAAAAAAAAAAAAAAAAAAAADqoMT3cuzqI9VCRLx2aLfLi4j9IuKpEfGCiHjQzNjz8MbpOWXF8/acshp5B0bEsyPityLiphFxkqR3R8TLIuKgVj2nrHjenlNWPG/PKesq2ziHC5e8P95mvBI18dr0StTEa9PbkRsR95y6vn9EPC8i3hMRL4qIA/HwStfEa9NzyopXjffrEXHLfP1OEfHRiLgqIj4VEfdY5K3i4uHRa3g1ek5ZG/D+KiJ+JpY8VujilaiJ16ZXoiZem16Jmkbe90bEGyLi9yPioIj4U0nnR8RfRsQxeMt5TlnxvD2nrHjenlPWiNgVEU+JiPdGxLkRcU5EvD0iHrrN9uFV4DllxfP2nLLieXvZPSQiXhIRF0bElRFxRURckG87FA9vHZ5TVjxvzykr3nq9LiLitCG9EjXx2vRK1MRr0ytRcwxeRBwcES+OiLdGxJNnxk5u1XPKiuftOWXF8/acsq6yjR2PufbvYcLrh0tWPG+vRE28Nr1N1Qyf77bCW6PnlBXP23PKirfQq+F7n+r/ot+IOHzB5QhJP7YJd4Wa/0PSQyRdIelVEfGHU2OPxRut55QVz9tzyurivUnSkZLuKOm9ku4r6b9JCkmvadhzyorn7TllxfP2nLL28iLi6oj4Vr5cHRFXSzp263a8YTynrHjenlNWPG9vRfdNU9dfIulOkv5A0s0k/QkeXgU18dr0nLLi1eH9SkrpG/n6KyW9PKV0mKTnbOOt4uLh0Wt4NXpOWcfuPUDSYyRdEhGnRMRPRsQBHfd385yy4nl7TlnxvD2nrEN7b5J0tqRvSzpTkz8u9ihJp0t6A97SnlNWPG/PKSuet+eU9fWSjpb0YklnSDo13/a8iHgaXvWeU1Y8b88pK563J0mnSLpK0kNTSoenlI6Q9LB82yl4eGvynLLieXtOWfHW6EXEcQsu95F0r3V7JWritek5ZcXz9pyyuniS3qjJ73a9S9KTIuJdEXGTPPbAhj2nrHjenlNWPG/PKWsvLwb+Hia8xbhkxfP2nLLieXuFarp8txXeej2nrHjenlNWvPm8ScN/t9WNSSlVfZF0raQvSvrS1GXr//+6CXcF77yp67slvVbSX0m6iaS9eOP0nLLieXtOWY28ffnfkHS5pJj6/3mtek5Z8bw9p6x43p5T1hW8V0l6i6Qjp277Utc+wVu/55QVz9tzyorn7a1Yc+/U9X2S9s/Xt1vT8Br0nLLieXtOWfGq8S6aun72zNh2vdbLxcOj1/Bq9JyyNuDtzf8eLOlnJb1P0tc1+dD+I9w9p6x43p5TVjxvzylrKS9fv2TRGN7OPKeseN6eU1Y8b88pq2bew0k6M/97E0kX4NXtOWXF8/acsuJ5e/k+FzHG2KbHasvD2HjHasvD2KBj10r6sCZfeD97+c66vRI18dr0nLLieXtOWY28fTP//21Jn5B0hKRzWvWcsuJ5e05Z8bw9p6wreEN/DxNeJTXx2vScsuJ5e4Wynjd1vebvtsJbo+eUFc/bc8qKt9Dbl/8d7Lut5l12q36+KOn4lNIlswMRcemG3L7eAVtXUkr/JumXIuJ3NDngexDeaD2nrHjenlNWF2/LSRHxvpRX1Pz/1LrnlBXP23PKiuftOWVd1kspPT0mfz36LyLi3ZL+SNJO6uCt0XPKiuftOWXF8/ZWdA+JiJ+UtEvSTVJK1+TH224txGvTc8qK5+05ZcWrw3tnRLxJ0u9J+uuI2CPpryX9iKQbnUNak4uHR6/h1eg5ZR27t3W88FuS3irprRFxhKQnSHqupA+Ye05Z8bw9p6x43p5T1qG96yLizpIOkXRgRNw3pfTpiLiTpP0WOHjduGTF8/acsuJ5e05Zr4mIY1NK/xARx0n6V0lKKf2f6D72iFeH55QVz9tzyorn7UnSVyLi2ZLenFL6qiRFxJGSTpLU9ftQeHjLeE5Z8bw9p6x46/UukPTUlNLFswPR/fu9fb0SNfHa9Jyy4nl7TlldvJtExK6U0nWSlFJ6YURcJumj6v4d5rF7TlnxvD2nrHjenlPWvt7Q38OEV09NvDY9p6x43l6Jmi7fbYW3Xs8pK56355QVr4OUhv9uq9kHqvoi6dck/eCCsadtwl3Be5ukE+bc/guSrsEbp+eUFc/bc8pq5L1O0kFzbj9W0sdb9Zyy4nl7TlnxvD2nrKtsY77fLklPl/QxSf97u/vjbcZzyorn7TllxfP2+riS3jhzOTLffpSkD+Hhla6J16bnlBWvDi/f5yRJn5L0DUlXS/p7SS+SdEiXt4qLh0ev4dXoOWUdsyfpo9s9T86eU1Y8b88pK56355S1gHe8pIs0+WXqB0t6l6QvSPqapBPxlvOcsuJ5e05Z8bw9p6y6/g+2fEHSlyQ9IN9+K0kvw6vbc8qK5+05ZcXz9vJ9DpP0UkkXSroyXy7Itx2Oh7cOzykrnrfnlBVv7d7jJd1lwdhj1u2VqInXpueUFc/bc8pq5L1M0sPn3H6CpItb9Zyy4nl7TlnxvD2nrCt4Q38PE14lNfHa9Jyy4nl7hbK6fLcV3ho9p6x43p5TVryFXpHvfZq9RJYBAABgioiI1GORHLtXoiZem16JmnhteiVqDuFFxK0l3Tul9L4la+Ct0StRE69Nr0RNvDa9VV0AAAAAAAAAAACARUTELSVdlVK6Fm91r0RNvDa9EjXx2vRK1NypFxEh6YiU0jeWfHy8CrwSNfHa9ErUxGvTAwAAAAAAAAAAAAAAAAAAAID5DPl9UbuXLVKCiLirpBMl3TbfdJmk96SULtiUi4e3jOeUFc/bc8qK5+05ZcXz9pyy4nl7TlnX6UXEl/CG9Zyy4nl7TlnxvL1115TJGorH6zW88XpOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllrcT7G0kX4i3vOWXF8/acsuJ5e2ZZ7yLpxIhY9nUCXh2eU1Y8b88pK563t5CI+E8ppTfi4W3SK1ETr02vRE28Nr0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHa9ErU3JS34JyYy+dKRuM5ZcXz9pyy4nl7TlnxvD2nrHjenlNWvDq8eexaVhiaiHiOpLdLCkln5UtI+ouIeO4mXDy8ZTynrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7Tlkr8t6Ot7znlBXP23PKiuftOWWtaA3F4/UaXsWeU1Y8b28H/Fc8vAG8EjXx2vRK1MRr0ytRE69Nr0RNvDa9EjXx2vRK1MRr0ytRE69Nr0TNtXsuxzrH7jllxfP2nLLieXtOWfG8PaeseN6eU1a8OryFj5dSWtYZlIj4vKTvTyldM3P7AZI+l1L6vnW7eHjLeE5Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP28v3OW/RkKQ7p5Rugoe3queUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKesKnsWxzrF7TlnxvD2nrHjenlNWPG/PKSuet+eUFa8ObxG7l7lzIa6TdBtJX5m5/dZ5bBMuHt4ynlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9iTpSEmPlHTVzO0h6ZN4eGvynLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7Tll7eu5HOscu+eUFc/bc8qK5+05ZcXz9pyy4nl7Tlnx6vDm4vBFv3skfSgiLpZ0ab7taEl3kvTrG3Lx8Og1vBo9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP25OkUyUdlFLaNzsQER/Bw1uTV6ImXpteiZp4bXolauK16ZWoidemV6ImXpteiZp4bXolauK16ZWoObS3Rx7HOsfuOWXF8/acsuJ5e05Z8bw9p6x43p5TVrw6vLlESmlZZ3AiYpek+0u6bb7pMklnp5Su3ZSLh7eM55QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PQAAAAAAAAAAAIAuXI51jt1zyorn7TllxfP2nLLieXtOWfG8PaeseHV4c0kp2V0k/dLQLh5e7TXx2vScsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8erwUkq2X/R7ztAuHl7tNfHa9Jyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7Tlnx6vBSStolT6KAi4dXe028Nr0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHa9ErUxPP2FPmbgq2IiNullP5xSBcPr/aaeG16JWritemVqInXpleiJl6bXomaeG16JWritemVqInXpleiJl6bXomaeG16JWritemVqInXpleiJl6bXomaeG16JWritemVqInXpleiJl6bXomaeG16JWritemVqInXpleiJl6bXomaeG16JWritemVqInXpleiJl6bXomaeG16JWritemVqInXpleiJl6bXomaeG16JWritemVqInXpleiJl6bXomaeG16JWritemVqInn7UnSrj5SabY2NiL+01AuHt4yXomaeG16JWritemVqInXpleiJl6bXomaeG16JWritemVqInXpleiJl6bXomaeG16JWritemVqInXpleiJl6bXomaeG16JWritemVqInXpleiJl6bXomaeG16JWritemVqInXpleiJl6bXomaeG16JWritemVqInXpleiJl6bXomaeG16JWritemVqInXpleiJl6bXomaeG16JWpu2ouIu0bE8RFx0Ix3At5wnlNWPG/PKSuet+eUFc/bc8qK5+05ZcWrw5tLSsn2IumSoV08vNpr4rXpOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5T1i5P0tMlXSTp3ZK+LOnEqbFz8IbxnLLieXtOWfG8PaeseN6eU1Y8b88pK14d3qLLblVORJy3aEjSkZtw8fCW8UrUxGvTK1ETr02vRE28Nr0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHa9ErUxGvTK1ETr02vRE28Nr0SNfHa9ErUxGvTK1GzwDb+oqT7pJS+HRHHSHpnRByTUnpldvGG8Zyy4nl7TlnxvD2nrHjenlNWPG/PKSteHd5cqv+iX03eQD5S0lUzt4ekT27IxcNbxnPKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5T1r7erpTStyUppfTliHioJl9cdYfs4g3jOWXF8/acsuJ5e05Z8bw9p6x43p5TVrw6vLk4fNHvqZIOSintmx2IiI9syMXDW8YrUROvTa9ETbw2vRI18dr0StTEa9MrUROvTa9ETbw2vRI18dr0StTEa9MrUROvTa9ETbw2vRI18dr0StTEa9MrUROvTa9ETbw2vRI18dr0StTEa9MrUROvTa9ETbw2vRI18dr0StTEa9MrUROvTa9ETbw2vRI18dr0StTEa9MrUROvTa9ETbw2vRI18dr0StTEa9MrUROvTa9EzaG9r0bEvba8lNK3I+LHJb1B0j3wBvOcsuJ5e05Z8bw9p6x43p5TVjxvzykrXh3eXCKltKwDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlRMRt5P0bymly+eMPSil9Am8zXtOWfG8PaeseN6eU1Y8b88pK56355QVrw5vEXzRLwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAK7CodYDsi4p4RcWZEXBoRr42Iw6bGztqEi4dHr+HV6DllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU9YVvHvglfecsuJ5e05Z8bw9p6x43p5TVjxvzykrXh3eQlJKVV8kfVzSCZIOlfSbkj4n6dg8tncTLh4evYZXo+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qKV4e38PGWFYa+SDp35v8Pk3SxpAdKOmcTLh4evYZXo+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qKV4e38PGWFYa+SDpX0iEzt90zb/QVm3Dx8Og1vBo9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVrw6vIWPt6ww9EXSkyU9cM7tR0v60024eHj0Gl6NnlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSuet+eUFc/bc8qK5+05ZcXz9pyy4nl7TlnxvD2nrHjenlNWPG/PKSteHd6iS2QZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPqw7DcDD32RdIikl0i6UNKVkq6QdEG+7dBNuHh49BpejZ5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrXh3eossu1c8pkq6S9NCU0uEppSMkPSzfdsqGXDw8eg2vRs8pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVrw5vPmnJbwYe+iLpoj5jq7iMMbbMWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GBvvWG15GKt/bNFll+rnKxHx7Ig4cuuGiDgyIp4j6dINuXh4y3hOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1a8Ory5OHzR7xMlHSHp7yLiyoi4UtJHJB0u6ac25OLh0Wt4NXpOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseHV4c4mU0rIOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGR2lQ6wEyLirhFxfETcfOb2Ezbl4uEt4zllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfHq8OaSUqr6Iunpki6S9G5JX5Z04tTYOZtw8fDoNbwaPaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1a8OryFj7esMPRF0vmSDsrXj5H0aUm/kf+/dxMuHh69hlej55QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyorn7TllxfP2nLLieXtOWfG8PaeseN6eU1Y8b88pK56355QVz9tzyopXh7foslv1syul9G1JSil9OSIeKumdEXEHSbEhFw+PXsOr0XPKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXFq8Ob/2DLCgX4akTca+s/eeN/XNItJd1jQy4eHr2GV6PnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKileHN5+UUtUXSbeTdNSCsQdtwsXDo9fwavScsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8bw9p6x43p5TVjxvzykrnrfnlBXP23PKiuftOWXF8/acsuJ5e05Z8erwFl0iiwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQg12lAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4wxf9AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKwAX/QLAAAAAAAAAAAAAAAAAAAAAAAAAAAwMiLi0Ij41dI5AAAAAAAAAAAAAAAAAAAAAAAAAAAAWoEv+gUAAAAAAAAAAAAAAAAAAAAAAAAAABgfh0rii34BAAAAAAAAAAAAAAAAAAAAAAAAAAAGYnfpAAAAAAAAAAAAAAAAAAAAAAAAAAAAALB2XiLp2IjYJ+lsSXeRdLAmnx/+lZTSxwpmAwAAAAAAAAAAAAAAAAAAAAAAAAAAGB2RUiqdAQAAAAAAAAAAAAAAAAAAAAAAAAAAANZIRBwj6dSU0g9ExLMk3TSl9MKI2E/SgSmlq8smBAAAAAAAAAAAAAAAAAAAAAAAAAAAGBe7SwcAAAAAAAAAAAAAAAAAAAAAAAAAAACAjXK2pDdExP6S3p1S2lc4DwAAAAAAAAAAAAAAAAAAAAAAAAAAwOjYVToAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbI6U0kcl/UdJl0l6U0T8XOFIAAAAAAAAAAAAAAAAAAAAAAAAAAAAo4Mv+gUAAAAAAAAAAAAAAAAAAAAAAAAAABgfV0u6hSRFxB0kfTWl9KeSXifpuJLBAAAAAAAAAAAAAAAAAAAAAAAAAAAAxsju0gEAAAAAAAAAAAAAAAAAAAAAAAAAAABgvaSUroiIT0TEZyXdXNK/RMQ1kr4t6efKpgMAAAAAAAAAAAAAAAAAAAAAAAAAABgfkVIqnQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAll2lAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4wxf9AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKwAX/QLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsAJ80S8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADACvBFvwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArwBf9AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKwAX/QLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsAJ80S8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADACvxfamkqbga2KiQAAAAASUVORK5CYII=\n", "text/plain": [ "
" ] }, "metadata": { "needs_background": "light" }, "output_type": "display_data" } ], "source": [ "# Static graph, you can double click on the graphic to get more details\n", "df['ts'] = pd.to_datetime(df['ts']).dt.date\n", "df['ts'] = pd.to_datetime(df['ts'])\n", "\n", "# Sorting the data by datetime\n", "data = df.groupby(df['ts'])['from'].count()\n", "data.plot(kind='bar',figsize=(100,10),legend=True, title=\"Number of discussion per day\")" ] }, { "cell_type": "code", "execution_count": 5, "id": "10c7ea51-ddeb-4068-9049-025b5150b5f0", "metadata": {}, "outputs": [ { "data": { "text/html": [ "\n", "
\n", " \n", " Loading BokehJS ...\n", "
" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "application/javascript": [ "\n", "(function(root) {\n", " function now() {\n", " return new Date();\n", " }\n", "\n", " const force = true;\n", "\n", " if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n", " root._bokeh_onload_callbacks = [];\n", " root._bokeh_is_loading = undefined;\n", " }\n", "\n", " const JS_MIME_TYPE = 'application/javascript';\n", " const HTML_MIME_TYPE = 'text/html';\n", " const EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n", " const CLASS_NAME = 'output_bokeh rendered_html';\n", "\n", " /**\n", " * Render data to the DOM node\n", " */\n", " function render(props, node) {\n", " const script = document.createElement(\"script\");\n", " node.appendChild(script);\n", " }\n", "\n", " /**\n", " * Handle when an output is cleared or removed\n", " */\n", " function handleClearOutput(event, handle) {\n", " const cell = handle.cell;\n", "\n", " const id = cell.output_area._bokeh_element_id;\n", " const server_id = cell.output_area._bokeh_server_id;\n", " // Clean up Bokeh references\n", " if (id != null && id in Bokeh.index) {\n", " Bokeh.index[id].model.document.clear();\n", " delete Bokeh.index[id];\n", " }\n", "\n", " if (server_id !== undefined) {\n", " // Clean up Bokeh references\n", " const cmd_clean = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n", " cell.notebook.kernel.execute(cmd_clean, {\n", " iopub: {\n", " output: function(msg) {\n", " const id = msg.content.text.trim();\n", " if (id in Bokeh.index) {\n", " Bokeh.index[id].model.document.clear();\n", " delete Bokeh.index[id];\n", " }\n", " }\n", " }\n", " });\n", " // Destroy server and session\n", " const cmd_destroy = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n", " cell.notebook.kernel.execute(cmd_destroy);\n", " }\n", " }\n", "\n", " /**\n", " * Handle when a new output is added\n", " */\n", " function handleAddOutput(event, handle) {\n", " const output_area = handle.output_area;\n", " const output = handle.output;\n", "\n", " // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n", " if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n", " return\n", " }\n", "\n", " const toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n", "\n", " if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n", " toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n", " // store reference to embed id on output_area\n", " output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n", " }\n", " if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n", " const bk_div = document.createElement(\"div\");\n", " bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n", " const script_attrs = bk_div.children[0].attributes;\n", " for (let i = 0; i < script_attrs.length; i++) {\n", " toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n", " toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n", " }\n", " // store reference to server id on output_area\n", " output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n", " }\n", " }\n", "\n", " function register_renderer(events, OutputArea) {\n", "\n", " function append_mime(data, metadata, element) {\n", " // create a DOM node to render to\n", " const toinsert = this.create_output_subarea(\n", " metadata,\n", " CLASS_NAME,\n", " EXEC_MIME_TYPE\n", " );\n", " this.keyboard_manager.register_events(toinsert);\n", " // Render to node\n", " const props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n", " render(props, toinsert[toinsert.length - 1]);\n", " element.append(toinsert);\n", " return toinsert\n", " }\n", "\n", " /* Handle when an output is cleared or removed */\n", " events.on('clear_output.CodeCell', handleClearOutput);\n", " events.on('delete.Cell', handleClearOutput);\n", "\n", " /* Handle when a new output is added */\n", " events.on('output_added.OutputArea', handleAddOutput);\n", "\n", " /**\n", " * Register the mime type and append_mime function with output_area\n", " */\n", " OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n", " /* Is output safe? */\n", " safe: true,\n", " /* Index of renderer in `output_area.display_order` */\n", " index: 0\n", " });\n", " }\n", "\n", " // register the mime type if in Jupyter Notebook environment and previously unregistered\n", " if (root.Jupyter !== undefined) {\n", " const events = require('base/js/events');\n", " const OutputArea = require('notebook/js/outputarea').OutputArea;\n", "\n", " if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n", " register_renderer(events, OutputArea);\n", " }\n", " }\n", "\n", " \n", " if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n", " root._bokeh_timeout = Date.now() + 5000;\n", " root._bokeh_failed_load = false;\n", " }\n", "\n", " const NB_LOAD_WARNING = {'data': {'text/html':\n", " \"
\\n\"+\n", " \"

\\n\"+\n", " \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n", " \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n", " \"

\\n\"+\n", " \"
    \\n\"+\n", " \"
  • re-rerun `output_notebook()` to attempt to load from CDN again, or
  • \\n\"+\n", " \"
  • use INLINE resources instead, as so:
  • \\n\"+\n", " \"
\\n\"+\n", " \"\\n\"+\n", " \"from bokeh.resources import INLINE\\n\"+\n", " \"output_notebook(resources=INLINE)\\n\"+\n", " \"\\n\"+\n", " \"
\"}};\n", "\n", " function display_loaded() {\n", " const el = document.getElementById(\"1002\");\n", " if (el != null) {\n", " el.textContent = \"BokehJS is loading...\";\n", " }\n", " if (root.Bokeh !== undefined) {\n", " if (el != null) {\n", " el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n", " }\n", " } else if (Date.now() < root._bokeh_timeout) {\n", " setTimeout(display_loaded, 100)\n", " }\n", " }\n", "\n", "\n", " function run_callbacks() {\n", " try {\n", " root._bokeh_onload_callbacks.forEach(function(callback) {\n", " if (callback != null)\n", " callback();\n", " });\n", " } finally {\n", " delete root._bokeh_onload_callbacks\n", " }\n", " console.debug(\"Bokeh: all callbacks have finished\");\n", " }\n", "\n", " function load_libs(css_urls, js_urls, callback) {\n", " if (css_urls == null) css_urls = [];\n", " if (js_urls == null) js_urls = [];\n", "\n", " root._bokeh_onload_callbacks.push(callback);\n", " if (root._bokeh_is_loading > 0) {\n", " console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n", " return null;\n", " }\n", " if (js_urls == null || js_urls.length === 0) {\n", " run_callbacks();\n", " return null;\n", " }\n", " console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n", " root._bokeh_is_loading = css_urls.length + js_urls.length;\n", "\n", " function on_load() {\n", " root._bokeh_is_loading--;\n", " if (root._bokeh_is_loading === 0) {\n", " console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n", " run_callbacks()\n", " }\n", " }\n", "\n", " function on_error(url) {\n", " console.error(\"failed to load \" + url);\n", " }\n", "\n", " for (let i = 0; i < css_urls.length; i++) {\n", " const url = css_urls[i];\n", " const element = document.createElement(\"link\");\n", " element.onload = on_load;\n", " element.onerror = on_error.bind(null, url);\n", " element.rel = \"stylesheet\";\n", " element.type = \"text/css\";\n", " element.href = url;\n", " console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n", " document.body.appendChild(element);\n", " }\n", "\n", " for (let i = 0; i < js_urls.length; i++) {\n", " const url = js_urls[i];\n", " const element = document.createElement('script');\n", " element.onload = on_load;\n", " element.onerror = on_error.bind(null, url);\n", " element.async = false;\n", " element.src = url;\n", " console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n", " document.head.appendChild(element);\n", " }\n", " };\n", "\n", " function inject_raw_css(css) {\n", " const element = document.createElement(\"style\");\n", " element.appendChild(document.createTextNode(css));\n", " document.body.appendChild(element);\n", " }\n", "\n", " \n", " const js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-gl-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-mathjax-2.4.2.min.js\"];\n", " const css_urls = [];\n", " \n", "\n", " const inline_js = [\n", " function(Bokeh) {\n", " Bokeh.set_log_level(\"info\");\n", " },\n", " function(Bokeh) {\n", " \n", " \n", " }\n", " ];\n", "\n", " function run_inline_js() {\n", " \n", " if (root.Bokeh !== undefined || force === true) {\n", " \n", " for (let i = 0; i < inline_js.length; i++) {\n", " inline_js[i].call(root, root.Bokeh);\n", " }\n", " if (force === true) {\n", " display_loaded();\n", " }} else if (Date.now() < root._bokeh_timeout) {\n", " setTimeout(run_inline_js, 100);\n", " } else if (!root._bokeh_failed_load) {\n", " console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n", " root._bokeh_failed_load = true;\n", " } else if (force !== true) {\n", " const cell = $(document.getElementById(\"1002\")).parents('.cell').data().cell;\n", " cell.output_area.append_execute_result(NB_LOAD_WARNING)\n", " }\n", "\n", " }\n", "\n", " if (root._bokeh_is_loading === 0) {\n", " console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n", " run_inline_js();\n", " } else {\n", " load_libs(css_urls, js_urls, function() {\n", " console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n", " run_inline_js();\n", " });\n", " }\n", "}(window));" ], "application/vnd.bokehjs_load.v0+json": "\n(function(root) {\n function now() {\n return new Date();\n }\n\n const force = true;\n\n if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n root._bokeh_onload_callbacks = [];\n root._bokeh_is_loading = undefined;\n }\n\n \n\n \n if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n root._bokeh_timeout = Date.now() + 5000;\n root._bokeh_failed_load = false;\n }\n\n const NB_LOAD_WARNING = {'data': {'text/html':\n \"
\\n\"+\n \"

\\n\"+\n \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n \"

\\n\"+\n \"
    \\n\"+\n \"
  • re-rerun `output_notebook()` to attempt to load from CDN again, or
  • \\n\"+\n \"
  • use INLINE resources instead, as so:
  • \\n\"+\n \"
\\n\"+\n \"\\n\"+\n \"from bokeh.resources import INLINE\\n\"+\n \"output_notebook(resources=INLINE)\\n\"+\n \"\\n\"+\n \"
\"}};\n\n function display_loaded() {\n const el = document.getElementById(\"1002\");\n if (el != null) {\n el.textContent = \"BokehJS is loading...\";\n }\n if (root.Bokeh !== undefined) {\n if (el != null) {\n el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n }\n } else if (Date.now() < root._bokeh_timeout) {\n setTimeout(display_loaded, 100)\n }\n }\n\n\n function run_callbacks() {\n try {\n root._bokeh_onload_callbacks.forEach(function(callback) {\n if (callback != null)\n callback();\n });\n } finally {\n delete root._bokeh_onload_callbacks\n }\n console.debug(\"Bokeh: all callbacks have finished\");\n }\n\n function load_libs(css_urls, js_urls, callback) {\n if (css_urls == null) css_urls = [];\n if (js_urls == null) js_urls = [];\n\n root._bokeh_onload_callbacks.push(callback);\n if (root._bokeh_is_loading > 0) {\n console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n return null;\n }\n if (js_urls == null || js_urls.length === 0) {\n run_callbacks();\n return null;\n }\n console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n function on_load() {\n root._bokeh_is_loading--;\n if (root._bokeh_is_loading === 0) {\n console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n run_callbacks()\n }\n }\n\n function on_error(url) {\n console.error(\"failed to load \" + url);\n }\n\n for (let i = 0; i < css_urls.length; i++) {\n const url = css_urls[i];\n const element = document.createElement(\"link\");\n element.onload = on_load;\n element.onerror = on_error.bind(null, url);\n element.rel = \"stylesheet\";\n element.type = \"text/css\";\n element.href = url;\n console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n document.body.appendChild(element);\n }\n\n for (let i = 0; i < js_urls.length; i++) {\n const url = js_urls[i];\n const element = document.createElement('script');\n element.onload = on_load;\n element.onerror = on_error.bind(null, url);\n element.async = false;\n element.src = url;\n console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n document.head.appendChild(element);\n }\n };\n\n function inject_raw_css(css) {\n const element = document.createElement(\"style\");\n element.appendChild(document.createTextNode(css));\n document.body.appendChild(element);\n }\n\n \n const js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-gl-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-mathjax-2.4.2.min.js\"];\n const css_urls = [];\n \n\n const inline_js = [\n function(Bokeh) {\n Bokeh.set_log_level(\"info\");\n },\n function(Bokeh) {\n \n \n }\n ];\n\n function run_inline_js() {\n \n if (root.Bokeh !== undefined || force === true) {\n \n for (let i = 0; i < inline_js.length; i++) {\n inline_js[i].call(root, root.Bokeh);\n }\n if (force === true) {\n display_loaded();\n }} else if (Date.now() < root._bokeh_timeout) {\n setTimeout(run_inline_js, 100);\n } else if (!root._bokeh_failed_load) {\n console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n root._bokeh_failed_load = true;\n } else if (force !== true) {\n const cell = $(document.getElementById(\"1002\")).parents('.cell').data().cell;\n cell.output_area.append_execute_result(NB_LOAD_WARNING)\n }\n\n }\n\n if (root._bokeh_is_loading === 0) {\n console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n run_inline_js();\n } else {\n load_libs(css_urls, js_urls, function() {\n console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n run_inline_js();\n });\n }\n}(window));" }, "metadata": {}, "output_type": "display_data" } ], "source": [ "# Dynamic graph using Bokeh\n", "import pandas_bokeh\n", "from bokeh.models import ColumnDataSource, HoverTool\n", "from bokeh.plotting import figure, show\n", "\n", "df['ts'] = pd.to_datetime(df['ts']).dt.date\n", "df['ts'] = pd.to_datetime(df['ts'])\n", "\n", "pandas_bokeh.output_notebook()\n", "pd.set_option('plotting.backend', 'pandas_bokeh')\n", "\n", "# Filter the result to manipulate only timestamp and number of discussion per day\n", "data2 = pd.DataFrame(df.groupby(df['ts'])['from'].count().reset_index())" ] }, { "cell_type": "code", "execution_count": 6, "id": "f03b2691-1f1b-4dd9-a3f8-cf881120454f", "metadata": {}, "outputs": [ { "data": { "text/html": [ "\n", "\n", "\n", "\n", "\n", "\n", "
\n" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "application/javascript": [ "(function(root) {\n", " function embed_document(root) {\n", " \n", " const docs_json = {\"64f61ea2-37ee-4223-aa14-21461f445fcb\":{\"defs\":[],\"roots\":{\"references\":[{\"attributes\":{\"below\":[{\"id\":\"1013\"}],\"center\":[{\"id\":\"1016\"},{\"id\":\"1020\"}],\"height\":500,\"left\":[{\"id\":\"1017\"}],\"renderers\":[{\"id\":\"1042\"}],\"title\":{\"id\":\"1037\"},\"toolbar\":{\"id\":\"1028\"},\"width\":900,\"x_range\":{\"id\":\"1005\"},\"x_scale\":{\"id\":\"1009\"},\"y_range\":{\"id\":\"1007\"},\"y_scale\":{\"id\":\"1011\"}},\"id\":\"1004\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"1065\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"1061\",\"type\":\"DaysTicker\"},{\"attributes\":{\"callback\":null,\"formatters\":{\"@ts\":\"datetime\"},\"tooltips\":[[\"Date\",\"@ts{%F}\"],[\"Nb of discussion\",\"@from{int}\"]]},\"id\":\"1035\",\"type\":\"HoverTool\"},{\"attributes\":{},\"id\":\"1007\",\"type\":\"DataRange1d\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"1062\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"1005\",\"type\":\"DataRange1d\"},{\"attributes\":{\"line_alpha\":0.1,\"line_color\":\"#851503\",\"line_width\":2,\"x\":{\"field\":\"ts\"},\"y\":{\"field\":\"from\"}},\"id\":\"1040\",\"type\":\"Line\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"1063\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"line_color\":\"#851503\",\"line_width\":2,\"x\":{\"field\":\"ts\"},\"y\":{\"field\":\"from\"}},\"id\":\"1039\",\"type\":\"Line\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"1064\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"line_alpha\":0.2,\"line_color\":\"#851503\",\"line_width\":2,\"x\":{\"field\":\"ts\"},\"y\":{\"field\":\"from\"}},\"id\":\"1041\",\"type\":\"Line\"},{\"attributes\":{\"bottom_units\":\"screen\",\"coordinates\":null,\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"group\":null,\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"syncable\":false,\"top_units\":\"screen\"},\"id\":\"1027\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"axis_label\":\"Date\",\"coordinates\":null,\"formatter\":{\"id\":\"1050\"},\"group\":null,\"major_label_policy\":{\"id\":\"1051\"},\"ticker\":{\"id\":\"1014\"}},\"id\":\"1013\",\"type\":\"DatetimeAxis\"},{\"attributes\":{},\"id\":\"1052\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"coordinates\":null,\"group\":null,\"text\":\"Activity discussion per day\"},\"id\":\"1037\",\"type\":\"Title\"},{\"attributes\":{},\"id\":\"1009\",\"type\":\"LinearScale\"},{\"attributes\":{},\"id\":\"1024\",\"type\":\"SaveTool\"},{\"attributes\":{},\"id\":\"1026\",\"type\":\"HelpTool\"},{\"attributes\":{},\"id\":\"1021\",\"type\":\"PanTool\"},{\"attributes\":{},\"id\":\"1025\",\"type\":\"ResetTool\"},{\"attributes\":{\"tools\":[{\"id\":\"1021\"},{\"id\":\"1022\"},{\"id\":\"1023\"},{\"id\":\"1024\"},{\"id\":\"1025\"},{\"id\":\"1026\"},{\"id\":\"1035\"}]},\"id\":\"1028\",\"type\":\"Toolbar\"},{\"attributes\":{},\"id\":\"1066\",\"type\":\"YearsTicker\"},{\"attributes\":{\"axis\":{\"id\":\"1013\"},\"coordinates\":null,\"group\":null,\"ticker\":null},\"id\":\"1016\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"1051\",\"type\":\"AllLabels\"},{\"attributes\":{\"overlay\":{\"id\":\"1027\"}},\"id\":\"1023\",\"type\":\"BoxZoomTool\"},{\"attributes\":{},\"id\":\"1053\",\"type\":\"Selection\"},{\"attributes\":{\"num_minor_ticks\":5,\"tickers\":[{\"id\":\"1055\"},{\"id\":\"1056\"},{\"id\":\"1057\"},{\"id\":\"1058\"},{\"id\":\"1059\"},{\"id\":\"1060\"},{\"id\":\"1061\"},{\"id\":\"1062\"},{\"id\":\"1063\"},{\"id\":\"1064\"},{\"id\":\"1065\"},{\"id\":\"1066\"}]},\"id\":\"1014\",\"type\":\"DatetimeTicker\"},{\"attributes\":{},\"id\":\"1050\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"1055\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"axis_label\":\"Number of discussion\",\"coordinates\":null,\"formatter\":{\"id\":\"1047\"},\"group\":null,\"major_label_policy\":{\"id\":\"1048\"},\"ticker\":{\"id\":\"1018\"}},\"id\":\"1017\",\"type\":\"LinearAxis\"},{\"attributes\":{},\"id\":\"1047\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"1058\",\"type\":\"DaysTicker\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"1056\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{},\"id\":\"1022\",\"type\":\"WheelZoomTool\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"1060\",\"type\":\"DaysTicker\"},{\"attributes\":{\"coordinates\":null,\"data_source\":{\"id\":\"1003\"},\"glyph\":{\"id\":\"1039\"},\"group\":null,\"hover_glyph\":null,\"muted_glyph\":{\"id\":\"1041\"},\"nonselection_glyph\":{\"id\":\"1040\"},\"view\":{\"id\":\"1043\"}},\"id\":\"1042\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"1018\",\"type\":\"BasicTicker\"},{\"attributes\":{},\"id\":\"1011\",\"type\":\"LinearScale\"},{\"attributes\":{\"axis\":{\"id\":\"1017\"},\"coordinates\":null,\"dimension\":1,\"group\":null,\"ticker\":null},\"id\":\"1020\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"1048\",\"type\":\"AllLabels\"},{\"attributes\":{\"data\":{\"from\":[58,16,10,59,66,80,38,48,1,57,46,29,27,39,6,17,190,56,58,161,12,13,57,41,140,135,118,9,2,45,70,165,158,144,55,10,260,161,104,108,188,21,3,166,146,114,113,317,1,49,113,142,213,206,111,44,28,103,162,122,128,189,2,5,147,137,59,103,177,7,1,99,99,88,112,101,23,4,137,114,138,140,54,3,2,75,61,143,54,338,116,19,57,143,208,222,161,6,6,372,274,110,196,135,6,2,215,168,65,173,125,27,6,138,165,118,103,241,19,34,37,89,158,237,213,135,21,276,414,368,144,178,43,8,114,157,198,225,161,16,4,73,214,169,117,286,34,48,539,154,129,210,182,5,4,615,229,154,158,111,33,17,146,157,216,256,375,56,19,361,152,235,211,196,6,2,206,257,224,198,219,25,3,120,130,104,146,105,12,12,61,243,155,159,300,25,6,310,217,162,149,169,12,11,109,42,110,305,1289,163,23,975,1156,280,707,320,65,5,190,278,191,208,233,13,89,320,515,169,255,65,13,39,165,102,95,181,61,10,14,141,209,159,183,114,20,37,350,302,473,228,169,216,5,338,439,261,126,471,48,28,253,578,361,290,853,20,60,372,313,320,163,161,29,34,268,257,197,235,191,23,96,286,210,342,495,574,19,100,376,362,260,205,467,43,56,332,730,470,263,356,30,21,494,571,971,431,353,274,23,562,481,149,134,503,74,400,486,141,109,263,127,26,2,70,228,137,176,63,80,18,297,257,73,22,31,24,40,12,14,23,42,8,24,11,79,80,65,73,52,9,10,115,84,39,159,99,21,295,60,126,140,147,121,33,10,190,78,147,119,75,22,77,74,121,59,151,29,9,7,79,123,87,98,33,39,11,214,97,67,28,33,11,67,14,15,9],\"index\":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395],\"ts\":{\"__ndarray__\":\"AAAACLd0d0IAAMBtCXV3QgAAgNNbdXdCAABAOa51d0IAAACfAHZ3QgAAwARTdndCAACAaqV2d0IAAEDQ93Z3QgAAADZKd3dCAACAAe93d0IAAEBnQXh3QgAAAM2TeHdCAADAMuZ4d0IAAICYOHl3QgAAAGTdeXdCAADAyS96d0IAAIAvgnp3QgAAQJXUendCAAAA+yZ7d0IAAMBgeXt3QgAAgMbLe3dCAABALB58d0IAAACScHx3QgAAwPfCfHdCAACAXRV9d0IAAEDDZ313QgAAACm6fXdCAADAjgx+d0IAAID0Xn53QgAAQFqxfndCAAAAwAN/d0IAAMAlVn93QgAAgIuof3dCAABA8fp/d0IAAABXTYB3QgAAwLyfgHdCAACAIvKAd0IAAECIRIF3QgAAAO6WgXdCAADAU+mBd0IAAIC5O4J3QgAAQB+OgndCAAAAheCCd0IAAMDqMoN3QgAAgFCFg3dCAABAtteDd0IAAAAcKoR3QgAAwIF8hHdCAACA586Ed0IAAEBNIYV3QgAAALNzhXdCAADAGMaFd0IAAIB+GIZ3QgAAQORqhndCAAAASr2Gd0IAAMCvD4d3QgAAgBVih3dCAABAe7SHd0IAAADhBoh3QgAAwEZZiHdCAACArKuId0IAAEAS/oh3QgAAAHhQiXdCAADA3aKJd0IAAIBD9Yl3QgAAQKlHindCAAAAD5qKd0IAAMB07Ip3QgAAgNo+i3dCAABAQJGLd0IAAACm44t3QgAAwAs2jHdCAACAcYiMd0IAAEDX2ox3QgAAAD0tjXdCAADAon+Nd0IAAIAI0o13QgAAQG4kjndCAAAA1HaOd0IAAMA5yY53QgAAgJ8bj3dCAABABW6Pd0IAAABrwI93QgAAwNASkHdCAACANmWQd0IAAECct5B3QgAAAAIKkXdCAADAZ1yRd0IAAIDNrpF3QgAAQDMBkndCAAAAmVOSd0IAAMD+pZJ3QgAAgGT4kndCAABAykqTd0IAAAAwnZN3QgAAwJXvk3dCAACA+0GUd0IAAEBhlJR3QgAAAMfmlHdCAADALDmVd0IAAICSi5V3QgAAQPjdlXdCAAAAXjCWd0IAAMDDgpZ3QgAAgCnVlndCAABAjyeXd0IAAAD1eZd3QgAAwFrMl3dCAACAwB6Yd0IAAEAmcZh3QgAAAIzDmHdCAADA8RWZd0IAAIBXaJl3QgAAQL26mXdCAAAAIw2ad0IAAMCIX5p3QgAAgO6xmndCAABAVASbd0IAAAC6Vpt3QgAAwB+pm3dCAACAhfubd0IAAEDrTZx3QgAAAFGgnHdCAADAtvKcd0IAAIAcRZ13QgAAQIKXnXdCAAAA6Omdd0IAAMBNPJ53QgAAgLOOnndCAABAGeGed0IAAAB/M593QgAAwOSFn3dCAACAStifd0IAAECwKqB3QgAAABZ9oHdCAADAe8+gd0IAAIDhIaF3QgAAQEd0oXdCAAAArcahd0IAAMASGaJ3QgAAgHhrondCAABA3r2id0IAAABEEKN3QgAAwKlio3dCAACAD7Wjd0IAAEB1B6R3QgAAANtZpHdCAADAQKykd0IAAICm/qR3QgAAQAxRpXdCAAAAcqOld0IAAMDX9aV3QgAAgD1IpndCAABAo5qmd0IAAAAJ7aZ3QgAAwG4/p3dCAACA1JGnd0IAAEA65Kd3QgAAAKA2qHdCAADABYmod0IAAIBr26h3QgAAQNEtqXdCAAAAN4Cpd0IAAMCc0ql3QgAAgAIlqndCAABAaHeqd0IAAADOyap3QgAAwDMcq3dCAACAmW6rd0IAAED/wKt3QgAAAGUTrHdCAADAymWsd0IAAIAwuKx3QgAAQJYKrXdCAAAA/Fytd0IAAMBhr613QgAAgMcBrndCAABALVSud0IAAACTpq53QgAAwPj4rndCAACAXkuvd0IAAEDEna93QgAAACrwr3dCAADAj0Kwd0IAAID1lLB3QgAAQFvnsHdCAAAAwTmxd0IAAMAmjLF3QgAAgIzesXdCAABA8jCyd0IAAABYg7J3QgAAwL3VsndCAACAIyizd0IAAECJerN3QgAAAO/Ms3dCAADAVB+0d0IAAIC6cbR3QgAAQCDEtHdCAAAAhha1d0IAAMDraLV3QgAAgFG7tXdCAABAtw22d0IAAAAdYLZ3QgAAwIKytndCAACA6AS3d0IAAEBOV7d3QgAAALSpt3dCAADAGfy3d0IAAIB/Trh3QgAAQOWguHdCAAAAS/O4d0IAAMCwRbl3QgAAgBaYuXdCAABAfOq5d0IAAADiPLp3QgAAwEePundCAACAreG6d0IAAEATNLt3QgAAAHmGu3dCAADA3ti7d0IAAIBEK7x3QgAAQKp9vHdCAAAAENC8d0IAAMB1Ir13QgAAgNt0vXdCAABAQce9d0IAAACnGb53QgAAwAxsvndCAACAcr6+d0IAAEDYEL93QgAAAD5jv3dCAADAo7W/d0IAAIAJCMB3QgAAQG9awHdCAAAA1azAd0IAAMA6/8B3QgAAgKBRwXdCAABABqTBd0IAAABs9sF3QgAAwNFIwndCAACAN5vCd0IAAECd7cJ3QgAAAANAw3dCAADAaJLDd0IAAIDO5MN3QgAAQDQ3xHdCAAAAmonEd0IAAMD/28R3QgAAgGUuxXdCAABAy4DFd0IAAAAx08V3QgAAwJYlxndCAACA/HfGd0IAAEBiysZ3QgAAAMgcx3dCAADALW/Hd0IAAICTwcd3QgAAQPkTyHdCAAAAX2bId0IAAMDEuMh3QgAAgCoLyXdCAABAkF3Jd0IAAAD2r8l3QgAAwFsCyndCAACAwVTKd0IAAEAnp8p3QgAAAI35yndCAADA8kvLd0IAAIBYnst3QgAAQL7wy3dCAAAAJEPMd0IAAMCJlcx3QgAAgO/nzHdCAABAVTrNd0IAAAC7jM13QgAAwCDfzXdCAACAhjHOd0IAAEDsg853QgAAAFLWzndCAADAtyjPd0IAAIAde893QgAAQIPNz3dCAAAA6R/Qd0IAAMBOctB3QgAAgLTE0HdCAABAGhfRd0IAAACAadF3QgAAwOW70XdCAACASw7Sd0IAAECxYNJ3QgAAABez0ndCAADAfAXTd0IAAIDiV9N3QgAAQEiq03dCAAAArvzTd0IAAMATT9R3QgAAgHmh1HdCAABA3/PUd0IAAABFRtV3QgAAwKqY1XdCAACAEOvVd0IAAEB2PdZ3QgAAANyP1ndCAADAQeLWd0IAAICnNNd3QgAAQA2H13dCAAAAc9nXd0IAAMDYK9h3QgAAgD5+2HdCAABApNDYd0IAAAAKI9l3QgAAwG912XdCAACA1cfZd0IAAEA7Gtp3QgAAAKFs2ndCAADABr/ad0IAAIBsEdt3QgAAQNJj23dCAAAAOLbbd0IAAMCdCNx3QgAAgANb3HdCAABAaa3cd0IAAADP/9x3QgAAwDRS3XdCAACAmqTdd0IAAEAA9913QgAAAGZJ3ndCAADAy5ved0IAAIAx7t53QgAAQJdA33dCAAAA/ZLfd0IAAMBi5d93QgAAgMg34HdCAABALorgd0IAAACU3OB3QgAAwPku4XdCAACAX4Hhd0IAAEDF0+F3QgAAACsm4ndCAADAkHjid0IAAID2yuJ3QgAAQFwd43dCAAAAwm/jd0IAAMAnwuN3QgAAgI0U5HdCAABA82bkd0IAAABZueR3QgAAwL4L5XdCAACAJF7ld0IAAECKsOV3QgAAAPAC5ndCAADAVVXmd0IAAIC7p+Z3QgAAQCH65ndCAAAAh0znd0IAAMDsnud3QgAAgFLx53dCAABAuEPod0IAAAAeluh3QgAAwIPo6HdCAACA6Trpd0IAAEBPjel3QgAAALXf6XdCAADAGjLqd0IAAICAhOp3QgAAQObW6ndCAAAATCnrd0IAAMCxe+t3QgAAgBfO63dCAABAfSDsd0IAAADjcux3QgAAwEjF7HdCAACArhftd0IAAEAUau13QgAAAHq87XdCAADA3w7ud0IAAIBFYe53QgAAQKuz7ndCAAAAEQbvd0IAAMB2WO93QgAAgNyq73dCAABAQv3vd0IAAACoT/B3QgAAwA2i8HdCAACAc/Twd0IAAEDZRvF3QgAAAD+Z8XdCAADApOvxd0IAAIAKPvJ3QgAAQHCQ8ndCAAAA1uLyd0IAAMA7NfN3QgAAgKGH83dCAABAB9rzd0IAAABtLPR3QgAAwNJ+9HdC\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[396]}},\"selected\":{\"id\":\"1053\"},\"selection_policy\":{\"id\":\"1052\"}},\"id\":\"1003\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"1057\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"1059\",\"type\":\"DaysTicker\"},{\"attributes\":{\"source\":{\"id\":\"1003\"}},\"id\":\"1043\",\"type\":\"CDSView\"}],\"root_ids\":[\"1004\"]},\"title\":\"Bokeh Application\",\"version\":\"2.4.2\"}};\n", " const render_items = [{\"docid\":\"64f61ea2-37ee-4223-aa14-21461f445fcb\",\"root_ids\":[\"1004\"],\"roots\":{\"1004\":\"cded5736-c145-436f-afaf-ea043c1bcc8a\"}}];\n", " root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n", "\n", " }\n", " if (root.Bokeh !== undefined) {\n", " embed_document(root);\n", " } else {\n", " let attempts = 0;\n", " const timer = setInterval(function(root) {\n", " if (root.Bokeh !== undefined) {\n", " clearInterval(timer);\n", " embed_document(root);\n", " } else {\n", " attempts++;\n", " if (attempts > 100) {\n", " clearInterval(timer);\n", " console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n", " }\n", " }\n", " }, 10, root)\n", " }\n", "})(window);" ], "application/vnd.bokehjs_exec.v0+json": "" }, "metadata": { "application/vnd.bokehjs_exec.v0+json": { "id": "1004" } }, "output_type": "display_data" } ], "source": [ "# Loading the filtered dataset into ColumnDataSource\n", "source = ColumnDataSource(data2)\n", "\n", "# Creating the figure with the size\n", "p = figure(x_axis_type='datetime', plot_width=900, plot_height=500)\n", "\n", "# Adding the hover tools\n", "p.add_tools(HoverTool(tooltips=[('Date', '@ts{%F}'), ('Nb of discussion','@from{int}')],\n", " formatters={'@ts':'datetime'}, mode='mouse'))\n", "\n", "# Legend\n", "p.title.text ='Activity discussion per day'\n", "p.xaxis.axis_label = 'Date'\n", "p.yaxis.axis_label = 'Number of discussion'\n", "\n", "# diagram\n", "p.line(x='ts', y='from', line_width=2, color='#851503', source=source)\n", "\n", "# print the diagram\n", "show(p)" ] }, { "cell_type": "markdown", "id": "adb84fda-d683-4ebb-bdb3-3b9b83173c1b", "metadata": {}, "source": [ "## Searching in the logs\n", "\n", "Reading all the leak can be a bit time consuming so it could be interesting to build a simple search engine to search for specific occurence of a string into the chat logs. That way we can filter to specific data of interest such as bitcoin, usernames, malware name, exploit, CVE... to name a few." ] }, { "cell_type": "code", "execution_count": 7, "id": "b9b32d34-ec26-4652-be66-ff8215be39e1", "metadata": {}, "outputs": [ { "data": { "application/vnd.jupyter.widget-view+json": { "model_id": "76ea2e9ae1fd4218a948631f32a5934b", "version_major": 2, "version_minor": 0 }, "text/plain": [ "Text(value='', description='Search:', placeholder='Enter your search')" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "application/vnd.jupyter.widget-view+json": { "model_id": "3e5c089a0d234bbc8c2a6cc38b7586a1", "version_major": 2, "version_minor": 0 }, "text/plain": [ "Button(description='search', icon='check', style=ButtonStyle())" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "application/vnd.jupyter.widget-view+json": { "model_id": "2774030d22844ff69d70becc45bdbc09", "version_major": 2, "version_minor": 0 }, "text/plain": [ "Output()" ] }, "metadata": {}, "output_type": "display_data" } ], "source": [ "# Import lib \n", "import ipywidgets as widgets\n", "from textsearch import TextSearch\n", "from IPython.display import display\n", "\n", "pd.set_option('display.max_colwidth', None)\n", "\n", "#configure widget\n", "keyword = widgets.Text(\n", " value='',\n", " placeholder='Enter your search',\n", " description='Search:',\n", " disabled=False\n", ")\n", "display(keyword)\n", "\n", "# Configure click button\n", "button = widgets.Button(description=\"search\", icon='check') # (FontAwesome names without the `fa-` prefix))\n", "display(button)\n", "\n", "output = widgets.Output()\n", "\n", "# Searching for the input word\n", "@output.capture()\n", "def userInput(b):\n", " \n", " # store the search result in a list\n", " result = []\n", " print(\"[+] Searching the chat for occurence of: \" + keyword.value)\n", " \n", " # look for the string into the translated column\n", " for i in df['LANG-EN']:\n", " ts = TextSearch(case=\"ignore\", returns=\"match\")\n", " words = keyword.value\n", " ts.add(words)\n", " \n", " # store the result into the list\n", " if ts.findall(str(i)):\n", " result.append(i)\n", " \n", " # Filter and print the result\n", " result = list(dict.fromkeys(result)) \n", " print('\\n'.join(map(str, result)))\n", "\n", "# get the input word\n", "button.on_click(userInput)\n", "display(output)" ] }, { "cell_type": "markdown", "id": "90dc3f34-79ae-4046-bde6-194f049971e0", "metadata": {}, "source": [ "## Analyzing the level of user activity " ] }, { "cell_type": "markdown", "id": "edcf5a0e-a78c-4e72-95b0-3b81e2514e05", "metadata": {}, "source": [ "When analyzing chat logs, identifying the number of users and analyzing the most active ones can provide insight into the size of the group and roles of users within it. Using Python, the list of users can be extracted and saved in a text file." ] }, { "cell_type": "code", "execution_count": 8, "id": "5dc9864e-2b88-43ad-8b78-c8671518f505", "metadata": {}, "outputs": [], "source": [ "# Extracting all the users\n", "userfrom = df['from']\n", "userto = df['to']\n", "\n", "# Dropping duplicate and concatenate dataframe\n", "user = pd.concat([userfrom.drop_duplicates(), userto.drop_duplicates()], ignore_index=True)\n", "user = user.drop_duplicates()\n", "\n", "# Save userlist to txt for additional hunting\n", "user.to_csv(r'IOC\\userlist.txt', header=None, index=None, sep='\\t', mode='a')" ] }, { "cell_type": "code", "execution_count": 9, "id": "1a5838b6-95a3-4184-a710-4457eb9e7f2a", "metadata": {}, "outputs": [ { "data": { "text/html": [ "\n", "\n", "\n", "\n", "\n", "\n", "
\n" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "application/javascript": [ "(function(root) {\n", " function embed_document(root) {\n", " \n", " const docs_json = {\"ba037f5d-27e7-460b-a11f-7e1f159c5610\":{\"defs\":[],\"roots\":{\"references\":[{\"attributes\":{\"below\":[{\"id\":\"1229\"}],\"center\":[{\"id\":\"1232\"},{\"id\":\"1236\"},{\"id\":\"1269\"}],\"height\":10,\"left\":[{\"id\":\"1233\"}],\"output_backend\":\"webgl\",\"renderers\":[{\"id\":\"1258\"}],\"sizing_mode\":\"fixed\",\"title\":{\"id\":\"1219\"},\"toolbar\":{\"id\":\"1244\"},\"width\":15,\"x_range\":{\"id\":\"1221\"},\"x_scale\":{\"id\":\"1225\"},\"y_range\":{\"id\":\"1223\"},\"y_scale\":{\"id\":\"1227\"}},\"id\":\"1218\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"callback\":null,\"mode\":\"hline\",\"renderers\":[{\"id\":\"1258\"}],\"tooltips\":[[\"from\",\"@__x__values_original\"],[\"ts\",\"@{ts}\"]]},\"id\":\"1271\",\"type\":\"HoverTool\"},{\"attributes\":{},\"id\":\"1262\",\"type\":\"AllLabels\"},{\"attributes\":{\"ticks\":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49]},\"id\":\"1273\",\"type\":\"FixedTicker\"},{\"attributes\":{\"coordinates\":null,\"group\":null,\"text\":\"Most active users\"},\"id\":\"1219\",\"type\":\"Title\"},{\"attributes\":{\"range\":{\"id\":\"1223\"}},\"id\":\"1253\",\"type\":\"Dodge\"},{\"attributes\":{},\"id\":\"1230\",\"type\":\"BasicTicker\"},{\"attributes\":{\"bottom_units\":\"screen\",\"coordinates\":null,\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"group\":null,\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"syncable\":false,\"top_units\":\"screen\"},\"id\":\"1243\",\"type\":\"BoxAnnotation\"},{\"attributes\":{},\"id\":\"1264\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"active_scroll\":{\"id\":\"1238\"},\"tools\":[{\"id\":\"1237\"},{\"id\":\"1238\"},{\"id\":\"1239\"},{\"id\":\"1240\"},{\"id\":\"1241\"},{\"id\":\"1242\"},{\"id\":\"1271\"}]},\"id\":\"1244\",\"type\":\"Toolbar\"},{\"attributes\":{},\"id\":\"1267\",\"type\":\"Selection\"},{\"attributes\":{\"fill_color\":{\"value\":\"#1f77b4\"},\"hatch_color\":{\"value\":\"#1f77b4\"},\"height\":{\"value\":0.7},\"line_color\":{\"value\":\"#1f77b4\"},\"line_width\":{\"value\":2},\"right\":{\"field\":\"ts\"},\"y\":{\"field\":\"__x__values\",\"transform\":{\"id\":\"1253\"}}},\"id\":\"1255\",\"type\":\"HBar\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#1f77b4\"},\"hatch_alpha\":{\"value\":0.1},\"hatch_color\":{\"value\":\"#1f77b4\"},\"height\":{\"value\":0.7},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#1f77b4\"},\"line_width\":{\"value\":2},\"right\":{\"field\":\"ts\"},\"y\":{\"field\":\"__x__values\",\"transform\":{\"id\":\"1253\"}}},\"id\":\"1256\",\"type\":\"HBar\"},{\"attributes\":{},\"id\":\"1241\",\"type\":\"ResetTool\"},{\"attributes\":{},\"id\":\"1240\",\"type\":\"SaveTool\"},{\"attributes\":{},\"id\":\"1227\",\"type\":\"LinearScale\"},{\"attributes\":{\"coordinates\":null,\"data_source\":{\"id\":\"1217\"},\"glyph\":{\"id\":\"1255\"},\"group\":null,\"hover_glyph\":null,\"muted_glyph\":{\"id\":\"1257\"},\"nonselection_glyph\":{\"id\":\"1256\"},\"view\":{\"id\":\"1259\"}},\"id\":\"1258\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"overlay\":{\"id\":\"1243\"}},\"id\":\"1239\",\"type\":\"BoxZoomTool\"},{\"attributes\":{\"axis\":{\"id\":\"1229\"},\"coordinates\":null,\"group\":null,\"ticker\":null},\"id\":\"1232\",\"type\":\"Grid\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.2},\"fill_color\":{\"value\":\"#1f77b4\"},\"hatch_alpha\":{\"value\":0.2},\"hatch_color\":{\"value\":\"#1f77b4\"},\"height\":{\"value\":0.7},\"line_alpha\":{\"value\":0.2},\"line_color\":{\"value\":\"#1f77b4\"},\"line_width\":{\"value\":2},\"right\":{\"field\":\"ts\"},\"y\":{\"field\":\"__x__values\",\"transform\":{\"id\":\"1253\"}}},\"id\":\"1257\",\"type\":\"HBar\"},{\"attributes\":{},\"id\":\"1237\",\"type\":\"PanTool\"},{\"attributes\":{},\"id\":\"1265\",\"type\":\"AllLabels\"},{\"attributes\":{},\"id\":\"1242\",\"type\":\"HelpTool\"},{\"attributes\":{\"source\":{\"id\":\"1217\"}},\"id\":\"1259\",\"type\":\"CDSView\"},{\"attributes\":{\"code\":\"\\n var labels = {0: 'defender@q3mcco35auwcstmt.onion', 1: 'stern@q3mcco35auwcstmt.onion', 2: 'driver@q3mcco35auwcstmt.onion', 3: 'bio@q3mcco35auwcstmt.onion', 4: 'mango@q3mcco35auwcstmt.onion', 5: 'ttrr@conference.q3mcco35auwcstmt.onion', 6: 'veron@q3mcco35auwcstmt.onion', 7: 'hof@q3mcco35auwcstmt.onion', 8: 'bentley@q3mcco35auwcstmt.onion', 9: 'bloodrush@q3mcco35auwcstmt.onion', 10: 'tramp@q3mcco35auwcstmt.onion', 11: 'skippy@q3mcco35auwcstmt.onion', 12: 'grom@q3mcco35auwcstmt.onion', 13: 'many@q3mcco35auwcstmt.onion', 14: 'pumba@q3mcco35auwcstmt.onion', 15: 'reshaev@q3mcco35auwcstmt.onion', 16: 'grant@q3mcco35auwcstmt.onion', 17: 'dollar@q3mcco35auwcstmt.onion', 18: 'best@q3mcco35auwcstmt.onion', 19: 'zulas@q3mcco35auwcstmt.onion', 20: 'cybergangster@q3mcco35auwcstmt.onion', 21: 'pin@q3mcco35auwcstmt.onion', 22: 'specter@q3mcco35auwcstmt.onion', 23: 'buza@q3mcco35auwcstmt.onion', 24: 'love@q3mcco35auwcstmt.onion', 25: 'revers@q3mcco35auwcstmt.onion', 26: 'terry@q3mcco35auwcstmt.onion', 27: 'sunday@q3mcco35auwcstmt.onion', 28: 'ford@q3mcco35auwcstmt.onion', 29: 'ramon@q3mcco35auwcstmt.onion', 30: 'derekson@q3mcco35auwcstmt.onion', 31: 'tom@q3mcco35auwcstmt.onion', 32: 'ghost@q3mcco35auwcstmt.onion', 33: 'green@q3mcco35auwcstmt.onion', 34: 'baget@q3mcco35auwcstmt.onion', 35: 'salamandra@q3mcco35auwcstmt.onion', 36: 'begemot@q3mcco35auwcstmt.onion', 37: 'netwalker@q3mcco35auwcstmt.onion', 38: 'demon@q3mcco35auwcstmt.onion', 39: 'strix@q3mcco35auwcstmt.onion', 40: 'ali@q3mcco35auwcstmt.onion', 41: 'derek@q3mcco35auwcstmt.onion', 42: 'viper@q3mcco35auwcstmt.onion', 43: 'dandis@q3mcco35auwcstmt.onion', 44: 'hash@q3mcco35auwcstmt.onion', 45: 'professor@q3mcco35auwcstmt.onion', 46: 'lemur@q3mcco35auwcstmt.onion', 47: 'tiktak@q3mcco35auwcstmt.onion', 48: 'rozetka@q3mcco35auwcstmt.onion', 49: 'hors@q3mcco35auwcstmt.onion'};\\n return labels[tick];\\n \"},\"id\":\"1251\",\"type\":\"FuncTickFormatter\"},{\"attributes\":{\"axis\":{\"id\":\"1233\"},\"coordinates\":null,\"dimension\":1,\"group\":null,\"ticker\":null},\"id\":\"1236\",\"type\":\"Grid\"},{\"attributes\":{\"axis_label\":\"from\",\"coordinates\":null,\"formatter\":{\"id\":\"1251\"},\"group\":null,\"major_label_policy\":{\"id\":\"1262\"},\"ticker\":{\"id\":\"1273\"}},\"id\":\"1233\",\"type\":\"LinearAxis\"},{\"attributes\":{},\"id\":\"1266\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"click_policy\":\"hide\",\"coordinates\":null,\"group\":null,\"items\":[{\"id\":\"1270\"}]},\"id\":\"1269\",\"type\":\"Legend\"},{\"attributes\":{\"data\":{\"__x__values\":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49],\"__x__values_original\":[\"defender@q3mcco35auwcstmt.onion\",\"stern@q3mcco35auwcstmt.onion\",\"driver@q3mcco35auwcstmt.onion\",\"bio@q3mcco35auwcstmt.onion\",\"mango@q3mcco35auwcstmt.onion\",\"ttrr@conference.q3mcco35auwcstmt.onion\",\"veron@q3mcco35auwcstmt.onion\",\"hof@q3mcco35auwcstmt.onion\",\"bentley@q3mcco35auwcstmt.onion\",\"bloodrush@q3mcco35auwcstmt.onion\",\"tramp@q3mcco35auwcstmt.onion\",\"skippy@q3mcco35auwcstmt.onion\",\"grom@q3mcco35auwcstmt.onion\",\"many@q3mcco35auwcstmt.onion\",\"pumba@q3mcco35auwcstmt.onion\",\"reshaev@q3mcco35auwcstmt.onion\",\"grant@q3mcco35auwcstmt.onion\",\"dollar@q3mcco35auwcstmt.onion\",\"best@q3mcco35auwcstmt.onion\",\"zulas@q3mcco35auwcstmt.onion\",\"cybergangster@q3mcco35auwcstmt.onion\",\"pin@q3mcco35auwcstmt.onion\",\"specter@q3mcco35auwcstmt.onion\",\"buza@q3mcco35auwcstmt.onion\",\"love@q3mcco35auwcstmt.onion\",\"revers@q3mcco35auwcstmt.onion\",\"terry@q3mcco35auwcstmt.onion\",\"sunday@q3mcco35auwcstmt.onion\",\"ford@q3mcco35auwcstmt.onion\",\"ramon@q3mcco35auwcstmt.onion\",\"derekson@q3mcco35auwcstmt.onion\",\"tom@q3mcco35auwcstmt.onion\",\"ghost@q3mcco35auwcstmt.onion\",\"green@q3mcco35auwcstmt.onion\",\"baget@q3mcco35auwcstmt.onion\",\"salamandra@q3mcco35auwcstmt.onion\",\"begemot@q3mcco35auwcstmt.onion\",\"netwalker@q3mcco35auwcstmt.onion\",\"demon@q3mcco35auwcstmt.onion\",\"strix@q3mcco35auwcstmt.onion\",\"ali@q3mcco35auwcstmt.onion\",\"derek@q3mcco35auwcstmt.onion\",\"viper@q3mcco35auwcstmt.onion\",\"dandis@q3mcco35auwcstmt.onion\",\"hash@q3mcco35auwcstmt.onion\",\"professor@q3mcco35auwcstmt.onion\",\"lemur@q3mcco35auwcstmt.onion\",\"tiktak@q3mcco35auwcstmt.onion\",\"rozetka@q3mcco35auwcstmt.onion\",\"hors@q3mcco35auwcstmt.onion\"],\"ts\":[8246,4323,3968,3196,3194,3122,2955,2389,1810,1798,1629,1610,1200,1015,915,765,692,684,630,611,607,586,580,561,552,519,489,472,456,424,400,393,375,367,357,349,305,279,267,265,263,255,216,213,209,189,178,173,173,173]},\"selected\":{\"id\":\"1267\"},\"selection_policy\":{\"id\":\"1266\"}},\"id\":\"1217\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"1223\",\"type\":\"DataRange1d\"},{\"attributes\":{\"label\":{\"value\":\" ts\"},\"renderers\":[{\"id\":\"1258\"}]},\"id\":\"1270\",\"type\":\"LegendItem\"},{\"attributes\":{},\"id\":\"1225\",\"type\":\"LinearScale\"},{\"attributes\":{},\"id\":\"1238\",\"type\":\"WheelZoomTool\"},{\"attributes\":{\"axis_label\":\"ts\",\"coordinates\":null,\"formatter\":{\"id\":\"1264\"},\"group\":null,\"major_label_policy\":{\"id\":\"1265\"},\"ticker\":{\"id\":\"1230\"}},\"id\":\"1229\",\"type\":\"LinearAxis\"},{\"attributes\":{},\"id\":\"1221\",\"type\":\"DataRange1d\"}],\"root_ids\":[\"1218\"]},\"title\":\"Bokeh Application\",\"version\":\"2.4.2\"}};\n", " const render_items = [{\"docid\":\"ba037f5d-27e7-460b-a11f-7e1f159c5610\",\"root_ids\":[\"1218\"],\"roots\":{\"1218\":\"78b325ec-89e9-4d22-97c9-1c571af52d0e\"}}];\n", " root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n", "\n", " }\n", " if (root.Bokeh !== undefined) {\n", " embed_document(root);\n", " } else {\n", " let attempts = 0;\n", " const timer = setInterval(function(root) {\n", " if (root.Bokeh !== undefined) {\n", " clearInterval(timer);\n", " embed_document(root);\n", " } else {\n", " attempts++;\n", " if (attempts > 100) {\n", " clearInterval(timer);\n", " console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n", " }\n", " }\n", " }, 10, root)\n", " }\n", "})(window);" ], "application/vnd.bokehjs_exec.v0+json": "" }, "metadata": { "application/vnd.bokehjs_exec.v0+json": { "id": "1218" } }, "output_type": "display_data" }, { "data": { "text/html": [ "
Figure(
id = '1218', …)
above = [],
align = 'start',
aspect_ratio = None,
aspect_scale = 1,
background = None,
background_fill_alpha = 1.0,
background_fill_color = '#ffffff',
below = [LinearAxis(id='1229', ...)],
border_fill_alpha = 1.0,
border_fill_color = '#ffffff',
center = [Grid(id='1232', ...), Grid(id='1236', ...), Legend(id='1269', ...)],
css_classes = [],
disabled = False,
extra_x_ranges = {},
extra_x_scales = {},
extra_y_ranges = {},
extra_y_scales = {},
frame_height = None,
frame_width = None,
height = 10,
height_policy = 'auto',
hidpi = True,
inner_height = 0,
inner_width = 0,
js_event_callbacks = {},
js_property_callbacks = {},
left = [LinearAxis(id='1233', ...)],
lod_factor = 10,
lod_interval = 300,
lod_threshold = 2000,
lod_timeout = 500,
margin = (0, 0, 0, 0),
match_aspect = False,
max_height = None,
max_width = None,
min_border = 5,
min_border_bottom = None,
min_border_left = None,
min_border_right = None,
min_border_top = None,
min_height = None,
min_width = None,
name = None,
outer_height = 0,
outer_width = 0,
outline_line_alpha = 1.0,
outline_line_cap = 'butt',
outline_line_color = '#e5e5e5',
outline_line_dash = [],
outline_line_dash_offset = 0,
outline_line_join = 'bevel',
outline_line_width = 1,
output_backend = 'webgl',
renderers = [GlyphRenderer(id='1258', ...)],
reset_policy = 'standard',
right = [],
sizing_mode = 'fixed',
subscribed_events = [],
syncable = True,
tags = [],
title = Title(id='1219', ...),
title_location = 'above',
toolbar = Toolbar(id='1244', ...),
toolbar_location = 'right',
toolbar_sticky = True,
visible = True,
width = 15,
width_policy = 'auto',
x_range = DataRange1d(id='1221', ...),
x_scale = LinearScale(id='1225', ...),
y_range = DataRange1d(id='1223', ...),
y_scale = LinearScale(id='1227', ...))
\n", "\n" ], "text/plain": [ "Figure(id='1218', ...)" ] }, "execution_count": 9, "metadata": {}, "output_type": "execute_result" } ], "source": [ "# Static graphic\n", "%matplotlib inline\n", "df.groupby('from').count().ts.sort_values(ascending=False).iloc[:50].plot.barh(figsize=(15,10), title=\"Most active users\")" ] }, { "cell_type": "code", "execution_count": 10, "id": "2ef00617-3055-4f02-a560-b487e1cd7e46", "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
fromcount
0defender@q3mcco35auwcstmt.onion8246
1stern@q3mcco35auwcstmt.onion4323
2driver@q3mcco35auwcstmt.onion3968
3bio@q3mcco35auwcstmt.onion3196
4mango@q3mcco35auwcstmt.onion3194
5ttrr@conference.q3mcco35auwcstmt.onion3122
6veron@q3mcco35auwcstmt.onion2955
7hof@q3mcco35auwcstmt.onion2389
8bentley@q3mcco35auwcstmt.onion1810
9bloodrush@q3mcco35auwcstmt.onion1798
\n", "
" ], "text/plain": [ " from count\n", "0 defender@q3mcco35auwcstmt.onion 8246\n", "1 stern@q3mcco35auwcstmt.onion 4323\n", "2 driver@q3mcco35auwcstmt.onion 3968\n", "3 bio@q3mcco35auwcstmt.onion 3196\n", "4 mango@q3mcco35auwcstmt.onion 3194\n", "5 ttrr@conference.q3mcco35auwcstmt.onion 3122\n", "6 veron@q3mcco35auwcstmt.onion 2955\n", "7 hof@q3mcco35auwcstmt.onion 2389\n", "8 bentley@q3mcco35auwcstmt.onion 1810\n", "9 bloodrush@q3mcco35auwcstmt.onion 1798" ] }, "execution_count": 10, "metadata": {}, "output_type": "execute_result" } ], "source": [ "# Filtering and extracting the 10 most active users\n", "user = pd.DataFrame(df.groupby('from').count().ts.sort_values(ascending=False).reset_index())\n", "user.columns = user.columns.str.replace('ts', 'count')\n", "user.head(10)" ] }, { "cell_type": "markdown", "id": "fd915929-c039-462c-a279-f7ab4f4e0afa", "metadata": {}, "source": [ "## Mapping the users’ connections " ] }, { "cell_type": "code", "execution_count": 11, "id": "8a438eb4-f469-4ee9-b90b-061112d3d62d", "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
fromtoweight
0admin@expiro-team.bizqwerty@q3mcco35auwcstmt.onion1
1admin@q3mcco35auwcstmt.oniondemon@q3mcco35auwcstmt.onion10
2admin@q3mcco35auwcstmt.onionwind@q3mcco35auwcstmt.onion1
3admin@q3mcco35auwcstmt.onionzevs@q3mcco35auwcstmt.onion6
4admintest@q3mcco35auwcstmt.onionrevers@q3mcco35auwcstmt.onion15
\n", "
" ], "text/plain": [ " from to weight\n", "0 admin@expiro-team.biz qwerty@q3mcco35auwcstmt.onion 1\n", "1 admin@q3mcco35auwcstmt.onion demon@q3mcco35auwcstmt.onion 10\n", "2 admin@q3mcco35auwcstmt.onion wind@q3mcco35auwcstmt.onion 1\n", "3 admin@q3mcco35auwcstmt.onion zevs@q3mcco35auwcstmt.onion 6\n", "4 admintest@q3mcco35auwcstmt.onion revers@q3mcco35auwcstmt.onion 15" ] }, "execution_count": 11, "metadata": {}, "output_type": "execute_result" } ], "source": [ "# Transforming the data, the weight corresponding to the number of message send between 2 users. \n", "df_weight = df.groupby([\"from\", \"to\"], as_index=False).count()\n", "df_weight = df_weight.drop(['body','LANG-EN'], axis = 1)\n", "df_weight.columns = df_weight.columns.str.replace('ts', 'weight')\n", "df_weight.head(5)" ] }, { "cell_type": "code", "execution_count": 14, "id": "2d054a26-cefe-487d-bf1e-43ed6ca73f6d", "metadata": {}, "outputs": [ { "data": { "text/html": [ "\n", " \n", " " ], "text/plain": [ "" ] }, "execution_count": 14, "metadata": {}, "output_type": "execute_result" } ], "source": [ "# Importing the pyvis lib\n", "from pyvis.network import Network\n", "\n", "# Configuring the graph option\n", "conti_net = Network(height='800px', width='100%', bgcolor='#222222', font_color='white', notebook = True)\n", "\n", "# set the physics layout of the network, here we used the barnes hut\n", "conti_net.barnes_hut()\n", "conti_data = df_weight\n", "\n", "# Split the data\n", "sources = conti_data['from']\n", "targets = conti_data['to']\n", "weights = conti_data['weight']\n", "\n", "edge_data = zip(sources, targets, weights)\n", "\n", "# Browsing the data to construct the network graph\n", "for e in edge_data:\n", " src = e[0]\n", " dst = e[1]\n", " w = e[2]\n", " \n", " conti_net.add_node(src, src, title=src)\n", " conti_net.add_node(dst, dst, title=dst)\n", " conti_net.add_edge(src, dst, value=w*10)\n", " \n", "neighbor_map = conti_net.get_adj_list()\n", "\n", "# add user data to node hover data\n", "for node in conti_net.nodes:\n", " node['title'] += '
- Discussion with:
' + '
'.join(neighbor_map[node['id']])\n", " node['value'] = len(neighbor_map[node['id']])\n", " \n", "conti_net.show('conti_leak.html')" ] }, { "cell_type": "markdown", "id": "b33db76c-c2f7-4126-b031-fe1c5cb2e7c7", "metadata": {}, "source": [ "# Using MSTICPy to extract and analyze IOCs " ] }, { "cell_type": "markdown", "id": "678350d5-81a8-4567-a095-db9ff179046d", "metadata": {}, "source": [ "Besides processing chat logs to analyze user activity and connections, Python can also be used to extract and analyze threat intelligence. This section shows how the MSTICPy library can be used to extract IOCs and how it can be used for additional threat hunting and intelligence. " ] }, { "cell_type": "markdown", "id": "166e8e9d-7f77-4ade-a777-181b0fe2d991", "metadata": {}, "source": [ "## Loading MSTICpy" ] }, { "cell_type": "code", "execution_count": 15, "id": "49cced21-d729-44b2-8d60-51916a32b9a1", "metadata": {}, "outputs": [ { "data": { "text/html": [ "

Starting Notebook initialization...


" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "msticpy version installed: 1.7.5 latest published: 1.8.1
A newer version of msticpy - 1.8.1 is available.
Upgrade with 'pip install --upgrade msticpy'

" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "Processing imports....
" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "Imported: pd (pandas), IPython.get_ipython, IPython.display.display, IPython.display.HTML, IPython.display.Markdown, widgets (ipywidgets), pathlib.Path, plt (matplotlib.pyplot), matplotlib.MatplotlibDeprecationWarning, np (numpy), sns (seaborn), msticpy, msticpy.data.QueryProvider, msticpy.nbtools.foliummap.FoliumMap, msticpy.common.utility.md, msticpy.common.utility.md_warn, msticpy.common.wsconfig.WorkspaceConfig, msticpy.datamodel.pivot.Pivot, msticpy.datamodel.entities, msticpy.nbtools.nbmagics, msticpy.vis.mp_pandas_plot
" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "Checking configuration....
" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "
The following configuration errors were found:
-----------------------------------------------
Missing or empty 'Workspaces' key in 'AzureSentinel' section
No warnings found.

" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "No valid configuration for Microsoft Sentinel found.
" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "Azure CLI credentials not detected. (see Caching credentials with Azure CLI)
" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "Setting notebook options....
" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "\n", "This product includes GeoLite2 data created by MaxMind, available from\n", "
https://www.maxmind.com.\n" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "\n", "This library uses services provided by ipstack.\n", "https://ipstack.com" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "
" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "
" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "

Notebook setup completed with some warnings.

" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "

One or more configuration items were missing or set incorrectly.

" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "

Please run the Getting Started Guide for Azure Sentinel ML Notebooks notebook. and the msticpy configuration guide.

" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "

This notebook may still run but with reduced functionality.

" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "

Notebook initialization complete


" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" } ], "source": [ "# Imports and configuration\n", "from IPython.display import display, HTML\n", "from msticpy.sectools import IoCExtract\n", "import matplotlib.pyplot as plt\n", "import sys\n", "import warnings\n", "from msticpy import init_notebook\n", "init_notebook(namespace=globals());\n", "\n", "pd.set_option('display.max_rows', 500)\n", "pd.set_option('display.max_columns', 50)\n", "pd.set_option('display.max_colwidth', 100)" ] }, { "cell_type": "markdown", "id": "0b1add33-1fc6-4c92-a0e8-7e82d2e0b235", "metadata": {}, "source": [ "## Extracting IOCs " ] }, { "cell_type": "markdown", "id": "fc15f8cb-b680-4b11-ac43-491241fd2417", "metadata": {}, "source": [ "MSTICPy is a Python library used for threat investigation and threat hunting. The library can connect to several threat intelligence providers, as well as Microsoft tools like Microsoft Sentinel. It can be used to query logs and to enrich data. It’s particularly convenient for analyzing IOCs and adding more threat contextualization. " ] }, { "cell_type": "code", "execution_count": 16, "id": "cf863742-8c8a-4384-9f97-2981f47ea43a", "metadata": {}, "outputs": [ { "data": { "text/html": [ "

IoC patterns found in chat logs.

" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
IoCTypeObservableSourceIndexInput
0dnsqaz.im23https://qaz.im/load/Tb6rNh/dYkYy2
1urlhttps://qaz.im/load/Tb6rNh/dYkYy223https://qaz.im/load/Tb6rNh/dYkYy2
2dnsqaz.im25https://qaz.im/load/hzkQTQ/BTa6Ze
3urlhttps://qaz.im/load/hzkQTQ/BTa6Ze25https://qaz.im/load/hzkQTQ/BTa6Ze
4dnsqaz.im29https://qaz.im/load/Tb6rNh/dYkYy2
5urlhttps://qaz.im/load/Tb6rNh/dYkYy229https://qaz.im/load/Tb6rNh/dYkYy2
6dnsqaz.im52https://qaz.im/load/hzkQTQ/BTa6Ze
7urlhttps://qaz.im/load/hzkQTQ/BTa6Ze52https://qaz.im/load/hzkQTQ/BTa6Ze
8ipv609:54:3054[09:54:30] <22> throw it right away. until March 1, whatever. and then you waste it on trifles a...
9ipv609:55:1754[09:54:30] <22> throw it right away. until March 1, whatever. and then you waste it on trifles a...
\n", "
" ], "text/plain": [ " IoCType Observable SourceIndex \\\n", "0 dns qaz.im 23 \n", "1 url https://qaz.im/load/Tb6rNh/dYkYy2 23 \n", "2 dns qaz.im 25 \n", "3 url https://qaz.im/load/hzkQTQ/BTa6Ze 25 \n", "4 dns qaz.im 29 \n", "5 url https://qaz.im/load/Tb6rNh/dYkYy2 29 \n", "6 dns qaz.im 52 \n", "7 url https://qaz.im/load/hzkQTQ/BTa6Ze 52 \n", "8 ipv6 09:54:30 54 \n", "9 ipv6 09:55:17 54 \n", "\n", " Input \n", "0 https://qaz.im/load/Tb6rNh/dYkYy2 \n", "1 https://qaz.im/load/Tb6rNh/dYkYy2 \n", "2 https://qaz.im/load/hzkQTQ/BTa6Ze \n", "3 https://qaz.im/load/hzkQTQ/BTa6Ze \n", "4 https://qaz.im/load/Tb6rNh/dYkYy2 \n", "5 https://qaz.im/load/Tb6rNh/dYkYy2 \n", "6 https://qaz.im/load/hzkQTQ/BTa6Ze \n", "7 https://qaz.im/load/hzkQTQ/BTa6Ze \n", "8 [09:54:30] <22> throw it right away. until March 1, whatever. and then you waste it on trifles a... \n", "9 [09:54:30] <22> throw it right away. until March 1, whatever. and then you waste it on trifles a... " ] }, "metadata": {}, "output_type": "display_data" } ], "source": [ "# We clean the dataframe to remove None value\n", "df['LANG-EN'] = df['LANG-EN'].fillna('').apply(str)\n", "\n", "# Initiate the IOC extractor\n", "ioc_extractor = IoCExtract()\n", "ioc_df = ioc_extractor.extract(data = df, columns = ['LANG-EN'])\n", "\n", "display(HTML(\"

IoC patterns found in chat logs.

\"))\n", "display(ioc_df.head(10))" ] }, { "cell_type": "code", "execution_count": 17, "id": "68afcf0f-1be7-4fd1-9568-ddd5e361a64a", "metadata": {}, "outputs": [ { "name": "stdout", "output_type": "stream", "text": [ "IoCPattern(ioc_type='btc', comp_regex=re.compile('^(?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})$', re.IGNORECASE|re.MULTILINE|re.VERBOSE), priority=0, group=None)\n" ] }, { "data": { "text/html": [ "

BTC addresses found in chat logs.

" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
IoCTypeObservableSourceIndexInput
152btcbc1q3efl4m2jcr6gk32usxnfyrxh294sr8plmpe3ye806bc1q3efl4m2jcr6gk32usxnfyrxh294sr8plmpe3ye
213btc1MxtwUpH4cWAz4en4kqVNzAdx5gpk9etUC1131hello, the bitcoins are over, in total 6 new servers, two vpn subscriptions, an ipvanish subscri...
214btc1MxtwUpH4cWAz4en4kqVNzAdx5gpk9etUC1136hello, the bitcoins are over, in total 6 new servers, two vpn subscriptions, an ipvanish subscri...
296btcbc1qnf6drcfl786d70wlhfytyr5xg3qqgknlsh8dc31606bc1qnf6drcfl786d70wlhfytyr5xg3qqgknlsh8dc3
297btc17mc4Qm7ka9jhQEUB5LTxP3gW3tsDYUJGQ1608hello, the cue ball is over, in total 8 new servers, two vpn subscriptions, and 18 renewals have...
307btcbc1qnf6drcfl786d70wlhfytyr5xg3qqgknlsh8dc31617bc1qnf6drcfl786d70wlhfytyr5xg3qqgknlsh8dc3
308btc17mc4Qm7ka9jhQEUB5LTxP3gW3tsDYUJGQ1619hello, the cue ball is over, in total 8 new servers, two vpn subscriptions, and 18 renewals have...
329btcbc1qy2083z665ux68zda3tfuh5xed2493uaj8whdwv1669bc1qy2083z665ux68zda3tfuh5xed2493uaj8whdwv
330btc172KVKhMqL5CU1HN884RbArzu5DDL5hwE31680172KVKhMqL5CU1HN884RbArzu5DDL5hwE3\\n\\n0.01523011
335btcbc1qc39qwc3nl2eyh2cu4ct6tyh9zqzp9ye993c0y21716bc1qc39qwc3nl2eyh2cu4ct6tyh9zqzp9ye993c0y2
\n", "
" ], "text/plain": [ " IoCType Observable SourceIndex \\\n", "152 btc bc1q3efl4m2jcr6gk32usxnfyrxh294sr8plmpe3ye 806 \n", "213 btc 1MxtwUpH4cWAz4en4kqVNzAdx5gpk9etUC 1131 \n", "214 btc 1MxtwUpH4cWAz4en4kqVNzAdx5gpk9etUC 1136 \n", "296 btc bc1qnf6drcfl786d70wlhfytyr5xg3qqgknlsh8dc3 1606 \n", "297 btc 17mc4Qm7ka9jhQEUB5LTxP3gW3tsDYUJGQ 1608 \n", "307 btc bc1qnf6drcfl786d70wlhfytyr5xg3qqgknlsh8dc3 1617 \n", "308 btc 17mc4Qm7ka9jhQEUB5LTxP3gW3tsDYUJGQ 1619 \n", "329 btc bc1qy2083z665ux68zda3tfuh5xed2493uaj8whdwv 1669 \n", "330 btc 172KVKhMqL5CU1HN884RbArzu5DDL5hwE3 1680 \n", "335 btc bc1qc39qwc3nl2eyh2cu4ct6tyh9zqzp9ye993c0y2 1716 \n", "\n", " Input \n", "152 bc1q3efl4m2jcr6gk32usxnfyrxh294sr8plmpe3ye \n", "213 hello, the bitcoins are over, in total 6 new servers, two vpn subscriptions, an ipvanish subscri... \n", "214 hello, the bitcoins are over, in total 6 new servers, two vpn subscriptions, an ipvanish subscri... \n", "296 bc1qnf6drcfl786d70wlhfytyr5xg3qqgknlsh8dc3 \n", "297 hello, the cue ball is over, in total 8 new servers, two vpn subscriptions, and 18 renewals have... \n", "307 bc1qnf6drcfl786d70wlhfytyr5xg3qqgknlsh8dc3 \n", "308 hello, the cue ball is over, in total 8 new servers, two vpn subscriptions, and 18 renewals have... \n", "329 bc1qy2083z665ux68zda3tfuh5xed2493uaj8whdwv \n", "330 172KVKhMqL5CU1HN884RbArzu5DDL5hwE3\\n\\n0.01523011 \n", "335 bc1qc39qwc3nl2eyh2cu4ct6tyh9zqzp9ye993c0y2 " ] }, "metadata": {}, "output_type": "display_data" } ], "source": [ "# Extracting BTC addresses\n", "# Adding the regex\n", "extractor = IoCExtract()\n", "extractor.add_ioc_type(ioc_type='btc', ioc_regex='^(?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})$')\n", "\n", "# Check that it added ok\n", "print(extractor.ioc_types['btc'])\n", "\n", "# Use it in our data set and create a new df\n", "btc_df = ioc_extractor.extract(data=df, columns=['LANG-EN']).query('IoCType == \\'btc\\'')\n", "\n", "display(HTML(\"

BTC addresses found in chat logs.

\"))\n", "display(btc_df.head(10))" ] }, { "cell_type": "code", "execution_count": 18, "id": "f9b0a386-1a19-443c-9d79-8db3ad88d1b7", "metadata": {}, "outputs": [ { "data": { "text/html": [ "

Merging, filtering and sorting

" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
IoCTypeObservableSourceIndexInput
0dnsqaz.im23https://qaz.im/load/Tb6rNh/dYkYy2
1urlhttps://qaz.im/load/Tb6rNh/dYkYy223https://qaz.im/load/Tb6rNh/dYkYy2
2urlhttps://qaz.im/load/hzkQTQ/BTa6Ze25https://qaz.im/load/hzkQTQ/BTa6Ze
6urlhttps://qaz.im/load/3EZGA7/4SEstA103https://qaz.im/load/3EZGA7/4SEstA
21ipv454.183.140.39228yep, they all worked\\nexcept\\nbot\\n54.183.140.39
...............
4241btc1G5LWXMN42ueD2eWvm4zMrhXGihghHDgMq594051G5LWXMN42ueD2eWvm4zMrhXGihghHDgMq\\nAmount $1000
4242btcbc1qr8fw0xj28emurqhu8k7gj4llzgnxf4dejhl04h59913hello, I turned to the defender to clarify the situation with the salary, he replied that now it...
4243btcbc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf660385bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6
4244btc33hiG13GTHTV2G8aZxzBJHBPBpDNevcK2B6054233hiG13GTHTV2G8aZxzBJHBPBpDNevcK2B
4245btc3351LRF9NrFH5v2CMZWsCv66tv5UAjX5Gn605593351LRF9NrFH5v2CMZWsCv66tv5UAjX5Gn
\n", "

2227 rows × 4 columns

\n", "
" ], "text/plain": [ " IoCType Observable SourceIndex \\\n", "0 dns qaz.im 23 \n", "1 url https://qaz.im/load/Tb6rNh/dYkYy2 23 \n", "2 url https://qaz.im/load/hzkQTQ/BTa6Ze 25 \n", "6 url https://qaz.im/load/3EZGA7/4SEstA 103 \n", "21 ipv4 54.183.140.39 228 \n", "... ... ... ... \n", "4241 btc 1G5LWXMN42ueD2eWvm4zMrhXGihghHDgMq 59405 \n", "4242 btc bc1qr8fw0xj28emurqhu8k7gj4llzgnxf4dejhl04h 59913 \n", "4243 btc bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6 60385 \n", "4244 btc 33hiG13GTHTV2G8aZxzBJHBPBpDNevcK2B 60542 \n", "4245 btc 3351LRF9NrFH5v2CMZWsCv66tv5UAjX5Gn 60559 \n", "\n", " Input \n", "0 https://qaz.im/load/Tb6rNh/dYkYy2 \n", "1 https://qaz.im/load/Tb6rNh/dYkYy2 \n", "2 https://qaz.im/load/hzkQTQ/BTa6Ze \n", "6 https://qaz.im/load/3EZGA7/4SEstA \n", "21 yep, they all worked\\nexcept\\nbot\\n54.183.140.39 \n", "... ... \n", "4241 1G5LWXMN42ueD2eWvm4zMrhXGihghHDgMq\\nAmount $1000 \n", "4242 hello, I turned to the defender to clarify the situation with the salary, he replied that now it... \n", "4243 bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6 \n", "4244 33hiG13GTHTV2G8aZxzBJHBPBpDNevcK2B \n", "4245 3351LRF9NrFH5v2CMZWsCv66tv5UAjX5Gn \n", "\n", "[2227 rows x 4 columns]" ] }, "execution_count": 18, "metadata": {}, "output_type": "execute_result" } ], "source": [ "display(HTML(\"

Merging, filtering and sorting

\"))\n", "# Merging dataframe\n", "\n", "ioc_df = pd.concat([ioc_df, btc_df], axis=0).drop_duplicates(subset='Observable').reset_index(drop=True)\n", "#ioc_df = ioc_df.drop_duplicates(subset='Observable', inplace=True)\n", "\n", "# Removing IPV6 rows because they are false positive\n", "ioc_df = ioc_df[ioc_df[\"IoCType\"].str.contains(\"ipv6\") == False]\n", "\n", "ioc_df" ] }, { "cell_type": "code", "execution_count": 19, "id": "ef307391-3b59-47fc-afc3-6cac216b6fcf", "metadata": {}, "outputs": [ { "data": { "text/plain": [ "url 1137\n", "dns 474\n", "ipv4 317\n", "btc 175\n", "md5_hash 106\n", "sha256_hash 16\n", "sha1_hash 2\n", "Name: IoCType, dtype: int64" ] }, "execution_count": 19, "metadata": {}, "output_type": "execute_result" } ], "source": [ "# Save IOC to CSV\n", "ioc_df.to_csv(\"IOC\\\\full_ioc.csv\")\n", "\n", "# Overview of the IOC in the dataset\n", "ioc_df[\"IoCType\"].value_counts()" ] }, { "cell_type": "markdown", "id": "e2d7be4d-5be7-4354-873a-b5e1a41273e0", "metadata": {}, "source": [ "## Cleaning the extracted IOCs" ] }, { "cell_type": "code", "execution_count": 20, "id": "896230f8-1db9-4c4c-9b55-401ecf887095", "metadata": {}, "outputs": [], "source": [ "ioc_df = ioc_df[ioc_df[\"Observable\"].str.contains(\"privnote.com\")==False ]\n", "ioc_df = ioc_df[ioc_df[\"Observable\"].str.contains(\"qaz.im\")==False ]" ] }, { "cell_type": "code", "execution_count": 21, "id": "300db554-b3d0-4c60-9825-3811aae2a7f5", "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
IoCTypeObservableSourceIndexInput
21ipv454.183.140.39228yep, they all worked\\nexcept\\nbot\\n54.183.140.39
24dns2Fwwwapps.ups.com3351Z9918AW3591558812 <https://hura.me/no-ref.php?url=http%3A%2F%2Fwwwapps.ups.com%2FWebTracking%2F...
25dnshura.me3351Z9918AW3591558812 <https://hura.me/no-ref.php?url=http%3A%2F%2Fwwwapps.ups.com%2FWebTracking%2F...
26urlhttps://hura.me/no-ref.php?url=http%3A%2F%2Fwwwapps.ups.com%2FWebTracking%2Ftrack%3FHTMLtrackVer...3351Z9918AW3591558812 <https://hura.me/no-ref.php?url=http%3A%2F%2Fwwwapps.ups.com%2FWebTracking%2F...
27urlhttps://hura.me/no-ref.php?url=http://wwwapps.ups.com/WebTracking/track?HTMLtrackVersion=5.0&loc...3351Z9918AW3591558812 <https://hura.me/no-ref.php?url=http%3A%2F%2Fwwwapps.ups.com%2FWebTracking%2F...
...............
4241btc1G5LWXMN42ueD2eWvm4zMrhXGihghHDgMq594051G5LWXMN42ueD2eWvm4zMrhXGihghHDgMq\\nAmount $1000
4242btcbc1qr8fw0xj28emurqhu8k7gj4llzgnxf4dejhl04h59913hello, I turned to the defender to clarify the situation with the salary, he replied that now it...
4243btcbc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf660385bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6
4244btc33hiG13GTHTV2G8aZxzBJHBPBpDNevcK2B6054233hiG13GTHTV2G8aZxzBJHBPBpDNevcK2B
4245btc3351LRF9NrFH5v2CMZWsCv66tv5UAjX5Gn605593351LRF9NrFH5v2CMZWsCv66tv5UAjX5Gn
\n", "

1760 rows × 4 columns

\n", "
" ], "text/plain": [ " IoCType \\\n", "21 ipv4 \n", "24 dns \n", "25 dns \n", "26 url \n", "27 url \n", "... ... \n", "4241 btc \n", "4242 btc \n", "4243 btc \n", "4244 btc \n", "4245 btc \n", "\n", " Observable \\\n", "21 54.183.140.39 \n", "24 2Fwwwapps.ups.com \n", "25 hura.me \n", "26 https://hura.me/no-ref.php?url=http%3A%2F%2Fwwwapps.ups.com%2FWebTracking%2Ftrack%3FHTMLtrackVer... \n", "27 https://hura.me/no-ref.php?url=http://wwwapps.ups.com/WebTracking/track?HTMLtrackVersion=5.0&loc... \n", "... ... \n", "4241 1G5LWXMN42ueD2eWvm4zMrhXGihghHDgMq \n", "4242 bc1qr8fw0xj28emurqhu8k7gj4llzgnxf4dejhl04h \n", "4243 bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6 \n", "4244 33hiG13GTHTV2G8aZxzBJHBPBpDNevcK2B \n", "4245 3351LRF9NrFH5v2CMZWsCv66tv5UAjX5Gn \n", "\n", " SourceIndex \\\n", "21 228 \n", "24 335 \n", "25 335 \n", "26 335 \n", "27 335 \n", "... ... \n", "4241 59405 \n", "4242 59913 \n", "4243 60385 \n", "4244 60542 \n", "4245 60559 \n", "\n", " Input \n", "21 yep, they all worked\\nexcept\\nbot\\n54.183.140.39 \n", "24 1Z9918AW3591558812 \n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
IocIocTypeSafeIocQuerySubtypeProviderResultSeverityDetailsRawResultReferenceStatus
054.183.140.39ipv454.183.140.39NoneGreyNoiseFalseinformationNot found.<Response [404 Not Found]>https://api.greynoise.io/v3/community/54.183.140.39404
15.139.220.204ipv45.139.220.204NoneGreyNoiseFalseinformationNot found.<Response [404 Not Found]>https://api.greynoise.io/v3/community/5.139.220.204404
2138.124.180.94ipv4138.124.180.94NoneGreyNoiseFalseinformationNot found.<Response [404 Not Found]>https://api.greynoise.io/v3/community/138.124.180.94404
345.14.226.47ipv445.14.226.47NoneGreyNoiseFalseinformationNot found.<Response [404 Not Found]>https://api.greynoise.io/v3/community/45.14.226.47404
4193.203.203.101ipv4193.203.203.101NoneGreyNoiseFalseinformationNot found.<Response [404 Not Found]>https://api.greynoise.io/v3/community/193.203.203.101404
5173.163.176.177ipv4173.163.176.177NoneGreyNoiseFalseinformationNot found.<Response [404 Not Found]>https://api.greynoise.io/v3/community/173.163.176.177404
675.151.48.49ipv475.151.48.49NoneGreyNoiseFalseinformationNot found.<Response [404 Not Found]>https://api.greynoise.io/v3/community/75.151.48.49404
771.105.126.26ipv471.105.126.26NoneGreyNoiseFalseinformationNot found.<Response [404 Not Found]>https://api.greynoise.io/v3/community/71.105.126.26404
896.70.44.17ipv496.70.44.17NoneGreyNoiseFalseinformationNot found.<Response [404 Not Found]>https://api.greynoise.io/v3/community/96.70.44.17404
996.93.217.253ipv496.93.217.253NoneGreyNoiseFalseinformationNot found.<Response [404 Not Found]>https://api.greynoise.io/v3/community/96.93.217.253404
\n", "" ], "text/plain": [ " Ioc IocType SafeIoc QuerySubtype Provider Result \\\n", "0 54.183.140.39 ipv4 54.183.140.39 None GreyNoise False \n", "1 5.139.220.204 ipv4 5.139.220.204 None GreyNoise False \n", "2 138.124.180.94 ipv4 138.124.180.94 None GreyNoise False \n", "3 45.14.226.47 ipv4 45.14.226.47 None GreyNoise False \n", "4 193.203.203.101 ipv4 193.203.203.101 None GreyNoise False \n", "5 173.163.176.177 ipv4 173.163.176.177 None GreyNoise False \n", "6 75.151.48.49 ipv4 75.151.48.49 None GreyNoise False \n", "7 71.105.126.26 ipv4 71.105.126.26 None GreyNoise False \n", "8 96.70.44.17 ipv4 96.70.44.17 None GreyNoise False \n", "9 96.93.217.253 ipv4 96.93.217.253 None GreyNoise False \n", "\n", " Severity Details RawResult \\\n", "0 information Not found. \n", "1 information Not found. \n", "2 information Not found. \n", "3 information Not found. \n", "4 information Not found. \n", "5 information Not found. \n", "6 information Not found. \n", "7 information Not found. \n", "8 information Not found. \n", "9 information Not found. \n", "\n", " Reference Status \n", "0 https://api.greynoise.io/v3/community/54.183.140.39 404 \n", "1 https://api.greynoise.io/v3/community/5.139.220.204 404 \n", "2 https://api.greynoise.io/v3/community/138.124.180.94 404 \n", "3 https://api.greynoise.io/v3/community/45.14.226.47 404 \n", "4 https://api.greynoise.io/v3/community/193.203.203.101 404 \n", "5 https://api.greynoise.io/v3/community/173.163.176.177 404 \n", "6 https://api.greynoise.io/v3/community/75.151.48.49 404 \n", "7 https://api.greynoise.io/v3/community/71.105.126.26 404 \n", "8 https://api.greynoise.io/v3/community/96.70.44.17 404 \n", "9 https://api.greynoise.io/v3/community/96.93.217.253 404 " ] }, "execution_count": 25, "metadata": {}, "output_type": "execute_result" } ], "source": [ "ip_intel = ti_lookup.lookup_iocs(data = df_ip[\"Observable\"])\n", "ip_intel.head(10)" ] }, { "cell_type": "code", "execution_count": 26, "id": "bf3a4525-e711-41fb-90af-eca603d9fd60", "metadata": {}, "outputs": [], "source": [ "# Saving the IP into a csv file.\n", "ip_intel.to_csv(\"IOC\\\\ipintel.csv\")" ] }, { "cell_type": "code", "execution_count": 27, "id": "d5c19263-649e-4feb-9700-1616de3f88c3", "metadata": {}, "outputs": [], "source": [ "# Removing the ip with severity == information\n", "ip_intel = ip_intel[ip_intel[\"Severity\"].str.contains(\"information\")==False ]" ] }, { "cell_type": "code", "execution_count": 28, "id": "c5aa97bd-21c8-40b6-9093-8a0c2f29d934", "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
GreyNoiseOTXVirusTotal
Ioc203.76.105.227203.76.105.227203.76.105.227
IocTypeipv4ipv4ipv4
QuerySubtypeNoneNoneNone
ProviderGreyNoiseOTXVirusTotal
ResultFalseTrueTrue
Severityinformationhighinformation
DetailsNot found.{'pulse_count': 3, 'names': ['IoC Ransomware CONTI', 'Conti Ransomware | CISA', 'Conti Ransomwar...{'verbose_msg': 'IP address in dataset', 'response_code': 1, 'positives': 0, 'detected_urls': []...
RawResult<Response [404 Not Found]>{'whois': 'http://whois.domaintools.com/203.76.105.227', 'reputation': 0, 'indicator': '203.76.1...{'asn': 23688, 'undetected_urls': [], 'undetected_downloaded_samples': [{'date': '2021-05-25 16:...
Referencehttps://api.greynoise.io/v3/community/203.76.105.227https://otx.alienvault.com/api/v1/indicators/IPv4/203.76.105.227/generalhttps://www.virustotal.com/vtapi/v2/ip-address/report
Status40400
\n", "
" ], "text/plain": [ " GreyNoise \\\n", "Ioc 203.76.105.227 \n", "IocType ipv4 \n", "QuerySubtype None \n", "Provider GreyNoise \n", "Result False \n", "Severity information \n", "Details Not found. \n", "RawResult \n", "Reference https://api.greynoise.io/v3/community/203.76.105.227 \n", "Status 404 \n", "\n", " OTX \\\n", "Ioc 203.76.105.227 \n", "IocType ipv4 \n", "QuerySubtype None \n", "Provider OTX \n", "Result True \n", "Severity high \n", "Details {'pulse_count': 3, 'names': ['IoC Ransomware CONTI', 'Conti Ransomware | CISA', 'Conti Ransomwar... \n", "RawResult {'whois': 'http://whois.domaintools.com/203.76.105.227', 'reputation': 0, 'indicator': '203.76.1... \n", "Reference https://otx.alienvault.com/api/v1/indicators/IPv4/203.76.105.227/general \n", "Status 0 \n", "\n", " VirusTotal \n", "Ioc 203.76.105.227 \n", "IocType ipv4 \n", "QuerySubtype None \n", "Provider VirusTotal \n", "Result True \n", "Severity information \n", "Details {'verbose_msg': 'IP address in dataset', 'response_code': 1, 'positives': 0, 'detected_urls': []... \n", "RawResult {'asn': 23688, 'undetected_urls': [], 'undetected_downloaded_samples': [{'date': '2021-05-25 16:... \n", "Reference https://www.virustotal.com/vtapi/v2/ip-address/report \n", "Status 0 " ] }, "execution_count": 28, "metadata": {}, "output_type": "execute_result" } ], "source": [ "# You can also make a request for a single IP.\n", "result = ti_lookup.lookup_ioc(observable=\"203.76.105.227\")\n", "ti_lookup.result_to_df(result).T" ] }, { "cell_type": "markdown", "id": "71660e52-9925-4837-a508-bd2010a9670c", "metadata": {}, "source": [ "## Browsing the result" ] }, { "cell_type": "code", "execution_count": 29, "id": "70457aea-642f-4310-9b55-cd421a884fcf", "metadata": {}, "outputs": [ { "data": { "application/vnd.jupyter.widget-view+json": { "model_id": "eee8c2a74da84d51b2c550896617da54", "version_major": 2, "version_minor": 0 }, "text/plain": [ "VBox(children=(Text(value=\"103.101.104.229 type: ipv4 (sev: high) providers: …" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "
" ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" }, { "data": { "text/html": [ "

103.101.104.229

Type: 'ipv4', Provider: OTX, severity: high

Details

\n", "\n", "{'pulse_count': 50, 'names': ['Network IOCs', 'feodotracker-0-20220511', 'feodotracker-0-20220504', 'feodotracker-0-20220510', 'feodotracker-0-20220503', 'feodotracker-0-20220509', 'feodotracker-0-20220502', 'feodotracker-0-20220501', 'feodotracker-0-20220507', 'feodotracker-0-20220430', 'feodotracker-0-20220506', 'feodotracker-0-20220429', 'feodotracker-0-20220428', 'feodotracker-0-20220427', 'feodotracker-0-20220426', 'feodotracker-0-20220425', 'feodotracker-0-20220424', 'feodotracker-0-20220422', 'feodotracker-0-20220420', 'feodotracker-0-20220419', 'feodotracker-0-20220418', 'feodotracker-0-20220417', 'resteex_blacklist_(ipset|hash:ip)_20220423_LVL0', 'feodotracker-0-20220415', 'IoC Ransomware CONTI', 'feodotracker-0-20220413', 'feodotracker-0-20220412', 'feodotracker-0-20220410', 'feodotracker-0-20220410', 'feodotracker-0-20220409', 'feodotracker-0-20220407', 'feodotracker-0-20220406', 'feodotracker-0-20220405', 'feodotracker-0-20220404', 'Conti Ransomware | CISA', 'feodotracker-0-20220403', 'Conti Ransomware IOC', 'feodotracker-0-20220402', 'feodotracker-0-20220402', 'feodotracker-0-20220401', 'feodotracker-0-20220331', 'feodotracker-0-20220330', 'feodotracker-0-20220329', 'feodotracker-0-20220328', 'feodotracker-0-20220327', 'feodotracker-0-20220326', 'feodotracker-0-20220323', 'feodotracker-0-20220322', 'feodotracker-0-20220321', 'feodotracker-0-20220320'], 'tags': [['msi file', 'tuesday', 'malspam email', 'headers', 'anna paula', 'utf8', 'currc3adculo', 'from email', 'associated', 'zip archive'], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], ['uscert', 'csirt', 'cert', 'cybersecurity', 'cyber security', 'computer security', 'u. s. computer emergency readiness', 'cyber risks', 'conti', 'technique title', 'id use', 'trickbot', 'remote desktop', 'protocol', 'cisa', 'kerberos', 'admin hash', 'ta0004', 'cobalt strike', 'icedid', 'zloader', 'service'], [], ['span', 'path', 'header dropdown', 'link', 'script', 'product', 'explore', 'footer', 'github', 'button', 'template', 'meta', 'form', 'team', 'enterprise', 'contact', 'code', 'copy', 'reload', 'body', 'star', 'open', 'desktop', 'main'], [], [], [], [], [], [], [], [], [], [], [], [], []], 'references': [['2021-09-21-Curriculo-IOCs.txt'], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], ['blacklist_ip.backup'], [], [], [], [], [], [], [], [], [], [], [], ['https://www.cisa.gov/uscert/sites/default/files/publications/AA21-265A.stix.xml', 'https://www.cisa.gov/uscert/ncas/alerts/aa21-265a', 'https://www.breachquest.com/conti-leaks-insight-into-a-ransomware-unicorn/'], [], ['https://github.com/whichbuffer/Conti-Ransomware-IOC/blob/main/Conti%20IOC.txt'], [], [], [], [], [], [], [], [], [], [], [], [], []]}

Reference:

https://otx.alienvault.com/api/v1/indicators/IPv4/103.101.104.229/general

Raw Results

\n", "
\n", " Raw results from provider...\n", "
(\"{'whois': 'http://whois.domaintools.com/103.101.104.229', 'reputation': 0, \"
 \"'indicator': '103.101.104.229', 'type': 'IPv4', 'type_title': 'IPv4', \"
 \"'base_indicator': {'id': 3011530694, 'indicator': '103.101.104.229', 'type': \"
 \"'IPv4', 'title': '', 'description': '', 'content': '', 'access_type': \"
 \"'public', 'access_reason': ''}, 'pulse_info': {'count': 50, 'pulses': \"
 \"[{'id': '614e0dc583aa90bf2dd4ec91', 'name': 'Network IOCs', 'description': \"
 \"'Network-based IOCs', 'modified': '2022-05-12T00:04:24.089000', 'created': \"
 \"'2021-09-24T17:41:25.461000', 'tags': ['msi file', 'tuesday', 'malspam \"
 \"email', 'headers', 'anna paula', 'utf8', 'currc3adculo', 'from email', \"
 \"'associated', 'zip archive'], 'references': \"
 \"['2021-09-21-Curriculo-IOCs.txt'], 'public': 1, 'adversary': '', \"
 \"'targeted_countries': [], 'malware_families': [], 'attack_ids': [], \"
 \"'industries': [], 'TLP': 'white', 'cloned_from': None, 'export_count': 87, \"
 \"'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': 0, 'locked': False, \"
 \"'pulse_source': 'web', 'validator_count': 0, 'comment_count': 0, \"
 \"'follower_count': 0, 'vote': 0, 'author': {'username': 'cnoscsoc@att.com', \"
 \"'id': '81627', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': \"
 \"{'domain': 3314, 'hostname': 610, 'URL': 16, 'email': 1, 'IPv4': 1893}, \"
 \"'indicator_count': 5834, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 102, 'modified_text': '13 minutes ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': True, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '627b45f5c02acb8a3eaee0db', \"
 \"'name': 'feodotracker-0-20220511', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-05-11T05:13:25.029000', 'created': \"
 \"'2022-05-11T05:13:25.029000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 1, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': \"
 \"{'IPv4': 2977}, 'indicator_count': 2977, 'is_author': False, \"
 \"'is_subscribing': None, 'subscriber_count': 340, 'modified_text': '19 hours \"
 \"ago ', 'is_modified': False, 'groups': [], 'in_group': False, \"
 \"'threat_hunter_scannable': True, 'threat_hunter_has_agents': 1, \"
 \"'related_indicator_type': 'IPv4', 'related_indicator_is_active': 1}, {'id': \"
 \"'627220e0f24ae0a0864f5a9c', 'name': 'feodotracker-0-20220504', \"
 \"'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-05-11T00:02:13.446000', 'created': \"
 \"'2022-05-04T06:44:48.234000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '1 day ago ', 'is_modified': True, \"
 \"'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '6279ee8ce28a19e0aaf5353c', \"
 \"'name': 'feodotracker-0-20220510', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-05-10T04:48:12.315000', 'created': \"
 \"'2022-05-10T04:48:12.315000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 5, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': \"
 \"{'IPv4': 2977}, 'indicator_count': 2977, 'is_author': False, \"
 \"'is_subscribing': None, 'subscriber_count': 340, 'modified_text': '1 day ago \"
 \"', 'is_modified': False, 'groups': [], 'in_group': False, \"
 \"'threat_hunter_scannable': True, 'threat_hunter_has_agents': 1, \"
 \"'related_indicator_type': 'IPv4', 'related_indicator_is_active': 1}, {'id': \"
 \"'6270d430bf9c2d34f0f370e3', 'name': 'feodotracker-0-20220503', \"
 \"'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-05-10T00:02:48.350000', 'created': \"
 \"'2022-05-03T07:05:20.872000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '2 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '6278f04cce1a4c290610a27e', \"
 \"'name': 'feodotracker-0-20220509', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-05-09T10:43:24.661000', 'created': \"
 \"'2022-05-09T10:43:24.661000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 1, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': \"
 \"{'IPv4': 2977}, 'indicator_count': 2977, 'is_author': False, \"
 \"'is_subscribing': None, 'subscriber_count': 339, 'modified_text': '2 days \"
 \"ago ', 'is_modified': False, 'groups': [], 'in_group': False, \"
 \"'threat_hunter_scannable': True, 'threat_hunter_has_agents': 1, \"
 \"'related_indicator_type': 'IPv4', 'related_indicator_is_active': 1}, {'id': \"
 \"'626f7ad3d15c591e25689db0', 'name': 'feodotracker-0-20220502', \"
 \"'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-05-09T00:00:19.127000', 'created': \"
 \"'2022-05-02T06:31:47.984000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '3 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '626ee671ecd2054b5f340414', \"
 \"'name': 'feodotracker-0-20220501', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-05-08T00:03:14.586000', 'created': \"
 \"'2022-05-01T19:58:41.206000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '4 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '627611c2149b9e5c3de4a4a2', \"
 \"'name': 'feodotracker-0-20220507', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-05-07T06:29:22.630000', 'created': \"
 \"'2022-05-07T06:29:22.630000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 1, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': \"
 \"{'IPv4': 2974}, 'indicator_count': 2974, 'is_author': False, \"
 \"'is_subscribing': None, 'subscriber_count': 339, 'modified_text': '4 days \"
 \"ago ', 'is_modified': False, 'groups': [], 'in_group': False, \"
 \"'threat_hunter_scannable': True, 'threat_hunter_has_agents': 1, \"
 \"'related_indicator_type': 'IPv4', 'related_indicator_is_active': 1}, {'id': \"
 \"'626ccbd12c593dc8f62f452a', 'name': 'feodotracker-0-20220430', \"
 \"'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-05-07T00:03:18.570000', 'created': \"
 \"'2022-04-30T05:40:33.936000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '5 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '6274f3ff64c4e483c4259859', \"
 \"'name': 'feodotracker-0-20220506', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-05-06T10:10:07.620000', 'created': \"
 \"'2022-05-06T10:10:07.620000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 1, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': \"
 \"{'IPv4': 2973}, 'indicator_count': 2973, 'is_author': False, \"
 \"'is_subscribing': None, 'subscriber_count': 339, 'modified_text': '5 days \"
 \"ago ', 'is_modified': False, 'groups': [], 'in_group': False, \"
 \"'threat_hunter_scannable': True, 'threat_hunter_has_agents': 1, \"
 \"'related_indicator_type': 'IPv4', 'related_indicator_is_active': 1}, {'id': \"
 \"'626b83311b4d4fa0370ade43', 'name': 'feodotracker-0-20220429', \"
 \"'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-05-06T00:03:41.989000', 'created': \"
 \"'2022-04-29T06:18:25.182000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 340, 'modified_text': '6 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '626a0e35c35f2f018f5ff6b2', \"
 \"'name': 'feodotracker-0-20220428', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-05-05T00:01:02.977000', 'created': \"
 \"'2022-04-28T03:47:01.193000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '7 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '6268e0c9a4d3824a4433a4e1', \"
 \"'name': 'feodotracker-0-20220427', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-05-04T00:05:07.263000', 'created': \"
 \"'2022-04-27T06:20:57.338000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '8 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '6267902ba01c16e11b513360', \"
 \"'name': 'feodotracker-0-20220426', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-05-03T00:01:26.398000', 'created': \"
 \"'2022-04-26T06:24:43.961000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '9 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '62664beab3e7e1f843d4ed7f', \"
 \"'name': 'feodotracker-0-20220425', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-05-02T00:00:42.176000', 'created': \"
 \"'2022-04-25T07:21:14.984000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '10 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '6264df9ed4858e43a43aee5d', \"
 \"'name': 'feodotracker-0-20220424', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-05-01T00:02:33.075000', 'created': \"
 \"'2022-04-24T05:26:54.855000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '11 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '62623dde3f37fb753d715f80', \"
 \"'name': 'feodotracker-0-20220422', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-29T00:05:19.794000', 'created': \"
 \"'2022-04-22T05:32:14.297000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 340, 'modified_text': '13 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '625f95960531c82bac8ad4fb', \"
 \"'name': 'feodotracker-0-20220420', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-27T00:03:12.448000', 'created': \"
 \"'2022-04-20T05:09:42.428000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '15 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '625e3a21f48c0e3dd7fbfbb4', \"
 \"'name': 'feodotracker-0-20220419', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-26T00:01:30.700000', 'created': \"
 \"'2022-04-19T04:27:13.116000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '16 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '625d934f029f45492a6edc19', \"
 \"'name': 'feodotracker-0-20220418', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-25T00:00:49.923000', 'created': \"
 \"'2022-04-18T16:35:27.393000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '17 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '625bb92c0e105f8c0537b1b2', \"
 \"'name': 'feodotracker-0-20220417', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-24T00:01:15.470000', 'created': \"
 \"'2022-04-17T06:52:28.817000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '18 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '62637949a39428085f129938', \"
 \"'name': 'resteex_blacklist_(ipset|hash:ip)_20220423_LVL0', 'description': \"
 \"'', 'modified': '2022-04-23T03:58:01.062000', 'created': \"
 \"'2022-04-23T03:58:01.062000', 'tags': [], 'references': \"
 \"['blacklist_ip.backup'], 'public': 1, 'adversary': '', 'targeted_countries': \"
 \"[], 'malware_families': [], 'attack_ids': [], 'industries': [], 'TLP': \"
 \"'green', 'cloned_from': None, 'export_count': 10, 'upvotes_count': 0, \"
 \"'downvotes_count': 0, 'votes_count': 0, 'locked': False, 'pulse_source': \"
 \"'web', 'validator_count': 0, 'comment_count': 0, 'follower_count': 0, \"
 \"'vote': 0, 'author': {'username': 'resteex0', 'id': '175858', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': \"
 \"{'IPv4': 63022, 'URL': 1429}, 'indicator_count': 64451, 'is_author': False, \"
 \"'is_subscribing': None, 'subscriber_count': 23, 'modified_text': '18 days \"
 \"ago ', 'is_modified': False, 'groups': [], 'in_group': False, \"
 \"'threat_hunter_scannable': True, 'threat_hunter_has_agents': 1, \"
 \"'related_indicator_type': 'IPv4', 'related_indicator_is_active': 1}, {'id': \"
 \"'6258f4c92dafeb4c4d2df77e', 'name': 'feodotracker-0-20220415', \"
 \"'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-22T00:03:50.614000', 'created': \"
 \"'2022-04-15T04:30:01.275000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '20 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '626186a215fc527fe850e655', \"
 \"'name': 'IoC Ransomware CONTI', 'description': 'IoC related with Ransomware \"
 'CONTI. \\\\nRelated to the security event that occurred in Costa Rica on April '
 \"20, 2022', 'modified': '2022-04-21T16:30:26.680000', 'created': \"
 \"'2022-04-21T16:30:26.680000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 7, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'web', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'soc_columbus', 'id': '2084', 'avatar_url': \"
 \"'/otxapi/users/avatar_image/media/avatars/user_2084/resized/80/avatar_804adb6fc4.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': \"
 \"{'FileHash-SHA1': 8, 'IPv4': 423, 'URL': 3, 'domain': 55, 'hostname': 2}, \"
 \"'indicator_count': 491, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 139, 'modified_text': '20 days ago ', 'is_modified': \"
 \"False, 'groups': [], 'in_group': False, 'threat_hunter_scannable': True, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 1}, {'id': '625698919820c39fcc32e838', \"
 \"'name': 'feodotracker-0-20220413', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-20T00:02:21.571000', 'created': \"
 \"'2022-04-13T09:32:01.671000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 340, 'modified_text': '22 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '62550f0309fdf2231d0b9642', \"
 \"'name': 'feodotracker-0-20220412', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-19T00:01:05.210000', 'created': \"
 \"'2022-04-12T05:32:51.853000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '23 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '6252630e40240989d59c3173', \"
 \"'name': 'feodotracker-0-20220410', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-17T00:01:27.728000', 'created': \"
 \"'2022-04-10T04:54:38.069000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '25 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '6252672b086133e496b3dce4', \"
 \"'name': 'feodotracker-0-20220410', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-17T00:01:27.728000', 'created': \"
 \"'2022-04-10T05:12:11.861000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 0, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '25 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '6251565b64f47ac1b7e6ec07', \"
 \"'name': 'feodotracker-0-20220409', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-16T00:04:53.479000', 'created': \"
 \"'2022-04-09T09:48:11.334000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 1, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '26 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '624e61bd1ce9fb5b0e6334df', \"
 \"'name': 'feodotracker-0-20220407', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-14T00:01:40.805000', 'created': \"
 \"'2022-04-07T03:59:57.344000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 11, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 340, 'modified_text': '28 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '624d36cef231bdea72ac18e5', \"
 \"'name': 'feodotracker-0-20220406', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-13T00:01:48.292000', 'created': \"
 \"'2022-04-06T06:44:30.129000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 6, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '29 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '624bdd422428575554ddd772', \"
 \"'name': 'feodotracker-0-20220405', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-12T00:02:34.248000', 'created': \"
 \"'2022-04-05T06:10:10.204000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 1, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 341, 'modified_text': '30 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '624adf0a9ea1216235242137', \"
 \"'name': 'feodotracker-0-20220404', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-11T00:04:29.819000', 'created': \"
 \"'2022-04-04T12:05:30.840000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 3, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 342, 'modified_text': '31 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '62290bead9aa05af6158671f', \"
 \"'name': 'Conti Ransomware | CISA', 'description': '', 'modified': \"
 \"'2022-04-10T00:02:49.890000', 'created': '2022-03-09T20:19:54.752000', \"
 \"'tags': ['uscert', 'csirt', 'cert', 'cybersecurity', 'cyber security', \"
 \"'computer security', 'u. s. computer emergency readiness', 'cyber risks', \"
 \"'conti', 'technique title', 'id use', 'trickbot', 'remote desktop', \"
 \"'protocol', 'cisa', 'kerberos', 'admin hash', 'ta0004', 'cobalt strike', \"
 \"'icedid', 'zloader', 'service'], 'references': \"
 \"['https://www.cisa.gov/uscert/sites/default/files/publications/AA21-265A.stix.xml', \"
 \"'https://www.cisa.gov/uscert/ncas/alerts/aa21-265a', \"
 \"'https://www.breachquest.com/conti-leaks-insight-into-a-ransomware-unicorn/'], \"
 \"'public': 1, 'adversary': '', 'targeted_countries': [], 'malware_families': \"
 \"[], 'attack_ids': [{'id': 'T1016', 'name': 'System Network Configuration \"
 \"Discovery', 'display_name': 'T1016 - System Network Configuration \"
 \"Discovery'}, {'id': 'T1021', 'name': 'Remote Services', 'display_name': \"
 \"'T1021 - Remote Services'}, {'id': 'T1021.002', 'name': 'SMB/Windows Admin \"
 \"Shares', 'display_name': 'T1021.002 - SMB/Windows Admin Shares'}, {'id': \"
 \"'T1027', 'name': 'Obfuscated Files or Information', 'display_name': 'T1027 - \"
 \"Obfuscated Files or Information'}, {'id': 'T1049', 'name': 'System Network \"
 \"Connections Discovery', 'display_name': 'T1049 - System Network Connections \"
 \"Discovery'}, {'id': 'T1055', 'name': 'Process Injection', 'display_name': \"
 \"'T1055 - Process Injection'}, {'id': 'T1057', 'name': 'Process Discovery', \"
 \"'display_name': 'T1057 - Process Discovery'}, {'id': 'T1059', 'name': \"
 \"'Command and Scripting Interpreter', 'display_name': 'T1059 - Command and \"
 \"Scripting Interpreter'}, {'id': 'T1059.003', 'name': 'Windows Command \"
 \"Shell', 'display_name': 'T1059.003 - Windows Command Shell'}, {'id': \"
 \"'T1078', 'name': 'Valid Accounts', 'display_name': 'T1078 - Valid \"
 \"Accounts'}, {'id': 'T1080', 'name': 'Taint Shared Content', 'display_name': \"
 \"'T1080 - Taint Shared Content'}, {'id': 'T1083', 'name': 'File and Directory \"
 \"Discovery', 'display_name': 'T1083 - File and Directory Discovery'}, {'id': \"
 \"'T1106', 'name': 'Native API', 'display_name': 'T1106 - Native API'}, {'id': \"
 \"'T1110', 'name': 'Brute Force', 'display_name': 'T1110 - Brute Force'}, \"
 \"{'id': 'T1133', 'name': 'External Remote Services', 'display_name': 'T1133 - \"
 \"External Remote Services'}, {'id': 'T1135', 'name': 'Network Share \"
 \"Discovery', 'display_name': 'T1135 - Network Share Discovery'}, {'id': \"
 \"'T1140', 'name': 'Deobfuscate/Decode Files or Information', 'display_name': \"
 \"'T1140 - Deobfuscate/Decode Files or Information'}, {'id': 'T1486', 'name': \"
 \"'Data Encrypted for Impact', 'display_name': 'T1486 - Data Encrypted for \"
 \"Impact'}, {'id': 'T1489', 'name': 'Service Stop', 'display_name': 'T1489 - \"
 \"Service Stop'}, {'id': 'T1490', 'name': 'Inhibit System Recovery', \"
 \"'display_name': 'T1490 - Inhibit System Recovery'}, {'id': 'T1558', 'name': \"
 \"'Steal or Forge Kerberos Tickets', 'display_name': 'T1558 - Steal or Forge \"
 \"Kerberos Tickets'}, {'id': 'T1558.003', 'name': 'Kerberoasting', \"
 \"'display_name': 'T1558.003 - Kerberoasting'}, {'id': 'T1566', 'name': \"
 \"'Phishing', 'display_name': 'T1566 - Phishing'}, {'id': 'T1566.001', 'name': \"
 \"'Spearphishing Attachment', 'display_name': 'T1566.001 - Spearphishing \"
 \"Attachment'}, {'id': 'T1566.002', 'name': 'Spearphishing Link', \"
 \"'display_name': 'T1566.002 - Spearphishing Link'}], 'industries': [], 'TLP': \"
 \"'white', 'cloned_from': None, 'export_count': 16, 'upvotes_count': 0, \"
 \"'downvotes_count': 0, 'votes_count': 0, 'locked': False, 'pulse_source': \"
 \"'web', 'validator_count': 0, 'comment_count': 0, 'follower_count': 0, \"
 \"'vote': 0, 'author': {'username': 'VertekLabs', 'id': '168455', \"
 \"'avatar_url': \"
 \"'/otxapi/users/avatar_image/media/avatars/user_168455/resized/80/avatar_3b9c358f36.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': \"
 \"{'CVE': 2, 'domain': 98, 'BitcoinAddress': 202, 'FileHash-MD5': 24, \"
 \"'FileHash-SHA1': 24, 'FileHash-SHA256': 72}, 'indicator_count': 422, \"
 \"'is_author': False, 'is_subscribing': None, 'subscriber_count': 85, \"
 \"'modified_text': '32 days ago ', 'is_modified': True, 'groups': [], \"
 \"'in_group': False, 'threat_hunter_scannable': True, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '62494787cf39b823ff8f7afe', \"
 \"'name': 'feodotracker-0-20220403', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-10T00:02:49.890000', 'created': \"
 \"'2022-04-03T07:06:47.463000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 1, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 341, 'modified_text': '32 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '6229d84f86d99550fa73e1fa', \"
 \"'name': 'Conti Ransomware IOC', 'description': '', 'modified': \"
 \"'2022-04-09T00:00:32.009000', 'created': '2022-03-10T10:51:59.898000', \"
 \"'tags': ['span', 'path', 'header dropdown', 'link', 'script', 'product', \"
 \"'explore', 'footer', 'github', 'button', 'template', 'meta', 'form', 'team', \"
 \"'enterprise', 'contact', 'code', 'copy', 'reload', 'body', 'star', 'open', \"
 \"'desktop', 'main'], 'references': \"
 \"['https://github.com/whichbuffer/Conti-Ransomware-IOC/blob/main/Conti%20IOC.txt'], \"
 \"'public': 1, 'adversary': '', 'targeted_countries': [], 'malware_families': \"
 \"[], 'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 8, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'web', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'bluewatcher', 'id': '174522', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': \"
 \"{'URL': 8, 'FileHash-MD5': 5, 'FileHash-SHA1': 1, 'FileHash-SHA256': 52, \"
 \"'domain': 111, 'email': 169}, 'indicator_count': 346, 'is_author': False, \"
 \"'is_subscribing': None, 'subscriber_count': 47, 'modified_text': '33 days \"
 \"ago ', 'is_modified': True, 'groups': [], 'in_group': False, \"
 \"'threat_hunter_scannable': True, 'threat_hunter_has_agents': 1, \"
 \"'related_indicator_type': 'IPv4', 'related_indicator_is_active': 0}, {'id': \"
 \"'6248002ceb67f57c92e0cf57', 'name': 'feodotracker-0-20220402', \"
 \"'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-09T00:00:32.009000', 'created': \"
 \"'2022-04-02T07:50:04.421000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 1, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 340, 'modified_text': '33 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '624804aac57a56b6d6f439ff', \"
 \"'name': 'feodotracker-0-20220402', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-09T00:00:32.009000', 'created': \"
 \"'2022-04-02T08:09:14.305000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 1, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 340, 'modified_text': '33 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '6246a992168dfa61b62e0743', \"
 \"'name': 'feodotracker-0-20220401', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-08T00:05:40.239000', 'created': \"
 \"'2022-04-01T07:28:18.183000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 3, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 340, 'modified_text': '34 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '624557c656e4f6be5ee26782', \"
 \"'name': 'feodotracker-0-20220331', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-07T00:04:02.553000', 'created': \"
 \"'2022-03-31T07:27:02.349000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 1, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 340, 'modified_text': '35 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '6243f3a2785e5607272c8999', \"
 \"'name': 'feodotracker-0-20220330', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-06T00:02:16.312000', 'created': \"
 \"'2022-03-30T06:07:30.478000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 2, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 343, 'modified_text': '36 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '6242af0eb5b55b34f2281d71', \"
 \"'name': 'feodotracker-0-20220329', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-05T00:01:21.136000', 'created': \"
 \"'2022-03-29T07:02:38.114000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 1, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 341, 'modified_text': '37 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '624155ab63c04888ff86f565', \"
 \"'name': 'feodotracker-0-20220328', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-04T00:01:44.993000', 'created': \"
 \"'2022-03-28T06:28:59.582000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 2, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 341, 'modified_text': '38 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '6240085db6c53cbc0ab1b4eb', \"
 \"'name': 'feodotracker-0-20220327', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-03T00:00:55.161000', 'created': \"
 \"'2022-03-27T06:46:53.652000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 1, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 340, 'modified_text': '39 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '623efad4d76871ab1edad105', \"
 \"'name': 'feodotracker-0-20220326', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-04-02T00:04:50.405000', 'created': \"
 \"'2022-03-26T11:36:52.602000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 1, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 340, 'modified_text': '40 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '623afb5ef6276fc9b737b2c9', \"
 \"'name': 'feodotracker-0-20220323', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-03-30T00:00:10.458000', 'created': \"
 \"'2022-03-23T10:50:06.252000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 1, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 340, 'modified_text': '43 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '6239ff37cda86ba9dabbe1cc', \"
 \"'name': 'feodotracker-0-20220322', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-03-29T00:03:34.773000', 'created': \"
 \"'2022-03-22T16:54:15.293000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 1, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 340, 'modified_text': '44 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '62382a0b212a53ecbb03abf5', \"
 \"'name': 'feodotracker-0-20220321', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-03-28T00:01:22.803000', 'created': \"
 \"'2022-03-21T07:32:27.129000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 1, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 340, 'modified_text': '45 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}, {'id': '6236a7e441bade8a29c72d3f', \"
 \"'name': 'feodotracker-0-20220320', 'description': 'Data from \"
 \"https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.csv', \"
 \"'modified': '2022-03-27T00:00:39.057000', 'created': \"
 \"'2022-03-20T04:04:52.565000', 'tags': [], 'references': [], 'public': 1, \"
 \"'adversary': '', 'targeted_countries': [], 'malware_families': [], \"
 \"'attack_ids': [], 'industries': [], 'TLP': 'white', 'cloned_from': None, \"
 \"'export_count': 4, 'upvotes_count': 0, 'downvotes_count': 0, 'votes_count': \"
 \"0, 'locked': False, 'pulse_source': 'api', 'validator_count': 0, \"
 \"'comment_count': 0, 'follower_count': 0, 'vote': 0, 'author': {'username': \"
 \"'ZENDataGE', 'id': '94417', 'avatar_url': \"
 \"'https://otx.alienvault.com/assets/images/default-avatar.png', \"
 \"'is_subscribed': False, 'is_following': False}, 'indicator_type_counts': {}, \"
 \"'indicator_count': 0, 'is_author': False, 'is_subscribing': None, \"
 \"'subscriber_count': 339, 'modified_text': '46 days ago ', 'is_modified': \"
 \"True, 'groups': [], 'in_group': False, 'threat_hunter_scannable': False, \"
 \"'threat_hunter_has_agents': 1, 'related_indicator_type': 'IPv4', \"
 \"'related_indicator_is_active': 0}], 'references': \"
 \"['https://www.breachquest.com/conti-leaks-insight-into-a-ransomware-unicorn/', \"
 \"'2021-09-21-Curriculo-IOCs.txt', \"
 \"'https://github.com/whichbuffer/Conti-Ransomware-IOC/blob/main/Conti%20IOC.txt', \"
 \"'https://www.cisa.gov/uscert/ncas/alerts/aa21-265a', 'blacklist_ip.backup', \"
 \"'https://www.cisa.gov/uscert/sites/default/files/publications/AA21-265A.stix.xml'], \"
 \"'related': {'alienvault': {'adversary': [], 'malware_families': [], \"
 \"'industries': []}, 'other': {'adversary': [], 'malware_families': [], \"
 \"'industries': []}}}, 'false_positive': [], 'validation': [], 'asn': 'AS55699 \"
 \"pt. cemerlang multimedia', 'city_data': True, 'city': 'Bandung', 'region': \"
 \"'JB', 'continent_code': 'AS', 'country_code3': 'IDN', 'country_code2': 'ID', \"
 \"'subdivision': 'JB', 'latitude': -6.9217, 'postal_code': None, 'longitude': \"
 \"107.6071, 'accuracy_radius': 1, 'country_code': 'ID', 'country_name': \"
 \"'Indonesia', 'dma_code': 0, 'charset': 0, 'area_code': 0, 'flag_url': \"
 \"'/assets/images/flags/id.png', 'flag_title': 'Indonesia', 'sections': \"
 \"['general', 'geo', 'reputation', 'url_list', 'passive_dns', 'malware', \"
 \"'nids_list', 'http_scans']}\")
\n", "
\n", "

Type: 'ipv4', Provider: VirusTotal, severity: high

Details

\n", "\n", "{'verbose_msg': 'IP address in dataset', 'response_code': 1, 'positives': 3, 'detected_urls': ['https://103.101.104.229/'], 'detected_downloaded_samples': [], 'detected_communicating_samples': []}

Reference:

https://www.virustotal.com/vtapi/v2/ip-address/report

Raw Results

\n", "
\n", " Raw results from provider...\n", "
(\"{'asn': 55699, 'undetected_urls': [], 'undetected_downloaded_samples': \"
 \"[{'date': '2020-08-11 18:53:02', 'positives': 0, 'total': 76, 'sha256': \"
 \"'121b87095769137ba3fe1d689efe8af43088ab95d1c9cf5669188fde2e9d5fab'}, \"
 \"{'date': '2021-05-25 16:43:33', 'positives': 0, 'total': 74, 'sha256': \"
 \"'78342a0905a72ce44da083dcb5d23b8ea0c16992ba2a82eece97e033d76ba3d3'}, \"
 \"{'date': '2021-02-17 11:39:22', 'positives': 0, 'total': 73, 'sha256': \"
 \"'0649170d63ef807fcca55a7e225518cda7310e15f559ad29882ebd421cf1d757'}], \"
 \"'detected_downloaded_samples': [], 'response_code': 1, 'as_owner': 'PT. \"
 \"Cemerlang Multimedia', 'detected_referrer_samples': [], 'verbose_msg': 'IP \"
 \"address in dataset', 'country': 'ID', 'undetected_referrer_samples': \"
 \"[{'date': '2022-04-04 09:13:29', 'positives': 0, 'total': 73, 'sha256': \"
 \"'66afc65465caf9f41dd93812284419cba60cb4d3d608d6b77f37842de7a5f5a3'}], \"
 \"'detected_urls': [{'url': 'https://103.101.104.229/', 'positives': 3, \"
 \"'total': 92, 'scan_date': '2022-05-03 15:12:47'}, {'url': \"
 \"'http://103.101.104.229:443/', 'positives': 3, 'total': 93, 'scan_date': \"
 \"'2022-04-08 06:02:57'}, {'url': 'http://103.101.104.229/', 'positives': 6, \"
 \"'total': 93, 'scan_date': '2022-01-04 04:47:05'}, {'url': \"
 \"'https://103.101.104.229/mod2/ANALYST0-2D1671_W512600.BBC33AC9D1F14F9D3B2D30F78F7E2337/5/file', \"
 \"'positives': 11, 'total': 91, 'scan_date': '2021-10-08 18:40:17'}, {'url': \"
 \"'https://103.101.104.229/mod2/ANALYST0-2D1671_W512600.BBC33AC9D1F14F9D3B2D30F78F7E2337/5/file/', \"
 \"'positives': 11, 'total': 91, 'scan_date': '2021-10-08 18:00:01'}, {'url': \"
 \"'https://103.101.104.229/sat1/FJLSEDAUV_W617601.DCE7336137D8E3B3B80B3BACBB3613B9/5/file', \"
 \"'positives': 10, 'total': 90, 'scan_date': '2021-09-03 23:10:06'}, {'url': \"
 \"'https://103.101.104.229/sat1/FJLSEDAUV_W617601.DCE7336137D8E3B3B80B3BACBB3613B9/5/file/', \"
 \"'positives': 10, 'total': 90, 'scan_date': '2021-09-03 22:44:25'}, {'url': \"
 \"'https://103.101.104.229/mod2/ANALYST0-2D1671_W512600.B383523BCAF4474453EBB9379CF35FC2/5/file', \"
 \"'positives': 10, 'total': 90, 'scan_date': '2021-09-02 07:10:06'}, {'url': \"
 \"'https://103.101.104.229/mod2/ANALYST0-2D1671_W512600.B383523BCAF4474453EBB9379CF35FC2/5/file/', \"
 \"'positives': 10, 'total': 90, 'scan_date': '2021-09-02 06:43:31'}, {'url': \"
 \"'https://103.101.104.229/mod2/ANALYST0-2D1671_W512600.0379BB767548B14B97BF79F8BB75F087/5/file', \"
 \"'positives': 8, 'total': 88, 'scan_date': '2021-06-21 04:20:10'}, {'url': \"
 \"'https://103.101.104.229/mod2/ANALYST0-2D1671_W512600.0379BB767548B14B97BF79F8BB75F087/5/file/', \"
 \"'positives': 7, 'total': 88, 'scan_date': '2021-06-21 03:59:55'}], \"
 \"'detected_communicating_samples': [{'date': '2021-09-01 02:13:54', \"
 \"'positives': 50, 'total': 74, 'sha256': \"
 \"'dc084e88f377ddd7ee21424f94f1f94b409b26ebfbfb6b8566654cc9ce71472e'}, \"
 \"{'date': '2021-06-20 12:51:53', 'positives': 48, 'total': 75, 'sha256': \"
 \"'be98cf40b1ba5dafde4834ba50fb1dc697e456b9f93cb437842f5177160c9fad'}], \"
 \"'undetected_communicating_samples': [], 'resolutions': []}\")
\n", "
\n", " " ], "text/plain": [ "" ] }, "metadata": {}, "output_type": "display_data" } ], "source": [ "from msticpy.nbtools.ti_browser import browse_results\n", "ip_intel = pd.read_csv(\"IOC\\\\ipintel.csv\")\n", "\n", "ti_selector = browse_results(data = ip_intel, height=\"200px\")\n", "ti_selector" ] }, { "cell_type": "markdown", "id": "5968be9f-2fe7-4e1c-9d82-6867b1024962", "metadata": {}, "source": [ "## Creating a Map with the IP addresses" ] }, { "cell_type": "code", "execution_count": 30, "id": "812b12fc-1aeb-44cb-bd5b-e3d248d81665", "metadata": {}, "outputs": [ { "name": "stdout", "output_type": "stream", "text": [ "Latest local Maxmind City Database present is older than 30 days. Attempting to download new database to C:\\Users\\thomasroccia\\.msticpy\n", "Downloading and extracting GeoLite DB archive from MaxMind....\n", "Extraction complete. Local Maxmind city DB: C:\\Users\\thomasroccia\\.msticpy\\GeoLite2-City.mmdb.19544.tar.gz\n" ] }, { "data": { "text/html": [ "

ipaddress

{ 'Address': '203.76.105.227',
  'Location': { 'City': 'Dhaka',
                'CountryCode': 'BD',
                'CountryName': 'Bangladesh',
                'Latitude': 23.7908,
                'Longitude': 90.4109,
                'State': 'Dhaka Division',
                'TimeGenerated': datetime.datetime(2022, 5, 12, 0, 22, 45, 503996),
                'Type': 'geolocation'},
  'TimeGenerated': datetime.datetime(2022, 5, 12, 0, 22, 45, 503996),
  'Type': 'ipaddress'}" ], "text/plain": [ "IpAddress(Address=203.76.105.227, Location={ 'City': 'Dhaka',\n", " 'CountryCode': 'BD',\n", " 'Co...)" ] }, "metadata": {}, "output_type": "display_data" } ], "source": [ "# Getting the geo result for one ip\n", "msticpy.settings.refresh_config()\n", "iplocation = GeoLiteLookup()\n", "\n", "loc_result, ip_entity = iplocation.lookup_ip(ip_address = '203.76.105.227')\n", "display(ip_entity[0])" ] }, { "cell_type": "code", "execution_count": 31, "id": "8e5b0ee1-d2d4-486f-bb0a-d65b2ff2900b", "metadata": {}, "outputs": [ { "data": { "text/html": [ "
Make this Notebook Trusted to load map: File -> Trust Notebook
" ], "text/plain": [ "" ] }, "execution_count": 31, "metadata": {}, "output_type": "execute_result" } ], "source": [ "# Creating the map using the folium module\n", "iploc = []\n", "\n", "for ip in ip_intel[\"Ioc\"]:\n", " loc_result, ip_entity = iplocation.lookup_ip(ip_address = ip)\n", " iploc += ip_entity\n", "\n", "folium_map = FoliumMap(zoom_start = 2)\n", "folium_map.add_ip_cluster(ip_entities = iploc, color = 'red')\n", "folium_map.center_map()\n", "folium_map" ] }, { "cell_type": "markdown", "id": "bbdc8d70-bbd6-42aa-a699-7fa55f8345d2", "metadata": {}, "source": [ "## URL Intelligence" ] }, { "cell_type": "code", "execution_count": 32, "id": "ce21d8bf-e39c-4182-b6ca-ab1c4457c789", "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
IoCTypeObservableSourceIndexInput
26urlhttps://hura.me/no-ref.php?url=http%3A%2F%2Fwwwapps.ups.com%2FWebTracking%2Ftrack%3FHTMLtrackVer...3351Z9918AW3591558812 <https://hura.me/no-ref.php?url=http%3A%2F%2Fwwwapps.ups.com%2FWebTracking%2F...
27urlhttps://hura.me/no-ref.php?url=http://wwwapps.ups.com/WebTracking/track?HTMLtrackVersion=5.0&loc...3351Z9918AW3591558812 <https://hura.me/no-ref.php?url=http%3A%2F%2Fwwwapps.ups.com%2FWebTracking%2F...
41urlhttps://dyncheck.com/scan/id/fbcb147447b24f5c583f710fafc5b214#collapse_info514+] Written in Jscript can be used as .js or .vbs\\n[+] Small size (14 KB ~)\\n[+] Support for all ...
42urlhttps://dyncheck.com/scan/id/84b7fe1b0f95031d2e5eaedf9fa2dbe2#collapse_info514+] Written in Jscript can be used as .js or .vbs\\n[+] Small size (14 KB ~)\\n[+] Support for all ...
46urlhttps://prnt.sc/wh26pt516Panel:\\n\\nhttps://prnt.sc/wh26qd\\nhttps://prnt.sc/wh26rb\\nhttps://prnt.sc/wh26pt
...............
3984urlhttps://temp.sh/HXmZA/СникzarBackdoorок60165https://temp.sh/HXmZA/%D0%A1%D0%BD%D0%B8%D0%BazarBackdoor%D0%BE%D0%BA%20%D1%8D%D0%BA%D1%80%D0%B0...
4027urlhttp://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chat/f3...60643Hey ! how come they decipher Fail ZGQB3V6qmIWHLAwDH4dw4ijjACAknqMO2vvVBERGCICHODV86ciJyer49HHhAb...
4029urlhttps://continews.click/uImgrfqk_WARNING60646https://continews.click/uImgrfqk_WARNING
4030urlhttps://send.exploit.in/download/8bcac089623fcf96/#Kr27VSxYFrdmUHELZDJF1w60658https://send.exploit.in/download/8bcac089623fcf96/#Kr27VSxYFrdmUHELZDJF1w
4032urlhttps://www.angelantoni.com60682https://www.angelantoni.com - here is their website
\n", "

672 rows × 4 columns

\n", "
" ], "text/plain": [ " IoCType \\\n", "26 url \n", "27 url \n", "41 url \n", "42 url \n", "46 url \n", "... ... \n", "3984 url \n", "4027 url \n", "4029 url \n", "4030 url \n", "4032 url \n", "\n", " Observable \\\n", "26 https://hura.me/no-ref.php?url=http%3A%2F%2Fwwwapps.ups.com%2FWebTracking%2Ftrack%3FHTMLtrackVer... \n", "27 https://hura.me/no-ref.php?url=http://wwwapps.ups.com/WebTracking/track?HTMLtrackVersion=5.0&loc... \n", "41 https://dyncheck.com/scan/id/fbcb147447b24f5c583f710fafc5b214#collapse_info \n", "42 https://dyncheck.com/scan/id/84b7fe1b0f95031d2e5eaedf9fa2dbe2#collapse_info \n", "46 https://prnt.sc/wh26pt \n", "... ... \n", "3984 https://temp.sh/HXmZA/СникzarBackdoorок \n", "4027 http://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chat/f3... \n", "4029 https://continews.click/uImgrfqk_WARNING \n", "4030 https://send.exploit.in/download/8bcac089623fcf96/#Kr27VSxYFrdmUHELZDJF1w \n", "4032 https://www.angelantoni.com \n", "\n", " SourceIndex \\\n", "26 335 \n", "27 335 \n", "41 514 \n", "42 514 \n", "46 516 \n", "... ... \n", "3984 60165 \n", "4027 60643 \n", "4029 60646 \n", "4030 60658 \n", "4032 60682 \n", "\n", " Input \n", "26 1Z9918AW3591558812 \n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
IoCTypeObservableSourceIndexInput
1811urlfile://157.230.60.143/download.jpg21267[07/27/2021 19:01:56] <rozteka> https://www.ired.team/offensive-security/initial-access/netntlmv...
3875urlftp://5.183.95.6/uploads/Team_D/58179ADo, can you crypt ftp://5.183.95.6/uploads/Team_D/
233urlftp://himemsys:antiDen4ik@3118kramer> rdp rdp://SERVER-AGM\\ella:[PLACEHOLDER][----REDACTED-----]...
2148urlhttp://(IP)/TAG/TEST_W639600.1234A242341C6D1A25B3F315D688968E/84/29277На запрос вида \\ncurl -X POST -F 'data=dXNlcg==|IE||||1240428288|1240428288|dXNlcg==|IE|demdex.n...
1380urlhttp://109.230.199.73/209.dll15237http://109.230.199.73/209.dll\\nhttp://109.230.199.73/209x64.exe
...............
1241urlhttps://www.zoominfo.com/c/xerox-corporation/19410165112123Доброе утро бро , заразили xerox \\nи ticket master https://www.zoominfo.com/c/ticketmaster-enter...
1880urlhttps://xflemdsxjrjilw34dsxpvrxp5whnaut7hc5xejwuqs6eqrkt77bxkwid.onion21800https://xflemdsxjrjilw34dsxpvrxp5whnaut7hc5xejwuqs6eqrkt77bxkwid.onion\\nganesh: fp6fqpVxlrYsorC5...
1255urlhttps://xzu6o2ni3hplvpmx.onion12638for HORSE\\nrobotbander@jabb.im\\n4815162342@jabb.im\\nsheppard@jabber.ru\\nsectorzero@jabb.im\\n\\n\\n...
1355urlhttps://yadi.sk/d/ySGgFr0ksqAp3Q14870[09:41:53] <mango> https://yadi.sk/d/ySGgFr0ksqAp3Q - examples of web artist's work
1859urlhttps://youtu.be/9gLHycT1RzU21705https://youtu.be/9gLHycT1RzU
\n", "

672 rows × 4 columns

\n", "" ], "text/plain": [ " IoCType \\\n", "1811 url \n", "3875 url \n", "233 url \n", "2148 url \n", "1380 url \n", "... ... \n", "1241 url \n", "1880 url \n", "1255 url \n", "1355 url \n", "1859 url \n", "\n", " Observable \\\n", "1811 file://157.230.60.143/download.jpg \n", "3875 ftp://5.183.95.6/uploads/Team_D/ \n", "233 ftp://himemsys:antiDen4ik@ \n", "2148 http://(IP)/TAG/TEST_W639600.1234A242341C6D1A25B3F315D688968E/84/ \n", "1380 http://109.230.199.73/209.dll \n", "... ... \n", "1241 https://www.zoominfo.com/c/xerox-corporation/194101651 \n", "1880 https://xflemdsxjrjilw34dsxpvrxp5whnaut7hc5xejwuqs6eqrkt77bxkwid.onion \n", "1255 https://xzu6o2ni3hplvpmx.onion \n", "1355 https://yadi.sk/d/ySGgFr0ksqAp3Q \n", "1859 https://youtu.be/9gLHycT1RzU \n", "\n", " SourceIndex \\\n", "1811 21267 \n", "3875 58179 \n", "233 3118 \n", "2148 29277 \n", "1380 15237 \n", "... ... \n", "1241 12123 \n", "1880 21800 \n", "1255 12638 \n", "1355 14870 \n", "1859 21705 \n", "\n", " Input \n", "1811 [07/27/2021 19:01:56] https://www.ired.team/offensive-security/initial-access/netntlmv... \n", "3875 ADo, can you crypt ftp://5.183.95.6/uploads/Team_D/ \n", "233 kramer> rdp rdp://SERVER-AGM\\ella:[PLACEHOLDER][----REDACTED-----]... \n", "2148 На запрос вида \\ncurl -X POST -F 'data=dXNlcg==|IE||||1240428288|1240428288|dXNlcg==|IE|demdex.n... \n", "1380 http://109.230.199.73/209.dll\\nhttp://109.230.199.73/209x64.exe \n", "... ... \n", "1241 Доброе утро бро , заразили xerox \\nи ticket master https://www.zoominfo.com/c/ticketmaster-enter... \n", "1880 https://xflemdsxjrjilw34dsxpvrxp5whnaut7hc5xejwuqs6eqrkt77bxkwid.onion\\nganesh: fp6fqpVxlrYsorC5... \n", "1255 for HORSE\\nrobotbander@jabb.im\\n4815162342@jabb.im\\nsheppard@jabber.ru\\nsectorzero@jabb.im\\n\\n\\n... \n", "1355 [09:41:53] https://yadi.sk/d/ySGgFr0ksqAp3Q - examples of web artist's work \n", "1859 https://youtu.be/9gLHycT1RzU \n", "\n", "[672 rows x 4 columns]" ] }, "execution_count": 34, "metadata": {}, "output_type": "execute_result" } ], "source": [ "# Sorting the value\n", "url_intel.sort_values('Observable', ascending = True)" ] }, { "cell_type": "markdown", "id": "85b3385f-dc48-4457-8a1c-efd3ac4af29e", "metadata": {}, "source": [ "### Extracting url containing specific extension" ] }, { "cell_type": "code", "execution_count": 35, "id": "a4851661-b81e-484e-a8fc-f0ccc4187f5e", "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
IoCTypeObservableSourceIndexInput
221urlhttps://help4windows.com/windows_7_shell32_dll.shtml3064https://help4windows.com/windows_7_shell32_dll.shtml
373urlhttps://oividaluxuosa.com/ke/miami.dll5275https://oividaluxuosa.com/ke/miami.dll , 3k copies with some neutral names so that the def does ...
564urlhttps://privatlab.com/s/v/nRl7zbAAjltBeLbRqrax6661Check if it works\\nhttps://privatlab.com/s/v/nRl7zbAAjltBeLbRqrax\\n123123
600urlhttps://emploimed.com/netr.dll71471st link https://emploimed.com/netr.dll
602urlhttps://www.ottenbourg.com/chester.dll71492nd link https://www.ottenbourg.com/chester.dll
728urlhttps://anonfiles.com/Hai0P8t1uc/Dolfs_rar7742https://anonfiles.com/Hai0P8t1uc/Dolfs_rar\\npass - AF2gAS2ggd
778urlhttps://atlantisprojects.ca/cheryasd.dll8169https://atlantisprojects.ca/cheryasd.dll
783urlhttps://parkisolutions.com/nerugin.dll8197https://parkisolutions.com/nerugin.dll
942urlhttp://109.230.199.73/k.exe9765<off> http://109.230.199.73/k.exe\\n[13.05.2021 08:33:36] <off> http://109.230.199.73/k.dll\\n[13....
943urlhttp://109.230.199.73/k.dll9765<off> http://109.230.199.73/k.exe\\n[13.05.2021 08:33:36] <off> http://109.230.199.73/k.dll\\n[13....
1211urlhttp://ozpve456vdzplanabllomqi6lfx67nlrrthquvcsrfxv7z3jreurmfqd.onion11755http://ozpve456vdzplanabllomqi6lfx67nlrrthquvcsrfxv7z3jreurmfqd.onion\\nadmin\\n[{/.)B4xcE3v=fd6
1293urlhttp://i.prntscr.com/qMqzmSbHSS_QdlEUONrHZw.png13636http://i.prntscr.com/qMqzmSbHSS_QdlEUONrHZw.png
1380urlhttp://109.230.199.73/209.dll15237http://109.230.199.73/209.dll\\nhttp://109.230.199.73/209x64.exe
1381urlhttp://109.230.199.73/209x64.exe15237http://109.230.199.73/209.dll\\nhttp://109.230.199.73/209x64.exe
1674urlhttps://bradiolum.top/aprel.dll19733now again on the command dll flies error\\nhttps://bradiolum.top/aprel.dll\\n\\nhttps://auk64p35qeb...
1811urlfile://157.230.60.143/download.jpg21267[07/27/2021 19:01:56] <rozteka> https://www.ired.team/offensive-security/initial-access/netntlmv...
2452urlhttp://31.14.*0.220/230*17*.dll,StartW33028http://31.14.*0.220/230*17*.dll,StartW
2495urlhttps://temp.sh/fJXCc/1.rar33474Готово. \\n[20:42:06] <bentley> pass: kJHDF273yubfjsbdf973uiwhgjsnkgb3oiygbhjsbdgkjhb \\n[20:42:13...
2502urlhttp://bergmeitli.ch/2.dll33631altmann-dias.com/1.dll\\nhttp://bergmeitli.ch/2.dll
2509urlhttp://195.149.87.59/2_https_x64.dll33801http://195.149.87.59/1_http_x64.dll\\nhttp://195.149.87.59/2_https_x64.dll\\n\\nStartW
2510urlhttp://195.149.87.59/1_http_x64.dll33801http://195.149.87.59/1_http_x64.dll\\nhttp://195.149.87.59/2_https_x64.dll\\n\\nStartW
2601urlhttps://temp.sh/jDpqP/1.rar36060https://temp.sh/jDpqP/1.rar
2767urlhttps://temp.sh/copeR/tmp.zip39915ADo, can I have a new crypt, please, the last build is already burning with something https://te...
2843urlhttps://temp.sh/bctPM/f3cfb349.7z41688https://temp.sh/bctPM/f3cfb349.7z
2863urlhttp://4nmxrhdtbznfr7f3q6bhd4qxxfcxodao3h2txugojsizca4uhppdkzad.onion/private/168xavj5/M5kuzP_sa...42663http://4nmxrhdtbznfr7f3q6bhd4qxxfcxodao3h2txugojsizca4uhppdkzad.onion/private/168xavj5/M5kuzP_sa...
3074urlhttp://root@195.149.87.59/var/www/html/bec_http_111_x86-1637769956-T12B123Z_32-cr.dll48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3075urlhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769859-T0B1Z_64-cr.exe48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3076urlhttps://root@195.149.87.59/var/www/html/bec_https_111_x64-1637770072-T12B123Z_64-cr.dll48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3077urlhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769920-T12B123Z_64-cr.dll48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3078urlhttps://root@195.149.87.59/var/www/html/bec_https_111_x64-1637770087-T0B123Z_64-cr.exe48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3079urlhttps://root@195.149.87.59/var/www/html/pe_https_111_x64-1637770298-T0B123Z_64-cr.exe48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3080urlhttp://root@195.149.87.59/var/www/html/bec_http_111_x86-1637769886-T12B1Z_32-cr.dll48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3081urlhttp://root@195.149.87.59/var/www/html/pe_http_111_x64-1637770246-T0Z_64-cr.exe48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3082urlhttp://root@195.149.87.59/var/www/html/pe_http_111_x64-1637770240-T0B123Z_64-cr.exe48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3083urlhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769933-T0B123Z_64-cr.exe48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3084urlhttps://root@195.149.87.59/var/www/html/bec_https_111_x86-1637770080-T12B1Z_32-cr.dll48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3085urlhttp://root@195.149.87.59/var/www/html/pe_http_111_x64-1637770256-T0B1Z_64-cr.exe48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3086urlhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3087urlhttps://root@195.149.87.59/var/www/html/pe_https_111_x64-1637770347-T0Z_64-cr.exe48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3088urlhttps://root@195.149.87.59/var/www/html/bec_https_111_x64-1637770051-T0B1Z_64-cr.exe48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3089urlhttp://root@195.149.87.59/var/www/html/bec_http_111_x86-1637769971-T0B123Z_32-cr.exe48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3090urlhttps://root@195.149.87.59/var/www/html/bec_https_111_x64-1637770033-T12B1Z_64-cr.dll48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3091urlhttps://root@195.149.87.59/var/www/html/bec_https_111_x86-1637770126-T0B123Z_32-cr.exe48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3092urlhttps://root@195.149.87.59/var/www/html/bec_https_111_x86-1637770066-T12Z_32-cr.dll48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3093urlhttps://root@195.149.87.59/var/www/html/bec_https_111_x86-1637770112-T12B123Z_32-cr.dll48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3094urlhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769815-T12Z_64-cr.dll48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3095urlhttps://root@195.149.87.59/var/www/html/bec_https_111_x64-1637770017-T12Z_64-cr.dll48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3096urlhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769837-T12B1Z_64-cr.dll48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3097urlhttps://root@195.149.87.59/var/www/html/bec_https_111_x86-1637770089-T0Z_32-cr.exe48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3098urlhttps://root@195.149.87.59/var/www/html/bec_https_111_x86-1637770099-T0B1Z_32-cr.exe48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3099urlhttps://root@195.149.87.59/var/www/html/pe_https_111_x64-1637770356-T0B1Z_64-cr.exe48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3100urlhttps://root@195.149.87.59/var/www/html/bec_https_111_x64-1637770042-T0Z_64-cr.exe48140111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe...
3129urlhttp://198.244.193.210/images/wolf.png48567http://198.244.193.210/images/wolf.png
3133urlhttps://temp.sh/FwsSg/1.rar48950https://temp.sh/FwsSg/1.rar
3134urlhttps://195.149.87.59/bec_https_555_x86-1638188794-T12B123Z_32-cr.dll48952555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b...
3135urlhttp://195.149.87.59/bec_http_111_x86-1638187422-T0B123Z_32-cr.exe48952555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b...
3136urlhttps://195.149.87.59/bec_https_111_x64-1638188186-T0B123Z_64-cr.exe48952555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b...
3137urlhttps://195.149.87.59/bec_https_111_x64-1638188048-T12B123Z_64-cr.dll48952555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b...
3138urlhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll48952555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b...
3139urlhttp://195.149.87.59/bec_http_555_x64-1638187557-T12B123Z_64-cr.dll48952555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b...
3140urlhttps://195.149.87.59/bec_https_111_x86-1638188296-T12B123Z_32-cr.dll48952555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b...
3141urlhttps://195.149.87.59/bec_https_111_x86-1638188430-T0B123Z_32-cr.exe48952555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b...
3142urlhttp://195.149.87.59/bec_http_111_x86-1638187295-T12B123Z_32-cr.dll48952555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b...
3143urlhttp://195.149.87.59/bec_http_111_x64-1638187173-T0B123Z_64-cr.exe48952555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b...
3144urlhttps://195.149.87.59/bec_https_555_x64-1638188681-T0B123Z_64-cr.exe48952555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b...
3145urlhttps://195.149.87.59/bec_https_555_x64-1638188562-T12B123Z_64-cr.dll48952555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b...
3146urlhttp://195.149.87.59/bec_http_555_x64-1638187720-T0B23Z_64-cr.exe48952555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b...
3147urlhttp://195.149.87.59/bec_http_555_x86-1638187956-T0B23Z_32-cr.exe48952555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b...
3148urlhttp://195.149.87.59/bec_http_111_x64-1638187035-T12B123Z_64-cr.dll48952555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b...
3149urlhttps://195.149.87.59/bec_https_555_x86-1638188919-T0B123Z_32-cr.exe48952555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b...
3412urlhttps://i.imgur.com/aEnyme5.png52565https://i.imgur.com/aEnyme5.png
3439urlhttps://shell.com/path/?dll52759on the topic of hosting appinstaller + appxbundle + dll files nearby - I managed to do it last n...
3443urlhttps://some/some/1.dll52898- if we write in .appinstaller\\n Uri=\"https://srcdatastorage.z13.web.core.windows.net/jaj...
3444urlhttps://srcdatastorage.z13.web.core.windows.net/jajnedhneb.appxbundle?param1=https://some/some/1...52898- if we write in .appinstaller\\n Uri=\"https://srcdatastorage.z13.web.core.windows.net/jaj...
3467urlhttps://shell.com/file.appinstaller&activationUri=custom-params:?data=https://host.com/1.dll53153ms-appinstaller:?source=https://shell.com/file.appinstaller&activationUri=custom-params:?data=ht...
3468urlhttps://host.com/1.dll53156&activationUri=custom-params:?data=https://host.com/1.dll
3477urlhttps://shell.com/file.appinstaller&activationUri=custom-params:?data=https://host2.com/file.dll53373everything works for me)\\n\\nin short, the scheme is as follows:\\nin html land in this link:\\n <a...
3519urlhttps://privatlab.com/s/v/EJawrarkp6Iwxd2AzBgb54653https://privatlab.com/s/v/EJawrarkp6Iwxd2AzBgb
3659urlhttps://temp.sh/ueksm/222.7z56679https://temp.sh/ueksm/222.7z
3983urlhttps://temp.sh/HXmZA/%D0%A1%D0%BD%D0%B8%D0%BazarBackdoor%D0%BE%D0%BA%20%D1%8D%D0%BA%D1%80%D0%B0...60165https://temp.sh/HXmZA/%D0%A1%D0%BD%D0%B8%D0%BazarBackdoor%D0%BE%D0%BA%20%D1%8D%D0%BA%D1%80%D0%B0...
\n", "
" ], "text/plain": [ " IoCType \\\n", "221 url \n", "373 url \n", "564 url \n", "600 url \n", "602 url \n", "728 url \n", "778 url \n", "783 url \n", "942 url \n", "943 url \n", "1211 url \n", "1293 url \n", "1380 url \n", "1381 url \n", "1674 url \n", "1811 url \n", "2452 url \n", "2495 url \n", "2502 url \n", "2509 url \n", "2510 url \n", "2601 url \n", "2767 url \n", "2843 url \n", "2863 url \n", "3074 url \n", "3075 url \n", "3076 url \n", "3077 url \n", "3078 url \n", "3079 url \n", "3080 url \n", "3081 url \n", "3082 url \n", "3083 url \n", "3084 url \n", "3085 url \n", "3086 url \n", "3087 url \n", "3088 url \n", "3089 url \n", "3090 url \n", "3091 url \n", "3092 url \n", "3093 url \n", "3094 url \n", "3095 url \n", "3096 url \n", "3097 url \n", "3098 url \n", "3099 url \n", "3100 url \n", "3129 url \n", "3133 url \n", "3134 url \n", "3135 url \n", "3136 url \n", "3137 url \n", "3138 url \n", "3139 url \n", "3140 url \n", "3141 url \n", "3142 url \n", "3143 url \n", "3144 url \n", "3145 url \n", "3146 url \n", "3147 url \n", "3148 url \n", "3149 url \n", "3412 url \n", "3439 url \n", "3443 url \n", "3444 url \n", "3467 url \n", "3468 url \n", "3477 url \n", "3519 url \n", "3659 url \n", "3983 url \n", "\n", " Observable \\\n", "221 https://help4windows.com/windows_7_shell32_dll.shtml \n", "373 https://oividaluxuosa.com/ke/miami.dll \n", "564 https://privatlab.com/s/v/nRl7zbAAjltBeLbRqrax \n", "600 https://emploimed.com/netr.dll \n", "602 https://www.ottenbourg.com/chester.dll \n", "728 https://anonfiles.com/Hai0P8t1uc/Dolfs_rar \n", "778 https://atlantisprojects.ca/cheryasd.dll \n", "783 https://parkisolutions.com/nerugin.dll \n", "942 http://109.230.199.73/k.exe \n", "943 http://109.230.199.73/k.dll \n", "1211 http://ozpve456vdzplanabllomqi6lfx67nlrrthquvcsrfxv7z3jreurmfqd.onion \n", "1293 http://i.prntscr.com/qMqzmSbHSS_QdlEUONrHZw.png \n", "1380 http://109.230.199.73/209.dll \n", "1381 http://109.230.199.73/209x64.exe \n", "1674 https://bradiolum.top/aprel.dll \n", "1811 file://157.230.60.143/download.jpg \n", "2452 http://31.14.*0.220/230*17*.dll,StartW \n", "2495 https://temp.sh/fJXCc/1.rar \n", "2502 http://bergmeitli.ch/2.dll \n", "2509 http://195.149.87.59/2_https_x64.dll \n", "2510 http://195.149.87.59/1_http_x64.dll \n", "2601 https://temp.sh/jDpqP/1.rar \n", "2767 https://temp.sh/copeR/tmp.zip \n", "2843 https://temp.sh/bctPM/f3cfb349.7z \n", "2863 http://4nmxrhdtbznfr7f3q6bhd4qxxfcxodao3h2txugojsizca4uhppdkzad.onion/private/168xavj5/M5kuzP_sa... \n", "3074 http://root@195.149.87.59/var/www/html/bec_http_111_x86-1637769956-T12B123Z_32-cr.dll \n", "3075 http://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769859-T0B1Z_64-cr.exe \n", "3076 https://root@195.149.87.59/var/www/html/bec_https_111_x64-1637770072-T12B123Z_64-cr.dll \n", "3077 http://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769920-T12B123Z_64-cr.dll \n", "3078 https://root@195.149.87.59/var/www/html/bec_https_111_x64-1637770087-T0B123Z_64-cr.exe \n", "3079 https://root@195.149.87.59/var/www/html/pe_https_111_x64-1637770298-T0B123Z_64-cr.exe \n", "3080 http://root@195.149.87.59/var/www/html/bec_http_111_x86-1637769886-T12B1Z_32-cr.dll \n", "3081 http://root@195.149.87.59/var/www/html/pe_http_111_x64-1637770246-T0Z_64-cr.exe \n", "3082 http://root@195.149.87.59/var/www/html/pe_http_111_x64-1637770240-T0B123Z_64-cr.exe \n", "3083 http://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769933-T0B123Z_64-cr.exe \n", "3084 https://root@195.149.87.59/var/www/html/bec_https_111_x86-1637770080-T12B1Z_32-cr.dll \n", "3085 http://root@195.149.87.59/var/www/html/pe_http_111_x64-1637770256-T0B1Z_64-cr.exe \n", "3086 http://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe \n", "3087 https://root@195.149.87.59/var/www/html/pe_https_111_x64-1637770347-T0Z_64-cr.exe \n", "3088 https://root@195.149.87.59/var/www/html/bec_https_111_x64-1637770051-T0B1Z_64-cr.exe \n", "3089 http://root@195.149.87.59/var/www/html/bec_http_111_x86-1637769971-T0B123Z_32-cr.exe \n", "3090 https://root@195.149.87.59/var/www/html/bec_https_111_x64-1637770033-T12B1Z_64-cr.dll \n", "3091 https://root@195.149.87.59/var/www/html/bec_https_111_x86-1637770126-T0B123Z_32-cr.exe \n", "3092 https://root@195.149.87.59/var/www/html/bec_https_111_x86-1637770066-T12Z_32-cr.dll \n", "3093 https://root@195.149.87.59/var/www/html/bec_https_111_x86-1637770112-T12B123Z_32-cr.dll \n", "3094 http://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769815-T12Z_64-cr.dll \n", "3095 https://root@195.149.87.59/var/www/html/bec_https_111_x64-1637770017-T12Z_64-cr.dll \n", "3096 http://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769837-T12B1Z_64-cr.dll \n", "3097 https://root@195.149.87.59/var/www/html/bec_https_111_x86-1637770089-T0Z_32-cr.exe \n", "3098 https://root@195.149.87.59/var/www/html/bec_https_111_x86-1637770099-T0B1Z_32-cr.exe \n", "3099 https://root@195.149.87.59/var/www/html/pe_https_111_x64-1637770356-T0B1Z_64-cr.exe \n", "3100 https://root@195.149.87.59/var/www/html/bec_https_111_x64-1637770042-T0Z_64-cr.exe \n", "3129 http://198.244.193.210/images/wolf.png \n", "3133 https://temp.sh/FwsSg/1.rar \n", "3134 https://195.149.87.59/bec_https_555_x86-1638188794-T12B123Z_32-cr.dll \n", "3135 http://195.149.87.59/bec_http_111_x86-1638187422-T0B123Z_32-cr.exe \n", "3136 https://195.149.87.59/bec_https_111_x64-1638188186-T0B123Z_64-cr.exe \n", "3137 https://195.149.87.59/bec_https_111_x64-1638188048-T12B123Z_64-cr.dll \n", "3138 http://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll \n", "3139 http://195.149.87.59/bec_http_555_x64-1638187557-T12B123Z_64-cr.dll \n", "3140 https://195.149.87.59/bec_https_111_x86-1638188296-T12B123Z_32-cr.dll \n", "3141 https://195.149.87.59/bec_https_111_x86-1638188430-T0B123Z_32-cr.exe \n", "3142 http://195.149.87.59/bec_http_111_x86-1638187295-T12B123Z_32-cr.dll \n", "3143 http://195.149.87.59/bec_http_111_x64-1638187173-T0B123Z_64-cr.exe \n", "3144 https://195.149.87.59/bec_https_555_x64-1638188681-T0B123Z_64-cr.exe \n", "3145 https://195.149.87.59/bec_https_555_x64-1638188562-T12B123Z_64-cr.dll \n", "3146 http://195.149.87.59/bec_http_555_x64-1638187720-T0B23Z_64-cr.exe \n", "3147 http://195.149.87.59/bec_http_555_x86-1638187956-T0B23Z_32-cr.exe \n", "3148 http://195.149.87.59/bec_http_111_x64-1638187035-T12B123Z_64-cr.dll \n", "3149 https://195.149.87.59/bec_https_555_x86-1638188919-T0B123Z_32-cr.exe \n", "3412 https://i.imgur.com/aEnyme5.png \n", "3439 https://shell.com/path/?dll \n", "3443 https://some/some/1.dll \n", "3444 https://srcdatastorage.z13.web.core.windows.net/jajnedhneb.appxbundle?param1=https://some/some/1... \n", "3467 https://shell.com/file.appinstaller&activationUri=custom-params:?data=https://host.com/1.dll \n", "3468 https://host.com/1.dll \n", "3477 https://shell.com/file.appinstaller&activationUri=custom-params:?data=https://host2.com/file.dll \n", "3519 https://privatlab.com/s/v/EJawrarkp6Iwxd2AzBgb \n", "3659 https://temp.sh/ueksm/222.7z \n", "3983 https://temp.sh/HXmZA/%D0%A1%D0%BD%D0%B8%D0%BazarBackdoor%D0%BE%D0%BA%20%D1%8D%D0%BA%D1%80%D0%B0... \n", "\n", " SourceIndex \\\n", "221 3064 \n", "373 5275 \n", "564 6661 \n", "600 7147 \n", "602 7149 \n", "728 7742 \n", "778 8169 \n", "783 8197 \n", "942 9765 \n", "943 9765 \n", "1211 11755 \n", "1293 13636 \n", "1380 15237 \n", "1381 15237 \n", "1674 19733 \n", "1811 21267 \n", "2452 33028 \n", "2495 33474 \n", "2502 33631 \n", "2509 33801 \n", "2510 33801 \n", "2601 36060 \n", "2767 39915 \n", "2843 41688 \n", "2863 42663 \n", "3074 48140 \n", "3075 48140 \n", "3076 48140 \n", "3077 48140 \n", "3078 48140 \n", "3079 48140 \n", "3080 48140 \n", "3081 48140 \n", "3082 48140 \n", "3083 48140 \n", "3084 48140 \n", "3085 48140 \n", "3086 48140 \n", "3087 48140 \n", "3088 48140 \n", "3089 48140 \n", "3090 48140 \n", "3091 48140 \n", "3092 48140 \n", "3093 48140 \n", "3094 48140 \n", "3095 48140 \n", "3096 48140 \n", "3097 48140 \n", "3098 48140 \n", "3099 48140 \n", "3100 48140 \n", "3129 48567 \n", "3133 48950 \n", "3134 48952 \n", "3135 48952 \n", "3136 48952 \n", "3137 48952 \n", "3138 48952 \n", "3139 48952 \n", "3140 48952 \n", "3141 48952 \n", "3142 48952 \n", "3143 48952 \n", "3144 48952 \n", "3145 48952 \n", "3146 48952 \n", "3147 48952 \n", "3148 48952 \n", "3149 48952 \n", "3412 52565 \n", "3439 52759 \n", "3443 52898 \n", "3444 52898 \n", "3467 53153 \n", "3468 53156 \n", "3477 53373 \n", "3519 54653 \n", "3659 56679 \n", "3983 60165 \n", "\n", " Input \n", "221 https://help4windows.com/windows_7_shell32_dll.shtml \n", "373 https://oividaluxuosa.com/ke/miami.dll , 3k copies with some neutral names so that the def does ... \n", "564 Check if it works\\nhttps://privatlab.com/s/v/nRl7zbAAjltBeLbRqrax\\n123123 \n", "600 1st link https://emploimed.com/netr.dll \n", "602 2nd link https://www.ottenbourg.com/chester.dll \n", "728 https://anonfiles.com/Hai0P8t1uc/Dolfs_rar\\npass - AF2gAS2ggd \n", "778 https://atlantisprojects.ca/cheryasd.dll \n", "783 https://parkisolutions.com/nerugin.dll \n", "942 http://109.230.199.73/k.exe\\n[13.05.2021 08:33:36] http://109.230.199.73/k.dll\\n[13.... \n", "943 http://109.230.199.73/k.exe\\n[13.05.2021 08:33:36] http://109.230.199.73/k.dll\\n[13.... \n", "1211 http://ozpve456vdzplanabllomqi6lfx67nlrrthquvcsrfxv7z3jreurmfqd.onion\\nadmin\\n[{/.)B4xcE3v=fd6 \n", "1293 http://i.prntscr.com/qMqzmSbHSS_QdlEUONrHZw.png \n", "1380 http://109.230.199.73/209.dll\\nhttp://109.230.199.73/209x64.exe \n", "1381 http://109.230.199.73/209.dll\\nhttp://109.230.199.73/209x64.exe \n", "1674 now again on the command dll flies error\\nhttps://bradiolum.top/aprel.dll\\n\\nhttps://auk64p35qeb... \n", "1811 [07/27/2021 19:01:56] https://www.ired.team/offensive-security/initial-access/netntlmv... \n", "2452 http://31.14.*0.220/230*17*.dll,StartW \n", "2495 Готово. \\n[20:42:06] pass: kJHDF273yubfjsbdf973uiwhgjsnkgb3oiygbhjsbdgkjhb \\n[20:42:13... \n", "2502 altmann-dias.com/1.dll\\nhttp://bergmeitli.ch/2.dll \n", "2509 http://195.149.87.59/1_http_x64.dll\\nhttp://195.149.87.59/2_https_x64.dll\\n\\nStartW \n", "2510 http://195.149.87.59/1_http_x64.dll\\nhttp://195.149.87.59/2_https_x64.dll\\n\\nStartW \n", "2601 https://temp.sh/jDpqP/1.rar \n", "2767 ADo, can I have a new crypt, please, the last build is already burning with something https://te... \n", "2843 https://temp.sh/bctPM/f3cfb349.7z \n", "2863 http://4nmxrhdtbznfr7f3q6bhd4qxxfcxodao3h2txugojsizca4uhppdkzad.onion/private/168xavj5/M5kuzP_sa... \n", "3074 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3075 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3076 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3077 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3078 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3079 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3080 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3081 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3082 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3083 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3084 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3085 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3086 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3087 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3088 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3089 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3090 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3091 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3092 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3093 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3094 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3095 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3096 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3097 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3098 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3099 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3100 111\\nexe - bec\\nhttp://root@195.149.87.59/var/www/html/bec_http_111_x64-1637769849-T0Z_64-cr.exe... \n", "3129 http://198.244.193.210/images/wolf.png \n", "3133 https://temp.sh/FwsSg/1.rar \n", "3134 555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b... \n", "3135 555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b... \n", "3136 555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b... \n", "3137 555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b... \n", "3138 555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b... \n", "3139 555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b... \n", "3140 555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b... \n", "3141 555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b... \n", "3142 555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b... \n", "3143 555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b... \n", "3144 555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b... \n", "3145 555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b... \n", "3146 555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b... \n", "3147 555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b... \n", "3148 555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b... \n", "3149 555\\nhttp://195.149.87.59/bec_http_555_x86-1638187809-T12B123Z_32-cr.dll\\nhttp://195.149.87.59/b... \n", "3412 https://i.imgur.com/aEnyme5.png \n", "3439 on the topic of hosting appinstaller + appxbundle + dll files nearby - I managed to do it last n... \n", "3443 - if we write in .appinstaller\\n Uri=\"https://srcdatastorage.z13.web.core.windows.net/jaj... \n", "3444 - if we write in .appinstaller\\n Uri=\"https://srcdatastorage.z13.web.core.windows.net/jaj... \n", "3467 ms-appinstaller:?source=https://shell.com/file.appinstaller&activationUri=custom-params:?data=ht... \n", "3468 &activationUri=custom-params:?data=https://host.com/1.dll \n", "3477 everything works for me)\\n\\nin short, the scheme is as follows:\\nin html land in this link:\\n \n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
IoCTypeObservableSourceIndexInput
287urlhttps://43oxsnqlub6aydymkwpn3agaaj7u2qexx4vwybgrwug46c6yldhuheid.onion/crpanel/4306https://43oxsnqlub6aydymkwpn3agaaj7u2qexx4vwybgrwug46c6yldhuheid.onion/crpanel/
741urlhttps://dnog7cgicmkrvugrfxexo34gikjbr54sd5skxj4r42aj4tuy2hjsw6qd.onion7860Ready to access the admin panel (storage)\\n[19:09:18] <bentley> https://dnog7cgicmkrvugrfxexo34g...
936urlhttp://epyclq65gskclmpu.onion:13379751http://epyclq65gskclmpu.onion:1337 - our file cleaner. will be on the SIA bransomwarechain
1211urlhttp://ozpve456vdzplanabllomqi6lfx67nlrrthquvcsrfxv7z3jreurmfqd.onion11755http://ozpve456vdzplanabllomqi6lfx67nlrrthquvcsrfxv7z3jreurmfqd.onion\\nadmin\\n[{/.)B4xcE3v=fd6
1218urlhttp://crdclub4wraumez4.onion/11827a cow was sold http://korovka32xc3t5cg.onion support@korovka.name and a card like http://crdclub...
1219urlhttp://korovka32xc3t5cg.onion11827a cow was sold http://korovka32xc3t5cg.onion support@korovka.name and a card like http://crdclub...
1255urlhttps://xzu6o2ni3hplvpmx.onion12638for HORSE\\nrobotbander@jabb.im\\n4815162342@jabb.im\\nsheppard@jabber.ru\\nsectorzero@jabb.im\\n\\n\\n...
1321urlhttp://i5rxdyozq7uyotqtmcj4hxq7modmxklejqysurqsf5ixhzw444jynvyd.onion/adminjx1p8zu25dr4ae7o.php?...14250http://i5rxdyozq7uyotqtmcj4hxq7modmxklejqysurqsf5ixhzw444jynvyd.onion/adminjx1p8zu25dr4ae7o.php?...
1675urlhttps://auk64p35qebertdsh576avhnswxdprft3kpmvsm5sixxof6bsbgryxqd.onion/logpost/more_ex/D1F299F1B...19733now again on the command dll flies error\\nhttps://bradiolum.top/aprel.dll\\n\\nhttps://auk64p35qeb...
1880urlhttps://xflemdsxjrjilw34dsxpvrxp5whnaut7hc5xejwuqs6eqrkt77bxkwid.onion21800https://xflemdsxjrjilw34dsxpvrxp5whnaut7hc5xejwuqs6eqrkt77bxkwid.onion\\nganesh: fp6fqpVxlrYsorC5...
1954urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/23069Here is the Tor for now http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/
2136urlhttp://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/50513/28827http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/50513/
2137urlhttp://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/55956/28828http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/55956/
2157urlhttps://mb5fbvx72fbod2hkirfecc5nh7lwq6ke7xocn7j2u7raiwbytvevpbad.onion/begemot/dero.git29668[core]\\nrepositoryformatversion=0\\nfilemode=true\\nbar = false\\nlogallrefupdates=true\\n[branch \"m...
2158urlhttps://mb5fbvx72fbod2hkirfecc5nh7lwq6ke7xocn7j2u7raiwbytvevpbad.onion/begemot/dero.git/»29669(base) begemot@big-comp:~/erl/dero/.git$ git push\\nfatal: «https://mb5fbvx72fbod2hkirfecc5nh7lwq...
2353urlhttp://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/56486/32626http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/56486/
2354urlhttp://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/56793/32627http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/56793/
2621urlhttps://ojdglzhrquash4igbx6e6wlthe3si4biabcpfopiw33uohvaufjgipad.onion36952https://ojdglzhrquash4igbx6e6wlthe3si4biabcpfopiw33uohvaufjgipad.onion
2794urlhttps://6yp2jljwgdxmwy4uxfaxbkjgm2txlxxb5akxn43cyaz3cjo2gqd65yid.onion40183jups 111111\\nhttps://6yp2jljwgdxmwy4uxfaxbkjgm2txlxxb5akxn43cyaz3cjo2gqd65yid.onion
2863urlhttp://4nmxrhdtbznfr7f3q6bhd4qxxfcxodao3h2txugojsizca4uhppdkzad.onion/private/168xavj5/M5kuzP_sa...42663http://4nmxrhdtbznfr7f3q6bhd4qxxfcxodao3h2txugojsizca4uhppdkzad.onion/private/168xavj5/M5kuzP_sa...
2866urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/6z3vSKVI_DEWEtech42840http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/6z3vSKVI_DEWEtech
2867urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/gWu2p5H1_TTC42850http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/gWu2p5H1_TTC
2878urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/Xa3Uo9Gk_KISTERS43520http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/Xa3Uo9Gk_KISTERS
2908urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/QIpblFS3_Harness_IP44194http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/QIpblFS3_Harness_IP
2926urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/ilUCk6R9_FRONTIER_SOFTWARE44954http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/ilUCk6R9_FRONTIER_SOFTWARE
2993urlhttp://czb6edlp7gsar4u5crxccldjkjn36p35fro7c7gck7wjumcrzq4efgid.onion/zeh7dkwfdxw99tdk/46844http://czb6edlp7gsar4u5crxccldjkjn36p35fro7c7gck7wjumcrzq4efgid.onion/zeh7dkwfdxw99tdk/
3010urlhttp://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/47381http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
3030urlhttp://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/support/fb5b77a7313635e3bc...47685<mango> <porovozik> I have a question about this mesh bro\\nhttp://continewsnv5otx5kaoje7krkto2qb...
3031urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/fFM9yCUN_Hutt47685<mango> <porovozik> I have a question about this mesh bro\\nhttp://continewsnv5otx5kaoje7krkto2qb...
3073urlhttps://m5px4n6r2jruhun3g2bp2uhj7d7w37dqglp34uvn5uhbz5n2tticgyad.onion/48135https://m5px4n6r2jruhun3g2bp2uhj7d7w37dqglp34uvn5uhbz5n2tticgyad.onion/
3104urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/9301xDIc_TRI-COUNTY_ELECTR...48167http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/9301xDIc_TRI-COUNTY_ELECTR...
3105urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/9ekt1FhM_RLD_Associates48168http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/9ekt1FhM_RLD_Associates
3108urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/S8NBp5rV_BSCR48172http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/S8NBp5rV_BSCR
3110urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/beNVUGLs_Spencer_Gifts_LLC48213http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/beNVUGLs_Spencer_Gifts_LLC...
3121urlhttp://czb6edlp7gsar4u5crxccldjkjn36p35fro7c7gck7wjumcrzq4efgid.onion/zeh7dkwfdxw99tdk/#/chat/55...48513http://czb6edlp7gsar4u5crxccldjkjn36p35fro7c7gck7wjumcrzq4efgid.onion/zeh7dkwfdxw99tdk/#/chat/55...
3153urlhttp://crypmix4m5iunofa25mpmiihdb56oaqg57tvrebqatc6otn3w65qhlid.onion/49123http://crypmix4m5iunofa25mpmiihdb56oaqg57tvrebqatc6otn3w65qhlid.onion/
3309urlhttp://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/51836http://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/
3325urlhttp://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chatList52154http://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chatList
3456urlhttp://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/NJv9nz4fcgefhEIiAcajtSgi4E...52993(01:29:20) cybergangster@q3mcco35auwcstmt.onion/1410513075163984878338200: ADo\\n(01:29:38) cyber...
3482urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/wqKecF1B_The_Briad_Group53652http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/wqKecF1B_The_Briad_Group
3483urlhttp://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chat/e3...53699eAfzfvt1WG6pViE5AMqFcEL8QDIZpTLHXshEMZH4WzNo9BNF2jWQ9Ez8esMtYZfK <http://l66orrehfw4hovqme625bav...
3484urlhttp://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chat/c3...53699eAfzfvt1WG6pViE5AMqFcEL8QDIZpTLHXshEMZH4WzNo9BNF2jWQ9Ez8esMtYZfK <http://l66orrehfw4hovqme625bav...
3485urlhttp://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chat/b6...53699eAfzfvt1WG6pViE5AMqFcEL8QDIZpTLHXshEMZH4WzNo9BNF2jWQ9Ez8esMtYZfK <http://l66orrehfw4hovqme625bav...
3486urlhttp://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chat/f8...53699eAfzfvt1WG6pViE5AMqFcEL8QDIZpTLHXshEMZH4WzNo9BNF2jWQ9Ez8esMtYZfK <http://l66orrehfw4hovqme625bav...
3487urlhttp://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chat/b5...53699eAfzfvt1WG6pViE5AMqFcEL8QDIZpTLHXshEMZH4WzNo9BNF2jWQ9Ez8esMtYZfK <http://l66orrehfw4hovqme625bav...
3495urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/GV8PuAI7_LAVI53828http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/GV8PuAI7_LAVI
3510urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/gQ1ZfJba_Shutterfly_Inc54466http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/gQ1ZfJba_Shutterfly_Inc
3608urlhttp://22q6iu4dmoex3xv5vdiceqzc2bkrc6262cak5ylp3vwauqw3zaxpuyad.onion/zeh7dkwfdxw99tdk/56064http://22q6iu4dmoex3xv5vdiceqzc2bkrc6262cak5ylp3vwauqw3zaxpuyad.onion/zeh7dkwfdxw99tdk/
3609urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/zTnGsBmj_Acuity_Brands56135http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/zTnGsBmj_Acuity_Brands
3612urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/4OlU3tF0_Minto_Group56324http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/4OlU3tF0_Minto_Group
3619urlhttp://pj3n6aix4l5lqoorwu5qbolmhwpqyabwpifdvn2w5qiznlqqayzmegid.onion/note/1U1kjIG12IiVvlWmhLlDX...56494http://pj3n6aix4l5lqoorwu5qbolmhwpqyabwpifdvn2w5qiznlqqayzmegid.onion/note/1U1kjIG12IiVvlWmhLlDX...
3671urlhttp://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/vOjdyhnt7ADeB867Pg5e1ANOWX...56924http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/vOjdyhnt7ADeB867Pg5e1ANOWX...
3672urlhttp://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk56948http://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk
3683urlhttps://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/57015https://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/
3887urlhttps://6k2zmzhc2wjs3u7rjykzuas2mtsd3w7va3alafnkzfiehmq2g3jrlmqd.onion/58308https://6k2zmzhc2wjs3u7rjykzuas2mtsd3w7va3alafnkzfiehmq2g3jrlmqd.onion/
3888urlhttps://6k2zmzhc2wjs3u7rjykzuas2mtsd3w7va3alafnkzfiehmq2g3jrlmqd.onion/note/1aPrgVchSA1Ay1TWQmnx...58309https://6k2zmzhc2wjs3u7rjykzuas2mtsd3w7va3alafnkzfiehmq2g3jrlmqd.onion/note/1aPrgVchSA1Ay1TWQmnx...
3925urlhttp://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/PygiWNjS_Financial_Horizon...58649ADo Financial Horizons Group! We are Conti Group. We want to inform that your company local netw...
4027urlhttp://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chat/f3...60643Hey ! how come they decipher Fail ZGQB3V6qmIWHLAwDH4dw4ijjACAknqMO2vvVBERGCICHODV86ciJyer49HHhAb...
\n", "" ], "text/plain": [ " IoCType \\\n", "287 url \n", "741 url \n", "936 url \n", "1211 url \n", "1218 url \n", "1219 url \n", "1255 url \n", "1321 url \n", "1675 url \n", "1880 url \n", "1954 url \n", "2136 url \n", "2137 url \n", "2157 url \n", "2158 url \n", "2353 url \n", "2354 url \n", "2621 url \n", "2794 url \n", "2863 url \n", "2866 url \n", "2867 url \n", "2878 url \n", "2908 url \n", "2926 url \n", "2993 url \n", "3010 url \n", "3030 url \n", "3031 url \n", "3073 url \n", "3104 url \n", "3105 url \n", "3108 url \n", "3110 url \n", "3121 url \n", "3153 url \n", "3309 url \n", "3325 url \n", "3456 url \n", "3482 url \n", "3483 url \n", "3484 url \n", "3485 url \n", "3486 url \n", "3487 url \n", "3495 url \n", "3510 url \n", "3608 url \n", "3609 url \n", "3612 url \n", "3619 url \n", "3671 url \n", "3672 url \n", "3683 url \n", "3887 url \n", "3888 url \n", "3925 url \n", "4027 url \n", "\n", " Observable \\\n", "287 https://43oxsnqlub6aydymkwpn3agaaj7u2qexx4vwybgrwug46c6yldhuheid.onion/crpanel/ \n", "741 https://dnog7cgicmkrvugrfxexo34gikjbr54sd5skxj4r42aj4tuy2hjsw6qd.onion \n", "936 http://epyclq65gskclmpu.onion:1337 \n", "1211 http://ozpve456vdzplanabllomqi6lfx67nlrrthquvcsrfxv7z3jreurmfqd.onion \n", "1218 http://crdclub4wraumez4.onion/ \n", "1219 http://korovka32xc3t5cg.onion \n", "1255 https://xzu6o2ni3hplvpmx.onion \n", "1321 http://i5rxdyozq7uyotqtmcj4hxq7modmxklejqysurqsf5ixhzw444jynvyd.onion/adminjx1p8zu25dr4ae7o.php?... \n", "1675 https://auk64p35qebertdsh576avhnswxdprft3kpmvsm5sixxof6bsbgryxqd.onion/logpost/more_ex/D1F299F1B... \n", "1880 https://xflemdsxjrjilw34dsxpvrxp5whnaut7hc5xejwuqs6eqrkt77bxkwid.onion \n", "1954 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/ \n", "2136 http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/50513/ \n", "2137 http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/55956/ \n", "2157 https://mb5fbvx72fbod2hkirfecc5nh7lwq6ke7xocn7j2u7raiwbytvevpbad.onion/begemot/dero.git \n", "2158 https://mb5fbvx72fbod2hkirfecc5nh7lwq6ke7xocn7j2u7raiwbytvevpbad.onion/begemot/dero.git/» \n", "2353 http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/56486/ \n", "2354 http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/56793/ \n", "2621 https://ojdglzhrquash4igbx6e6wlthe3si4biabcpfopiw33uohvaufjgipad.onion \n", "2794 https://6yp2jljwgdxmwy4uxfaxbkjgm2txlxxb5akxn43cyaz3cjo2gqd65yid.onion \n", "2863 http://4nmxrhdtbznfr7f3q6bhd4qxxfcxodao3h2txugojsizca4uhppdkzad.onion/private/168xavj5/M5kuzP_sa... \n", "2866 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/6z3vSKVI_DEWEtech \n", "2867 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/gWu2p5H1_TTC \n", "2878 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/Xa3Uo9Gk_KISTERS \n", "2908 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/QIpblFS3_Harness_IP \n", "2926 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/ilUCk6R9_FRONTIER_SOFTWARE \n", "2993 http://czb6edlp7gsar4u5crxccldjkjn36p35fro7c7gck7wjumcrzq4efgid.onion/zeh7dkwfdxw99tdk/ \n", "3010 http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ \n", "3030 http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/support/fb5b77a7313635e3bc... \n", "3031 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/fFM9yCUN_Hutt \n", "3073 https://m5px4n6r2jruhun3g2bp2uhj7d7w37dqglp34uvn5uhbz5n2tticgyad.onion/ \n", "3104 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/9301xDIc_TRI-COUNTY_ELECTR... \n", "3105 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/9ekt1FhM_RLD_Associates \n", "3108 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/S8NBp5rV_BSCR \n", "3110 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/beNVUGLs_Spencer_Gifts_LLC \n", "3121 http://czb6edlp7gsar4u5crxccldjkjn36p35fro7c7gck7wjumcrzq4efgid.onion/zeh7dkwfdxw99tdk/#/chat/55... \n", "3153 http://crypmix4m5iunofa25mpmiihdb56oaqg57tvrebqatc6otn3w65qhlid.onion/ \n", "3309 http://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/ \n", "3325 http://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chatList \n", "3456 http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/NJv9nz4fcgefhEIiAcajtSgi4E... \n", "3482 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/wqKecF1B_The_Briad_Group \n", "3483 http://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chat/e3... \n", "3484 http://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chat/c3... \n", "3485 http://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chat/b6... \n", "3486 http://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chat/f8... \n", "3487 http://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chat/b5... \n", "3495 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/GV8PuAI7_LAVI \n", "3510 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/gQ1ZfJba_Shutterfly_Inc \n", "3608 http://22q6iu4dmoex3xv5vdiceqzc2bkrc6262cak5ylp3vwauqw3zaxpuyad.onion/zeh7dkwfdxw99tdk/ \n", "3609 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/zTnGsBmj_Acuity_Brands \n", "3612 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/4OlU3tF0_Minto_Group \n", "3619 http://pj3n6aix4l5lqoorwu5qbolmhwpqyabwpifdvn2w5qiznlqqayzmegid.onion/note/1U1kjIG12IiVvlWmhLlDX... \n", "3671 http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/vOjdyhnt7ADeB867Pg5e1ANOWX... \n", "3672 http://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk \n", "3683 https://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/ \n", "3887 https://6k2zmzhc2wjs3u7rjykzuas2mtsd3w7va3alafnkzfiehmq2g3jrlmqd.onion/ \n", "3888 https://6k2zmzhc2wjs3u7rjykzuas2mtsd3w7va3alafnkzfiehmq2g3jrlmqd.onion/note/1aPrgVchSA1Ay1TWQmnx... \n", "3925 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/PygiWNjS_Financial_Horizon... \n", "4027 http://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chat/f3... \n", "\n", " SourceIndex \\\n", "287 4306 \n", "741 7860 \n", "936 9751 \n", "1211 11755 \n", "1218 11827 \n", "1219 11827 \n", "1255 12638 \n", "1321 14250 \n", "1675 19733 \n", "1880 21800 \n", "1954 23069 \n", "2136 28827 \n", "2137 28828 \n", "2157 29668 \n", "2158 29669 \n", "2353 32626 \n", "2354 32627 \n", "2621 36952 \n", "2794 40183 \n", "2863 42663 \n", "2866 42840 \n", "2867 42850 \n", "2878 43520 \n", "2908 44194 \n", "2926 44954 \n", "2993 46844 \n", "3010 47381 \n", "3030 47685 \n", "3031 47685 \n", "3073 48135 \n", "3104 48167 \n", "3105 48168 \n", "3108 48172 \n", "3110 48213 \n", "3121 48513 \n", "3153 49123 \n", "3309 51836 \n", "3325 52154 \n", "3456 52993 \n", "3482 53652 \n", "3483 53699 \n", "3484 53699 \n", "3485 53699 \n", "3486 53699 \n", "3487 53699 \n", "3495 53828 \n", "3510 54466 \n", "3608 56064 \n", "3609 56135 \n", "3612 56324 \n", "3619 56494 \n", "3671 56924 \n", "3672 56948 \n", "3683 57015 \n", "3887 58308 \n", "3888 58309 \n", "3925 58649 \n", "4027 60643 \n", "\n", " Input \n", "287 https://43oxsnqlub6aydymkwpn3agaaj7u2qexx4vwybgrwug46c6yldhuheid.onion/crpanel/ \n", "741 Ready to access the admin panel (storage)\\n[19:09:18] https://dnog7cgicmkrvugrfxexo34g... \n", "936 http://epyclq65gskclmpu.onion:1337 - our file cleaner. will be on the SIA bransomwarechain \n", "1211 http://ozpve456vdzplanabllomqi6lfx67nlrrthquvcsrfxv7z3jreurmfqd.onion\\nadmin\\n[{/.)B4xcE3v=fd6 \n", "1218 a cow was sold http://korovka32xc3t5cg.onion support@korovka.name and a card like http://crdclub... \n", "1219 a cow was sold http://korovka32xc3t5cg.onion support@korovka.name and a card like http://crdclub... \n", "1255 for HORSE\\nrobotbander@jabb.im\\n4815162342@jabb.im\\nsheppard@jabber.ru\\nsectorzero@jabb.im\\n\\n\\n... \n", "1321 http://i5rxdyozq7uyotqtmcj4hxq7modmxklejqysurqsf5ixhzw444jynvyd.onion/adminjx1p8zu25dr4ae7o.php?... \n", "1675 now again on the command dll flies error\\nhttps://bradiolum.top/aprel.dll\\n\\nhttps://auk64p35qeb... \n", "1880 https://xflemdsxjrjilw34dsxpvrxp5whnaut7hc5xejwuqs6eqrkt77bxkwid.onion\\nganesh: fp6fqpVxlrYsorC5... \n", "1954 Here is the Tor for now http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/ \n", "2136 http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/50513/ \n", "2137 http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/55956/ \n", "2157 [core]\\nrepositoryformatversion=0\\nfilemode=true\\nbar = false\\nlogallrefupdates=true\\n[branch \"m... \n", "2158 (base) begemot@big-comp:~/erl/dero/.git$ git push\\nfatal: «https://mb5fbvx72fbod2hkirfecc5nh7lwq... \n", "2353 http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/56486/ \n", "2354 http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/56793/ \n", "2621 https://ojdglzhrquash4igbx6e6wlthe3si4biabcpfopiw33uohvaufjgipad.onion \n", "2794 jups 111111\\nhttps://6yp2jljwgdxmwy4uxfaxbkjgm2txlxxb5akxn43cyaz3cjo2gqd65yid.onion \n", "2863 http://4nmxrhdtbznfr7f3q6bhd4qxxfcxodao3h2txugojsizca4uhppdkzad.onion/private/168xavj5/M5kuzP_sa... \n", "2866 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/6z3vSKVI_DEWEtech \n", "2867 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/gWu2p5H1_TTC \n", "2878 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/Xa3Uo9Gk_KISTERS \n", "2908 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/QIpblFS3_Harness_IP \n", "2926 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/ilUCk6R9_FRONTIER_SOFTWARE \n", "2993 http://czb6edlp7gsar4u5crxccldjkjn36p35fro7c7gck7wjumcrzq4efgid.onion/zeh7dkwfdxw99tdk/ \n", "3010 http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ \n", "3030 I have a question about this mesh bro\\nhttp://continewsnv5otx5kaoje7krkto2qb... \n", "3031 I have a question about this mesh bro\\nhttp://continewsnv5otx5kaoje7krkto2qb... \n", "3073 https://m5px4n6r2jruhun3g2bp2uhj7d7w37dqglp34uvn5uhbz5n2tticgyad.onion/ \n", "3104 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/9301xDIc_TRI-COUNTY_ELECTR... \n", "3105 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/9ekt1FhM_RLD_Associates \n", "3108 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/S8NBp5rV_BSCR \n", "3110 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/beNVUGLs_Spencer_Gifts_LLC... \n", "3121 http://czb6edlp7gsar4u5crxccldjkjn36p35fro7c7gck7wjumcrzq4efgid.onion/zeh7dkwfdxw99tdk/#/chat/55... \n", "3153 http://crypmix4m5iunofa25mpmiihdb56oaqg57tvrebqatc6otn3w65qhlid.onion/ \n", "3309 http://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/ \n", "3325 http://l66orrehfw4hovqme625bavlpz7m2achabov3iyqy76cai44oao6neqd.onion/zeh7dkwfdxw99tdk/#/chatList \n", "3456 (01:29:20) cybergangster@q3mcco35auwcstmt.onion/1410513075163984878338200: ADo\\n(01:29:38) cyber... \n", "3482 http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/wqKecF1B_The_Briad_Group \n", "3483 eAfzfvt1WG6pViE5AMqFcEL8QDIZpTLHXshEMZH4WzNo9BNF2jWQ9Ez8esMtYZfK \n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
IoCTypeObservableSourceIndexInput
46urlhttps://prnt.sc/wh26pt516Panel:\\n\\nhttps://prnt.sc/wh26qd\\nhttps://prnt.sc/wh26rb\\nhttps://prnt.sc/wh26pt
47urlhttps://prnt.sc/wh26rb516Panel:\\n\\nhttps://prnt.sc/wh26qd\\nhttps://prnt.sc/wh26rb\\nhttps://prnt.sc/wh26pt
48urlhttps://prnt.sc/wh26qd516Panel:\\n\\nhttps://prnt.sc/wh26qd\\nhttps://prnt.sc/wh26rb\\nhttps://prnt.sc/wh26pt
243urlhttps://prnt.sc/10ni7xz3370https://prnt.sc/10ni7xz broa what is it?
535urlhttps://prnt.sc/11cdg8c6368https://prnt.sc/11cdg8c
555urlhttps://prnt.sc/11h59lg6578now I’ve made an emphasis on spam, I’m sending it to collect cc from a fake epla, now I’ve remad...
556urlhttps://prnt.sc/11h4zwh6578now I’ve made an emphasis on spam, I’m sending it to collect cc from a fake epla, now I’ve remad...
557urlhttps://prnt.sc/11h4w3v6578now I’ve made an emphasis on spam, I’m sending it to collect cc from a fake epla, now I’ve remad...
558urlhttps://prnt.sc/11h5bqx-gmail6578now I’ve made an emphasis on spam, I’m sending it to collect cc from a fake epla, now I’ve remad...
559urlhttps://prnt.sc/11h58ex6578now I’ve made an emphasis on spam, I’m sending it to collect cc from a fake epla, now I’ve remad...
1293urlhttp://i.prntscr.com/qMqzmSbHSS_QdlEUONrHZw.png13636http://i.prntscr.com/qMqzmSbHSS_QdlEUONrHZw.png
1465urlhttps://prnt.sc/16x133m15672https://prnt.sc/16x133m
1545urlhttps://prnt.sc/180y0u916788https://prnt.sc/180y0u9\\n\\nand this is in PM I communicate with the encoder\\nhttps://prnt.sc/180...
1546urlhttps://prnt.sc/180y5tl16788https://prnt.sc/180y0u9\\n\\nand this is in PM I communicate with the encoder\\nhttps://prnt.sc/180...
1547urlhttps://prnt.sc/180y8tl16788https://prnt.sc/180y0u9\\n\\nand this is in PM I communicate with the encoder\\nhttps://prnt.sc/180...
1662urlhttps://prnt.sc/1b5gj8j19588+ file stealer\\nhttps://prnt.sc/1b5gj8j\\nlike this\\nHe drag and drop works\\nGenerating an execut...
2183urlhttps://prnt.sc/1ri6dev30371https://prnt.sc/1ri6dev
3981urlhttps://prnt.sc/26xz31260138hello\\nDinov threw off mmme yesterday but I did not start\\n https://prnt.sc/26xz312\\n\\nlook - I ...
\n", "" ], "text/plain": [ " IoCType Observable SourceIndex \\\n", "46 url https://prnt.sc/wh26pt 516 \n", "47 url https://prnt.sc/wh26rb 516 \n", "48 url https://prnt.sc/wh26qd 516 \n", "243 url https://prnt.sc/10ni7xz 3370 \n", "535 url https://prnt.sc/11cdg8c 6368 \n", "555 url https://prnt.sc/11h59lg 6578 \n", "556 url https://prnt.sc/11h4zwh 6578 \n", "557 url https://prnt.sc/11h4w3v 6578 \n", "558 url https://prnt.sc/11h5bqx-gmail 6578 \n", "559 url https://prnt.sc/11h58ex 6578 \n", "1293 url http://i.prntscr.com/qMqzmSbHSS_QdlEUONrHZw.png 13636 \n", "1465 url https://prnt.sc/16x133m 15672 \n", "1545 url https://prnt.sc/180y0u9 16788 \n", "1546 url https://prnt.sc/180y5tl 16788 \n", "1547 url https://prnt.sc/180y8tl 16788 \n", "1662 url https://prnt.sc/1b5gj8j 19588 \n", "2183 url https://prnt.sc/1ri6dev 30371 \n", "3981 url https://prnt.sc/26xz312 60138 \n", "\n", " Input \n", "46 Panel:\\n\\nhttps://prnt.sc/wh26qd\\nhttps://prnt.sc/wh26rb\\nhttps://prnt.sc/wh26pt \n", "47 Panel:\\n\\nhttps://prnt.sc/wh26qd\\nhttps://prnt.sc/wh26rb\\nhttps://prnt.sc/wh26pt \n", "48 Panel:\\n\\nhttps://prnt.sc/wh26qd\\nhttps://prnt.sc/wh26rb\\nhttps://prnt.sc/wh26pt \n", "243 https://prnt.sc/10ni7xz broa what is it? \n", "535 https://prnt.sc/11cdg8c \n", "555 now I’ve made an emphasis on spam, I’m sending it to collect cc from a fake epla, now I’ve remad... \n", "556 now I’ve made an emphasis on spam, I’m sending it to collect cc from a fake epla, now I’ve remad... \n", "557 now I’ve made an emphasis on spam, I’m sending it to collect cc from a fake epla, now I’ve remad... \n", "558 now I’ve made an emphasis on spam, I’m sending it to collect cc from a fake epla, now I’ve remad... \n", "559 now I’ve made an emphasis on spam, I’m sending it to collect cc from a fake epla, now I’ve remad... \n", "1293 http://i.prntscr.com/qMqzmSbHSS_QdlEUONrHZw.png \n", "1465 https://prnt.sc/16x133m \n", "1545 https://prnt.sc/180y0u9\\n\\nand this is in PM I communicate with the encoder\\nhttps://prnt.sc/180... \n", "1546 https://prnt.sc/180y0u9\\n\\nand this is in PM I communicate with the encoder\\nhttps://prnt.sc/180... \n", "1547 https://prnt.sc/180y0u9\\n\\nand this is in PM I communicate with the encoder\\nhttps://prnt.sc/180... \n", "1662 + file stealer\\nhttps://prnt.sc/1b5gj8j\\nlike this\\nHe drag and drop works\\nGenerating an execut... \n", "2183 https://prnt.sc/1ri6dev \n", "3981 hello\\nDinov threw off mmme yesterday but I did not start\\n https://prnt.sc/26xz312\\n\\nlook - I ... " ] }, "execution_count": 39, "metadata": {}, "output_type": "execute_result" } ], "source": [ "url_intel[url_intel['Observable'].str.contains(\"prntscr.com|prnt.sc\")]" ] }, { "cell_type": "markdown", "id": "50089750-6814-4bb1-aa70-d0920918f404", "metadata": {}, "source": [ "## Bitcoin Tracking" ] }, { "cell_type": "code", "execution_count": 40, "id": "e55e89c8-d39f-4427-b297-73fd18f80c69", "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
IoCTypeObservableSourceIndexInput
4071btcbc1q3efl4m2jcr6gk32usxnfyrxh294sr8plmpe3ye806bc1q3efl4m2jcr6gk32usxnfyrxh294sr8plmpe3ye
4072btc1MxtwUpH4cWAz4en4kqVNzAdx5gpk9etUC1131hello, the bitcoins are over, in total 6 new servers, two vpn subscriptions, an ipvanish subscri...
4073btcbc1qnf6drcfl786d70wlhfytyr5xg3qqgknlsh8dc31606bc1qnf6drcfl786d70wlhfytyr5xg3qqgknlsh8dc3
4074btc17mc4Qm7ka9jhQEUB5LTxP3gW3tsDYUJGQ1608hello, the cue ball is over, in total 8 new servers, two vpn subscriptions, and 18 renewals have...
4075btcbc1qy2083z665ux68zda3tfuh5xed2493uaj8whdwv1669bc1qy2083z665ux68zda3tfuh5xed2493uaj8whdwv
4076btc172KVKhMqL5CU1HN884RbArzu5DDL5hwE31680172KVKhMqL5CU1HN884RbArzu5DDL5hwE3\\n\\n0.01523011
4077btcbc1qc39qwc3nl2eyh2cu4ct6tyh9zqzp9ye993c0y21716bc1qc39qwc3nl2eyh2cu4ct6tyh9zqzp9ye993c0y2
4078btc1LLRL4vZajTtpjuBh5VpBD8zUg73CHUsq317721LLRL4vZajTtpjuBh5VpBD8zUg73CHUsq3
4079btc1Q6SsW88b94a4P3Rxtfr4pRxvhqqJAWvEc2868hello, cue ball is over, in total there are two av licenses, three new servers, three vpn subscr...
4080btc12YQDqmq3t6bCKPKMRWFmqrju4UMXbcqvF4561hello, the beats are over, in total 4 new servers, 3 vpn subscriptions, ipvaninsh subscription a...
\n", "
" ], "text/plain": [ " IoCType Observable SourceIndex \\\n", "4071 btc bc1q3efl4m2jcr6gk32usxnfyrxh294sr8plmpe3ye 806 \n", "4072 btc 1MxtwUpH4cWAz4en4kqVNzAdx5gpk9etUC 1131 \n", "4073 btc bc1qnf6drcfl786d70wlhfytyr5xg3qqgknlsh8dc3 1606 \n", "4074 btc 17mc4Qm7ka9jhQEUB5LTxP3gW3tsDYUJGQ 1608 \n", "4075 btc bc1qy2083z665ux68zda3tfuh5xed2493uaj8whdwv 1669 \n", "4076 btc 172KVKhMqL5CU1HN884RbArzu5DDL5hwE3 1680 \n", "4077 btc bc1qc39qwc3nl2eyh2cu4ct6tyh9zqzp9ye993c0y2 1716 \n", "4078 btc 1LLRL4vZajTtpjuBh5VpBD8zUg73CHUsq3 1772 \n", "4079 btc 1Q6SsW88b94a4P3Rxtfr4pRxvhqqJAWvEc 2868 \n", "4080 btc 12YQDqmq3t6bCKPKMRWFmqrju4UMXbcqvF 4561 \n", "\n", " Input \n", "4071 bc1q3efl4m2jcr6gk32usxnfyrxh294sr8plmpe3ye \n", "4072 hello, the bitcoins are over, in total 6 new servers, two vpn subscriptions, an ipvanish subscri... \n", "4073 bc1qnf6drcfl786d70wlhfytyr5xg3qqgknlsh8dc3 \n", "4074 hello, the cue ball is over, in total 8 new servers, two vpn subscriptions, and 18 renewals have... \n", "4075 bc1qy2083z665ux68zda3tfuh5xed2493uaj8whdwv \n", "4076 172KVKhMqL5CU1HN884RbArzu5DDL5hwE3\\n\\n0.01523011 \n", "4077 bc1qc39qwc3nl2eyh2cu4ct6tyh9zqzp9ye993c0y2 \n", "4078 1LLRL4vZajTtpjuBh5VpBD8zUg73CHUsq3 \n", "4079 hello, cue ball is over, in total there are two av licenses, three new servers, three vpn subscr... \n", "4080 hello, the beats are over, in total 4 new servers, 3 vpn subscriptions, ipvaninsh subscription a... " ] }, "execution_count": 40, "metadata": {}, "output_type": "execute_result" } ], "source": [ "btc_intel = ioc_df.loc[(ioc_df['IoCType'] == \"btc\")]\n", "btc_intel.head(10)" ] }, { "cell_type": "code", "execution_count": 41, "id": "d65e0e6d-fd63-4a12-b256-82aae3289f3d", "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
hash160addressn_txn_unredeemedtotal_receivedtotal_sentfinal_balancetxs
031b2fe08ed09d4fdcffe051d1ea8452544801703bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6802298000002298000000{'hash': '2b4c26e565d0be930ae6e817b703b1aa6ba731da7ba4705e81c2bb5d7ecfb967', 'ver': 1, 'vin_sz':...
131b2fe08ed09d4fdcffe051d1ea8452544801703bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6802298000002298000000{'hash': '336e8d542047377aa13fb73e41a8e59cf5feba9b2b646547a04cdb2a57472eed', 'ver': 1, 'vin_sz':...
231b2fe08ed09d4fdcffe051d1ea8452544801703bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6802298000002298000000{'hash': 'e5954c3d0552fa10abf9a9639ea3949ef154dccbe5fbecdd6e1afd34fb9dfd60', 'ver': 2, 'vin_sz':...
331b2fe08ed09d4fdcffe051d1ea8452544801703bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6802298000002298000000{'hash': 'a6409ef7e1e99baad3ec7ae1063be56820f870db79da91244d82eac79ff922b5', 'ver': 2, 'vin_sz':...
431b2fe08ed09d4fdcffe051d1ea8452544801703bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6802298000002298000000{'hash': 'bde120466b01e79ac3874033655a91aac0f0753ffaa8b2ebe804663d160418d5', 'ver': 1, 'vin_sz':...
531b2fe08ed09d4fdcffe051d1ea8452544801703bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6802298000002298000000{'hash': '60c05b7fc440a8c321510866a32d6bc29c78686b22283d5ef0ffc97cd4a91912', 'ver': 2, 'vin_sz':...
631b2fe08ed09d4fdcffe051d1ea8452544801703bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6802298000002298000000{'hash': 'ed559bc70719af3706623a3db2ed921c3e5dce84b2ec61a201cfb0181e85393a', 'ver': 1, 'vin_sz':...
731b2fe08ed09d4fdcffe051d1ea8452544801703bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6802298000002298000000{'hash': '74066e28cfed92b06ead14059fcab65e825a302cc036096a31869bf5e8b8a1c0', 'ver': 2, 'vin_sz':...
\n", "
" ], "text/plain": [ " hash160 \\\n", "0 31b2fe08ed09d4fdcffe051d1ea8452544801703 \n", "1 31b2fe08ed09d4fdcffe051d1ea8452544801703 \n", "2 31b2fe08ed09d4fdcffe051d1ea8452544801703 \n", "3 31b2fe08ed09d4fdcffe051d1ea8452544801703 \n", "4 31b2fe08ed09d4fdcffe051d1ea8452544801703 \n", "5 31b2fe08ed09d4fdcffe051d1ea8452544801703 \n", "6 31b2fe08ed09d4fdcffe051d1ea8452544801703 \n", "7 31b2fe08ed09d4fdcffe051d1ea8452544801703 \n", "\n", " address n_tx n_unredeemed \\\n", "0 bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6 8 0 \n", "1 bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6 8 0 \n", "2 bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6 8 0 \n", "3 bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6 8 0 \n", "4 bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6 8 0 \n", "5 bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6 8 0 \n", "6 bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6 8 0 \n", "7 bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6 8 0 \n", "\n", " total_received total_sent final_balance \\\n", "0 229800000 229800000 0 \n", "1 229800000 229800000 0 \n", "2 229800000 229800000 0 \n", "3 229800000 229800000 0 \n", "4 229800000 229800000 0 \n", "5 229800000 229800000 0 \n", "6 229800000 229800000 0 \n", "7 229800000 229800000 0 \n", "\n", " txs \n", "0 {'hash': '2b4c26e565d0be930ae6e817b703b1aa6ba731da7ba4705e81c2bb5d7ecfb967', 'ver': 1, 'vin_sz':... \n", "1 {'hash': '336e8d542047377aa13fb73e41a8e59cf5feba9b2b646547a04cdb2a57472eed', 'ver': 1, 'vin_sz':... \n", "2 {'hash': 'e5954c3d0552fa10abf9a9639ea3949ef154dccbe5fbecdd6e1afd34fb9dfd60', 'ver': 2, 'vin_sz':... \n", "3 {'hash': 'a6409ef7e1e99baad3ec7ae1063be56820f870db79da91244d82eac79ff922b5', 'ver': 2, 'vin_sz':... \n", "4 {'hash': 'bde120466b01e79ac3874033655a91aac0f0753ffaa8b2ebe804663d160418d5', 'ver': 1, 'vin_sz':... \n", "5 {'hash': '60c05b7fc440a8c321510866a32d6bc29c78686b22283d5ef0ffc97cd4a91912', 'ver': 2, 'vin_sz':... \n", "6 {'hash': 'ed559bc70719af3706623a3db2ed921c3e5dce84b2ec61a201cfb0181e85393a', 'ver': 1, 'vin_sz':... \n", "7 {'hash': '74066e28cfed92b06ead14059fcab65e825a302cc036096a31869bf5e8b8a1c0', 'ver': 2, 'vin_sz':... " ] }, "execution_count": 41, "metadata": {}, "output_type": "execute_result" } ], "source": [ "# Visualizing transaction for a single BTC address\n", "your_btc_address = 'bc1qxxe0uz8dp820mnl7q5w3a2z9y4zgq9cr6smlf6' # Genesis Block\n", "transactions_url = 'https://blockchain.info/rawaddr/' + your_btc_address\n", "df_btc = pd.read_json(transactions_url)\n", "df_btc" ] }, { "cell_type": "markdown", "id": "836f277b-e081-4646-af0a-ee94219dd909", "metadata": {}, "source": [ "## Pivoting through the IOCs using VirusTotal" ] }, { "cell_type": "markdown", "id": "6fe2bada-1c7c-414b-92a9-ec84f72fe234", "metadata": {}, "source": [ "### Loading Modules" ] }, { "cell_type": "code", "execution_count": 44, "id": "5bd0d62a-e2cc-4055-aa4b-2ff95601e146", "metadata": {}, "outputs": [], "source": [ "# Loading the VT API key\n", "from msticpy.common.provider_settings import get_provider_settings\n", "from msticpy.sectools.vtlookupv3 import VTLookupV3, VTEntityType\n", "import nest_asyncio\n", "vt_key = get_provider_settings(\"TIProviders\")[\"VirusTotal\"].args[\"AuthKey\"]\n", "\n", "# Instantiate vt_lookup object\n", "vt_lookup = VTLookupV3(vt_key)\n", "nest_asyncio.apply()" ] }, { "cell_type": "markdown", "id": "d846c4c6-5c49-4de3-abe8-3cf0244c5dbf", "metadata": {}, "source": [ "### Extracting information from an IP" ] }, { "cell_type": "code", "execution_count": 45, "id": "2a332f69-a3af-4ac9-93e6-7387f4d2d199", "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
indextarget_typetargetsourcesource_typerelationship_type
00filecf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58109.230.199.73ip_addressdownloaded_files
11file889e89b7c88b217f02e2b8ee54f7ee142aeb3fd60a1bd002482664a1dc8ba4ae109.230.199.73ip_addressdownloaded_files
22filea738cf48df8b168e783a8728baac0d208298361a696ef219de01faeba030316f109.230.199.73ip_addressdownloaded_files
33file21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868109.230.199.73ip_addressdownloaded_files
44filed2c9f693a2080c6382a0a29d74a1b5cb13a1deeb5dbe7ff1427a669ddf66f59e109.230.199.73ip_addressdownloaded_files
55file37ce6b6f7a4026a69784ee202283bb4d9f13651b84cb1abaec0ca4f359514a0b109.230.199.73ip_addressdownloaded_files
66filea4dc4dd1ddb449490d236dd1cbf087fbdf7f923616a9948bf32b28eff03e57c9109.230.199.73ip_addressdownloaded_files
77file61ca39fe6ad7c054484810ba7ca1f292efab2399a5607f42006d088302f07efc109.230.199.73ip_addressdownloaded_files
88filefe52c23ae690d0dcf2bda89c7ed75f798d2d94beaabed014de5b76159f336f5e109.230.199.73ip_addressdownloaded_files
99file83e285b9347fd74af8cb9c1962f584191325a98b50b2a6df6738aacd0c8054db109.230.199.73ip_addressdownloaded_files
1010file1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464109.230.199.73ip_addressdownloaded_files
\n", "
" ], "text/plain": [ " index target_type \\\n", "0 0 file \n", "1 1 file \n", "2 2 file \n", "3 3 file \n", "4 4 file \n", "5 5 file \n", "6 6 file \n", "7 7 file \n", "8 8 file \n", "9 9 file \n", "10 10 file \n", "\n", " target \\\n", "0 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 \n", "1 889e89b7c88b217f02e2b8ee54f7ee142aeb3fd60a1bd002482664a1dc8ba4ae \n", "2 a738cf48df8b168e783a8728baac0d208298361a696ef219de01faeba030316f \n", "3 21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868 \n", "4 d2c9f693a2080c6382a0a29d74a1b5cb13a1deeb5dbe7ff1427a669ddf66f59e \n", "5 37ce6b6f7a4026a69784ee202283bb4d9f13651b84cb1abaec0ca4f359514a0b \n", "6 a4dc4dd1ddb449490d236dd1cbf087fbdf7f923616a9948bf32b28eff03e57c9 \n", "7 61ca39fe6ad7c054484810ba7ca1f292efab2399a5607f42006d088302f07efc \n", "8 fe52c23ae690d0dcf2bda89c7ed75f798d2d94beaabed014de5b76159f336f5e \n", "9 83e285b9347fd74af8cb9c1962f584191325a98b50b2a6df6738aacd0c8054db \n", "10 1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464 \n", "\n", " source source_type relationship_type \n", "0 109.230.199.73 ip_address downloaded_files \n", "1 109.230.199.73 ip_address downloaded_files \n", "2 109.230.199.73 ip_address downloaded_files \n", "3 109.230.199.73 ip_address downloaded_files \n", "4 109.230.199.73 ip_address downloaded_files \n", "5 109.230.199.73 ip_address downloaded_files \n", "6 109.230.199.73 ip_address downloaded_files \n", "7 109.230.199.73 ip_address downloaded_files \n", "8 109.230.199.73 ip_address downloaded_files \n", "9 109.230.199.73 ip_address downloaded_files \n", "10 109.230.199.73 ip_address downloaded_files " ] }, "execution_count": 45, "metadata": {}, "output_type": "execute_result" } ], "source": [ "# Instantiate vt_lookup object\n", "IP = \"109.230.199.73\"\n", "ip_relation = vt_lookup.lookup_ioc_relationships(observable = IP, vt_type = 'ip_address', relationship = 'downloaded_files')\n", "ip_relation" ] }, { "cell_type": "markdown", "id": "ebfc7f67-2860-4fc8-b2b7-a0d330b9feb8", "metadata": {}, "source": [ "### Obtaining more details about a specific hash" ] }, { "cell_type": "code", "execution_count": 46, "id": "4fce9171-0287-4814-aa31-22bf5604ec95", "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
idtypetype_descriptiontlshvhashtridcreation_datenameslast_modification_datetype_tagcapabilities_tagssizeauthentihashtimes_submittedlast_submission_datemeaningful_namedownloadablesha256type_extensiontagscrowdsourced_ids_resultslast_analysis_dateunique_sourcesfirst_submission_datesha1...last_analysis_results.Fortinet.methodlast_analysis_results.Fortinet.engine_updatelast_analysis_results.AVG.categorylast_analysis_results.AVG.engine_namelast_analysis_results.AVG.engine_versionlast_analysis_results.AVG.resultlast_analysis_results.AVG.methodlast_analysis_results.AVG.engine_updatelast_analysis_results.Cybereason.categorylast_analysis_results.Cybereason.engine_namelast_analysis_results.Cybereason.engine_versionlast_analysis_results.Cybereason.resultlast_analysis_results.Cybereason.methodlast_analysis_results.Cybereason.engine_updatelast_analysis_results.Panda.categorylast_analysis_results.Panda.engine_namelast_analysis_results.Panda.engine_versionlast_analysis_results.Panda.resultlast_analysis_results.Panda.methodlast_analysis_results.Panda.engine_updatesigma_analysis_stats.highsigma_analysis_stats.mediumsigma_analysis_stats.criticalsigma_analysis_stats.lowcontext_attributes
0cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58fileWin32 DLLT110049E14B2A914FBEE6A82B984935611B07174624338DFEF03A4C375DE0E7E15A3EF25115076651d155d15555az43=z55[{'file_type': 'Win64 Executable (generic)', 'probability': 48.7}, {'file_type': 'Win16 NE execu...2021-06-28 19:55:54+00:00[197.dll, iduD2A1.tmp]2022-03-10 07:02:37+00:00pedll[]1812480d10a35c1bed8d5a4516a2e704d43f10d47ffd2aabd9ce9e04fb3446f62168bf12021-06-28 22:02:34+00:00197.dllTruecf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58dll[assembly, invalid-rich-pe-linker-version, detect-debug-environment, long-sleeps, 64bits, pedll][{'rule_category': 'non-standard-protocol', 'alert_severity': 'medium', 'rule_msg': 'DELETED BAD...2021-11-11 00:50:52+00:0012021-06-28 22:02:34+00:00ddf0214fbf92240bc60480a37c9c803e3ad06321...blacklist20211110maliciousAVG21.1.5827.0Win64:DropperX-gen [Drp]blacklist20211110type-unsupportedCybereason1.2.449Noneblacklist20210330maliciousPanda4.6.4.2Trj/CI.Ablacklist202111100110None
\n", "

1 rows × 538 columns

\n", "
" ], "text/plain": [ " id type \\\n", "0 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 file \n", "\n", " type_description \\\n", "0 Win32 DLL \n", "\n", " tlsh \\\n", "0 T110049E14B2A914FBEE6A82B984935611B07174624338DFEF03A4C375DE0E7E15A3EF25 \n", "\n", " vhash \\\n", "0 115076651d155d15555az43=z55 \n", "\n", " trid \\\n", "0 [{'file_type': 'Win64 Executable (generic)', 'probability': 48.7}, {'file_type': 'Win16 NE execu... \n", "\n", " creation_date names last_modification_date \\\n", "0 2021-06-28 19:55:54+00:00 [197.dll, iduD2A1.tmp] 2022-03-10 07:02:37+00:00 \n", "\n", " type_tag capabilities_tags size \\\n", "0 pedll [] 181248 \n", "\n", " authentihash \\\n", "0 0d10a35c1bed8d5a4516a2e704d43f10d47ffd2aabd9ce9e04fb3446f62168bf \n", "\n", " times_submitted last_submission_date meaningful_name downloadable \\\n", "0 1 2021-06-28 22:02:34+00:00 197.dll True \n", "\n", " sha256 \\\n", "0 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 \n", "\n", " type_extension \\\n", "0 dll \n", "\n", " tags \\\n", "0 [assembly, invalid-rich-pe-linker-version, detect-debug-environment, long-sleeps, 64bits, pedll] \n", "\n", " crowdsourced_ids_results \\\n", "0 [{'rule_category': 'non-standard-protocol', 'alert_severity': 'medium', 'rule_msg': 'DELETED BAD... \n", "\n", " last_analysis_date unique_sources first_submission_date \\\n", "0 2021-11-11 00:50:52+00:00 1 2021-06-28 22:02:34+00:00 \n", "\n", " sha1 ... \\\n", "0 ddf0214fbf92240bc60480a37c9c803e3ad06321 ... \n", "\n", " last_analysis_results.Fortinet.method \\\n", "0 blacklist \n", "\n", " last_analysis_results.Fortinet.engine_update \\\n", "0 20211110 \n", "\n", " last_analysis_results.AVG.category last_analysis_results.AVG.engine_name \\\n", "0 malicious AVG \n", "\n", " last_analysis_results.AVG.engine_version last_analysis_results.AVG.result \\\n", "0 21.1.5827.0 Win64:DropperX-gen [Drp] \n", "\n", " last_analysis_results.AVG.method last_analysis_results.AVG.engine_update \\\n", "0 blacklist 20211110 \n", "\n", " last_analysis_results.Cybereason.category \\\n", "0 type-unsupported \n", "\n", " last_analysis_results.Cybereason.engine_name \\\n", "0 Cybereason \n", "\n", " last_analysis_results.Cybereason.engine_version \\\n", "0 1.2.449 \n", "\n", " last_analysis_results.Cybereason.result \\\n", "0 None \n", "\n", " last_analysis_results.Cybereason.method \\\n", "0 blacklist \n", "\n", " last_analysis_results.Cybereason.engine_update \\\n", "0 20210330 \n", "\n", " last_analysis_results.Panda.category \\\n", "0 malicious \n", "\n", " last_analysis_results.Panda.engine_name \\\n", "0 Panda \n", "\n", " last_analysis_results.Panda.engine_version \\\n", "0 4.6.4.2 \n", "\n", " last_analysis_results.Panda.result last_analysis_results.Panda.method \\\n", "0 Trj/CI.A blacklist \n", "\n", " last_analysis_results.Panda.engine_update sigma_analysis_stats.high \\\n", "0 20211110 0 \n", "\n", " sigma_analysis_stats.medium sigma_analysis_stats.critical \\\n", "0 1 1 \n", "\n", " sigma_analysis_stats.low context_attributes \n", "0 0 None \n", "\n", "[1 rows x 538 columns]" ] }, "execution_count": 46, "metadata": {}, "output_type": "execute_result" } ], "source": [ "hash_details = vt_lookup.get_object(\"cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58\", \"file\")\n", "hash_details" ] }, { "cell_type": "markdown", "id": "322a3375-4deb-4ba8-99bf-e1c0298f10a7", "metadata": {}, "source": [ "### Get relationship for a specific hash" ] }, { "cell_type": "code", "execution_count": 47, "id": "a8da57d0-097d-448c-ae39-e0cf818e220d", "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
indextarget_typetargetsourcesource_typerelationship_type
00domain125.21.88.13.in-addr.arpacf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58filecontacted_domains
11domain130.155.190.20.in-addr.arpacf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58filecontacted_domains
22domain137.90.64.13.in-addr.arpacf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58filecontacted_domains
33domain150.32.88.40.in-addr.arpacf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58filecontacted_domains
44domain197.161.181.107.in-addr.arpacf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58filecontacted_domains
55domain83.188.255.52.in-addr.arpacf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58filecontacted_domains
66domainzizodream.comcf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58filecontacted_domains
\n", "
" ], "text/plain": [ " index target_type target \\\n", "0 0 domain 125.21.88.13.in-addr.arpa \n", "1 1 domain 130.155.190.20.in-addr.arpa \n", "2 2 domain 137.90.64.13.in-addr.arpa \n", "3 3 domain 150.32.88.40.in-addr.arpa \n", "4 4 domain 197.161.181.107.in-addr.arpa \n", "5 5 domain 83.188.255.52.in-addr.arpa \n", "6 6 domain zizodream.com \n", "\n", " source \\\n", "0 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 \n", "1 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 \n", "2 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 \n", "3 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 \n", "4 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 \n", "5 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 \n", "6 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 \n", "\n", " source_type relationship_type \n", "0 file contacted_domains \n", "1 file contacted_domains \n", "2 file contacted_domains \n", "3 file contacted_domains \n", "4 file contacted_domains \n", "5 file contacted_domains \n", "6 file contacted_domains " ] }, "execution_count": 47, "metadata": {}, "output_type": "execute_result" } ], "source": [ "contacted_domain = vt_lookup.lookup_ioc_relationships(observable = \"cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58\", vt_type = 'file', relationship = 'contacted_domains')\n", "contacted_domain" ] }, { "cell_type": "markdown", "id": "812f7b41-e5a7-4825-b1f3-b80091701f6f", "metadata": {}, "source": [ "### Get relationship for multiple hashes" ] }, { "cell_type": "code", "execution_count": 48, "id": "2330e31b-ab33-4fa1-8e72-f46ba91925af", "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
indextarget_typetargetsourcesource_typerelationship_typeidtypefirst_submission_datesizetype_descriptionmeaningful_namelast_submission_datetimes_submitted
00.0domain125.21.88.13.in-addr.arpacf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
11.0domain130.155.190.20.in-addr.arpacf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
22.0domain137.90.64.13.in-addr.arpacf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
33.0domain150.32.88.40.in-addr.arpacf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
44.0domain197.161.181.107.in-addr.arpacf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
55.0domain83.188.255.52.in-addr.arpacf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
66.0domainzizodream.comcf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
00.0domainkrinsop.com889e89b7c88b217f02e2b8ee54f7ee142aeb3fd60a1bd002482664a1dc8ba4aefilecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
0NaNNaNNaNNaNNaNNaNa738cf48df8b168e783a8728baac0d208298361a696ef219de01faeba030316ffileNot foundNot foundNot foundNot foundNot foundNot found
00.0domain1.155.190.20.in-addr.arpa21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
11.0domain106.89.54.20.in-addr.arpa21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
22.0domain152.68.35.23.in-addr.arpa21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
33.0domain226.101.242.52.in-addr.arpa21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
44.0domain234.151.42.104.in-addr.arpa21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
55.0domain41.69.35.23.in-addr.arpa21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
66.0domain48.193.43.104.in-addr.arpa21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
77.0domain80.69.35.23.in-addr.arpa21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
88.0domain83.188.255.52.in-addr.arpa21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
99.0domainprda.aadg.msidentity.com21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868filecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
0NaNNaNNaNNaNNaNNaNd2c9f693a2080c6382a0a29d74a1b5cb13a1deeb5dbe7ff1427a669ddf66f59efileNot foundNot foundNot foundNot foundNot foundNot found
0NaNNaNNaNNaNNaNNaN37ce6b6f7a4026a69784ee202283bb4d9f13651b84cb1abaec0ca4f359514a0bfileNot foundNot foundNot foundNot foundNot foundNot found
0NaNNaNNaNNaNNaNNaNa4dc4dd1ddb449490d236dd1cbf087fbdf7f923616a9948bf32b28eff03e57c9fileNot foundNot foundNot foundNot foundNot foundNot found
00.0domainfanklez.com61ca39fe6ad7c054484810ba7ca1f292efab2399a5607f42006d088302f07efcfilecontacted_domainsNaNNaNNaNNaNNaNNaNNaNNaN
0NaNNaNNaNNaNNaNNaNfe52c23ae690d0dcf2bda89c7ed75f798d2d94beaabed014de5b76159f336f5efileNot foundNot foundNot foundNot foundNot foundNot found
0NaNNaNNaNNaNNaNNaN83e285b9347fd74af8cb9c1962f584191325a98b50b2a6df6738aacd0c8054dbfileNot foundNot foundNot foundNot foundNot foundNot found
0NaNNaNNaNNaNNaNNaN1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464fileNot foundNot foundNot foundNot foundNot foundNot found
\n", "
" ], "text/plain": [ " index target_type target \\\n", "0 0.0 domain 125.21.88.13.in-addr.arpa \n", "1 1.0 domain 130.155.190.20.in-addr.arpa \n", "2 2.0 domain 137.90.64.13.in-addr.arpa \n", "3 3.0 domain 150.32.88.40.in-addr.arpa \n", "4 4.0 domain 197.161.181.107.in-addr.arpa \n", "5 5.0 domain 83.188.255.52.in-addr.arpa \n", "6 6.0 domain zizodream.com \n", "0 0.0 domain krinsop.com \n", "0 NaN NaN NaN \n", "0 0.0 domain 1.155.190.20.in-addr.arpa \n", "1 1.0 domain 106.89.54.20.in-addr.arpa \n", "2 2.0 domain 152.68.35.23.in-addr.arpa \n", "3 3.0 domain 226.101.242.52.in-addr.arpa \n", "4 4.0 domain 234.151.42.104.in-addr.arpa \n", "5 5.0 domain 41.69.35.23.in-addr.arpa \n", "6 6.0 domain 48.193.43.104.in-addr.arpa \n", "7 7.0 domain 80.69.35.23.in-addr.arpa \n", "8 8.0 domain 83.188.255.52.in-addr.arpa \n", "9 9.0 domain prda.aadg.msidentity.com \n", "0 NaN NaN NaN \n", "0 NaN NaN NaN \n", "0 NaN NaN NaN \n", "0 0.0 domain fanklez.com \n", "0 NaN NaN NaN \n", "0 NaN NaN NaN \n", "0 NaN NaN NaN \n", "\n", " source \\\n", "0 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 \n", "1 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 \n", "2 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 \n", "3 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 \n", "4 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 \n", "5 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 \n", "6 cf0a85f491146002a26b01c8aff864a39a18a70c7b5c579e96deda212bfeec58 \n", "0 889e89b7c88b217f02e2b8ee54f7ee142aeb3fd60a1bd002482664a1dc8ba4ae \n", "0 NaN \n", "0 21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868 \n", "1 21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868 \n", "2 21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868 \n", "3 21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868 \n", "4 21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868 \n", "5 21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868 \n", "6 21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868 \n", "7 21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868 \n", "8 21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868 \n", "9 21145b7f20221b447d2b58ca5aaa17f6eedba1f8aa2ed91ca5ffd696cc560868 \n", "0 NaN \n", "0 NaN \n", "0 NaN \n", "0 61ca39fe6ad7c054484810ba7ca1f292efab2399a5607f42006d088302f07efc \n", "0 NaN \n", "0 NaN \n", "0 NaN \n", "\n", " source_type relationship_type \\\n", "0 file contacted_domains \n", "1 file contacted_domains \n", "2 file contacted_domains \n", "3 file contacted_domains \n", "4 file contacted_domains \n", "5 file contacted_domains \n", "6 file contacted_domains \n", "0 file contacted_domains \n", "0 NaN NaN \n", "0 file contacted_domains \n", "1 file contacted_domains \n", "2 file contacted_domains \n", "3 file contacted_domains \n", "4 file contacted_domains \n", "5 file contacted_domains \n", "6 file contacted_domains \n", "7 file contacted_domains \n", "8 file contacted_domains \n", "9 file contacted_domains \n", "0 NaN NaN \n", "0 NaN NaN \n", "0 NaN NaN \n", "0 file contacted_domains \n", "0 NaN NaN \n", "0 NaN NaN \n", "0 NaN NaN \n", "\n", " id type \\\n", "0 NaN NaN \n", "1 NaN NaN \n", "2 NaN NaN \n", "3 NaN NaN \n", "4 NaN NaN \n", "5 NaN NaN \n", "6 NaN NaN \n", "0 NaN NaN \n", "0 a738cf48df8b168e783a8728baac0d208298361a696ef219de01faeba030316f file \n", "0 NaN NaN \n", "1 NaN NaN \n", "2 NaN NaN \n", "3 NaN NaN \n", "4 NaN NaN \n", "5 NaN NaN \n", "6 NaN NaN \n", "7 NaN NaN \n", "8 NaN NaN \n", "9 NaN NaN \n", "0 d2c9f693a2080c6382a0a29d74a1b5cb13a1deeb5dbe7ff1427a669ddf66f59e file \n", "0 37ce6b6f7a4026a69784ee202283bb4d9f13651b84cb1abaec0ca4f359514a0b file \n", "0 a4dc4dd1ddb449490d236dd1cbf087fbdf7f923616a9948bf32b28eff03e57c9 file \n", "0 NaN NaN \n", "0 fe52c23ae690d0dcf2bda89c7ed75f798d2d94beaabed014de5b76159f336f5e file \n", "0 83e285b9347fd74af8cb9c1962f584191325a98b50b2a6df6738aacd0c8054db file \n", "0 1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464 file \n", "\n", " first_submission_date size type_description meaningful_name \\\n", "0 NaN NaN NaN NaN \n", "1 NaN NaN NaN NaN \n", "2 NaN NaN NaN NaN \n", "3 NaN NaN NaN NaN \n", "4 NaN NaN NaN NaN \n", "5 NaN NaN NaN NaN \n", "6 NaN NaN NaN NaN \n", "0 NaN NaN NaN NaN \n", "0 Not found Not found Not found Not found \n", "0 NaN NaN NaN NaN \n", "1 NaN NaN NaN NaN \n", "2 NaN NaN NaN NaN \n", "3 NaN NaN NaN NaN \n", "4 NaN NaN NaN NaN \n", "5 NaN NaN NaN NaN \n", "6 NaN NaN NaN NaN \n", "7 NaN NaN NaN NaN \n", "8 NaN NaN NaN NaN \n", "9 NaN NaN NaN NaN \n", "0 Not found Not found Not found Not found \n", "0 Not found Not found Not found Not found \n", "0 Not found Not found Not found Not found \n", "0 NaN NaN NaN NaN \n", "0 Not found Not found Not found Not found \n", "0 Not found Not found Not found Not found \n", "0 Not found Not found Not found Not found \n", "\n", " last_submission_date times_submitted \n", "0 NaN NaN \n", "1 NaN NaN \n", "2 NaN NaN \n", "3 NaN NaN \n", "4 NaN NaN \n", "5 NaN NaN \n", "6 NaN NaN \n", "0 NaN NaN \n", "0 Not found Not found \n", "0 NaN NaN \n", "1 NaN NaN \n", "2 NaN NaN \n", "3 NaN NaN \n", "4 NaN NaN \n", "5 NaN NaN \n", "6 NaN NaN \n", "7 NaN NaN \n", "8 NaN NaN \n", "9 NaN NaN \n", "0 Not found Not found \n", "0 Not found Not found \n", "0 Not found Not found \n", "0 NaN NaN \n", "0 Not found Not found \n", "0 Not found Not found \n", "0 Not found Not found " ] }, "execution_count": 48, "metadata": {}, "output_type": "execute_result" } ], "source": [ "multiple_result = vt_lookup.lookup_iocs_relationships(ip_relation, relationship = 'contacted_domains')\n", "multiple_result" ] }, { "cell_type": "markdown", "id": "4dbe6fed-d6bb-45c9-8a86-ad502f05b8f8", "metadata": {}, "source": [ "# Conclusion\n", "\n", "This blog outlines how Python can be used to find valuable threat intelligence from data sets such as chat logs. It also presents details on how processing data using the MSTICPy library can be useful for enriching and hunting within environments, as well as collecting additional threat context. This notebook can be adapted for your own purpose or for other data source." ] } ], "metadata": { "kernelspec": { "display_name": "Python 3 (ipykernel)", "language": "python", "name": "python3" }, "language_info": { "codemirror_mode": { "name": "ipython", "version": 3 }, "file_extension": ".py", "mimetype": "text/x-python", "name": "python", "nbconvert_exporter": "python", "pygments_lexer": "ipython3", "version": "3.9.8" } }, "nbformat": 4, "nbformat_minor": 5 }