﻿<?xml version="1.0" encoding="utf-8"?>
<KaseyaImport>
  <ScriptExport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://www.kaseya.com/vsa/2008/12/Scripting">
    <Folder name="XMR v5.1" treePres="3">
      <Procedure name="XMR Endpoint Check v5.1" treePres="3" id="1547312417" folderId="806895044169805">
        <Body description="Procedure to check the endpoints for the mining exploit.&#xA;Created by Douglas Sanchez (douglas.sanchez@kaseya.com)">
          <If description="Check for the registry keys">
            <Condition name="Windows 32 or 64 Bit Check">
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
            </Condition>
            <Then>
              <If description="v1 Check">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\ScriptInit found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\a found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\b found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\c found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\d found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                  </Statement>
                  <Statement name="UpdateSystemInfo" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                    <Parameter xsi:type="StringParameter" name="Value" value="System Affected" />
                  </Statement>
                </Then>
                <Else>
                  <If description="v2 Check">
                    <Condition name="TestRegistryKey64">
                      <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System" />
                      <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                    </Condition>
                    <Then>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\Start found" />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System\a found." />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System\b found." />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System\c found." />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System\d found." />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                      </Statement>
                      <Statement name="UpdateSystemInfo" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                        <Parameter xsi:type="StringParameter" name="Value" value="System Affected" />
                      </Statement>
                    </Then>
                    <Else>
                      <Statement description="v4 Check" name="ExecuteShellCommand" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Command" value="echo IF (Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\RemovalTools -Name a){&quot;System Affected&quot; ^| Out-file #vAgentConfiguration.agentTempDir#\resultv3.txt} &gt;&gt; #vAgentConfiguration.agentTempDir#\resultv3.ps1" />
                        <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
                        <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
                      </Statement>
                      <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                        <Parameter xsi:type="StringParameter" name="Parameter2" value="#vAgentConfiguration.agentTempDir#\resultv3.ps1" />
                        <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
                      </Statement>
                      <If description="">
                        <Condition name="TestFile">
                          <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv3.txt" />
                          <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                          <Parameter xsi:type="StringParameter" name="Value" value="" />
                        </Condition>
                        <Then>
                          <Statement name="WriteScriptLogEntry" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                          </Statement>
                          <Statement name="UpdateSystemInfo" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                            <Parameter xsi:type="StringParameter" name="Value" value="System Affected" />
                          </Statement>
                        </Then>
                        <Else>
                          <Statement name="ExecuteShellCommand" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Command" value="echo IF (Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Tcpip -Name a){&quot;System Affected&quot; ^| Out-file #vAgentConfiguration.agentTempDir#\resultv4.txt} &gt;&gt; #vAgentConfiguration.agentTempDir#\resultv4.ps1" />
                            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
                            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
                          </Statement>
                          <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                            <Parameter xsi:type="StringParameter" name="Parameter2" value="#vAgentConfiguration.agentTempDir#\resultv4.ps1" />
                            <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
                          </Statement>
                          <If description="">
                            <Condition name="TestFile">
                              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv4.txt" />
                              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                              <Parameter xsi:type="StringParameter" name="Value" value="" />
                            </Condition>
                            <Then>
                              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                              </Statement>
                              <Statement name="UpdateSystemInfo" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                                <Parameter xsi:type="StringParameter" name="Value" value="System Affected" />
                              </Statement>
                            </Then>
                          </If>
                          <If description="V5 Check">
                            <Condition name="TestFile">
                              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\OneDriveStandaloneUpdater.exe" />
                              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                              <Parameter xsi:type="StringParameter" name="Value" value="" />
                            </Condition>
                            <Then>
                              <Statement name="UpdateSystemInfo" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                                <Parameter xsi:type="StringParameter" name="Value" value="System Affected" />
                              </Statement>
                              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                              </Statement>
                            </Then>
                          </If>
                          <Statement description="V6 Check" name="ExecuteShellCommand" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Command" value="echo IF (Get-ItemProperty -Path HKLM:\SOFTWARE\Policies\Power\PowerSettings -Name a){&quot;System Affected&quot; ^| Out-file #vAgentConfiguration.agentTempDir#\resultv5.txt} &gt;&gt; #vAgentConfiguration.agentTempDir#\resultv5.ps1" />
                            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
                            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
                          </Statement>
                          <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                            <Parameter xsi:type="StringParameter" name="Parameter2" value="#vAgentConfiguration.agentTempDir#\resultv5.ps1" />
                            <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
                          </Statement>
                          <If description="">
                            <Condition name="TestFile">
                              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv5.txt" />
                              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                              <Parameter xsi:type="StringParameter" name="Value" value="" />
                            </Condition>
                            <Then>
                              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                              </Statement>
                              <Statement name="UpdateSystemInfo" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                                <Parameter xsi:type="StringParameter" name="Value" value="System Affected" />
                              </Statement>
                            </Then>
                            <Else>
                              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="Comment" value="System Unaffected" />
                              </Statement>
                              <Statement name="UpdateSystemInfo" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                                <Parameter xsi:type="StringParameter" name="Value" value="System Unaffected" />
                              </Statement>
                            </Else>
                          </If>
                        </Else>
                      </If>
                    </Else>
                  </If>
                </Else>
              </If>
            </Then>
            <Else>
              <If description="">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\ScriptInit found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\a found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\b found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\c found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\d found." />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                  </Statement>
                  <Statement name="UpdateSystemInfo" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                    <Parameter xsi:type="StringParameter" name="Value" value="System Affected" />
                  </Statement>
                </Then>
                <Else>
                  <If description="">
                    <Condition name="TestRegistryKey">
                      <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System" />
                      <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                    </Condition>
                    <Then>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\Start found" />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System\a found." />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System\b found." />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System\c found." />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System\d found." />
                      </Statement>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                      </Statement>
                      <Statement name="UpdateSystemInfo" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                        <Parameter xsi:type="StringParameter" name="Value" value="System Affected" />
                      </Statement>
                    </Then>
                    <Else>
                      <Statement name="ExecuteShellCommand" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Command" value="echo IF (Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\RemovalTools -Name a){&quot;System Affected&quot; ^| Out-file #vAgentConfiguration.agentTempDir#\resultv3.txt} &gt;&gt; #vAgentConfiguration.agentTempDir#\resultv3.ps1" />
                        <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
                        <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
                      </Statement>
                      <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                        <Parameter xsi:type="StringParameter" name="Parameter2" value="#vAgentConfiguration.agentTempDir#\resultv3.ps1" />
                        <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
                      </Statement>
                      <If description="">
                        <Condition name="TestFile">
                          <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv3.txt" />
                          <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                          <Parameter xsi:type="StringParameter" name="Value" value="" />
                        </Condition>
                        <Then>
                          <Statement name="WriteScriptLogEntry" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                          </Statement>
                          <Statement name="UpdateSystemInfo" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                            <Parameter xsi:type="StringParameter" name="Value" value="System Affected" />
                          </Statement>
                        </Then>
                        <Else>
                          <Statement name="ExecuteShellCommand" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Command" value="echo IF (Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Tcpip -Name a){&quot;System Affected&quot; ^| Out-file #vAgentConfiguration.agentTempDir#\resultv4.txt} &gt;&gt; #vAgentConfiguration.agentTempDir#\resultv4.ps1" />
                            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
                            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
                          </Statement>
                          <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                            <Parameter xsi:type="StringParameter" name="Parameter2" value="#vAgentConfiguration.agentTempDir#\resultv4.ps1" />
                            <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
                          </Statement>
                          <If description="">
                            <Condition name="TestFile">
                              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv4.txt" />
                              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                              <Parameter xsi:type="StringParameter" name="Value" value="" />
                            </Condition>
                            <Then>
                              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                              </Statement>
                              <Statement name="UpdateSystemInfo" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                                <Parameter xsi:type="StringParameter" name="Value" value="System Affected" />
                              </Statement>
                            </Then>
                          </If>
                          <If description="V5 Check">
                            <Condition name="TestFile">
                              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\OneDriveStandaloneUpdater.exe" />
                              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                              <Parameter xsi:type="StringParameter" name="Value" value="" />
                            </Condition>
                            <Then>
                              <Statement name="UpdateSystemInfo" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                                <Parameter xsi:type="StringParameter" name="Value" value="System Affected" />
                              </Statement>
                              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                              </Statement>
                            </Then>
                          </If>
                          <Statement description="V6 Check" name="ExecuteShellCommand" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Command" value="echo IF (Get-ItemProperty -Path HKLM:\SOFTWARE\Policies\Power\PowerSettings -Name a){&quot;System Affected&quot; ^| Out-file #vAgentConfiguration.agentTempDir#\resultv5.txt} &gt;&gt; #vAgentConfiguration.agentTempDir#\resultv5.ps1" />
                            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
                            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
                          </Statement>
                          <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                            <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                            <Parameter xsi:type="StringParameter" name="Parameter2" value="#vAgentConfiguration.agentTempDir#\resultv5.ps1" />
                            <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
                          </Statement>
                          <If description="">
                            <Condition name="TestFile">
                              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv5.txt" />
                              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                              <Parameter xsi:type="StringParameter" name="Value" value="" />
                            </Condition>
                            <Then>
                              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="Comment" value="System Affected" />
                              </Statement>
                              <Statement name="UpdateSystemInfo" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                                <Parameter xsi:type="StringParameter" name="Value" value="System Affected" />
                              </Statement>
                            </Then>
                            <Else>
                              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="Comment" value="System Unaffected" />
                              </Statement>
                              <Statement name="UpdateSystemInfo" continueOnFail="false">
                                <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                                <Parameter xsi:type="StringParameter" name="Value" value="System Unaffected" />
                              </Statement>
                            </Else>
                          </If>
                        </Else>
                      </If>
                    </Else>
                  </If>
                </Else>
              </If>
            </Else>
          </If>
          <If description="Cleanup">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv3.txt" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv3.txt" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv3.ps1" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv3.ps1" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv4.txt" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv4.txt" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv4.ps1" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv4.ps1" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv5.txt" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv5.txt" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv5.ps1" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\resultv5.ps1" />
              </Statement>
            </Then>
          </If>
        </Body>
      </Procedure>
      <Procedure name="XMR Endpoint Cleanup v5.1" treePres="3" id="732343871" folderId="806895044169805">
        <Body description="Procedure to cleanup endpoints of the mining exploit.&#xA;Created by Douglas Sanchez (douglas.sanchez@kaseya.com)">
          <If description="Stop Powershell Process">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell_ise" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell_ise" />
              </Statement>
            </Then>
          </If>
          <If description="Stop OneDrive Process">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="E9RyTFy59JixGHESbDl3" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="E9RyTFy59JixGHESbDl3" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="OneDriveStandaloneUpdater" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="OneDriveStandaloneUpdater" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="Windows 32 or 64 Bit Check">
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
            </Condition>
            <Then>
              <If description="Cleanup Registry Keys">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts found. Deleting" />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\ScriptInit found. Deleting" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\ScriptInit" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\a" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\b" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\c" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\d" />
                  </Statement>
                  <Statement name="DeleteRegistryKey64" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="DeleteRegistryKey64" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\Start" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\a" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\b" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\c" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\d" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\x" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\1" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\a" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\b" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\c" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\d" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\x" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\1" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\a" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\b" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\c" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\d" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\e" />
                  </Statement>
                  <Statement name="DeleteRegistryValue64" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\x" />
                  </Statement>
                </Then>
              </If>
              <Statement description="Cleanup Scheduled Tasks" name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="schtasks /query /v /fo CSV &gt;&gt;  #vAgentConfiguration.agentTempDir#\tasks.csv" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Import-Csv #vAgentConfiguration.agentTempDir#\tasks.csv | Where-Object {$_.'Task To Run' -like '*ScriptInit*'} | Select -ExpandProperty TaskName | Format-Table | Out-File #vAgentConfiguration.agentTempDir#\findings.txt" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Import-Csv #vAgentConfiguration.agentTempDir#\tasks.csv | Where-Object {$_.'Task To Run' -like '*).Start*'} | Select -ExpandProperty TaskName | Format-Table | Out-File -append #vAgentConfiguration.agentTempDir#\findings.txt" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Import-Csv #vAgentConfiguration.agentTempDir#\tasks.csv | Where-Object {$_.'Task To Run' -like '*FromBase64String*'} | Select -ExpandProperty TaskName | Format-Table | Out-File -append #vAgentConfiguration.agentTempDir#\findings.txt" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Import-Csv #vAgentConfiguration.agentTempDir#\tasks.csv | Where-Object {$_.'Task To Run' -like '*E9RyTFy59JixGHESbDl3*'} | Select -ExpandProperty TaskName | Format-Table | Out-File -append #vAgentConfiguration.agentTempDir#\findings.txt" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="ExecuteShellCommand" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Command" value="echo foreach($line in Get-Content #vAgentConfiguration.agentTempDir#\findings.txt) { schtasks /Delete /TN $line /F ^| Out-File -append #vAgentConfiguration.agentTempDir#\results.txt} &gt;&gt; #vAgentConfiguration.agentTempDir#\clean.ps1" />
                <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
                <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="True" />
              </Statement>
              <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="#vAgentConfiguration.agentTempDir#\clean.ps1" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Set-ScheduledTask '\Microsoft\Windows\Time Zone\SynchronizeTimeZone' -Action (New-ScheduledTaskAction -Execute '%windir%\system32\tzsync.exe' -Argument '/boot')" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="IF (Test-path C:\Users\*\AppData\Roaming\E9RyTFy59JixGHESbDl3){Remove-Item C:\Users\*\AppData\Roaming\E9RyTFy59JixGHESbDl3 -force}" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
            </Then>
            <Else>
              <If description="Cleanup Registry Keys">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Powershell\Scripts" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Powershell\ScriptInit found. Deleting" />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Powershell\Scripts\a found. Deleting" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Powershell\ScriptInit" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\a" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\b" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\c" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\d" />
                  </Statement>
                  <Statement name="DeleteRegistryKey" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Powershell\Scripts" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="DeleteRegistryKey" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\System" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\Start" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\a" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\b" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\c" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\d" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\x" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\1" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\a" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\b" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\c" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\d" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\x" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tcpip\1" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\a" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\b" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\c" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\d" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\e" />
                  </Statement>
                  <Statement name="DeleteRegistryValue" continueOnFail="true">
                    <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Power\PowerSettings\x" />
                  </Statement>
                </Then>
              </If>
              <Statement description="Cleanup Scheduled Tasks" name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="schtasks /query /v /fo CSV &gt;&gt;  #vAgentConfiguration.agentTempDir#\tasks.csv" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Import-Csv #vAgentConfiguration.agentTempDir#\tasks.csv | Where-Object {$_.'Task To Run' -like '*ScriptInit*'} | Select -ExpandProperty TaskName | Format-Table | Out-File #vAgentConfiguration.agentTempDir#\findings.txt" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Import-Csv #vAgentConfiguration.agentTempDir#\tasks.csv | Where-Object {$_.'Task To Run' -like '*).Start*'} | Select -ExpandProperty TaskName | Format-Table | Out-File -append #vAgentConfiguration.agentTempDir#\findings.txt" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Import-Csv #vAgentConfiguration.agentTempDir#\tasks.csv | Where-Object {$_.'Task To Run' -like '*FromBase64String*'} | Select -ExpandProperty TaskName | Format-Table | Out-File -append #vAgentConfiguration.agentTempDir#\findings.txt" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="ExecuteShellCommand" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Command" value="echo foreach($line in Get-Content #vAgentConfiguration.agentTempDir#\findings.txt) { schtasks /Delete /TN $line /F ^| Out-File -append #vAgentConfiguration.agentTempDir#\results.txt} &gt;&gt; #vAgentConfiguration.agentTempDir#\clean.ps1" />
                <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
                <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="True" />
              </Statement>
              <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="#vAgentConfiguration.agentTempDir#\clean.ps1" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="Set-ScheduledTask '\Microsoft\Windows\Time Zone\SynchronizeTimeZone' -Action (New-ScheduledTaskAction -Execute '%windir%\system32\tzsync.exe' -Argument '/boot')" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
              <Statement name="Execute Powershell Command (32-bit, Run As System)" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="" />
                <Parameter xsi:type="StringParameter" name="Parameter2" value="IF (Test-path C:\Users\*\AppData\Roaming\E9RyTFy59JixGHESbDl3){Remove-Item C:\Users\*\AppData\Roaming\E9RyTFy59JixGHESbDl3 -force}" />
                <Parameter xsi:type="StringParameter" name="Parameter3" value="False" />
              </Statement>
            </Else>
          </If>
          <Statement description="Cleanup Repetitive Scheduled Task" name="WriteFile" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\CacheTask.xml" />
            <Parameter xsi:type="StringParameter" name="ManagedFile" value="VSASharedFiles\XMR\CacheTask" />
            <Parameter xsi:type="BooleanParameter" name="DeleteAfter" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="schtasks /end /tn &quot;\Microsoft\Windows\wininet\CacheTask&quot;" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="schtasks /delete /tn &quot;\Microsoft\Windows\wininet\CacheTask&quot; /F" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="schtasks /create /tn &quot;\Microsoft\Windows\wininet\CacheTask&quot; /xml #vAgentConfiguration.agentTempDir#\CacheTask.xml" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="WriteFile" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\sihboot.xml" />
            <Parameter xsi:type="StringParameter" name="ManagedFile" value="VSASharedFiles\XMR\sihboot.xml" />
            <Parameter xsi:type="BooleanParameter" name="DeleteAfter" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="schtasks /end /tn &quot;\Microsoft\Windows\WindowsUpdate\sihboot&quot;" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="schtasks /delete /tn &quot;\Microsoft\Windows\WindowsUpdate\sihboot&quot; /F" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="schtasks /create /tn &quot;\Microsoft\Windows\WindowsUpdate\sihboot&quot; /xml #vAgentConfiguration.agentTempDir#\sihboot.xml" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="schtasks /end /tn &quot;\Microsoft\Windows\ErrorDetails\ReportScriptErrors&quot;" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="schtasks /delete /tn &quot;\Microsoft\Windows\ErrorDetails\ReportScriptErrors&quot; /F" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <If description="Stop Powershell Process">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell_ise" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell_ise" />
              </Statement>
            </Then>
          </If>
          <If description="Stop OneDrive Process">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="E9RyTFy59JixGHESbDl3" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="E9RyTFy59JixGHESbDl3" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="OneDriveStandaloneUpdater" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="OneDriveStandaloneUpdater" />
              </Statement>
            </Then>
          </If>
          <If description="Download Endpoint Files and Cleanup">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\tasks.csv" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="GetFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="RemoteFileName" value="#vAgentConfiguration.agentTempDir#\tasks.csv" />
                <Parameter xsi:type="StringParameter" name="KServerFileName" value="ExploitCleanUp\tasks.csv" />
                <Parameter xsi:type="EnumParameter" name="Action" value="OverwriteSendAlert" />
              </Statement>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\tasks.csv" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\findings.txt" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="GetFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="RemoteFileName" value="#vAgentConfiguration.agentTempDir#\findings.txt" />
                <Parameter xsi:type="StringParameter" name="KServerFileName" value="ExploitCleanUp\findings.txt" />
                <Parameter xsi:type="EnumParameter" name="Action" value="OverwriteSendAlert" />
              </Statement>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\findings.txt" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\results.txt" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="GetFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="RemoteFileName" value="#vAgentConfiguration.agentTempDir#\results.txt" />
                <Parameter xsi:type="StringParameter" name="KServerFileName" value="ExploitCleanUp\results.txt" />
                <Parameter xsi:type="EnumParameter" name="Action" value="OverwriteSendAlert" />
              </Statement>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\results.txt" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\CacheTask.xml" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\CacheTask.xml" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\clean.ps1" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\clean.ps1" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\sihboot.xml" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\sihboot.xml" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\OneDriveStandaloneUpdater.exe" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\OneDriveStandaloneUpdater.exe" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\OneDriveStandaloneUpdater.exe" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#vAgentConfiguration.agentTempDir#\OneDriveStandaloneUpdater.exe" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="C:\Windows\System32\Tasks\Microsoft\Windows\ErrorDetails\ReportScriptErrors" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="DeleteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="C:\Windows\System32\Tasks\Microsoft\Windows\ErrorDetails\ReportScriptErrors" />
              </Statement>
            </Then>
          </If>
          <If description="Stop Powershell Process">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell_ise" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="powershell_ise" />
              </Statement>
            </Then>
          </If>
          <If description="Stop OneDrive Process">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="E9RyTFy59JixGHESbDl3" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="E9RyTFy59JixGHESbDl3" />
              </Statement>
            </Then>
          </If>
          <If description="">
            <Condition name="ApplicationRunning">
              <Parameter xsi:type="StringParameter" name="ApplicationName" value="OneDriveStandaloneUpdater" />
            </Condition>
            <Then>
              <Statement name="CloseApplication" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ApplicationName" value="OneDriveStandaloneUpdater" />
              </Statement>
            </Then>
          </If>
        </Body>
      </Procedure>
    </Folder>
  </ScriptExport>
  <Views>
    <View viewId="47817836" name="XMR" readWrite="0" shareAll="0" useMachFil="0" overMachFil="*" useGroupFil="0" groupIdFil="" showCheckin="0" onLineMin="1" showReboot="0" rebootMin="1" useGateway="0" onlyGateway="" useIpFil="0" ipFil="" useOs="0" useOsVer="0" osVer="*" useScriptPending="0" scriptId="0" useScriptResult="0" useScriptSince="0" scriptMin="1440" useViewColFil="0" useColFil="0" colIdFil="0" useAppName="0" appFilter="*" useAppVer="0" verFilter="0" usePatchFil="0" missingPatches="0" usePatchPolicy="0" usePatchScanPending="0" usePatchScanResult="0" usePatchScanSince="0" patchScanMin="1440" advFilter="1" advFilterId="26032915" usePatchRebootPending="0" usePatchAutoUpdateConfig="0" patchAutoUpdateConfig="0" usePatchRebootConfig="0" patchRebootConfig="0" usePatchTestStatus="0" patchTestStatus="-2" usePatchFileSrcConfig="0" patchFileSrcConfig="0,4" usePatchUnscanned="0" usePatchMissingKB="0" patchMissingKB="" showSuspended="0" useAgentCredentialStatus="0" agentCredentialStatus="-1" useMonsetFilter="0" MonsetID="0" useSNMPsetFilter="0" SNMPsetID="0" Override="0" andMachineLabelsFlag="False" colIdFilName="">
      <Filters>
        <ReportFilters filterId="26032915" colId="2015" showCol="1" filter="&quot;System Affected&quot;" itemId="91" />
      </Filters>
      <viewDefApp />
      <viewDeflabels />
      <viewShare>
        <viewAcl viewId="47817836" adminId="2" partitionId="1" adminGroupName="Master" internalCode="1" />
      </viewShare>
    </View>
  </Views>
  <Reports>
    <Report ReportInstanceId="142496857206568" PartitionId="1" ReportId="0" ReportTypeId="5" Name="XMR" Title="Wanna Cry Report (Custom Field)" OutputType="PDF" Orientation="Portrait" PageSize="Letter" DefaultSubject="" DefaultMessage="" RequiresApproval="False" HideHeader="N" HasTemporals="False" CoverDefinitionId="-1" FooterDefinitionId="-1" HeaderDefinitionId="-1" StandardReportId="" StandardReportName="" Description="" treeFullPath="myReports - Administrator.XMR" sortOrder="-1" Override="0">
      <Parameters />
      <ParametersGridValue />
      <ReportDataSetInstances>
        <ReportDataSetInstance Name="XMR" ObjectTypeID="0" Row="0" Column="0" ColSpan="2">
          <SerializedObject>PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTE2Ij8+PERhdGFQYXJ0VGFibGUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeG1sbnM6eHNkPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYSI+PFNlcmlyYWxpemVkT2JqZWN0IC8+PGRhdGFQYXJ0T2JqVHlwZT5UYWJsZTwvZGF0YVBhcnRPYmpUeXBlPjxQYWdlQnJlYWs+Tm9QYWdlQnJlYWs8L1BhZ2VCcmVhaz48VGl0bGU+WE1SPC9UaXRsZT48U2hvd1RpdGxlT25SZXBvcnQ+dHJ1ZTwvU2hvd1RpdGxlT25SZXBvcnQ+PERlc2NyaXB0aW9uIC8+PFRpdGxlQWxpZ25tZW50PkxlZnQ8L1RpdGxlQWxpZ25tZW50PjxEYXRhc2V0SWQ+MjAxOTwvRGF0YXNldElkPjxTZWxlY3RlZENvbHVtbnM+PERhdGFzZXRJbnN0YW5jZVNlbGVjdGVkQ29sdW1uPjxJZD4yMDE5MDAyPC9JZD48Q29sdW1uPkNvbXB1dGVyIE5hbWU8L0NvbHVtbj48QWxpYXMgLz48QWdncmVnYXRlPjA8L0FnZ3JlZ2F0ZT48V2VpZ2h0PjEwPC9XZWlnaHQ+PFJlZ2lzdHJhdGlvbklkPjA8L1JlZ2lzdHJhdGlvbklkPjxDb2x1bW5BbGlnbm1lbnQ+TGVmdDwvQ29sdW1uQWxpZ25tZW50PjwvRGF0YXNldEluc3RhbmNlU2VsZWN0ZWRDb2x1bW4+PERhdGFzZXRJbnN0YW5jZVNlbGVjdGVkQ29sdW1uPjxJZD4yMDE5MDUwPC9JZD48Q29sdW1uPlhNUjwvQ29sdW1uPjxBbGlhcyAvPjxBZ2dyZWdhdGU+MDwvQWdncmVnYXRlPjxXZWlnaHQ+MTA8L1dlaWdodD48UmVnaXN0cmF0aW9uSWQ+MDwvUmVnaXN0cmF0aW9uSWQ+PENvbHVtbkFsaWdubWVudD5MZWZ0PC9Db2x1bW5BbGlnbm1lbnQ+PC9EYXRhc2V0SW5zdGFuY2VTZWxlY3RlZENvbHVtbj48L1NlbGVjdGVkQ29sdW1ucz48SGVpZ2h0PjA8L0hlaWdodD48SGVpZ2h0VW5pdD5Qb2ludHM8L0hlaWdodFVuaXQ+PFdpZHRoPjA8L1dpZHRoPjxXaWR0aFVuaXQ+UG9pbnRzPC9XaWR0aFVuaXQ+PERhdGVGaWx0ZXJDb2x1bW4+MDwvRGF0ZUZpbHRlckNvbHVtbj48VGltZVJhbmdlVHlwZT45PC9UaW1lUmFuZ2VUeXBlPjxOdW1iZXJPZkRheXM+MDwvTnVtYmVyT2ZEYXlzPjxDdXN0b21TdGFydERhdGVUaW1lPjIwMTctMDQtMThUMTc6NDk6MzUtMDQ6MDA8L0N1c3RvbVN0YXJ0RGF0ZVRpbWU+PEN1c3RvbUVuZERhdGVUaW1lPjIwMTctMDUtMThUMTc6NDk6MzUtMDQ6MDA8L0N1c3RvbUVuZERhdGVUaW1lPjxSb3dMaW1pdFR5cGU+LTE8L1Jvd0xpbWl0VHlwZT48Um93TGltaXQ+MDwvUm93TGltaXQ+PEFkdmFuY2VkRmlsdGVycz48RGF0YXNldEluc3RhbmNlRmlsdGVyPjxBZHZhbmNlZEZpbHRlckZpZWxkPjIwMTkwNTA8L0FkdmFuY2VkRmlsdGVyRmllbGQ+PEFkdmFuY2VkRmlsdGVyT3BlcmF0b3I+TGlrZTwvQWR2YW5jZWRGaWx0ZXJPcGVyYXRvcj48QWR2YW5jZWRGaWx0ZXJWYWx1ZT5TeXN0ZW0gQWZmZWN0ZWQ8L0FkdmFuY2VkRmlsdGVyVmFsdWU+PFJlZ2lzdHJhdGlvbklkPjA8L1JlZ2lzdHJhdGlvbklkPjwvRGF0YXNldEluc3RhbmNlRmlsdGVyPjwvQWR2YW5jZWRGaWx0ZXJzPjxTZWxlY3REaXN0aW5jdD5mYWxzZTwvU2VsZWN0RGlzdGluY3Q+PE9yZGVyQnk+PERhdGFQYXJ0VGFibGVPcmRlckJ5PjxPcmRlckJ5Q29sdW1uPjIwMTkwMDI8L09yZGVyQnlDb2x1bW4+PERpcmVjdGlvbj5BU0M8L0RpcmVjdGlvbj48QWdncmVnYXRlPjA8L0FnZ3JlZ2F0ZT48UmVnaXN0cmF0aW9uSWQ+MDwvUmVnaXN0cmF0aW9uSWQ+PC9EYXRhUGFydFRhYmxlT3JkZXJCeT48L09yZGVyQnk+PENoYXJ0Q2F0ZWdvcnkgLz48Q2hhcnRWYWx1ZSAvPjxDaGFydFR5cGUgLz48Q2hhcnQzRD50cnVlPC9DaGFydDNEPjxHcm91cEJ5IC8+PFRleHRTaXplPk5vcm1hbDwvVGV4dFNpemU+PC9EYXRhUGFydFRhYmxlPg==</SerializedObject>
          <DataSet RegistrationId="2019" Name="Machine Summary" DataSetTypeId="0" />
        </ReportDataSetInstance>
      </ReportDataSetInstances>
    </Report>
  </Reports>
</KaseyaImport>