24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4f8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Prometheus.Generic Sample 07298425bee2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 07298425bee2…. Malware family: Ransom.Prometheus.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 10 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430","keywords":["Malicious","Ransom.Prometheus.Generic","malware analysis","sandbox report","threat intelligence","07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430"],"about":{"@type":"SoftwareApplication","name":"07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Prometheus.Generic","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T400,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "conhost.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "conhost.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "conhost.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "conhost.exe"26:T1827,Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; File: "07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00001700.00000000.178655.03670000.00000004.mdmp, 00000000-00001700.00000001.178677.036F0000.00000004.mdmp, 00000000-00001700.00000001.178677.03700000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00001700.00000000.178655.03670000.00000004.mdmp, 00000000-00001700.00000001.178677.036F0000.00000004.mdmp, 00000000-00001700.00000001.178677.03700000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00001700.00000000.178655.03670000.00000004.mdmp, 00000000-00001700.00000001.178677.036F0000.00000004.mdmp, 00000000-00001700.00000001.178677.03700000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001700.00000001.178677.036F0000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp, 00000000-00003592.00000000.178131.04990000.00000004.mdmp") Found reference to "smfjvcivQLl1rRC2Rnh" (Indicator: "RC2"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp") Found reference to "DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp") Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp, 00000000-00003592.00000000.178131.04990000.00000004.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp, 00000000-00003592.00000000.178131.04990000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp, 00000000-00003592.00000000.178131.04750000.00000004.mdmp, 00000000-00003592.00000000.178131.04990000.00000004.mdmp, 00000000-00003592.00000001.178345.04720000.00000004.mdmp, 00000000-00003592.00000001.178345.04780000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp, 00000000-00003592.00000000.178131.04750000.00000004.mdmp, 00000000-00003592.00000000.178131.04990000.00000004.mdmp, 00000000-00003592.00000001.178345.04720000.00000004.mdmp, 00000000-00003592.00000001.178345.04780000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp, 00000000-00003592.00000000.178131.04750000.00000004.mdmp, 00000000-00003592.00000000.178131.04990000.00000004.mdmp, 00000000-00003592.00000001.178345.04720000.00000004.mdmp, 00000000-00003592.00000001.178345.04780000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00003592.00000000.178131.00212000.00000002.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00003592.00000000.178131.04990000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00003592.00000000.178131.04990000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003592.00000000.178131.04990000.00000004.mdmp")27:T418,Found string - \.\root\cimv2; Source: "00000000-00001700.00000000.178655.1E3D0000.00000004.mdmp, 00000000-00001700.00000000.178655.1FDA0000.00000004.mdmp, 00000000-00001700.00000001.178677.1E3D2000.00000004.mdmp, 00000000-00001700.00000001.178677.1E3FF000.00000004.mdmp, 00000000-00001700.00000001.178677.1FE31000.00000004.mdmp") Found string - \\.\root\cimv2; Source: "00000000-00003592.00000000.178131.04990000.00000004.mdmp") Found string - \\.\root\cimv2:Win32_Process; Source: "00000000-00003592.00000000.178131.04990000.00000004.mdmp") Found string - \.\root\cimv2; Source: "00000000-00003592.00000000.178131.1DA20000.00000004.mdmp, 00000000-00003592.00000001.178345.1DA41000.00000004.mdmp, 00000000-00003592.00000001.178345.1DA67000.00000004.mdmp, 00000000-00003592.00000001.178345.1F437000.00000004.mdmp, 00000000-00003592.00000001.178345.1F4D0000.00000004.mdmp, 00000000-00003592.00000001.178345.1F551000.00000004.mdmp, 00000000-00003592.00000001.178345.1F60B000.00000004.mdmp, 00000000-00003592.00000001.178345.1F710000.00000004.mdmp")28:Ta43,"++*+(+(* s}s} }i{(1*^ 9})(* *:(* (C*&(U *F +{+Y*+.+{(*+^+{%+{&*+++*++{'+'_d}'-++{(+Y}(,*++++++.+{+*++++,{'+({(__d}'++{(_}(*+++++2+*(7+++++b`*+(M++(M++${&+ {%-Y-+{(-c-X*++++ +++b`*+oq ++oq +b++*(+ +(+2#+*( +2$+*( +2%+*( +2&+*( +2'+*( +2(+*( +2)+*( +2*+*( +2++*( +2,+*( +2-+*( +2.+*( +2/+*( +20+*( +21+*( +22+*( +23+*( +24+*( +25+*( +26+*( +27+*( +28+*( +29+*( +088:&,!88},8{8{8{~ f+uo! o ~ tf( ( ,- s" s# ($ * 8xs8s8t8v8t8{(98{8z( 80R89&8~ Kf8898~ ^f888~ Uf( o% ~ ,f( o% ~ ;f( o% ~ f( o% 9~ f( o% ~ f( o% ~ f( o% ,~ οf( o% ~ ſf( o% ~ f( o% ~ f( o% ~ f( o% ~ f( o% ~ tf( o% (*o& +L(' o& +(' ~O (W,=(( -- o -(( -o %-**s) 888( 8o% 88( 8o% 88(Y08 + X+ +++(, +(+ ++&݁98} (8y8~8T8QJ o- XRXTXo. YT+gXJo/ ~3XR+\XT-+.~XJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ o< XJ1~? o< XJ11XT+~@ XJoA XXJXTXJXJ2~B o< XF-~C +~D oE ~F o< oG & oH &-JXTJi?* 8I8}oI 8}8|8{@ )3" /C20Z,:3%+%+ , +#+(++--,*(J +(+ +( +oK +oL +08[8\ (8X8]8^T,8-8U8VJ8U8o3 (+ .9~7 (+ %8(+ oM sN o: ~; o< (+ oO XT+]XJo8 (+ 34~P oQ _oA ~R o< ~C oE +,XXJXTXJi-2~F o< (+ oG oH 8&JXTJi?* 88oI 888888A=P02rp rp ,8 %-~S~ r p8,98~T~ 8-~W~U8rp88~Z~Y+3+4(o9~\(r&-(:,+(l+,~Q(Z*s* 8((`8FsT 8O(c8Y(f8f(i8f 8eI0S+/, f%, a+$+&~-Y+~--++*++*+++++(-++('+0|8%E+Q-B8%L+A,8%M+1%,8%H+!--*(J +(J +(J +(J +0 98:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2s - 9 +%X 2,s .* 8H8P8T8W8X8f8i8k8s0\8%K+9/-%,8%F+'0-%,͍8%I+<*(J +(J +(J +08%I8^=9%G8Q> :? 9@-\8/+-~?8)08(Xb8&-~@%X88 2+&~?8 Xb(I~@%X 2::+(~? X b(I9~@%X 2+~?Xb(I~@%X 2:A9B:3 +(~Ab(I9~B9X 2*(J 8(J 8 888(I8 8880+f8g{+8c8dX}+-+^ 3,+Uz,+V{)+R+S{* X}*Ҝ--{* _}**88 88+sV ++++0T%98 8X8 {T8XJYE"n88{: 8}*88{8TJ/*{(;J9_, 9e}JcE8+H{(A,}+1~-}"~.}#}+s!}!}*{()%}/*{(;}{()-/*{(;}X{ {{(ET{XJY}{- }*{(5*{!{(Q-*{!(O}"{!(2}#}((*9** 88888/8;8C8B()8C0| ~ +\~]8X8Y~++&+ - -++ "+oW ++++~^(u-+(-** 88(u8+4J0D 88{ 88888{T8JYE0/8, 8{ 8(%Y% /9'*{"{(G% _, /#%:X/*}#}"}*~ Y}~ Y}{1J}X{{()TXJ/*-{{(;{XJX} }:{#{(G/*~}~}{1K }X{{()TXJ%-/*{{(;{XJX}{ {{(/{Y,} <* 88(.8888888#08{(8<8{%8{&3:,o*,88{'8{$88{% X}% _{${% X}% _b`{(_b`}'{(X}({'n-_b-%,Yj_i*82868:8>8R8Q8U8Y8X08v8{~C uf8~C Df888888~-sX ~(+(+~C 3f( o[ o\ o o% ~C "f( o[ o\ o o% A( 8Z( 8_s] 8Z8Y8Xo^ 8S(+8N&~C uf( ~C f( s] o^ (+~-sX ~(+(+~C ȼf( o[ o\ o o% &*s) 8 8 v0 8p:d~_8f8k%988~C ߼f88~C ּf88~C f( ~C f( -~C f( ~C f( ~C f( T+4J ~c~a ({({(+,XRzJXTJ-i2<88( 8 8( 8%8$&XR+ ~C ߼f( ~C ּf( ~C f( ~C f( ~C f( ~C f( - ~C f( XT,+j XJXT+?XJ~O~c~e({({(W,XRAXXJXTXJ,i2XXJXTXJ: i? &XR*XF* 8(x88A4=I i 0Q ~f+++0- %,j\ j\i-+0%,+,sa +(~++ +&*+*+FF0I88~%X9&88 _-888-e~7 *8,,@_-?_b~%X-X +7_b~%XbX~%XbX-~%XX- -~k~j~h(~(( ~l~j~h( i((~,(@ &-*888888 888` 088{+8X%}+8 18z8{*8Y _8-v 8-Y0c{*/Z0L{){){*(b {*X}**{){*X}*{)%X %Y0*(K*8483878>sV 8@8@8D 8J8Q08~_88%9y88~C hf88~C {f88T+3J ~c~a ({({(+, -XRlJXTJ,i-29nH(x8]8\8f8d( 8j8i( 8o8n&XR9*XF* 8 0,v8{%8{&/8z88X880880i1sc z_,3{'%X _{(_b`}'{(X}(}$}%}&*8e8isV 8k8k8j 8j8j8k8j0P++{69+"+#{2+{5++{6+++*+ +++++(b ++s +0r-~S~m+9~C Ff+4+9-,!~S~n+/~C ]f+*+/,-*%-*(+( +(`+(+( +(`+0f+T8Y-+- -+++++ +!+"od ,)++++oe +++ -o *sf 8 8=D0c+N+RR~q~o++++&+ X+FR'(+(++(S+++&XFR+XF* 88+ ;E 0 8~C 0f888~C f88-/8~C 0f88~C 'f( ( ,'(B,(g (,(g (3,(g ~C Bf( o! o ~C f( ( -+~C Bf( o! ~C 'f( ( ,-:V~C f( o! ( (,,(g ~C f( o! o ~C f( ( -+~C f( o! ~C 'f( ( , (R,(g ~C f( o! o ~C f( ( -+~C f( o! ~C 'f( ( ,'(h ,(g (D,(g (J,(g ~C f( o! o ~C f( ( -+~C f( o! ~C 'f( ( ,(8,(g (+,(g ~C Žf( o! o ~C f( ( -+~C Žf( o! ~C 'f( ( , (>,(g ~C f( o! o ~C f( ( -+~C Žf( o! ~C 'f( ( , (<,(g ~C f( o! o ~C f( ( -+~C f( o! ~C 'f( ( ,(0,(g (J,(g *8H( 8Mo! 8Ho 8C( 8H( 8C8D( 8Io! 8D08X8Y8Z8_98Z8[(H%c8S8TbY {z}@8GEy8(HTJ9XT+SX(HTX(HTXJ9io &XJsXJ(=&XXJXJXTXJJ2+w9%J(J 9%D(J (6iYoi (:-,o r_p 8ropsj zrpsk zol * 88s$8888 8 8 8+0b 8B,~_8;8@88~C f88~C f88~C hf( ~C {f( ~C bf( ~C -f( T+4J ~c~a ({({(+,XRkJXTJi2<8583( 8988( 8>8=&XR ~C f( ~C 8f( ~C f( ~C hf( ~C f( ~C f( ~C f( XT+j XJXT+BXJ~O~c~e({({(W,,,XR8XXJXTXJi2XXJXTXJ i? &XR*XF* 8(x88A4'; 088T8{%,X.B8uX8t8u8v8w{ +vTXJXJXJXTXJY-J*(&-{ {+1 {@J* 8z8y8z88888(N80j 8J~_8F8K 88~C Ⱥf88~C ۺf88~C f( ~C f( ~C f( ~C f( -^~C f( ~C f( :V~C qf( ~C df( T+4J ~c~a ({({(+,XRJXTJi2<88( 88( 88&XR9 ~C Ⱥf( , ~C ۺf( ~C f( ~C f( ~C f( ~C f( ~C f( : ~C f( ~C qf( ~C df( ~C wf( ~C Ff( ~C 8f( ~C -f( ~C 4f( XT+g XJXT+?XJ~O~c~e({({(W,XRAXXJXTXJi2XXJXT9!XJ i?&,XR*XF* 8(x88A4Vo{@0U~ +=-~]+6+7,~+ + +-++om +-~^(u ++(u+&* 3QQ0 9&~r+B+G+H+GU-~R +>,#~r+;+@-+<,LY j/XR9/(+++(n +(]+(++(n +&:v*XF* 8uu05@888888XT+D8X88XJT8XJ18XJ8%JXTXXJXTXJi2TX TXT+uXJJJXJXJY_bXTXJ 2?XXJ _TXJ _TXXJXJXJYXJY_cXTXXJXTXJ>XJ:},X T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{,(XJ(IXJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ (o 8?8>(L89(o 8482810T :8 8 ()%?8{ 8%2 -88_88-c*8ceTX_TXJ()%2{ J c`_(;c*X{(TXJ(){ J c` A_XJ0_(;-c**X{(TXJ(){ 2_XJ0_(;c** 88888 8(;888 0H~>+5_b~>+*c_b`~>+c_b`~>+c`h*++++0s,.~s+2~C f+-+2+7~O+3~C f+*+/+4--,1sp +( +(+ ++( +(W++&*+*+hh0,_+N,Z+Y{)+U+V{*+R+SX}*+M+N{)%X+F+F{* _}* _%Y =*+++ ++++++0888{*T88{+9 p18{++#88{*8{+YX _TXT---XJYTXJ%-"1'{) XJYXJ(b XJXJ{)JY(b {+XJY}+{+/sV zXJ* 8$8#8"8'8&858=8<8@0G+%{59++{2++{5+++*+ ++++(b ++s +0888T+Q8%X88{'Ҝ88{'d}'88{(Y}(YJXT{(10-J*X{&{%YTXJ1XJ{${%(b {%X}%{%{&Y_,4{$X{%TXJX}%XJ _}'}(JX* 8888888880888{4T8JEJ-+8p8q8q}58q{5/*8h{5 X}5(;}4()}6{6/*{6X}6(;{5{6X}8{89}2}4()}7{7/*{7X}7(;9}1};}4+AX()TXJ/*(;{1~<{;XJҜ{;X};{;{72{1s }3}1};}4+<{2X{;TXJX};XJ%}:{;{83*{3(G%_,/*2}:Y}9}4X~0{9TXJ() /*XJ(; ~/{9X +'{2X{;TXJX};XJ{: %Y 0{;{83*}48n 8h8g8f8k88()8880 8~_8888~C ʻf88~C ٻf88~C f( ~C f( ~C f( T+%J(F(r ,XRJXTJi238[8Y( 8_8^( 8d8c&~C f( ~C f( ~C f( XT+o XJ -XT+B XJ~O~c~e({({(W,/,XRAXXJXTXJ, i2XXJXTXJ i? &XR:0*XF* 8,(x8,8+ D{z}ZLW@#^ҸJ2:KE1SʶUU6n0Z2zB'ۤ۩<팰$L[b[ e.]A.¶vZ5Vwj|Jqn(4x&[2ט8ۇ, 2Ⱦba!ǡʜ O'@?/5+"ЩyEhE"&u-j 8U 7LK K.,]ꝏ,#L%>ZܐCknaq)k( p@ᝥg kBsDVŮ)I{dGl؈<1k Nol7ո3U#f5r򚂢j]bl*B_I:=&Cxܙs_HC( vC_.<=ɲ1N:b0sa&luqs$TYs&0d#/ ]77Zzse4Y9~'Cs~AnfnLv)gb37D^C @tkGBSJBv4.0.30319l#-`8 #Strings!#US"#GUID"T#Blobw< %3I;t rEJ/u ;|d9 n } %/! W^E 22}\2wo} }}}S}DffRfYf}D2? W}gw8P & b vE IE kkEJ a $) /! =#C$ C% DUNUNUNU NUNU w %NU NU PX R[ S^ Ta Ud Vg Xj Zm [p ]s _v `y! f|$ h' i* k, l/ m1 o3 p5 r7 s %uw*NN Wrz~31*1*33331VVVV 3333 6633 31311114 W3333333333 "",66DDI!T T$T#T'T&T*^)^ h/r.r13579<;>2 1 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~U&}['#H# P#hP#h]#nH# # *r?8-n-2o j ` # # # # # # #`/n0# # #1nH# $ 1n$H# 2n3n+$4d57\8:; p=#@@@5$B,C#PD%4E/E#G$6S$UIDtypeIDSystem.IOLdarg_Svalue__mscorlibSubSystem.Collections.GenericMicrosoft.VisualBasicget_IsStaticReadThreadAddDynamicMethodmethodOpCodeEndInvokeBeginInvokeIEnumerableIDisposableget_HandleRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleGetModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandleget_MainWindowTitleget_Moduleget_Nameget_MachineNameConfigPluginNameget_UserNameget_ProcessNameDateTimeget_FieldTypeValueTypeOfTypeget_ReturnTypeownerTypeget_ParameterTypeWhereSystem.CoreMethodBaseCloseDisposeCreateDelegateCreateGetStringDelegateMulticastDelegateCompilerGeneratedAttributeAttributeUsageAttributeAssemblyFileVersionAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeReadByteTryGetValueSetValueBuildTagO2nbgConfigSystem.ThreadingEncodingFromBase64StringDownloadStringToStringGetStringMathPathget_LengthiAsyncCallbackcallbackTransformFinalBlockCallTailcallkernel32.dllshlwapi.dllGetManifestResourceStreamMemoryStreamget_ItemSystemSymmetricAlgorithmICryptoTransformEnumget_MetadataTokenMinPluginget_TerminalServerSessionSystemInformationSystem.ReflectionManagementObjectCollectionArgumentOutOfRangeExceptionInvalidOperationExceptionFormatExceptionInternFieldInfoMethodInfoMemberInfoParameterInfoComputerInfoSleepSystem.LinqCharAesCryptoServiceProviderManagementObjectSearcherEnterToLowerGetEnumeratorGetILGenerator.ctor.cctorMonitorCreateDecryptorCreateEncryptorIntPtrdummy_ptrSystem.DiagnosticsGetFieldsGetMethodsMicrosoft.VisualBasic.DevicesSystem.Runtime.CompilerServicesOpCodesGetModulesGetProcessesCreateMemberRefsDelegatesBindingFlagsStringsget_TicksSystem.Windows.FormsContainsSystem.Collectionsget_CharsRuntimeHelpersGetParametersGetCurrentProcessAttributeTargetsManagementBaseObjectManagementObjectobjectGetSystem.NetRetSystem.Reflection.EmitOnInitExitFirstOrDefaultIAsyncResultresultWebClientSystem.ManagementEnvironmentget_CurrentCheckRemoteDebuggerPresentThreadStartConvertCallvirtMoveNextSystem.Textget_NowInitializeArraySystem.Security.CryptographyGetExecutingAssemblydummyCopyget_TotalPhysicalMemoryop_EqualityEmptyMemberRefsProxy{c6cf4687-62c8-4193-867c-25ba4a74a2c9}{11710c1e-2f1e-4e7f-b6bd-fb70c101177c}{9d03f632-95a4-4c86-bf28-c41d3419552e}~01461M{9d03f632-95a4-4c86-bf28-c41d3419552e}versionaSelected compression algorithm is not supported.Unknown Header,P͔HC94Vz\V4 ?_ :%m%! = A I Q I Y a a a aaa a ) aa q ! ! %!%)a ei e8%LX\d` \TXm\\ X`dXX q %X TX`\X`Xl \ XdX|x = A I Q I Y TWrapNonExceptionThrowslD@ mmm"aaAm!!IIIII IIIq lLqYYIII| _CorDllMainmscoree.dll% @0HX4VS_VERSION_INFO?,StringFileInfo000004B0$FileVersion$InternalName(LegalCopyright ,OriginalFilename(ProductVersion,Assembly VersionDVarFileInfo$Translation0", Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PELb" n @ `t@ K $@ H.textt `.rsrc$ @@.reloc@@BPH<[c|w{ko0g+׫vʂ}YGԢr&6?4q1#'u nZR;ֳ)/S [j˾9JLXCM3EPfHa5WiَU(ߌ BhA-TR j068@|9/4CDT{2#=LBN.f($v[Im%rdhԤ\]elpHP^FWث XE,?k:AOgst"57unGq)ŉobV>Ky xZݨ31Y'_`QJ -zɜ;M*((*B++ }*++:( }*b++*(G +(g+>+%*s+R~++*+(+>(("*>((*B++ }'*++fs })( (!*.+{(*+B++ }(*++B++ }**++.+{+*+B++ }+*++>(("*>(%('*B++ },*++>(("*>(((+*.+{-*+B++ }-*++zs }.s }/(*f+ {.++*++o +f+ {.++*++o +f+ {/++*++o ++{.+ +{/+*+o ++o +z+{.++ + *+++o +R+{.+*+o +f+ {.+ *+o + *b++*(G +(g+**R }E( *&(P*++gF*(G +(g+( }Z}Y}[}X*.+{Z*+.+{[*+.+{X*+.+{Y*+( -~] ׹f(is zo) t}\*b++*(G +(g+"( *(^*"(_*( *+*++{+'_d}-++{+Y},*++++++z~+ {_+ t*+(+.+{)*++ ~+ +t**++(++${+ {-Y-+{-c-X*++++# _b,+- _d%,Z,a*+++ +++b`*+o ++o +^+{+{*++.+{^*++++,{+({__d}++{_}*+++++++++b`*+(++(+,+n.+t.,+,- * *+*+++++ _d+- +Y%,_-b,`*++++F +{Y*+.+{*++++ dm++ -X++m+,*+++(x++++(x+.+{*+z~+ {\+ t*+(+b,++*(G +(g+>++*+(+( s}}s}~}wi{}(*^ g}( *:( (*&(0 *2E+*(e+2F+*(e+2G+*(e+2H+*(e+2I+*(e+2J+*(e+2K+*(e+2L+*(e+2M+*(e+2N+*(e+2O+*(e+2P+*(e+2Q+*(e+2R+*(e+2S+*(e+2T+*(e+2U+*(e+2V+*(e+2W+*(e+2X+*(e+2Y+*(e+2Z+*(e+2[+*(e+2\+*(e+2]+*(e+2^+*(e+2_+*(e+2`+*(e+2a+*(e+2b+*(e+2c+*(e+2d+*(e+2e+*(e+2f+*(e+2g+*(e+2h+*(e+2i+*(e+2j+*(e+2k+*(e+2l+*(e+2m+*(e+2n+*(e+2o+*(e+2p+*(e+2q+*(e+2r+*(e+2s+*(e+2t+*(e+2u+*(e+2v+*(e+2w+*(e+2x+*(e+2y+*(e+2z+*(e+2{+*(e+2|+*(e+2}+*(e+2~+*(e+2+*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+0 8~8~:&8~ ݾf88Y98d8i8j9&~ f(i(" ( :9~ f(i(" ~ f(i( ~%-&~s %(+(+~ %-&~s % o ~ f(i(" ~ f(i( ~ %-&~ s % (+(+~%-&~s %o ~ f(i(" ~ f(i( T,[+_s J} {s o o 30 {~ f(i( (+ s o JXTJi2~ ¾f(i(? ~ f(i~ f(i(" ~ f(i( (+T( ~ Of(i( o (+-~ ¾f(i(? ~ bf(io ((888&~ Af(io Y9s XR(, ( -~ 4f(io 8~ f(is ~ ޿f(i( T+oJ( oY o ,Jo o ( (4 ~ տf(i(" ( (+(o XRJXTJi2&(+(+XTXF,X(+T~~ f(iXJo ~ f(iX( ~ ~f(i( (? ~ uf(i( o (~ Pf(io Y9;:~ Gf(i (w ~ *f(i(" ( 9 ~ *f(i(" ~ =f(i( (+~%-&~s %o ~ 4f(i( (+~ %-&~s % o ~ ~ f(i(" ( ,e ~ f(i(" ( T+=-J ~ f(i ( ~ uf(i( JXTJi2~ (ro +x( %%~ f(i%%~ f(i%%~ f(i%%~ uf(i( ( :| o ~ ּf(i((" ~ f(i(? %~ f(i%(%~ Sf(i%(%~ Jf(i%(%~ Of(i% %~ f(i% (% ~ f(i%%~ f(i% ( o (+ ~ f(i(? o (~~ ƽf(i o &~ f(io Y9(4 o ~ f(i(" ( ,9~ f(i(4 o ~ f(i(" ( ((4 o ~ Rf(i(" ( ,9~ )f(i(4 o ~ Rf(i(" ( (&~* 8]o 8]o 8_8^(i8co 8^A|Cv!0,D~~ ~f+8~+8{+4~ af+/~+/+0+5~+5+6(ݷ(i++(+(i++(+(++(+&~( ~(~~ ~f(i~{(~ af(i~((~((~(--&*~0,<-9~+T+U+] j/F~~+S+T+Y~ Ѻf+T+Y-&,!, ~~+Ls ((**+s 8(8+s +(+(i+(++0T~~ f+~+++ ~+ +!,%&&*(i++(+(++(+(+0~~+r8s8x~ df8s8x-P~~+t+x8}~ 7f+{(-*~~s (~ Jf(i(**8s 8(8~(i8(8~8s 8~(8y(i8{0T~~ f+~+++ ~+ +!,%&&*(i++(+(++(+(+0T~~ f+~+++ ~+ +!,%&&*(i++(+(++(+(+0888,*888888YEg38 }o/ ( }o *: }o/ ( }o *o %92o/ (.~ +f(io/ sz }}o *X(:XF:-( }}}}*:" }}o Jo /Jo o (* 8l8k( 8f8h8go/ 8c(8^8]8\08\8]{-~ ֺf8M8Rz~8Q{8M/$~ f8E~ ֺf8@8Ez-{(%o /$~ f(i~ ֺf(is zs o 8r( {3 ~{(o 8B:{-',{s)P{8{3_s o 1? o +( {) o ( -o o u8~ f(isz9F{:~{~(X(,XJs& +=~{o~((, Os +{s) o 1@ o +( {)o ( -o o o38{@s, o 1@ o +( {)o ( -o o o3 u+A{-{+-{3o#u+~ Vf(isz( : o ,~ f(isz** 88(i8s 88(8(i8(i8s 8AdD#g0$T$;0,8-~0 )f88z-8288{.82~0 f88z~o (,~0 f(is zo (,4~~0 f(io ~0 f(i(s zo${.o {/o o *8(i8$s 88"8$8#o 8#(i8*s 8%0\,+4{.+0+1+6+7{.+3+4+9{/+5o o &--,*++o + +++o +++0~8{.888888,&,?8{/8{.o o o &-/{/o o ,+9{/o o {.o *8m8qo 8lo 8g8fo 8a(8\8`8d08-~0 )f88z~888 ~0 f88z8o (,4~~0 f(io ~0 f(i(s zo${.o {/o o *8L(i8Ss 8N8So 8N(8I(i8Ps 8K8K0+j-~0 )f+b8gz ~+f+j8o ~0 f+k+sz8w{/o o - {/o o * *8(i8s 88o 8(8(i8s 880,+~-~0 )f8s8xz~8w8x8} ~0 f8v8{z8(5-,'-{/o o &{.o &%,*%-*8|(i8s 8~8o 8~(8y(i8s 8{8{0~9- 89~8- 88~7- 87-~6- 86,]~788+A888-"%,&3( ,+( -~7o> &X o 2,(G ~7o (*s 89s 8@s 8Gs 8Qo 8Z 8Z8[8Zo/ 8U0888%:888888b8o -e,o c(G o ,3c(G ( tco ( -o , o ,X-i,?U*( 8.s 8) 8(8.82818584(G 890+Ou-&~~D %f+:~~+5+6+;+@+Ez+I+Jt((}>}C*+(i++(+(+(+s +++0,!8{>-~D f88z8X8i1~D ˸f88z8X8i1~D f(isaz{C,(t{>(q(|+(t{>((|*8K(i8Ws 8R8R8T(i8]sa8X8W8Y0~+T+Y- %,g%`+H: g%a+8;-%,%,g%b+"<*(G +(g+(( +(( +(( +08Q8R{E8E{E88{E58*{E58{E888T+6~{EJJX(t({EJJcTJ9/~{E(t({EXT+F~{EXJXJX(t (:_{EXJ XXJcTXJ%9/XT+wXT+W~{EXJ(t{EXJ({EXJXJXXXJXTXJXJ2XXJXJXTXJ?~X% 3*>c{E{E5XT+F~{EYXJ(t(}{EXJXXJcTXJ08 8888888(880) 58888{E88X88_8% 8a% a% a% a{EXX _c% a% a% a% aY8=8<8A8M8M(i8Ysc8T8T0 8c + X+ +++( +(G ++&݁98} (8y8~8T8QJ o XRXTXo YT+gXJo/ ~3XR+\XT-+.~dXJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ(= 8?8>(89(= 84828108~8|8}-*~8y8y{@~8r~8n8oY8r}@(o ],*o [s XT+L~XJo ~XJo (Y()XJXo (zo XXJXTXJo 2*~(&[3k~~(Y(&]3O( o s XT+# XJo (zo XXJXTXJ o 2*-~(&"3T~~(Y(&"38~~~(Y()~e Qf(i~ (,*~~(&(/-~(&-3[~~e f(i(,$~ ~((&O*~X(2&XJ*~~e Lf(i(,Y*~~e cf(i(,Y** 8z8~(8y8(&8}88(8(&80o-H+G+H{?+D+E,%-"+D+E{@+AX+@-+B{AX(-{BX(*+++(++++(++08-+++,&+Y,,++--* ++(++ ++08X8Y8Z8_g8Z8[(%c8S8TbY {z}@8GEy8(TJgXT+SX(TX(TXJgio^ &XJsXJ(&XXJXJXTXJJ2+wg%Ч(( g%С(( (iYo (~-,o rp rps zrsps zo * 88s8888 8 8 8+0l8~6808+ ~688888!8"3*T~7o XT8XJo/ :5".<,.H:.C+b-]5[.].+N{.}. +BJXT+:JYT+2XXJ(T+6J-~7o o ~7o +~7XJo/ o> &XXJXTXJo Y?M~7o o * 8o 8s 8o 888o 88o 80\+7+8+9+>,+<-+9+:a-+7+8a%, (a,(a*++(+ +++++(+0l8~e Zf88 t~e -f88t8888 (+(+(+(+(+sCsOs[ sV % oQ%ioRg%ioSoT&( o ~e 8f(i( o *&( o ~e 8f(i( o *8(i8o 8(i8o 8( 8(+8(+8( 8)*0L+0-+%%+&+'+'+(aҜ+%Y+$,+"%-%-/-* ++++++ ++0f+T8Y-+- -+++++ +!+"o ,)++++o +++ -o *s 8 8=D0K+3 _%-+$ +"+#,-+" %+ a*+ ++(+++0; 888i[T8J.'8J.8J.~e f88z8JX}={=X:s XTXT+0XJcXJ_XJ(( XXJXTXXJXTXJi2X{=XbTXJT8XXJYcXJY_( TXJJ]-*XXK((~7(5+(i+(+(+(5+(i+(+ +&,*+*+0 ~8N8O8T8U8V8[8\8]],8^*~8o -~T(;( +~8o ~9o -~T(>( + ~9 o 8~o (>~o ~o (Y()Xo o "~~(((A+- o ,!~~(((DXo ?E*8(88 88(888o 880|!~k+\~8X8Y~j++&+,-,-++,"+o ++++~(G-+(** 88(G8+4J0,_+N,Z+Y{+U+V{+R+SX}+M+N{%X+F+F{ _}, _%Y,=*+++ ++++++0>"88T+<8{T% 8J%88X%8-88JYTJ/g{G{ToA&{I,~~FY(+XYT+0% XJ% XJaҜXJXXJXXJYTXJ/{S(-{H{SoJ%{VjX}V* 8888 8 88 88 0~~~ ~e f+)( %~e ٶf++#t+#+$+)+*-ݐ(i+(i+o. + +(+++&~~~ ~e f+,( %~e ٶf+!o. t(,,#(i+(i+&~e ~f(i*,*jUii[0888{T88{9,p18{+#88{8{YX _TXT---XJYTXJ%-"1'{ XJYXJ(+ XJXJ{JY(+ {XJY}{/s zXJ* 8$8#8"8'8&858=8<8@0#%,r+tg8n-- 8iT+P-g+_+`X~+Zi+YJY+VT~+UJXJ(({HoJJXTJi2* 888++++(J++0?~~7~8888&8X88~888\3C,~~7~(&(M&~~7~X(&(M&X +J~(&"3~~7~(&(M&*~~7~(&(M&X ~(?F~(Y*88(&8(M88 888(&8 0~~~ ~e f+)( %~e Ķf++#t+#+$+)+*-ݐ(i+(i+o. + +(+++&~~~ ~e f+,( %~e Ķf+!o. t(,,#(i+(i+&~e ~f(i*,*jUii[08-8888T-8X88K8TXXK(T,XXKaTKXKaXKaKXKa- (aXKXK,a(aXK-(a* 8d8f8e8d(8_8b8c8b(8^08D%{?8>8?{=8:a}?%{@8283{=8.a}@%{A8&8'{=( a}A%{B{=( a}B{=Y8g~;{? _~;{Bd _ba~;{Ad _ba~;{@d _ba(( aTX~;{@ _~;{?d _ba~;{Bd _ba~;{Ad _ba(( aTX~;{A _~;{@d _ba~;{?d _ba~;{Bd _ba(( aT~;{B _~;{Ad _ba~;{@d _ba~;{?d _ba(%Y( a~;K _~;d _ba~;XKd _ba~;XKd _ba(( a}?~;XK _~;Kd _ba~;d _ba~;XKd _ba(( a}@~;XK _~;XKd _ba~;Kd _ba~;d _ba(( a}A~; _~;XKd _ba~;XKd _ba~;Kd _ba(%Y( a}B=~;{? _~;{Bd _ba~;{Ad _ba~;{@d _ba(( aTX~;{@ _~;{?d _ba~;{Bd _ba~;{Ad _ba(( aTX~;{A _~;{@d _ba~;{?d _ba~;{Bd _ba(( aT~;{B _~;{Ad _ba~;{@d _ba~;{?d _ba(( a~;K _~;d _ba~;XKd _ba~;XKd _ba( a}?~;XK _~;Kd _ba~;d _ba~;XKd _ba( a}@~;XK _~;XKd _ba~;Kd _ba~;d _ba( a}A~; _~;XKd _ba~;XKd _ba~;Kd _ba( a}B* 888( 888( 8880$9&8~e f88888X89&XF-||%P(" Q}*}{o Jo /Jo o (* 8o8n(i8s8r(" 8m8m8l(8i8j0V+9+:+:+;+<+=X%b`+5+6+7X%b` -X%b` *++ ++++ +++0%888*% 8~&%-&~%s %&888+7+?+@{,%! s" (+%! s" (oA -+o# +,o -*s$ 8R 8Q8Po% 8V(+8po' 8k8jMM 0I&88~i%X9&88 _-888-e~ *8,,@_-?_b~i%X-X +7_b~i%XbX~i%XbX-~i%XX- -~~~ (P~i(S( ~~~ (P i(S(~l,( &-*888888 888` 0b+A+B+CiT+AJ+Ai.*+8R8Q8U8Y8X0*'88~~8~e ڹf88888t8-+P,o t-K-H~~e f(io2to*(-,o ݌~ (V-,-~(Y(8< 8;(w8@(i8E(8@(8;s86(81o981&~e ~f(i* *A4Gd0P+3+4+5Ҝ+4+5X%+1dҜ+.+/X%++dҜX%dҜ*+++++++++0H~+5_b~+*c_b`~+c_b`~+c`h*++++0Y(5+.+/+.+/,+0+/+0+4+3((* +++(+++(+++0+s8t{O8p}S8p8q{P+p}T+s}U+qj}V+k{Q,~{Q{Qi(Y,}R{GoB*88({888({88++0D)88{~88888{wT8JYE0/8 8{~8(Y% /9'*{{}(% _, /#%:X/*}}}w*~s Y}y~t Y}x{x1J}wX{}{x(TXJ/*-{}{x(o{yXJX}y }w:{{}(/*~u}z~v}x{x1K }wX{}{x(TXJ%-/*{}{x(o{zXJX}z{~{y{z({yY,}w <* 88(8888888#0G+%{g++{++{+++*+ ++++(+ ++s+0\~:+I _~:+=d _b`~:+,d _b`~:+d _b`*++++0[-,&+4+4+5T+4X+3+4T+3+4+5XKdK`X%3*XKbT+ +++++++++0+f8g{8c8dX}-+^ 3,+Uz,+V{+R+S{ X}Ҝ--{ _}*88 88+s ++++08"588 YEDB\\D8e .;8b".B,-+E8Z\58W/.&,+T\.+(+O{.+L}.+***,**,*%,%,**8w8z8888+++0T):8 8 (%?8{8%2 -88_88-c*8ceTX_TXJ(%2{J c`_(oc*X{TXJ({J c`,A_XJ0_(o-c**X{TXJ({2_XJ0_(oc** 88888 8(o888 05*@8888XT+D8X88XJT8XJ18XJ%JXTXXJXTXJi2TX TXT+uXJJJXJXJY_bXTXJ 2?XXJ _TXJ _TXXJXJXJYXJY_cXTXXJXTXJ>XJw}X T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{(XJ(XJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ s 8@8@8D 8J8Q0/~ 88888~,~e of8888~,~e f(i(o, ~,~e Qf(i(o, ,!~,~e df(i(o, +3,&~~~.o- ((( X&&~~~e f(i((,~~~e f(i((--v~~~0~e Wf(is ~/~e :f(i(t((~e f(i~e ȷf(i(, & K 8e8es. 8`8_8^(i8h(8co, 8^8]&* *AL/%s0088R8XR8 X8~8|8}8~8R:s :9T8w~J(&(9.;8XF XF_,J1JXT~(* XF9?-"~e Ƿf(i~J(&szXF9~~J(&((M&XR89^ XF,~~J(&(M&8JT~(*XF,~~J(&((M&XXFR:y+GXF,'~~J(&((M&XR+~~J(&(M&JXTJ~(?w~(T XF9~~(Y(&(.R+]9XTX~(YT+XXJXTXXJYTXJ2~XJ(&(.XJ]R~(* 8u8s8t8x8z8~8}(&8x(8s0T%98 8X8 {wT8XJYE"n88{|:,8}w*88{}8TJ/*{}(oJ9_, 9e}|JcE8+H{}(,}w+1~}~}}w+s}}w*{}(%}{/*{}(o}w{}(-/*{}(o}wX{~{}{{(yT{{XJY}{{{- }w*{}(*{{}(-*{(}{(v}}w(*9** 88888/8;8C8B(8C0q+@-~e f+5+:z~+9+:,~e qf+3+8z+<{/+8o --*+(i+s ++(+(i+s +++0b+E+Fb+C+D,-2+?+@X%b,-`+1+2+3X%b-` X%` *++ ++++ +++021rpgrph,i8kl%-m~~grp8,9l8j~2~h8-m~5~38rp88~6~+3+4(g~8(&-(~i,+(+,~(*s 8((8Fs/ 8O(8Y(8f(8f 8eI0S+/, f%, a+$+&~m-Y+~l--++*++*+++++(++(+0|%Т+Qs-B%Щ+At,%Ъ+1u%,%Х+!v--*(( +(( +(( +(( +02 g8:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2s g +%X 2,s* 8H8P8T8W8X8f8i8k8s0\%Ш+9-%,%У+'-%,͍%Ц+*(( +(( +(( +0%Ц8^g%Ф8Q w g-\8/+-~8)08(Xb8&-~%X88 2+&~8 Xb(~%X 2::+(~ X b(9~%X 2+~Xb(~%X 2wg:3 +(~b(9~9X 2*(( 8(( 8 888(8 888{z}2E&/^'@GB#/yCՇ>vʽ"H&ezc"b<၊=uZSC:ԛޘgY+~TF)|ں" fDx6Q _n19+zɷO/wVTtQ{Z3hf߼}/HATmC2q^4\6C}:[KqNsuݸ"7ϓˣ|S#(1DBTQ{CC)z<-S(v3e[-W}ršKEU%$[OsJ"H.A:&RW$Z;P@ccVW$еm{7A{Sjqfy<;fT7On)+rƈfF͊#crM*U Ggϟ [F`܂4ZwOWZ牮Z>`C~/A&:l6u:+0Pg VLv:|חh9Bo&~pGR":(-WZ ʞ :fՎU&?uH *]pX# &&Qo8DWgFv噠b(.ҪSq@)m2t=w C B G F KJNQT*W6[AZA_P^Pc_b_g_f_kkjkyy ~ ! %$)(,/2598?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~h%k0rt%{%# %){%# x9%)%){%# :{L;;{L;<<&# &# &#&+&#H=0?:&)S&){%# c&x&#&# &&#&w&&'&&-'#'#3.'?'#O'#_'wk'|'#'JTCPD' WD P']E-' Fc(i0( GcE(qE(_( +b()HI {%# J{(dK( pL){%# LO(# (#P#@Q(TTU#()(#*( 5( ):):)#K)){%# &# d)#m)# u)#m)# u)#{%# W? ZZ)H[_#9q le bp ~)# ~)# ~)# )w)]d)epfghcipij)hmm(n*C*oXqqHss$t|t'o*6v=*GyNzY*azh{cX|s~z~$pctLc **6hhzБ@Pcl + ԕ 4@+ n+$ ++ +3 ; hC ȜM V ] dc +$ $+j 8c|q X } 8 +)~)# ~)# ~)# ,z)z~)# ~)# ,#X){%# T,# )l,#{%# )L){,#e #9Fq,)#9Fq ,)#9Fq ,)#9Fq ,)#9Fq ,)#9Fq ,)#9Fq{,)#9Fq& ,)#9Fq2 ,)#9Fq,)#9FqB -)#9Fq-)#9Fqw!-)#9FqY .-)#9Fq;-)#9Fqj H-)#9Fqt U-)#9Fq~ b-)#9Fqo-)#9Fq |-)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq-)#9Fq -)#9Fq.)#9Fq#.)#9Fq/%.)#9Fq;2.)#9FqF?.)#9FqUL.)#9FqdY.)#9Fqpf.)#9Fq s.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq/)#9Fq/)#9Fq /)#9Fq-)/)#9Fq;6/)#9FqGC/)#9FqSP/)#9Fqb]/)#9Fqnj/)#9Fqyw/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq0)m hqqM1 1 A M !PXLLL q#(3e>>/CGJ;JP PkPP/UY ] ]pcgn s s!Zw ww w)cw1*w {& { {/ 7N?O 9}A/AA7 QzYi6 @y @ #V+I+ +++A/8;@G@`HM XanA2vA@0q=7 At AA+`1& 'Y # !#)# 1#A#I#Q#Y#a#i#q#y######## ##(# /$#9_?OV,#94f p# p /+wwf < 4# 4# +Ye< m DL/LV+>< T # <# T# ## Qw\qd'#dl4'4t|tV+4 lV+## # `#1' #Y & YQ%# # # # ZwQZw!#1#/#II+YI 'a%Qi#.i;yAqFyAyIAymAyAqMyk Ayf Ay@AqUyrAi_' gn2si#yyuA yAQ# nDD# <#4 < #J ## 'sn]H[GW# #v! # 1# 44444#9d\#9d# T #T$T%$ $# # Y#/TX\`dtx|.c.k.s.{ . .# .k Cccq Cc @`#{ @AC `ac !cbb#$%t1@ALBtCxD ,6AGTu &2:A_er{ { 012Z\^`bhjlnprtv%,39?FMU\cjryP `P!aP"bp"f""p###$X$h$x$$ e U #"$"%"10328797:7;7<7=7>7@?A?B?C?D?{}666z:'6CCC|G|LMQ~~~~~~~~~~~~~~~~~~~~~~~~~Ldarg_0Ldarg_1IEnumerable`1Stack`1Action`1ICollection`1IEqualityComparer`1IEnumerator`1IList`1Microsoft.Win32UInt32ToInt32Ldarg_2Func`2Dictionary`2m0000D3Ldarg_3Ldc_I4Int168PjL4j9p1T4HRGW6get_UTF8XleD8lmu2TukS_OnInitDoneZdHepKsnhZdDeeUG93ky9OjZ8GM5rlvnM8PWPluginUrWtnueHw9t59ZdHepKsnhZdDeeUG93ky9OjZ8GM5rlvnM8PWPluginUrWtnueHw9t59OnStealerZdHepKsnhZdDeeUG93ky9OjZ8GM5rlvnM8PWPluginUrWtnueHw9t59UIDtypeIDkDgA3J9dTGoVv4ZKSystem.IOLdarg_Svalue__ProtectedDatamscorlibSubSystem.Collections.Genericget_IsStaticReadAddIsDefinedTrimEndAppendDynamicMethodmethodReplaceIsWhiteSpaceCreateInstanceOpCodeget_UnicodeAddRangeTakeEndInvokeBeginInvokeIEnumerableIDisposableDoubleRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandleFileget_Moduleget_MainModuleProcessModuleget_Nameget_FileNameGetTempFileNameGetFileNameGetProcessesByNameGetDirectoryNameLocalMachineCloneDataProtectionScopeget_IsGenericTypeget_FieldTypeChangeTypeValueTypeget_ReturnTypeownerTypeget_ParameterTypeGetTypeGetElementTypeget_PropertyTypeWhereSystem.Coreget_InvariantCultureCaptureMethodBaseget_OrdinalIgnoreCaseCloseDisposeTryParseCreateDelegateCreateGetStringDelegateMulticastDelegateDeleteThreadStaticAttributeCompilerGeneratedAttributeGuidAttributeAttributeUsageAttributeDebuggableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeGetCustomAttributeExtensionAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeIgnoreDataMemberAttributeDefaultMemberAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeCLSCompliantAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeReadByteget_ValueTryGetValueSetValueget_IsPrimitiveRemoveIndexOfBuildTagStealerConfigSystem.ThreadingEncodingSystem.Runtime.VersioningFromBase64StringToStringGetStringSubstringForEachMatchPushMathGetFolderPathget_Lengthset_LengthEndsWithStartsWithiAsyncCallbackcallbackTransformFinalBlockDecimalCallTailcallGetManifestResourceStreamMemoryStreamget_Itemset_ItemSystemSymmetricAlgorithmTrimICryptoTransformget_IsEnumBooleanget_MetadataTokenMinJoinSystem.GlobalizationSystem.Runtime.SerializationSystem.ReflectionGetGenericTypeDefinitionSearchOptionArgumentOutOfRangeExceptionArgumentNullExceptionInvalidOperationExceptionFormatExceptionArgumentExceptionInternCopyToFieldInfoMethodInfoFileInfoCultureInfoFileSystemInfoMemberInfoParameterInfoConstructorInfoDirectoryInfoPropertyInfoSkipPopGroupSystem.LinqClearCharAesCryptoServiceProviderIFormatProviderStringBuilderSpecialFolderStringComparerCurrentUserEnterIEnumeratorGetEnumeratorGetILGenerator.ctor.cctorGetConstructorMonitorCreateDecryptorCreateEncryptordummy_ptrSystem.DiagnosticsGetFieldsGetMethodsSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesFormatterServicesOpCodesDebuggingModesGetDirectoriesGetPropertiesGetFilesGetModulesNumberStylesCreateMemberRefsDelegatesReadAllBytesGetBytesBindingFlagsStringsContainsSystem.Text.RegularExpressionsSystem.Collectionsget_CharsRuntimeHelpersGetParametersget_SuccessProcessAttributeTargetsGetGenericArgumentsExistsRemoveAtConcatGetUninitializedObjectobjectSelectUnprotectDistinctGetRetSetIsDigitSplitSystem.Reflection.EmitExitget_DefaultIAsyncResultZdHepKsnhZdDeeUG93ky9OjZ8GM5rlvnM8PWPluginUrWtnueHw9t59OnStealerWorkResultresultEnvironmentget_Currentget_CountInsertConvertCallvirtIListToListMoveNextSystem.TextReadAllTextRegexInitializeArrayToArrayToCharArrayget_IsArrayOpenSubKeyContainsKeyRegistryKeySystem.Security.CryptographyGetExecutingAssemblyget_IsReadOnlydummyCopyIDictionaryDirectoryRegistryop_Equalityop_InequalitySystem.SecurityIsNullOrEmptyMemberRefsProxy{7dd4f6ff-8200-4ae5-8a57-1edf78202c30}{7dac886c-d93d-41aa-ae79-d6fffeab5ea4}{b457cb8e-1ec3-453a-a0c3-b70d2a289d5d}~~~~~~~~~~~~~~~~~~~~~~~versionaSelected compression algorithm is not supported.Unknown Header154M{b457cb8e-1ec3-453a-a0c3-b70d2a289d5d}aܿJv0.3ajgs !1Aa 0@`2+*+>++*+(+(O *+~ f+ +*(E +(Y+( +b++*(P +(W+.+{*+B++ }*++r(O ~ f(Y(*b++*(P +(W+.+{*+B++ }*++r(O ~ [f(Y(*b++*(P +(W+.+{*+B++ }*++r(O ~ &f(Y(*b++*(P +(W+.+{*+B++ }*++r(O ~ f(Y("*b ++*(P +(W+.+{*+B++ }*++r(O ~ Zf(Y('*b ++*(P +(W+.+{*+B++ }*++r(O ~ f(Y(,*b++*(P +(W+.+{ *+B++ } *++r(O ~! ҹf(Y(1*b++*(P +(W+.+{"*+B++ }"*++r(O ~# mf(Y(6*b ++*(P +(W+.+{$*+B++ }$*++r(O ~% (f(Y(;*b++*(P +(W+.+{&*+B++ }&*++r(O ~' f(Y(@*b++*(P +(W+.+{(*+B++ }(*++r(O ~) f(Y(E*b++*(P +(W+.+{**+B++ }**++r(O ~+ Jf(Y(J*b++*(P +(W+.+{,*+B++ },*++.+{-*+B++ }-*++.+{.*+B++ }.*++v(O(Q(S*( *>++*+(g+(O sy}Hs}I}B{Hiox*+*++{P+'_d}P-++{Q+Y}Q,*++++++.+{Q*++${O+ {N-Y-+{Q-c-X*++++++,{P+({Q__d}P++{Q_}Q*+++++^+{N+{O*++F +{TY*+.+{T*+^ E}R(O *:(O (*+ +++b`*+o ++o +++++b`*+(++(+&( *21+*(U+22+*(U+23+*(U+24+*(U+25+*(U+26+*(U+27+*(U+28+*(U+29+*(U+2:+*(U+2;+*(U+2<+*(U+2=+*(U+2>+*(U+2?+*(U+2@+*(U+2A+*(U+0+t8y+++++,-+++( +o +&+2+3- + - (o &- X i2 +( +&*s 8 8()0FU3>q0W+<+8+4 +0-+*+'-+!,-*+++++++0G888-~ ~ f888~v88-|~y8 ~w( (+G~{$:(~~ jf(Yo Xi2*~~ jf(Y~ Uf(Y~ \f(Yo *888(Y8o 8 88(8 80t8 8!8&8(8*}8*8/81~~ 7f8$o o ~ *f(Y( -+so ~~ Af(Yo o ~ *f(Y( -+so ~~ f(Yo o ~ *f(Y( -+so ~~ f(Yo o ~ *f(Y( -+s#o ~~ f(Yo o ~ *f(Y( -+s(o ~~ f(Yo o ~ *f(Y( -+s-o ~~ f(Yo o ~ *f(Y( -+s2o ~~ ׿f(Yo o ~ *f(Y( -+s7o ~~ ʿf(Yo o ~ *f(Y( -+s :$ o &XXJXTXJ#i?H"(? :" o ~~ Uf(Y~~- s@ ~(+-~ f(Y+~ f(Yo< ~oB *+0*(C ~~ jf(Y(D (E o *(F -* o s ~oB ++2+(C (D ~ f(Y(E (G oH +(F -+ o ~~ f(Y( (I oJ &{* 8s 888sK 8sL 888(Y8A ?>} M=?0+^8c8d~ f+^~~ - s@ ~ +D-~ f+=+~ f+6+;,+=*sM 8 88(Y8(++(Y+(Y+oN ++0M+*+/-++-~ ʻf+-*(P +(W+sQ +(Y+0+{,u8z8{8881:,8{8}9}&&~o~ f(Yo< *~o~ f(Yo< ,*88o8{ 8z8yoR 8t8y8}oS 8{09888~ f888+"+#~ f+(7 o8 V++(Y+&(9 (: ~ f(Y (7 (; o8 &'(# 8[(Y8`(& 8[8Z&*sK 8& 8%(hC07gI0Y8D8I8~ Ff88888:88-~ 9f(Yo0 (& -o3 (7 o8 \&(9 o3 (: ,6~ 9f(Yo0 (& (7 (; o8 &%, Xi?IC(# 8 (Y8(& 8 s, 8(4 888&9*sK 8 8ALVN>\ 4>0Y8D8I8~ 1f88888:88-~ f(Yo0 (& -o3 (7 o8 \&(9 o3 (: ,6~ f(Yo0 (& (7 (; o8 &%, Xi?IC(# 8 (Y8(& 8 s, 8(4 888&9*sK 8 8ALVN>\ 4>088~T ~ Ըf88~ f88~ f889&~ f(YoU oV ~ f(Y(& s, ~ f(Y(W 8 ~ zf(Yo3 ($ (X ~ =f(Yo0 (Y o3 (7 o8 |&(9 o3 (: ~ zf(Yo3 ($ (X ~ =f(Yo0 (Y (7 (; o8 &Xi? ,o :gE(Y8ooZ 8j(Y8ooZ 8j(Y8ooZ 8j8k&*sK 8 8Adv{Z|RA 0S8>8C8~ %f888~ 8f8888-+~ f(Yo0 (& o3 (7 o8 Y&(9 o3 (: ~ f(Yo0 (& (7 (; o8 &Xi?RF(# 8(Y8(& 8s, 8(Y8([ 88&*sK 8 8ALSQ>Y 4>088~T ~ ظf88~ ߹f88~ f889&~ f(YoU oV ~ f(Y(& s, ~ f(Y(W 8 ~ ɹf(Yo3 ($ (X ~ Af(Yo0 (Y o3 (7 o8 |&(9 o3 (: ~ ɹf(Yo3 ($ (X ~ Af(Yo0 (Y (7 (; o8 &Xi? ,o :gE(Y8ooZ 8j(Y8ooZ 8j(Y8ooZ 8j8k&*sK 8 8Adv{Z|RA 0Y8D8I8~! f88888:88-~! f(Yo0 (& -o3 (7 o8 \&(9 o3 (: ,6~! f(Yo0 (& (7 (; o8 &%, Xi?IC(# 8 (Y8(& 8 s, 8(4 888&9*sK 8 8ALVN>\ 4>0Y8D8I8~# xf88888:88-~# _f(Yo0 (& -o3 (7 o8 \&(9 o3 (: ,6~# _f(Yo0 (& (7 (; o8 &%, Xi?IC(# 8 (Y8(& 8 s, 8(4 888&9*sK 8 8ALVN>\ 4>0Y8D8I8~% f88888:88-~% f(Yo0 (& -o3 (7 o8 \&(9 o3 (: ,6~% f(Yo0 (& (7 (; o8 &%, Xi?IC(# 8 (Y8(& 8 s, 8(4 888&9*sK 8 8ALVN>\ 4>088~T ~' f88~' f88~' f889&~' f(YoU oV ~' f(Y(& s, ~' f(Y(W 8 ~' Ķf(Yo3 ($ (X ~' If(Yo0 (Y o3 (7 o8 |&(9 o3 (: ~' Ķf(Yo3 ($ (X ~' If(Yo0 (Y (7 (; o8 &Xi? ,o :gE(Y8ooZ 8j(Y8ooZ 8j(Y8ooZ 8j8k&*sK 8 8Adv{Z|RA 0 888~T ~) f88~) tf88~) f88~) Nf(YoU oV ($ ($ s, (- T8-J o4 XT8 XJ-T~) ]f(Y o0 ~) Kf(Yo0 (Y o3 (7 o8 t&(9 o3 (: ~) ]f(Y o0 ~) Kf(Yo0 (Y (7 (; o8 &XXJXTXJ i?JXTJi? ,o ?(Y8ioZ 8d(Y8ioZ 8d(Y8ioZ 8d&* 8sK 8 8AdnyY tUS 0Y8D8I8~+ f88888:88-~+ f(Yo0 (& -o3 (7 o8 \&(9 o3 (: ,6~+ f(Yo0 (& (7 (; o8 &%, Xi?IC(# 8 (Y8(& 8 s, 8(4 888&9*sK 8 8ALVN>\ 4>0 8/ + X+ +++(\ +(P ++&݁98} (8y8~8T8QJ o] XRXTXo^ YT+gXJo_ ~3XR+\XT-+.~0XJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ Y}D~? Y}C{C1J}BX{H{CoqTXJ/*-{H{Cor{DXJX}D }B:{L{Ho/*~@}E~A}C{C1K }BX{H{CoqTXJ%-/*{H{Cor{EXJX}E{I{D{Eo|{DY,}B <* 88o~8888888#0T%98 8X8 {BT8XJYE"n88{G:,8}B*88{H8TJ/*{HorJ9_, 9e}GJcE8+H{Hou,}B+1~V}K~W}L}B+s}J}B*{Hoq%}F/*{Hor}B{Hoq-/*{Hor}BX{I{H{Fo}T{FXJY}F{F- }B*{Hov*{J{Ho-*{Jo}K{Jo}L}B(m*9** 88888/8;8C8Boq8C0+w8xT8w{B%,O.98lX8k{I+j+n+r+vTXJXJXJXTXJY-J*(n-{Io1 {B@J* 88888888o80|-%m+Q>-B-%t+A?,-%u+1@%,-%p+!A--*(z +(z +(z +(z +08{Q8<8{N8{O3:,o*,88{P8{M88{N X}N _{M{N X}N _b`{Q_b`}P{QX}Q{Pn-_b-%,Yj_i*82868:8>8R8Q8U8Y8X0888T+Q8%X88{PҜ88{Pd}P88{QY}QYJXT{Q10-J*X{O{NYTXJ1XJ{M{N( {NX}N{N{OY_,4{MX{NTXJX}NXJ _}P}QJX* 8888888880,v8{N8{O/8z88X880880i1s z_,3{P%X _{Q_b`}P{QX}Q}M}N}O*8e8is 8k8k8j 8j8j8k8j0+f8g{T8c8dX}T-+^ 3,+Uz,+V{R+R+S{S X}SҜ--{S _}S*88 88+s ++++0,_+N,Z+Y{R+U+V{S+R+SX}S+M+N{R%X+F+F{S _}S, _%Y,=*+++ ++++++088{T8X%}T8 18z8{S8Y _8-v 8-Y0c{S/Z0L{R{R{S( {SX}S*{R{SX}S{R%X %Y0*({*8483878>s 8@8@8D 8J8Q088 %,8{TY888888X {SYTXJ1:{R{SXJowTJXJ3/J{RXJYowXT+{R{SowT{SJX _}S{TJX}TJ* 88878>( 8?8>ot89( 8482810888{ST88{T9,o18{T8+88{S{TYX _TXT---XJYTXJ%-"1'{R XJYXJ( XJXJ{RJY( {TXJY}T{T/s zXJ* 8%8$8#8(8'86898:890 E8:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2sV E +%X 2,sW* 8H8P8T8W8X8f8i8k8s05@8-8-88XT+D8X88XJT8XJ18XJ-%JXTXXJXTXJi2TX TXT+uXJJJXJXJY_bXTXJ 2?XXJ _TXJ _TXXJXJXJYXJY_cXTXXJXTXJ>XJL}UX T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{U(XJ(XJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ pTӂX8xQl*67?gm1bTL<,8^+!XdbUqrd*%TP!qkCBy$ʍ*dC-z|7e;!WCd[[~ߺ%EEn,/K,ҋy7z؊ƆHғ{;rØUa wf!}@cZs.|j2eX|98i@?nzzMCM.sߛsؾנVQt0UnFTCP.Ep(bvvuR\5D7; {X_vVzDrA7t=YijosE8#БT|)LQx-vI3Ab")qPL$^8k#AITäj*(wԜ\Sɘ®1$ n=\V.z'},}9\XUuH_8Z֟7h,-5>5Nn/qMT@01#`Q*UЇ롿jz>Es;L>6a9{puhpd74 o݁$Uzg#cqe=xIy\}ˌc.>YePΒ ^d< gUehr gwʻyd76|=mݒ"D;Ltpn?q4RRCo$cqi5Je ;K-~7+rE>ͶʰM-qbJt[)̷oʙ8wV+^R/Қ<|}U_68G=?y^+R<ҒyC!?`o$Ehr[ܠrU?wVk0耤V8;b+䍑 Q@[]GF ^rI}63[j>lMqRz UX fll v v v v vE 5v v w x z | ~ " $ ' 5CCCC, Cl Cx C C. C{ C0 C{ Cu Co Cr C C0 CCC3)1C1C1-111911<?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~*$P+ .H#! v+UU#-d=oe# m#m#>e# e# l># $# $## 8?#$ $$$ X@<$U$ $a$r$ B$$ $$$ C$$ $%% ,F5%N% $Z%k% G%% $%% DJ%% $&& K.&G& $S&d& M&& $&& `O&& $& ' Q''@' $L']' HTz''$''$''$''UN (YYW.#( ( ( ( ( ( (?P[?[?P]D] _?( ( _c`m (adlf0ggU(((( )hje# jkl0m%)7)LnC) po[)tpsuwPxe# xyhyj)))2 .F).F$).F).F).F).F#).F-*.F;*.FF*.FP,*.F[9*.FeF*.FoS*.F{`*.Fm*.Fz*.F*l>G> y y y q hyy x xP@ ++ $#y$,(4.,4?9+FyP< <(D VL `QQ+e C!uYe$Y! )r 119 AI: A Q Yw1OTY^..CTTT T!T@T@T`TTTTTT#ATCcTTTTT T#@TATTTTTTAT`TcTTTTTT TTT@T`TTTTT T@ T T T T T@ T` T T Tt,-L.t/x02KQ[_go#*19@GNV]iqxP 1 l mP!n`!op!p!q8"rH"sX"t"u- #$#%#&#'#(#)#*#,+-+.+/+0+~~~~~~~m000090Ldarg_0Ldarg_1IEnumerable`1Action`1List`1Microsoft.Win32ToInt32Ldarg_2Func`2Action`2KeyValuePair`2Dictionary`2Ldarg_3Func`3Action`3Ldc_I4Int16get_UTF8UIDtypeIDNNcUlZ4XfnRyr8VPN7Wv6cyvod6jjWmR5vUMmg2erpeoRL8PYpdPluginrTCwTeUDIGqIR9zJOnStealerMmg2erpeoRL8PYpdPluginrTCwTeUDIGqIR9zJwS7znTxTv2UDJfua5qFwTDhvjNSfQoPPRr2_OnStealerWorkResultMmg2erpeoRL8PYpdPluginrTCwTeUDIGqIR9zJSystem.IOLdarg_Svalue__addDatasetCustomColumnDatagetDatasetDatarawDatamscorlibSubSystem.Collections.Genericget_IsStaticReadAo8n3qKPRohb7hy8xcB458YKdmAxMgztDJq_OnLoadAddDynamicMethodmethodOpCodeAddRangeEndInvokeBeginInvokeEnumerableIDisposableRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandlesendFileget_Moduleget_NameGetTempFileNameGetFileNameget_FullNameConfigPluginNameGetDirectoryNameget_NewLineget_FieldTypeValueTypeget_ReturnTypeownerTypeget_ParameterTypeSystem.CoreMethodBaseCloseDisposeCreateDelegateCreateGetStringDelegateMulticastDelegateDeleteCompilerGeneratedAttributeAttributeUsageAttributeAssemblyFileVersionAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeReadByteget_ValueTryGetValueSetValueBuildTagConfigSystem.ThreadingEncodingFromBase64StringToStringGetStringForEachMathGetFolderPathget_LengthECNGrm81DXfmTAQiAsyncCallbackcallbackTransformFinalBlockCallTailcallGetManifestResourceStreamMemoryStreamget_Itemset_ItemSystemSymmetricAlgorithmICryptoTransformEnumget_MetadataTokenMinJoinSystem.ReflectionSearchOptionArgumentOutOfRangeExceptionInvalidOperationExceptionFormatExceptionInternFieldInfoMethodInfoFileInfoFileSystemInfoMemberInfoParameterInfoDirectoryInfoSystem.LinqCharAesCryptoServiceProviderSpecialFolderCurrentUserEnterToLowerGetEnumeratorGetILGenerator.ctor.cctorMonitorCreateDecryptorCreateEncryptordummy_ptrGetFieldsGetMethodsSystem.Runtime.CompilerServicesOpCodesGetDirectoriesGetFilesGetModulesCreateMemberRefsDelegatesReadAllBytesBindingFlagsStringsStringSplitOptionsget_CharsRuntimeHelpersGetParametersHostAddressAttributeTargetssetStatusConcatObjectobjectRetSplitSystem.Reflection.EmitntL1zO7Fi3R8uPjeD4Of0mKk6517Tkq3FZiMmg2erpeoRL8PYpdPluginrTCwTeUDIGqIR9zJOnInitExitIAsyncResultresultEnvironmentget_Currentget_CountConvertCallvirtMoveNextSystem.Textylv8ulDJ1YPOdnLMmg2erpeoRL8PYpdPluginrTCwTeUDIGqIR9zJOnAPIDelegatesCreate_cko9xyV8PXPJCvyuUBpr8pbEuGqlxeixInitializeArrayget_KeyOpenSubKeyContainsKeyRegistryKeySystem.Security.CryptographyGetExecutingAssemblydummyAnyCopyDirectoryRegistryop_EqualityIsNullOrEmptyMemberRefsProxy{1d89f989-b2c8-4b40-9479-ea8ed15802f2}{05aa602a-569d-426d-8e76-0f28ad0914c6}{4bfdf6d4-39ba-46d9-b29f-c51280107a2d}1114M{05aa602a-569d-426d-8e76-0f28ad0914c6}versionaSelected compression algorithm is not supported.Unknown Header QG@2&. Pz\V4 5)!55HH5!%%1 E M U Y ! % a a a aaa a 9 aa m %!%T 5G )-!111) 5 % )-!1)5 9a ei et m E M U Y TWrapNonExceptionThrowslD@5 ,55HH5H%5%5HHHHHHHHHHH5555 5"aa Ym m@^ P_CorDllMainmscoree.dll% @0HX4VS_VERSION_INFO? StringFileInfo000004B0$FileVersion$InternalName(LegalCopyright,OriginalFilename(ProductVersion,Assembly VersionDVarFileInfo$Translationp1", Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PELa!N^m @ @mS H.textdM N `.rsrcP@@.relocT@B@mHP(O"ս` !b #+3;CScs (v>JcgS !1Aa 0@`2+*+( *++~ f+*( +(+( +(> *>++*+(+( s}s}}i{(-*^ 0}(( *:( (#*&(F *.+{'*++*++{&+'_d}&-++{'+Y}',*++++++^+{$+{%*+++++,{&+({'__d}&++{'_}'*+++++F +{*Y*++${%+ {$-Y-+{'-c-X*+++.+{**+++++b`*+(@++(@++ +++b`*+oa ++oa +b++*( +(+08S8TXR~ ~ f8B~~ f888=~ ;f888=8B8C( o 9~~ f( o ~ ;f( ( (>o o ~~ f( o ~ ;f( ( (>( 9K,XRo XF:[~~ ľf( o %9~ ׾f( ( :9~ f( ( -f~ f( ( -R~ f( ( ->~ f( ( -*~ rf( ( -++++++%9R ~~ f( o %9W~: s %~ xf( ( %~ Kf( ( %~ bf( ( %~ 1f( ( %~ (f( ( %~ 7f( ( %~ f( ( %~ !f( ( %~ f( ( -N~( ,cJE !%*5:+0@ ++ +&0 +! +@ + + +%9 +0 9~ ~ f( ~~ f( o ~ ;f( ( (>( o ~~ f( o ~ ;f( ( (>~~ f( o ~ ;f( ( (>o &:~~ f( o ~~ f( o ( &* 88( 8( 8o 8( 8( 88(>8T08 + X+ +++( +( ++&݁98} (8y8~8T8QJ o XRXTXo YT+gXJo ~3XR+\XT-+.~XJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ 0?-\8/+-~>8)08(Xb8&-~?%X88 2+&~>8 Xb('~?%X 2::+(~> X b('9~?%X 2+~>Xb('~?%X 23@0A:3 +(~@b('9~A9X 2*(4 8(4 8 888('8 888088 %,8{*Y888888X {)YTXJ1:{({)XJ(,TJXJ3/J{(XJY(,XT+{({)(,T{)JX _}){*JX}*J* 88878>(G 8?8>(689(G 84828105@8.8.88XT+D8X88XJT8XJ18XJ.%JXTXXJXTXJi2TX TXT+uXJJJXJXJY_bXTXJ 2?XXJ _TXJ _TXXJXJXJYXJY_cXTXXJXTXJ>XJ3}+X T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{+(XJ('XJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ sI 8@8@8D 8J8Q0 888{3T8JEJ-+8p8q8q}48q{4/*8h{4 X}4((}3(?}5{5/*{5X}5(({4{5X}7{70}1}3(?}6{6/*{6X}6((0}0}:}3+AX(?TXJ/*(({0~;{:XJҜ{:X}:{:{62{0s}2}0}:}3+<{1X{:TXJX}:XJ%}9{:{73*{2(2%_,/*2}9Y}8}3X~/{8TXJ(? /*XJ(( ~.{8X +'{1X{:TXJX}:XJ{9 %Y 0{:{73*}38n 8h8g8f8k88(?8880+f8g{*8c8dX}*-+^ 3,+Uz,+V{(+R+S{) X})Ҝ--{) _})*88 88+sI ++++0H~=+5_b~=+*c_b`~=+c_b`~=+c`h*++++088T8{% X.B8uX8t8u8v8w{+vTXJXJXJXTXJY-J*(1-{{*1 {@J* 8z8y8z88888(.8088~ %X888 _-888-V~! *8@_-?_b~ %XX +1_b~ %XbX~ %XbX~ %XX (J ~ oK (L (J ioK (M ~ ,(9&*8!8 8(8(8'8. 8-8,83B0888T+Q8%X88{&Ҝ88{&d}&88{'Y}'YJXT{'10-J*X{%{$YTXJ1XJ{#{$(H {$X}${${%Y_,4{#X{$TXJX}$XJ _}&}'JX* 8888888880,v8{$8{%/8z88X880880i1sN z_,3{&%X _{'_b`}&{'X}'}#}$}%*8e8isI 8k8k8j 8j8j8k8j0888{)T88{*9 p18{*+#88{)8{*YX _TXT---XJYTXJ%-"1'{( XJYXJ(H XJXJ{(JY(H {*XJY}*{*/sI zXJ* 8$8#8"8'8&858=8<8@0u~+U8V8W~++&-+,- ++-*+oO ++++(P ,-+(+** 88(Q 8+4E 0T %98 8X8 {T8XJYE"n88{:,8}*88{8TJ/*{((J9_, 9e}JcE8+H{(/,}+1~,}!~-}"}+s} }*{(?%}/*{((}{(?-/*{((}X{{{(!T{XJY}{- }*{(**{ {(%-*{ (:}!{ (8}"}(7*9** 88888/8;8C8B(?8C0T:8 8 (?%?8{+8%2 -88_88-c*8ceTX_TXJ(?%2{+J c`_((c*X{'TXJ(?{+J c`,A_XJ0_((-c**X{'TXJ(?{+2_XJ0_((c** 88888 8((888 08X8Y8Z8_08Z8[(=%c8S8TbY {z}@8GEy8(=TJ0XT+SX(=TX(=TXJ0io@ &XJXJs()&XXJXJXTXJJ2+w0%I(4 0%C(4 (4iYoR (3-,oB rYp .ripsS zrpsT zoU * 88s 8888 8 8 8+0f+T8Y-+- -+++++ +!+"oV ,)++++oW +++ -oB *sX 8 8=D0D88{88888{T8JYE0/8 8{8(&Y% /9'*{!{(2% _, /#%:X/*}"}!}*~ Y}~ Y}{1J}X{{(?TXJ/*-{{(({XJX} }:{"{(2/*~}~}{1K }X{{(?TXJ%-/*{{(({XJX}{{{(${Y,} <* 88(58888888#0P++{50+"+#{1+{4++{5+++*+ +++++(H ++s+0K~+3,+1+2~++ +,-++oY +(P - ++(Q +&* .GG0G+%{40++{1++{4+++*+ ++++(H ++s+0,_+N,Z+Y{(+U+V{)+R+SX})+M+N{(%X+F+F{) _}) _%Y =*+++ ++++++0988+p8u8v8{ T8y8z8{-sZ + 0~B f( ([ o\ &,Xi,2 o @(] 88o^ 8888o_ 8{,oB *(` 8< 8; 08{'8<8{$8{%3:,o*,88{&8{#88{$ X}$ _{#{$ X}$ _b`{'_b`}&{'X}'{&n-_b-%,Yj_i*82868:8>8R8Q8U8Y8X{z}6v{~ۥ11BN<@mU@YPYUޒMV|E "ZEd?,`~9|K6iN4OgYнT3Z^Gnh512A̜mB߄9;s6u%vVz51<uWCǒ>i*i&p[(wi8ͳˢ0NN3r߸BSJBv4.0.30319lX #~ #Strings#US#GUID#BlobW( %3>"LAa>EEEEE*YEEE!EIZwE7EoxxE ! 1 > PqEE5E[1>EHEMlErEEEE ENETEbE|EEZUZnZZ%.LNP{ LL NN N L L LLL N NNLN#(+.L?L%M i{!!!!!!!!!#>I'I\4a>aDiKIPVId!!y ya41YQ]yia*3)N9Nah|mtz@FDKHPLU..C#Kc#KbKbK++ #+ C+c++#+ C+$#KtL t!x"m#:W_d=ZP C DP!E`!Fp!G!H8"IH"JX"K"L5IH !"MessageOnStart.dclibMessageOnStartPluginmscorlibObjectSystemMemberRefsProxySmartAssembly.HouseOfCardsStringsGetStringSmartAssembly.DelegatesMulticastDelegateAttributeValueTypeEnumMemoryStreamSystem.IOPoweredByAttributeSmartAssembly.AttributesDictionary`2System.Collections.GenericConfigPluginNameModuleHandlevalue__OnInitUIDPathBuildTagConfigOnInitDone.ctor.cctorCreateMemberRefsDelegatestypeIDCreateGetStringDelegateTypeownerTypeobjectmethodInvokeiBeginInvokeIAsyncResultAsyncCallbackcallbackEndInvokeresultICryptoTransformSystem.Security.CryptographyCompilationRelaxationsAttributeSystem.Runtime.CompilerServicesRuntimeCompatibilityAttributeAssemblyFileVersionAttributeSystem.ReflectionCompilerGeneratedAttributeAttributeUsageAttributeAttributeTargets{e0b3b8f0-3f4a-4a22-9fcd-a3606047cdb1}RegistryMicrosoft.Win32CurrentUserRegistryKeyStringConcatOpenSubKeyget_ItemGetValueToStringop_EqualityCloseAddTryGetValueCreateSubKeySetValueSystem.Windows.FormsMessageBoxShowDialogResultMessageBoxButtonsMessageBoxIconGetTypeFromHandleRuntimeTypeHandleResolveTypeHandleMemberInfoget_Nameget_Lengthget_CharsResolveMethodHandleRuntimeMethodHandleMethodBaseGetMethodFromHandleMethodInfoget_IsStaticFieldInfoget_FieldTypeDelegateCreateDelegateGetParametersParameterInfoget_ParameterTypeEmptyget_ReturnTypeDynamicMethodSystem.Reflection.EmitGetILGeneratorILGeneratorOpCodesLdarg_0OpCodeEmitLdarg_1Ldarg_2Ldarg_3Ldarg_STailcallCallCallvirtRetGetFieldsBindingFlagsExceptionCharRuntimeHelpersInitializeArrayArrayRuntimeFieldHandleAssemblyGetExecutingAssemblyGetModulesModuleget_ModuleHandleInt32get_ModuleGetMethodsLdc_I4get_MetadataTokenSubConvertToInt32ByteStreamReadIDisposableDisposeGetManifestResourceStreamInt16MathMinCopyInvalidOperationExceptionEncodingSystem.Textget_UTF8FromBase64StringInternArgumentOutOfRangeExceptionMonitorSystem.ThreadingExitEnterTransformFinalBlockFormatExceptionSymmetricAlgorithmCreateDecryptorCreateEncryptorSystem.CoreAesCryptoServiceProviderStringBuilderAppendget_ASCIIGetBytesHashAlgorithmComputeHashMD5CreateReadByteH4h21Ag3H111M{e0b3b8f0-3f4a-4a22-9fcd-a3606047cdb1}versionaSelected compression algorithm is not supported.Unknown Header=.FNCiz\V4!8LX\d` |x % )- ) \XX`\dX\X TX X X \XT`X 1\`dlX TWrapNonExceptionThrows 8.1.0.4892(#Powered by SmartAssembly 8.1.0.4892 IlD@Q Q ]aeQae%i i quq % %y %%% y % }%}}y% ! %% y}}yy lL1 11 0mNm @m_CorDllMainmscoree.dll% @0HXll4l4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0LInternalNameMessageOnStart.dclib(LegalCopyright TOriginalFilenameMessageOnStart.dclib4ProductVersion0.0.0.08Assembly Version0.0.0.0``=", Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PEL8%a!:NX `@ n@WW`H H.textT8 : `.rsrcH`<@@.reloc@@B0XHLE@7_Ғ-2: #+3;CScs _?bZhI !1Aa 0@`( *(*, f%,a,$&~ -Y,&~ -(%*(+*++( *( s}s}}i{(*^ }$( *:( ()*&(! *Bo( o( b`*~9_b~9c_b`~9c_b`~9c`h*{"_d}"-{#Y}#,*6 {&Y*F((b`*{"{#__d}"{#_}#*{!{ - Y-{#c-X*{#*>{ {!*{&*0j( ( 9&o f(( -g&( f(( o ̻f(o ûf(( o -(&( o -&&( 8z + +( +&( ( 9&o f(( :&( ڻf(( }{( &( ѻf(( o ̻f(o f({o ( ( 8X8u&*(f0J{,& ( +&~-&- o +&~- &-- o +&*(+.F0,rprps ~rp( , s ~( -( rpo -P&,o ( -'&, &o &(- &+++-,o * +yA 0%?,V&&-H%F-C&&%G,3&&%,%B- &&-*( +( +( +( +0 :&:&,O+%X:& 2,\+%X:& 2+%X9n& %,92+%X,\& 2s( +%X 2,s)* 8X8Z8e8z8+0b%E >&&*-% %@-)&&+-%C &&7*( +( +( +0%C:Z&&8%A:J&&9 : ;-M:%&+$~:0Xb(~;%X:& 2+(~: Xb(~;%X:& 2+.~: X b(9%~;%X:& 2+~:Xb(~;%X 2<=:6 +(~( :Y (iYo) (0-,o rYprips* zrps+ zo, * 888 888$0? s- ,4&- -o. +o/ ,&,+, -o * + $- 0p,]+M,X{${%,I&X}%{$%X,5&{% _}%, _-&%Y,-&0* ++++0{%9&{&1 {&+{%{&Y-AX _,|&:z&,Y:s&1#{$ Y-a&&&&&-X{$Y-I&&&&&{&Y}&{&/s# z9* 8V 888(" +(" +0 - {&Y(0 (*(0 :& %,{%Y:&16,{${%(,h&3/{$Y(X,Q&+{${%(-;&{%X _}%-{&X}&*8k8{ + + +0{#/~{ {!3-m*{"{{ -p&X} _{{ ,U&X} _b`{#_b`}"{#X}#{"n-_b-%,Yj_i* 8 +0& ( % ?{'%%-2_9&&c*ce9&_9& ( % -%2%{' c`9&_9&&c*{#9&( {' c`_0_(c9P**{#( {'2_,-0_(c**(8*83 888U(8X8b0n -,%-,[&{%,.+{(,?&X,#X,3&Y-*($-{{&1 {3* ++ +0{9&YEb8{, }*{( :&/*{9}&&_,}c9p&:sE!@-+P{9L&}9+4~(}~)}}+ /s}}*{( %}/*{9&&}{( /*{(}{{{( { Y}{- }*{(.*{{('-*{(0}{(}}(1*-**8 8p(8{8((8(80 :&~%X9&9& _-9&-^~1 *@_-!?_b~%X:&X9&+1_b~%XbX~%XbX~%XX ( ~o2 ( ( io2 (3 ~ ,(&*8$8.80 8;8Z 8]B0{/:v&EC,+( }0{09/*{0 X}09#&&}/( }1{1/*{1X}1:&&{0{1X}3{3}-}/( }2{2/*{2X}2:&&},}6}/+A( :&/*9z&&{,~7{6Ҝ{6X}6{6{22{,s}.},}6}/+;{-{6 X}6 %}5{6{3:b3*{.("%_,/*2}5Y}4}/~+{4( /*(~*{4X+{-{6 X}6 {5%Y0{6{33*:}/8~ 8(8(8(8S8x(8~019&:&9&+(:&1 %JXTX9&i2:& +GY_bX 2& _ _ YY_cX X1 }' +c _ Y_bY _+3{'(eb `h Y%,_bX X2 Y / 8, 9( 0({' b`h_bX 2+_{' _%9__bce{' c` b`h%9:_bX2Y_bX X i?6* 8888 8#8,0N~-<&-:&~o4 &, ,&- +(& ,-(%** +(' + . 0{&X%}& 1s# z{%Y _9&: -Y9&0n{%/e0U{${${%,_&&&&&{%X}%*{${%-B&X}%{$%X,.&%Y-'&0*(* 8h8y(" ++ ++07{0,&{-{0,&&&&&s* +(" +0{(!9&8{:&%9YE"!8{9&&Y% /*{{("% _, /&-/*}}:s}*~ Y}~ Y}{1G}{{( 9& /*{{9&&{ X} }{{("9&/*~}~}{1B }{{( /*{{({X}{{{(,{Y } <7* 8*86(8^ 8(8 85{z}AAV >xmQ7\h%fݍ}j-Ȇk]]UN׾ FeٻwV'~S`l =9؜dZ^5RE?'B @/l4Jdk~5Td)?@Q'N4_t+ޅ~z,ZFyjK(\Itr7q'/gO%rBQD'R[-A\]7}I3QȵI{SwYVjy[ pCZDgx}qDk pS]}ŬlRlET8df|p- IQMp?rx/%lÓN0} =\T<&VdYn@0Fp?YKaX٩a5'?|'j*֨,^EvBG8x ZWc0?Ƽٌ9= KAk؏Iu@Pva<*3?'B2RulZ=|Iʼ mf^Yz=.gGǝ_%J4i\.ͥf%kkYr~FZ~} efS&]`O-mD4Qkf3֙gv- w6e8*:E
âeS.fmUZC&8rPԤ!&ŝzxFnWMٸR3>47U^#oV{8y%,2qy*Whi`BƦDUv5;'M[ձι; )(̈4Ԫ+*v> |~S; *N3F>5]Sr9GjM~W`;>G/?/Op^Gb')%@bPߙr2"@9 6T蠧l<"@>BSJBv4.0.30319lX #~ #Strings#US#GUID#BlobW( %3"G14 LS`SlSwS EVsNSdSr{SSOaSkSSSSSS8SZVsVS3^^>Z^>2ZH2^H2jH2\H2qH2Z ^ Z1Z1^3Z3Z3Z3Z 1Z##VZ&V^&Vj&V\&3Z>3^>3j>3\>Z#^#j#\#q#Z ZBZFZJZN^NZZ#^#ZRj#ZZ#^#ZU6ZN6^N3Z>3^>Z^ZNZ#^#j#\#q#s#ZYu#3j>1Z>3Z1ZU1^1^U1j3Z\3Z`3Zd3^\3Zh3Zl3j\3^d3^`3^h$p(&,w"8|"Z&>"Z#8|#8|%#8'>"8|Z#8| (>r#8"8|)>p)>#8+Z`+Z+Z#Z\ Z#Z-Z-Z/Z/Z#Zt0ZX1Z02Z#Z2Z4Z 4Z6Z $Z7Z$Z":Z(E$Z0Z>Z#I8` ? @ A Bp!C!D!E!FX"GCSN SimpleProcessWatchdog.dclibSimpleProcessWatchdogPluginmscorlibObjectSystemAttributeEnumMemoryStreamSystem.IOValueTypePoweredByAttributeSmartAssembly.AttributesProcessSystem.DiagnosticsDictionary`2System.Collections.Genericvalue__OnInitDoneUIDPathBuildTagOnUninstall.ctor.cctorICryptoTransformSystem.Security.CryptographyCompilationRelaxationsAttributeSystem.Runtime.CompilerServicesRuntimeCompatibilityAttributeAssemblyFileVersionAttributeSystem.ReflectionCompilerGeneratedAttribute{d3d7cc22-1fde-462d-9987-16be85c8162f}GetTempPathGuidNewGuidToStringStringConcatEncodingSystem.Textget_UTF8ConvertFromBase64StringGetStringReplaceGetCurrentProcessget_IdInt32StartFileWriteAllTextCopyDeleteKillop_EqualityToInt32AssemblyGetExecutingAssemblyGetManifestResourceStreamStreamget_LengthByteReadIDisposableDisposeRuntimeHelpersInitializeArrayArrayRuntimeFieldHandleInt16InvalidOperationExceptionArgumentOutOfRangeExceptionAddMonitorSystem.ThreadingExitEnterReadByteTransformFinalBlockFormatExceptionCloseSystem.CoreAesCryptoServiceProviderSymmetricAlgorithmCreateEncryptorCreateDecryptorMathMinEmptyInternTryGetValueYGo2ngYfy3ks188M{d3d7cc22-1fde-462d-9987-16be85c8162f}versionaSelected compression algorithm is not supported.Unknown Header- ~@|az\V4(,40 LTHXP 04 (< (, !,( ,,((,0( $$4((0(( TWrapNonExceptionThrows 8.1.0.4892(#Powered by SmartAssembly 8.1.0.48929 A 99Q U Uei ee X 0X_CorDllMainmscoree.dll% @0HX`4VS_VERSION_INFO?PStringFileInfo,000004B00FileVersion0.0.0.0$InternalName(LegalCopyright ,OriginalFilename4ProductVersion0.0.0.08Assembly Version0.0.0.0DVarFileInfo$TranslationPP8", Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PEL#b!Rq @ @pO$ H.text$Q R `.rsrc$T@@.relocX@BqHO(!NM:`&^ #+3;CScs DdhøO!Q !1Aa 0@`2+*+(( *++~ f+*() +( +(+(Q *>++*+(+(( s+}s3}}{io**+*++{%+'_d}%-++{&+Y}&,*++++++.+{&*++${$+ {#-Y-+{&-c-X*++++++,{%+({&__d}%++{&_}&*+++++^+{#+{$*++F +{)Y*+.+{)*+^ 9}'(( *:(( (6*+ +++b`*+o` ++o` +++++b`*+(?++(?+&(a *2!+*(+2"+*(+2#+*(+2$+*(+2%+*(+2&+*(+2'+*(+2(+*(+2)+*(+2*+*(+2++*(+2,+*(+2-+*(+2.+*(+2/+*(+0+,++(++(+&*0~~ f888~ lf889~ {f8888o o o ~ Jf(o ~ af(( ( ~ f(~ f(o ~ f(( o ( &#(8]s 8X8W8V&( ( (! %: 8 9~ {f(s o -o o ~ Jf(o -~ af(~ f(~ f(o ~ f(( o ( && X i?<*,o" 8 (# ~ {f(s o o o -F~ Jf(o ~ af(~ f(( o ( && ($ :g o ,*(8go% 8bo& 8](8b( 8]47'0M~M~K++ + ,%,+,%,(D+s' +(G+ +&%-*+*+??08 + X+ +++(* +() ++&݁98} (8y8~8T8QJ o+ XRXTXo, YT+gXJo- ~3XR+\XT-+.~XJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ XJo? XXJXTXJXJ2~@ o: XF-~A +~B oC ~D o: oE & oF &-JXTJi?* 8I8}oG 8}8|8{@ )3" /C20Z,:3%+%+ , +#+(++--,*(H +() +( +oI +oJ +08[8\ (8X8]8^T,8-8U8VJ8U8o1 () .9~5 () %8() oK sL o8 ~9 o: () oM XT+]XJo6 () 34~N oO _o? ~P o: ~A oC +,XXJXTXJi-2~D o: () oE oF 8&JXTJi?* 88oG 888888A=P0|~+\~N8X8Y~ ++&+,-,-++,"+oR ++++~O(J-+(** 88(J8+4J0I88~ %X9&88 _-888-e~5 *8,,@_-?_b~ %X-X +7_b~ %XbX~ %XbX-~ %XX- -~S~R~P(M~ (P(S ~T~R~P(M i(P(V~,( &-*888888 888` 0U~+=-~N+6+7,~ + + +-++oS +-~O(J ++(J+&* 3QQ02rprp, 8%- ~U~rp8,98 ~V~8- ~Y~W8r p88~\~[+3+4(h9~^(k&-( ,+(e+,~`(n*s( 8((Y8FsT 8O(\8Y(_8f(b8f 8eI0S+/, f%, a+$+&~ -Y+~--++*++*+++++(++(+0f +T8Y-+- -+++++ +!+"oU ,)++++oV +++ -o *sW 8 8=D0 8X8Y8Z8_98Z8[o@%c8S8TbY {z}@8GEy8o@TJ9XT+SXo@TXo@TXJ9io &sXJXJo!&XXJXJXTXJJ2+w9%G(H 9%A(H (iYoX (-,o r[p 8rkpsY zrpsZ zo[ * 88sA8888 8 8 8+0D88{88888{T8JYE0/8, 8{8o,Y% /9'*{ {o7% _, /#%:X/*}!} }*~ Y}~ Y}{1J}X{{o#TXJ/*-{{o${XJX} }:{!{o7/*~}~}{1K }X{{o#TXJ%-/*{{o${XJX}{{{o.{Y,} <* 88o08888888#0T%98 8X8 {T8XJYE"n88{:,8}*88{8TJ/*{o$J9_, 9e}JcE8+H{o',}+1~+} ~,}!}+s;}}*{o#%}/*{o$}{o#-/*{o$}X{{{o/T{XJY}{- }*{o(*{{o8-*{o9} {o:}!}(*9** 88888/8;8C8Bo#8C0 +w8xT8w{%,O.98lX8k{+j+n+r+vTXJXJXJXTXJY-J*( -{o11 {@J* 88888888o280|8%B+Q-B8%I+A,8%J+1%,8%E+!--*(H +(H +(H +(H +08{&8<8{#8{$3:,o*,88{%8{"88{# X}# _{"{# X}# _b`{&_b`}%{&X}&{%n-_b-%,Yj_i*82868:8>8R8Q8U8Y8X08 88T+Q8%X88{%Ҝ88{%d}%88{&Y}&YJXT{&10-J*X{${#YTXJ1XJ{"{#(\ {#X}#{#{$Y_,4{"X{#TXJX}#XJ _}%}&JX* 8888888880,v8{#8{$/8z88X880880i1s] z_,3{%%X _{&_b`}%{&X}&}"}#}$*8e8is^ 8k8k8j 8j8j8k8j0+f8g{)8c8dX})-+^ 3 +Uz +V{'+R+S{( X}(Ҝ--{( _}(*88 88+s^ ++++0,_+N,Z+Y{'+U+V{(+R+SX}(+M+N{'%X+F+F{( _}(, _%Y,=*+++ ++++++088{)8X%})8 18z8{(8Y _8-v 8-Y0c{(/Z0L{'{'{((\ {(X}(*{'{(X}({'%X %Y0*(-*8483878>s^ 8@8@8D 8J8Q0 88 %,8{)Y888888X {(YTXJ1:{'{(XJo)TJXJ3/J{'XJYo)XT+{'{(o)T{(JX _}({)JX})J* 88878>(_ 8?8>o&89(_ 8482810 888{(T88{)9 o18{)8+88{({)YX _TXT---XJYTXJ%-"1'{' XJYXJ(\ XJXJ{'JY(\ {)XJY}){)/s^ zXJ* 8%8$8#8(8'86898:890 98:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2s5+ 9 +%X 2,s5,* 8H8P8T8W8X8f8i8k8s05@888888XT+D8X88XJT8XJ18XJ8%JXTXXJXTXJi2TX TXT+uXJJJXJXJY_bXTXJ 2?XXJ _TXJ _TXXJXJXJYXJY_cXTXXJXTXJ>XJ@}*X T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{*(XJ(=XJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ -\8/+-~=8)08(Xb8&-~>%X88 2+&~=8 Xb(=~>%X 2::+(~= X b(=9~>%X 2+~=Xb(=~>%X 2@?9@:3 +(~?b(=9~@9X 2*(H 8(H 8 888(=8 888{z}9ab`,ˬՐʃԄɑ bal;|*ݾa](%6ϰUmFz`\8X Tce=G돳᫳k3#Xn:o3Ճ>QvK=w:cX܍?^<- Fݨs{}BSJBv4.0.30319l#-#Strings|#USh#GUIDx#Blobw( %3A1`ooa%hVIB\BBT7ZKMkM.M % -%n %3O{spf77m777UM`@O5r%p "#',*4 -8 ;=A?ABKBKBKBKB KBKB KB LE NH PK QN SQ TT UW VZ W] X` Zc \f ]i" _laoI3;111?1C1K1N1QQV_V_V_V_1111QQQQ QN?QQQ?QQ6611??QQQQ Q QQ111?11?11?3333333333 )4>IS]]iis"}!}%$ !"#$%&'()*+,-./0123456789:;<=>?@ACDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnoBH#N&{<&T)U# ]# ), T- ! M'H >5# # # # # # #T/T/T1Y1 2T# # D3w3#570:p: |;#x$&$V$ $xT??@$$Bp$ 4C $8D|GHKLU# pL L M $%3%F !FM=% !FMJ% !FMW% !FMd% !FM q% !FM.~% !FM9% !FMC% !FMN% !FMX% !FMb% !FMn% !FMx% !FM% !FM% (%,gI)Q.a4aU4ix9i>qFy_Ly=Qq>W \a gq>kp x } }) Ly/y}}uzyQ A1@y yAAAQZYAayYIrii%y'+qI0y/+yN+yc+y+qI7yr+ym+y+qI?y3+iIQQ8Wakrwi}Byk+1y+ $$$ .} $ 1UIDtypeIDSystem.IOLdarg_SIs1jm2w0L3MH28uSvalue__mscorlibset_VerbSubSystem.Collections.Genericget_IsStaticReadAddDynamicMethodInstallationMethodmethodReplaceOpCodeEndInvokeBeginInvokeIDisposableRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandleIsInRoleWindowsBuiltInRoleget_Moduleset_WindowStyleProcessWindowStyleget_NameConfigPluginNameget_FieldTypeValueTypeget_ReturnTypeownerTypeget_ParameterTypeSystem.CoreMethodBaseCloseDisposeCreateDelegateCreateGetStringDelegateMulticastDelegateCompilerGeneratedAttributeAttributeUsageAttributeAssemblyFileVersionAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeset_UseShellExecuteReadByteTryGetValueSetValueBuildTagConfigSystem.ThreadingEncodingFromBase64StringGetStringMathPathget_LengthiAsyncCallbackcallbackTransformFinalBlockSystem.Security.PrincipalWindowsPrincipalCallTailcallOnInstallGetManifestResourceStreamMemoryStreamget_ItemSystemSymmetricAlgorithmTrimICryptoTransformEnumget_MetadataTokenMinPluginSystem.ReflectionArgumentOutOfRangeExceptionInvalidOperationExceptionFormatExceptionInternFieldInfoMethodInfoMemberInfoParameterInfoProcessStartInfoCharAesCryptoServiceProviderEnterGetEnumeratorGetILGenerator.ctor.cctorMonitorCreateDecryptorCreateEncryptordummy_ptrSystem.DiagnosticsGetFieldsGetMethodsSystem.Runtime.CompilerServicesOpCodesGetDirectoriesGetModulesCreateMemberRefsDelegatesBindingFlagsStringsInstallationPathsget_CharsRuntimeHelpersGetParametersProcessAttributeTargetsset_ArgumentsConcatObjectobjectRetSystem.Reflection.EmitOnInitExitIAsyncResultresultEnvironmentget_CurrentGetCurrentGetPathRootStartConvertCallvirtMoveNextSystem.Textset_CreateNoWindowInitializeArraySystem.Security.CryptographyGetExecutingAssemblydummyCopyget_SystemDirectoryop_EqualityWindowsIdentityEmpty79jwYs1UOc5hFmuyMemberRefsProxy{d43ce598-bc32-44ec-be58-db0883b2bfa0}{8b3c3c07-a856-4692-89cb-689f20605fe4}{80bab5b3-69fa-49c5-b0ed-800b07e79bcd}1117M{80bab5b3-69fa-49c5-b0ed-800b07e79bcd}versionaSelected compression algorithm is not supported.Unknown Headerz5dlIOLz\V4 M% -5 A E u } y %Q Q Q QQQ Q ! QQ ] MM!Q UY U4H ]TX`\ T T T \t|px % - 5 A E TWrapNonExceptionThrowslD@yyyyyy"QQ E] hH]pq q_CorDllMainmscoree.dll% @0HX4VS_VERSION_INFO? StringFileInfo000004B0$FileVersion$InternalName(LegalCopyright OriginalFilename(ProductVersion Assembly VersionDVarFileInfo$Translationp 1"5b:T7f3,16/26 Antivirus vendors marked dropped file "conhost.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "services.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "System.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "dllhost.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "WmiPrvSE.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "ctfmon.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "SearchUI.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "lsass.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "taskhostw.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "OSPPSVC.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "sppsvc.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "ONENOTEM.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "explorer.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "csrss.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "RuntimeBroker.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "sihost.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791198280979,"unified_at":"2026-10-05T11:04:40.979Z","metadata":{"hashes":{"sha256":"07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430","sha1":"03ef34eb3988a671bff188d0d9deccd6b15a9a91","md5":"072b45fb8eabc0a6b35a66e8fac134e6","sha512":"8897537c9ba7f348ed21f7237832865e2b8e86597be1810903980be2dde285690cf6c918e7498f8797e41555d717b34fd534a27f24ec2ed1af241c648183ca36","ssdeep":"24576:9aW+kpR3A6u2NTmjuj3IhW5WzYcsEhnIEwPbU64JitpEfYWY:9aHkpYC/Ihr4EhAs","ssdeep_chunks":["24576:9aW+kpR","24576:aW+kpR3","24576:W+kpR3A","24576:+kpR3A6","24576:kpR3A6u","24576:pR3A6u2","24576:R3A6u2N","24576:3A6u2NT","24576:A6u2NTm","24576:6u2NTmj","24576:u2NTmju","24576:2NTmjuj","24576:NTmjuj3","24576:Tmjuj3I","24576:mjuj3Ih","24576:juj3IhW","24576:uj3IhW5","24576:j3IhW5W","24576:3IhW5Wz","24576:IhW5WzY","24576:hW5WzYc","24576:W5WzYcs","24576:5WzYcsE","24576:WzYcsEh","24576:zYcsEhn","24576:YcsEhnI","24576:csEhnIE","24576:sEhnIEw","24576:EhnIEwP","24576:hnIEwPb","24576:nIEwPbU","24576:IEwPbU6","24576:EwPbU64","24576:wPbU64J","24576:PbU64Ji","24576:bU64Jit","24576:U64Jitp","24576:64JitpE","24576:4JitpEf","24576:JitpEfY","24576:itpEfYW","24576:tpEfYWY","49152:9aW+kpR","49152:aW+kpR3","49152:W+kpR3A","49152:+kpR3A6","49152:kpR3A6u","49152:pR3A6u2","49152:R3A6u2N","49152:3A6u2NT","49152:A6u2NTm","49152:6u2NTmj","49152:u2NTmju","49152:2NTmjuj","49152:NTmjuj3","49152:Tmjuj3I","49152:mjuj3Ih","49152:juj3IhW","49152:uj3IhW5","49152:j3IhW5W","49152:3IhW5Wz","49152:IhW5WzY","49152:hW5WzYc","49152:W5WzYcs","49152:5WzYcsE","49152:WzYcsEh","49152:zYcsEhn","49152:YcsEhnI","49152:csEhnIE","49152:sEhnIEw","49152:EhnIEwP","49152:hnIEwPb","49152:nIEwPbU","49152:IEwPbU6","49152:EwPbU64","49152:wPbU64J","49152:PbU64Ji","49152:bU64Jit","49152:U64Jitp","49152:64JitpE","49152:4JitpEf","49152:JitpEfY","49152:itpEfYW","49152:tpEfYWY","24576:9aHkpYC","24576:aHkpYC/","24576:HkpYC/I","24576:kpYC/Ih","24576:pYC/Ihr","24576:YC/Ihr4","24576:C/Ihr4E","24576:/Ihr4Eh","24576:Ihr4EhA","24576:hr4EhAs"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1288192,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1777257341000,"last_seen":1777448830000,"last_multi_scan":1777448830000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":83},"sandbox_signatures":{"informative_count":197,"suspicious_count":17,"malicious_count":10,"total":224},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.FUJL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/MSIL.DCRat","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1323984","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Prometheus.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Msilmamut-9950860-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Prometheus.2 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Spy.Agent.DTP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.Stealer.n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005c37eb1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"Malicious","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DCRat-N","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Trojan-FUJL!072B45FB8EAB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.GRNG-1086","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.BasicGen.Win32.4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Prometheus.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Found WMI keywords in script (string)"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"suspicious","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Contains symmetric decryption functionality in .NET code"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Contains ability to perform AES cryptographic operations (Dotnet)"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Able to delete scheduled task(s)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"},{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","identifiers":[{"type":"informative","value":"Contains ability to perform code compilation at runtime (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to collect clipboard information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to get active window titles (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve user privileges"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve system time"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":".NET code is able to query registry"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads VM-specific registry key"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Able to access Steam setting"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to retrieve geographical location"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Copy files into temp folder"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"suspicious","value":"Contains ability to use Webdav for network"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"informative","value":"Able to download remote files (.NET)"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Observed Microsoft Internet Information Services [IIS] related strings in binary/memory"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"},{"type":"informative","value":"Contains ability to perform asymmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to access Steam setting","description":"Found string \"SOFTWARE\\\\Valve\\\\Steam\" (Indicator: \"software\\\\valve\\\\steam\"; File: \"07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin\")","origin":"File/Memory","mitre_attack_id":"T1518","relevance":1,"id":"string-763","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"elected compression algorithm is not supported.\" (Source: \"00000000-00001700.00000000.178655.03670000.00000004.mdmp, 00000000-00001700.00000001.178677.036F0000.00000004.mdmp, 00000000-00001700.00000001.178677.03700000.00000004.mdmp\")\n Found string \"GZipStream\" (Source: \"00000000-00003592.00000000.178131.00212000.00000002.mdmp\")\n Found string \"elected compression algorithm is not supported.\" (Source: \"00000000-00003592.00000000.178131.04750000.00000004.mdmp, 00000000-00003592.00000000.178131.04990000.00000004.mdmp, 00000000-00003592.00000001.178345.04720000.00000004.mdmp, 00000000-00003592.00000001.178345.04780000.00000004.mdmp\")\n Found string \"Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression\" (Source: \"00000000-00003592.00000000.178131.04990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"$25","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00003592.00000000.178131.00212000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00003592.00000000.178131.00212000.00000002.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00003592.00000000.178131.00212000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"nulstart \"\" \"C:\\Users\\.NET v4.5 Classic\\Desktop\\System.exe\"del /a /q /f \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\\\R1NRaFDyOx.bat\"\" (Indicator: \"w32tm \"; File: \"R1NRaFDyOx.bat\")\n Found string \"@echo off\\r\\nw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\\r\\ncd \\\"\" (Indicator: \"w32tm \"; File: \"07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin\"), Found string \"@echo off\\r\\nw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\\r\\ndel /a /q /f \\\"\" (Indicator: \"w32tm \"; File: \"07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin\")\n Found string \"@echo off\\r\\nw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\\r\\nstart \\\"\\\" \\\"\" (Indicator: \"w32tm \"; File: \"07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-519","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; File: \"07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin\")\n Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"00000000-00003592.00000000.178131.00212000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\", Potential IP \"4.0.0.0\" found in string \"4.0.0.0\n Culture=neutral\n PublicKeyToken=b77a5c561934e089\" />\"\n \"2.168.0.2\"\n \"0.0.0.0\"\n \"2.5.29.10\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.37\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST / HTTP/1.1\\r\\nHost:\" (Indicator: \"HTTP/1.1\"; File: \"07298425bee226d4d690426615379577339bfab3fec6c69baf2855c16b224430.bin\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003592\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \"System.Runtime.Remoting\" (Source: \"00000000-00003592.00000000.178131.00212000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"Remote Access Related","name":"Observed Microsoft Internet Information Services [IIS] related strings in binary/memory","description":"Found string -C:\\inetpub\\wwwroot\\sppsvc.exeIndicator: \\inetpub\\wwwroot\\","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-130","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00003592.00000000.178131.04990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00001700.00000000.178655.03670000.00000004.mdmp\")\n Found string \"GetProcessById\" (Source: \"00000000-00003592.00000000.178131.00212000.00000002.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00003592.00000000.178131.00212000.00000002.mdmp, 00000000-00003592.00000000.178131.04990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"nulstart \"\" \"C:\\Users\\.NET v4.5 Classic\\Desktop\\System.exe\"del /a /q /f \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\\\R1NRaFDyOx.bat\"\" (Indicator: \"\"del \") in Source: R1NRaFDyOx.bat","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00001700.00000000.178655.1E3D0000.00000004.mdmp, 00000000-00001700.00000000.178655.1FDA0000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003592.00000000.178131.04990000.00000004.mdmp, 00000000-00003592.00000000.178131.1DA20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 600028d-ctor","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"Win32API|Process and Thread Functions|TerminateProcess|uExitCode\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001700.00000000.178655.1E3D0000.00000004.mdmp, 00000000-00001700.00000000.178655.1FDA0000.00000004.mdmp\")\n Found reference to API \"Win32API|Process and Thread Functions|TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001700.00000000.178655.1E3D0000.00000004.mdmp, 00000000-00001700.00000000.178655.1FDA0000.00000004.mdmp\")\n Found reference to API \"Win32API|Process and Thread Functions|TerminateProcess|uExitCode\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003592.00000000.178131.1DA20000.00000004.mdmp\")\n Found reference to API \"Win32API|Process and Thread Functions|TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003592.00000000.178131.1DA20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"69f1b77da45146a0f203c8e1"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"