26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ca,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Capa_get_geographical_location Sample 0c39d439fe9a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0c39d439fe9a…. Malware family: Capa_get_geographical_location. Threat score 100/100. 15/25 AV engines flagged this file. 13 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4","keywords":["Malicious","Capa_get_geographical_location","malware analysis","sandbox report","threat intelligence","0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4"],"about":{"@type":"SoftwareApplication","name":"0c39d.Spy.exe","applicationCategory":["peexe","executable"],"identifier":"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Capa_get_geographical_location","antivirusDetections":{"malicious":15,"total":25},"behavioralIndicators":{"malicious":13,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T51c,Pattern match: "http://ocsp.digicert.com0a", Pattern match: "http://ocsp.digicert.com0c", Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0", Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c", Pattern match: "www.digicert.com1$0", Pattern match: "http://ocsp.digicert.com0x", Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0", Pattern match: "cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0", Pattern match: "crl.comodoca.com/aaacertificateservices.crl06", Pattern match: "crl.comodoca.com/aaacertificateservices.crl04", Pattern match: "crl.sectigo.com/sectigopubliccodesigningcar36.crl0y", Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e", Pattern match: "http://ocsp.comodoca.com0", Pattern match: "crt.sectigo.com/sectigopubliccodesigningcar36.crt0#", Pattern match: "www.digicert.com1!0", Pattern match: "http://crt.sectigo.com/sectigopubliccodesigningrootr46.p7c0#", Pattern match: "http://ocsp.sectigo.com0", Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0", Pattern match: "http://ocsp.sectigo.com0*", Pattern match: "crl.comodo.net/aaacertificateservices.crl0", Pattern match: "https://sectigo.com/cps0", Pattern match: "http://crl.sectigo.com/sectigopubliccodesigningrootr46.crl0"28:T1b90,Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "SetHandleCount"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeConsole"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapCreate"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "EnumSystemLocalesA"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedExchange"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocale"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")29:T108f,Assembly shows XOR instruction xor eax ebp in Stream UID: 7590-117-00412029 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7590-117-00412029 Assembly shows XOR instruction xor eax ebp in Stream UID: 7590-296-004141A7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7590-296-004141A7 Assembly shows XOR instruction xor byte ptr [eax+02h] al in Stream UID: 7590-586-0041AF1E Assembly shows XOR instruction xor eax ebp in Stream UID: 7590-839-0041294A Assembly shows XOR instruction xor ecx ebp in Stream UID: 7590-839-0041294A Assembly shows XOR instruction xor eax ebp in Stream UID: 7590-920-0040D57F Assembly shows XOR instruction xor ecx ebp in Stream UID: 7590-920-0040D57F Assembly shows XOR instruction xor eax ebp in Stream UID: 7590-921-004153D0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7590-921-004153D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 7590-926-00418859 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7590-926-00418859 Assembly shows XOR instruction xor eax ebp in Stream UID: 7590-979-00414A9B Assembly shows XOR instruction xor ecx ebp in Stream UID: 7590-979-00414A9B Assembly shows XOR instruction xor eax ebp in Stream UID: 7590-981-00414B33 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7590-981-00414B33 Assembly shows XOR instruction xor eax ebp in Stream UID: 7590-982-00414BA7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7590-982-00414BA7 Assembly shows XOR instruction xor eax ebp in Stream UID: 7590-986-00414D79 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7590-986-00414D79 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-8678-10-0040C36A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-8678-26-0040A47F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-8678-26-0040A47F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-8678-220-0040CE65 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-8678-220-0040CE65 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-8678-223-004150CC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-8678-223-004150CC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-8678-224-004155A7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-8678-224-004155A7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-8678-227-0041555E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-8678-227-0041555E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-8678-248-0040DA12 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-8678-248-0040DA12 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-8678-251-00414982 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-8678-251-00414982 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-8678-325-00412029 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-8678-325-00412029 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-8678-326-00418173 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-8678-326-00418173 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-8678-541-0041294A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-8678-541-0041294A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-8678-625-0040D57F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-8678-625-0040D57F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-8678-626-004153D0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-8678-626-004153D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-8678-631-00418859 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-8678-631-004188592a:T101e,"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000008dc570000000000c04e1f000203797700020000880179770000000064de5700a40179770000000000000000000000015500530045005200330032002e0064006c006c000000000000000000000072770000727700000000cedc5700d0007277f0db5700ccdc570018dd570095e1737728f21a00fefffffff5f6777716f87777e81e1b00cedc5700c4dc5700c4dc57000100000028dd57009ef87777626f777764f87777e8273a777412db7188dd570000000000000072773ff000007412db710000000000000000e81e1b00ccdc57004199777700000000000052746c44656c (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000064e47d0170e47d0138e67d0192e0cd694dd3ec70feffffffb8e57d0116bccc699c605e8c04000000ece47d01b8e57d0120bccc69060000000000de6a010000002fbccc692a000000060000009c605e8c04000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4e57d01000000008e00000044e67d01feffffffcce57d01cf007877d60078770c1f10768e0000004700000044e67d0100000000a0e57d010000000008e67d0195e17377d8fc1a00feffffffd60078772f7b8c75010000005c007806167b8c75c0f4ee1f (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005708)2b:T148d,"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\MUI\0409\\mscoreeis.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreeis.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005708)2c:T3b36,"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005708)2d:T8bd,Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1708_IESQMMUTEX_0_519" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_5896" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1708_IE_EarlyTabStart_0x168c_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1708_ConnHashTable<5896>_HashTable_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1708_IESQMMUTEX_0_303" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1708_IESQMMUTEX_0_331" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\https://learn.microsoft.com/" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\InternetExplorerDOMStoreQuota" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1708_IESQMMUTEX_0_274" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\_!SHMSFTHISTORY!_" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\MSIMGSIZECacheMutex"2e:T1257,"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "MSCOREE.DLL" at base 6bb90000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "ADVAPI32.DLL" at base 76050000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71030000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "KERNEL32" at base 75b00000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6bb00000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "SHLWAPI.DLL" at base 77870000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEIS.DLL" at base 6c400000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "USER32.DLL" at base 75a10000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "IMM32.DLL" at base 765f0000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "COMCTL32.DLL" at base 71db0000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "USER32" at base 75a10000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74320000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "DWMAPI.DLL" at base 73e80000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75db0000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "CRYPTBASE.DLL" at base 75520000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "KERNEL32.DLL" at base 75b00000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "CLBCATQ.DLL" at base 75fc0000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75ce0000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "OLEAUT32.DLL" at base 76250000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "SHELL32.DLL" at base 76670000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "OLE32.DLL" at base 75db0000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "PROPSYS.DLL" at base 741b0000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "COMCTL32.DLL" at base 74520000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "APPHELP.DLL" at base 754d0000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6ade0000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75780000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 756b0000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "URLMON.DLL" at base 76100000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 728c0000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 741b0000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 71c20000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "IERTUTIL.DLL" at base 763b0000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76670000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75b00000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "SETUPAPI.DLL" at base 772d0000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "RPCRT4.DLL" at base 75960000 "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 754d00002f:T9fb,The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 10, O=Microsoft Corporation, C=US" (SHA1: 76:46:2F:19:47:F2:77:4F:98:1D:63:C0:2F:DC:1A:A2:47:82:01:D0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: B6:63:D8:41:3C:A3:5F:3F:22:64:3C:CB:C2:D3:25:07:00:91:6B:1A; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB" (SHA1: E5:7C:E0:1F:6A:5E:1D:4C:52:2B:C6:84:88:AF:53:D9:BA:D1:3A:B7; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: D1:EB:23:A4:6D:17:D6:8F:D9:25:64:C2:F1:F1:60:17:64:D8:E3:49; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB" (SHA1: 0B:C5:E7:67:73:D2:E4:4F:C9:90:3D:4D:FE:FE:45:15:53:BB:EC:4A; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B6:C8:AF:83:4D:4E:53:B6:73:C7:68:72:AA:8C:95:0C:7C:54:DF:5F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA, O="DigiCert Inc.", C=US" (SHA1: F3:87:22:4D:86:33:82:92:35:A9:94:BC:BD:8F:96:E9:FE:1C:7C:73; see report for more information)30:T1369,"logo_net_1_.svg" has type "Unknown"- [targetUID: 00000000-00005708] "index-docs_1_.js" has type "Unknown"- [targetUID: 00000000-00005708] "site_1_.css" has type "Unknown"- [targetUID: 00000000-00005708] "ms.jsll-4.min_1_.js" has type "Unknown"- [targetUID: 00000000-00005708] "1JH54RYU.htm" has type "HTML document ASCII text with very long lines (56232) with CRLF line terminators"- [targetUID: 00000000-00005708] "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_0c39d43" has type "JavaScript source ASCII text with very long lines (427)"- [targetUID: 00000000-00005708] "wcp-consent_1_.js" has type "Unknown"- [targetUID: 00000000-00005708] "docons.7a3b485.aaf6a59e_1_.eot" has type "Unknown"- [targetUID: 00000000-00005708] "app-could-not-be-started_1_.png" has type "Unknown"- [targetUID: 00000000-00005708] "app-could-not-be-started-details_1_.png" has type "Unknown"- [targetUID: 00000000-00005708] "imagestore.dat" has type "data"- [targetUID: 00000000-00005708] "repair-tool-no-resolution_1_.png" has type "Unknown"- [targetUID: 00000000-00005708] "en-US.4" has type "data"- [targetUID: 00000000-00005708] "favicon_2_.ico" has type "Unknown"- [targetUID: 00000000-00005708] "~DF9DFA4827FE18F2AE.TMP" has type "data"- [targetUID: 00000000-00005708] "~DF07BAD5D126EF85D3.TMP" has type "data"- [targetUID: 00000000-00005708] "~DFE3DD4E93112D58D6.TMP" has type "data"- [targetUID: 00000000-00005708] "repair-tool-recommended-changes_1_.png" has type "Unknown"- [targetUID: 00000000-00005708] "repair-tool-changes-complete_1_.png" has type "Unknown"- [targetUID: 00000000-00005708] "_AF66452A-B4F2-11F1-A6DD-00505691B3CB_.dat" has type "Unknown"- [targetUID: 00000000-00005708] "RecoveryStore._AF664528-B4F2-11F1-A6DD-00505691B3CB_.dat" has type "Unknown"- [targetUID: 00000000-00005708] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4987 bytes 1 file at 0x2c last modified Sep 04 2025 20:23:24 +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- [targetUID: 00000000-00005708] "_535077C1-B4FC-11F1-A6DD-00505691B3CB_.dat" has type "Unknown"- [targetUID: 00000000-00005708] "B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF" has type "data"- [targetUID: 00000000-00005708] "9D6B3FE9E6E4067193F477ABAD990106" has type "data"- [targetUID: 00000000-00005708] "3B7CEBA4139B7484BAF665AC9E712D61" has type "data"- [targetUID: 00000000-00005708] "892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6" has type "data"- [targetUID: 00000000-00005708] "U9U4YZ2N.txt" has type "ASCII text with very long lines (480)"- [targetUID: 00000000-00005708] "P3IB1P90.txt" has type "ASCII text with very long lines (480)"- [targetUID: 00000000-00005708] "3GIY273Z.txt" has type "ASCII text with very long lines (480)"- [targetUID: 00000000-00005708] "IPOTXX2P.txt" has type "ASCII text with very long lines (496)"- [targetUID: 00000000-00005708] "YCWUH0EI.txt" has type "ASCII text with very long lines (480)"- [targetUID: 00000000-00005708] "Z8C8WGD4.txt" has type "ASCII text with very long lines (480)"- [targetUID: 00000000-00005708] "U0UUU3B7.txt" has type "ASCII text"- [targetUID: 00000000-00005708] "E4DYN205.txt" has type "ASCII text with very long lines (464)"- [targetUID: 00000000-00005708] "377D8EVO.txt" has type "ASCII text with very long lines (428)"- [targetUID: 00000000-00005708] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959" has type "data"- [targetUID: 00000000-00005708] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F" has type "data"- [targetUID: 00000000-00005708] "7GJC0IJA.txt" has type "ASCII text"- [targetUID: 00000000-00005708] "26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD" has type "data"- [targetUID: 00000000-00005708] "P49JY9BX.txt" has type "ASCII text"- [targetUID: 00000000-00005708] "C30A8653A628E8368A1D33BB7E570E4E" has type "data"- [targetUID: 00000000-00005708] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- [targetUID: 00000000-00005708] "4V3XPOTM.txt" has type "ASCII text"- [targetUID: 00000000-00005708] "B54B00CE250A47F2A29BFE4A70858A02" has type "data"- [targetUID: 00000000-00005708] "BA8E834886E353ED96ACC8AB83273509" has type "data"- [targetUID: 00000000-00005708] "Y458XSLQ.txt" has type "ASCII text"- [targetUID: 00000000-00005708] "ZY06OGR7.txt" has type "ASCII text"- [targetUID: 00000000-00005708] "30IVFCOG.txt" has type "ASCII text"- [targetUID: 00000000-00005708] "66CPDKL9.txt" has type "ASCII text"- [targetUID: 00000000-00005708] "MLWZ4G2K.txt" has type "ASCII text"- [targetUID: 00000000-00005708] "PPOJWWPS.txt" has type "ASCII text"- [targetUID: 00000000-00005708] "learn.microsoft_1_.xml" has type "Unknown"- [targetUID: 00000000-00005708] "application-not-started_1_.htm" has type "Unknown"- [targetUID: 00000000-00005708]31:Tb78,"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: ""; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: ""; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: ""; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: ""; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: ""; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "")32:T1582,"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: "SUPPRESSIONPOLICY"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: "SUPPRESSIONPOLICY"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: "SUPPRESSIONPOLICY"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: "SUPPRESSIONPOLICY"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: "SUPPRESSIONPOLICY"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORPARSING"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSPARSEDISPLAYNAME"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFOROVERLAY"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "MAPNETDRIVEVERBS"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFORINFOTIP"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEINWEBVIEW"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEONDESKTOPPERUSER"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSALIASEDNOTIFICATIONS"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSUNIVERSALDELEGATE"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "NOFILEFOLDERJUNCTION"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "PINTONAMESPACETREE"; Value: "") "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HASNAVIGATIONENUM"; Value: "")33:Tbe8,"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\FLTLIB.DLL" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\MSVCP140.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\VCRUNTIME140.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\ucrtbase.DLL" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll"34:Tcf7,"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\FLTLIB.DLL" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\MSVCP140.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\ucrtbase.DLL" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"35:T217c9,"GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: js.monitor.azure.comDNT: 1Connection: Keep-Alive" "HTTP/1.1 200 OKDate: Sun, 20 Sep 2026 12:30:40 GMTContent-Type: text/javascript; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingCache-Control: no-transform, public, max-age=1800, immutableLast-Modified: Wed, 08 Jul 2026 19:34:46 GMTETag: W/"0x8DEDD27F7DB6F34"x-ms-request-id: 10f5fdc3-501e-0090-23b1-48172f000000x-ms-version: 2025-05-05x-ms-version-id: 2026-07-08T19:34:46.5015364Zx-ms-is-current-version: truex-ms-meta-jssdkver: 4.4.2x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.4.2.min.jsx-ms-or-policy-id: 6437dba7-5170-44ca-b9b7-c3a660a5c205x-ms-creation-time: Wed, 08 Jul 2026 19:34:46 GMTx-ms-blob-content-md5: +eEumdRvFky1unHu2UN6HA==x-ms-lease-state: availablex-ms-server-encrypted: truex-ms-access-tier: Hotx-ms-access-tier-inferred: trueAccess-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-version-id,x-ms-is-current-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,x-ms-or-policy-id,Content-Type,Cache-Control,ETag,Last-Modified,x-ms-creation-time,x-ms-blob-content-md5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,x-ms-server-encrypted,x-ms-access-tier,x-ms-access-tier-inferred,Accept-Ranges,Content-Length,Date,Transfer-EncodingAccess-Control-Allow-Origin: *x-azure-ref: 20260920T123040Z-16558856f9dtjtjmhC1FTYwcxn00000002r0000000000swnx-fd-int-roxy-purgeid: 0X-Cache: TCP_HITContent-Encoding: gzip8000��i{�8�&�}~��&[�b9KUQA�ql'qV'vV��MA2c�T�8v,�o�s�$()�=�{�tW,Ď��?7�G럭��I��ɫW��D�A�Ag��6�&y��(L�,� ��$��ȓ4��Z��Tz�F��օ��\�q0m��}��?6�E�Q�J��u��b��H��X��^4v��sG��v��qK�̒4϶��U2*�jC�^�o^OM3�B鲅��|kK�v��݁c�;C��}JE$TY|2M΃��E�Q��W�y��cȻ�H�svv�mR��Q -�EGe)��[6��=��C&�rGL��#��K��C9�?�9eIw�i&�3��lɐ��L��5��!U<��Q�u"��u��I�F�(v��$z�Y�]��'r7�D�ҹ�n��菘�)��&ĥl�#�Q��r'��|<��v<ᆃt(��j5�7�Y�ޝSТfu��CKi�IU^��6��[��醔��.��C�z]`�G"Tuq+Q�V�q�ZP�,��)��3K�<��J��;�bC�ؗ�H��R;'�W��ҙ�x�_8�&2��rE��)}��N��G�N��8Mf*�oT�ь�<]��q(��3��'��%� 1��A~ቈ��4��}��5��'�F��u|C��}S\��C�Nxj��.9� ��{59��q�Nx�$S�o9�0M]�{��Y2�G��W��nwi�x��2��魁��k�6�l6��A^�q$wʏ��^�5��تJ*q�$�b��,��\: -��w��lp1�`��A)�XU;S뛞��S��9��v>��u��9��:�s�s��}��׮�iP�ĵ�WB�U�'uI�np�m��W��Aʉ21��:�z�D;1C�}�۹�z}��Mc��f'�P��5��5ϖ��n ��j��T�N�&Q\'Ѩ��y��s�y=^n�u��ۋ��N�ZW��P[�SUC�ph��̐v*�f��!��N��wY��6�ʲ`�t�y�0�N��z�5�ti&^��}��K�o��[��5��՜&��*��N�f� T�=��G�s��D8�]��x��G �@�7a�Q�Nk��0��4��*Ѷ&w�9�H�z~��S��j�΅}��E%�� 5��V��[I�gG+OZ�[�\r-��|�Z��W^��G+�Z�1h�;�.v�8�h{mm�u.��zA1X��k�3��.D�ὲv��c�Qڐ?�cݡW�(c�¾��s^qQ��QX�'<�k��h)��E��&y�<��H(�O�V�B��y�.-��\|#��S�P�:7��^�Έ��'b��uu��.�}�jp=��?w��E�ӭ�&��8�uW��h�G��[D�g��ri@�6��ct��:�o�t�L4�H�x>�ʑ�2H'ŕ��L��S"�g�;��J��m�R��àW�0��C�_��3䛕�e�B36%�x��+(Z��Z��J�G4#��hQ��o}�6��7΄��%��6�� |��ct��΂*�ة��F�h�� G�a��g��|=��O|#d�|GY�Bd�8�&��w��iAO?|�G�:y�V$��w2�]��g^OdL�J��C��#�Q�cޙ.�1�r��l��B�$}�Z;S�\;Lt�Q.��倾QB��C��@�2g��_��3�ԗ��[G�W��(��̦">�$D��]��hR�E��7�Lh�Eʏ�$��.A�x�+�cf��^4�z�׎�f��J��'�=wO5�a^˼��!�3�c�@�8��i��ƿ�h��ik~�E�oT;��i��T�7�c .��O�>m}�mVG\�=M��W��,�8U꧲M�6^��@;]��[n(�u�A�E4��Ku��Ȯ��WR�S.�w>�#�ΔM~�pFN�M�8�h^��I�J��Y�xU�b�+��2��9ЫE5j�J�� 9��"I�r>i��18ϭQ�(:v��C�\d��?�=ך�3+jd��ӈ��dy�*�G��A}��Y,b>��F"��E�Q'p�#4`�?Z2C�ԥ=p�'��X��s�I�2��Մ��ۍ�iꘖ�B�E4|��v��s��FW�˚>�*s|�re5�7�U6�"�k�Z!�N��3[r��l�|�{��ל��h��us�k��1��􌕤��'�sFI� �3�Ε�v�QY��x��QU�9��-��N|�Ӊ��[��U��Fc+i4��y�Pe OkQ��:�*�(k��#��6ۻ��~S��-�%�V�tt<~J�K�>cJ��,Su=?_��Y��̴u�lZ��5��dU�#��?Zg�K�Zf��n��5�Ȑ��x>�Z�>Q��A.r��\S��?��P��!�CD�o$�uo�!��{�[3��@�h��>��W��n*��=U�P'O�fN`4f��s>MĂ]cܐ�Ax�nl�_j+"�H�4��1��\;S�j��˜{�џa_^�*��o��,%4DE�DDX�\��t��>��uFI�⸍q\�a(�@�z^�n�M��X��'b�;C�l$o�7��tz�j��0Od��lz:P�z�r�,CS�zZ̜v-[��v8�rJY�B��;�\��D^�>OqSb��AL�LD$c�"�NO��#�S��͙YK�B��;f��]-��z�Mc1��s�^{bk�k]�*JTPr`�XNc"p��@<�"�q��G��1��:��W�^4��+��Ci��+�<É��F0l��+��cq��X҃b��+f�b�޿��s�/��B��=;�n@,�*�ʺ�W*�4�#�ۖ>��<�Y�cl>�_ڕ��ǲT�+C�u[��Vi$�0uD��j��Vp7�Cb��Ѻ��w��MM1x��T��tL�紥��i�.�۷�.�*6vxZ�b9X'�6�{�9��Ŧ��N��b�Kh�N��:t�ݞ&��PD�]�b�r��E�G�+��n�tɶ��6�ܰ^�7�=,�!��bu��y��P[�N�i��Y��-�}J9"#@S�jaX�L�߷�B�l��dp�ݑ��R,J��4�b"*��9�&�)�w��^�רc0��y�}�Ce��S�f)�OT�x��/��J�Y/�T�~��vh�1R?�Gq��U�S?D�NޟW3��rU�G��K��w�g_��t��'ф��4��V�7[��)�Մ؜� �<�E��<��Wc�X��9�3�o"#��x�%��mV֩�ޖ:��~��Xa��>:��,T��b�Dm¸)g�2+F.XFw��8�UǠJ�[T�L'ڎ-h=nP�ZMn��8/��#D3@|~<.X�SW��>'��7\�/*Yx�{-��|��L��I��Z+�x˷�㭑`0X�TJ�p�b��׆~M�"��AT�x�C��G٧�y7�M�~��"6��9�jrH�6X�?�(��?��x;��<�ؚ�z�%�7ͫf��>�w��<��fC"n��lw��&��"Ȱ�-�G�LiK��(DH��w44��D�w@3d��v�~6;�D��(9�J>�$�F�y�'fA��O�@�R��T�T�O��hJ��޿��m�IW�R��Ri��9-=^�ӅF*�y��!዁:"i�Jsж��15�z�0�Ȝ^��DLOWzs�Q�J£k�_h�"�@N��D�4u��rN��F�4��T�7�rGL#ۧbU�M@��O@|�^�@1�J;%�ɡ�K[%*�1#��x��*��^E%�8��m#�5מU4�}n(MՔ1�.IwZ��q�c{P=�:�~«|��FB�Ons��#{��O��J��v��ڗWψ(��f�%H35:�I��d@�&��Y��΁X�mMM��F��+��`��2Ҥ��l��Q�W�>j8ϼ�~6�#��1ćH��I�}��ցia��R�̙��Ӵ�&��y$��bH-��WW��ki�?N{q�]��e;��އh�12~��$NP9<�*�B<��X^#��u��tK�blY8��լJu��D�ۃ�ײ��s�WL4aP�٠m�k��idJW�&v�Qֱ<��Z�NČ��ҞX��̴q��j��r�y۩��Jk|Z�'�u��O��_�$ m�^�GK��;��%��6K�C�ђC׷&�~j��(�6��!)�n�7�s>�<<3�u��j��;��z_"�.�&�,�$��/�3`�0ESxg�w��Z�r4��°��윰A��q2a�)��TB�cmk\IPn�"�I�i��L�� pEFK��*��ؽSx�G�%��F�cP�bu��o�Ӡ��dC�$|�"�y��]�k�y+�e��W%�V��ѹ��E�0m��t��)>��@�3��-ﱓF�a)�7-5H�a�E��/��4\��V��V"�X��9v�]r�(e��WO��u\zocԔm1b��F}�DQٵb��1h��$X2IR�Վa��S��|n\V<-��Ͳ��E"�\E!��l%�E��-��<�q/��f+~�;8ޙ�u-0h(�k�"��h�hU�Q��V�Xa�_��Ny^�L�5;�ĵ(��w�BN�0BGCd1��T��H�D"Ԉ�w�s��@��y�"P��܌��:�㢱m��-t��1$��ic��3d�M�uA�zo[��{��5�+�C(�f��3m�(�`��ΙC��-:��̜[�8U��jb"760��ë��d��ppM-�9A;'j�A7��nmM6}��XD��X��hH� A�OU�s�i�g��GI4xQ��}r��K��I�mJ�1ϋ*e~-hX��'A��J0,6-��%bH}Ux5x-X��f�P�"&̳V)��J�y9�\Xa>��{�s=�D�@1P��/��U�%��4��Dd�S��P�cY&��P>�)E�9��K��T��h��O�Ap�#��K �s�3*E4]� �ko��4GTӘ�ϝaƐ$��a?��Q;cc&J��FH��s� ��x�t!�LU�$l[��@��i��~�y0��ab��Ԡe8��4��(�M(�M�f��=<�1@�/"o��$��)tK�_��[P~��Q!��y i�J��wZx��<��?X��F�W��ձXE��g9�)kQ��4ґ�-�hI٩�s�g��+9��BΜ��XY��䍍�X�dL��ʆ e�4��4� �ч��/�2m�v�xsBt��G0�)!*�#�0G��n iC�Te��~�t��Ne3M�; #��QVV/�D��o��s(�v�6��]��^ �� 7b-��?U�l��zk~Ͽh�?��qA�*�Yl��ǎ�)ma�H��%|\[�13��u��L��b��hiV��.\��бÆ��7"��ލb%�T��Uw?�#��s��qS[[3�J�&aT�G� �X�Y�~�c��R��«&�#ֻ��]��_"+`�MJ1v�E7��?$��Z<�wWt��r��6��C�U�빠��ؽ](�-�k��A��<��|��ܽA�Yj{9�Os"�"E�VM��R�!��X&��PP��&��M`�}�ƾ�N��)��P/bmR��<��`�}pb:_?Z��V?Z:1�|8��k�o�5i!i#l�xXw58��/P�.�I Hz��R�W��v�1��ig�L^">�l�R��L��0;��M�:>BrT(��\:/K�Mz5jЦx�>�6�m�V_=�h/Zj7�2h�b��e��sID��v��t��C�U%�Z�,��ѱM��f})��8JB�[�F��U�𛒱�[r!��vL�-��-�E�K��;��O��fkW��@��~|�0^d��+�ϐ��)%v��&B�Tơ��i�`��j��-��PTi�NÈh�i�1c��/��^�(�Ci/�`1�a�72��y�B�V��[��0��`n�o��ų"��&��׬L�"1�pv׳h��xŘ��gF�a�kz�$�x~MDQ*7��Fe�b��h��L+�Ej�W5�a�^ ��(U�{�D级�6ә�Z�� /��=0�d!t�k>U��|l.��6E}zV�:��i��&�h�?��'�p�upy�'�C��1:pUh�'�$�<��V(�K�Nt[H�d�~�g�-��ԛ�t��O��4��T��ϴoT��D��s��s�N��eppe'��R�DY�#��ig"��{� ��F��$�1�X�:3�?��'o�R��z�&3��-/��(��tDBOoE5R��{��3̊sMb��Wg��^�y�n�]v>o?K��v�g(2��x�Y�4i�famÑ��O��B9"}��3��<��*��ݺ&.�"+��`ߣ(��s��&�qcî��n/�>S��Ѣ��V΋՜�Q�p.��]%�6��A��s�ݛ�}zu��_��MN9��ڃ*Q�&Fѱ��<ҭ�u44��EbI�ub�ӡ{��k! �0�i�l9g�OXP�_�חe7U怫n�5�]�C��=�x�s)\��R��j��-�-L��ag~��I:��<{Ip��=��O��D��5�L�h1J mߛ��Xp��2��:�XZh�+�Sb&��'��'2��VMT*�O`#W��p�I��S�f�-ge��I��+�r~��7(�L1��l�_K�O+�)M�To��4��qm-��܅9��Iy�[��0�uڗdvfM:6{��ׯ��̠`a�Ϝ�l�ö#J3J��E��o"�o��&�r��΃Y��y��M��ھ"4YE�=ۛ�6�1��A�۳'�� 7G��|��;�ا�aοIm$c[��PT�i'�fl�Ki�V�S��s��ƀ�zZ��9��Hvk��)�*!��0/�؊�d��[�F��m#bm>$P��r�`l��i�1B֤�;)��<�9�$�w{T�f��.'mg��w3��#5̓�+�e�isb�X+҅\D�>��Ɩ�X�A��;a�{��ҿ�a��&b��(UD�h��k��D0��v�.��>�b� w!6�s^l�v觾'H5/O엧I3h·��_;4�\��'�� QIʊ�Z)�gh�sR�c��7��M��e��8g��a��c��M�5%�h�f��M��C_��4)��tnFE�w�ݯt��j��*��8��G07)S��U)��>J��P�ȥ�H�:;;t��V�!��x�Sb�X��J��t��y��:��vD\�1��X�S"^&�Y">'��:V��3}��824;�K"+яؤ� ��$��U�o�r~�`X�ʏ�k��LoM�E�3��uX�ω��{kB��JK�A�R�sv,��(�:��4`��]%��rd�$�cuU��ڊ��Z��(��~��S��.�Pׁ�2��iZB"Tt�.ZEQM_��q��I��Q�"$T�WA��`˴~��gZ׃Y/��PET�e�ܗ�,��)A@MeB�O1�I�ɞ�qa9�?K䳤&��,�Dߡ��o'#�M�7�qT��&�x�^6��c�"�,�J��z9�)��Xj��(��L81��34d��t�s�[�m*�:R�q�&�K+W�v�R�Y0�Jx��^3Z�G��*fQp�b�P��vH}�GK��A�q��r�kk�پR�J��3LuS�q��=�=Q��Lҽ��u��haT�0�uC�,$�?_r9�(\k�8��o"0qg�ʞ�" ��J�[k�M�nBv/t��2%��Œc �m+�Ro�G�L5�ꪨ��s�X��V�N=¼��;�]�!�f��ut5��+�x��`*�Z��aP��5F��ӯ.��xdޘ֬v��5-��*��:4�;��;��G��û��!v�^��v;��6�!^t)��ˇ��| �Q�m��]3��ji^@��0a��z��U��8ǚO~H��41�@�Q/��At0��%H��5��|��@?19�Fwz�c>�{E��1^K$=N^�@��6v��c��K!4"#*>@ŕ��XL�:[N��H��e��<ԓz�g^�?��Ҙ��;b��ی&�j�DٟkP�ԏ3:`�l��b��M�u=�뾮f��it��.jk�i?mg�f�D9�M]��B�D�L��x��ľ��P��{��G��8-��]q�gG��ǣ?��>z��í��kS�vyT�{��K�vW��G�|Tg��˹cS��'0G�Iȏb�w��/�em��Y�l�<ܪY�[3Ѭz^ږ�ޓ��çϞ�x��ޟ�~��yH�dr}��^��{��۟;��9��[��Ջ.>�m�m�\��Vfs�^u�i��y|_�"��V�!>��Aa��H�V�I;�ù7��Ѯ�,�P�3�> ��Fd=�ڴ?��^��ě¶�� ?�w�ȧ:�3��H��K2��_�X�K�cjt�QmOُԷ��.%wٳ��ť��/ck\,�ٿ�r�;�x�ǋukb E�M7��ʅHb)��*X܈v*�|hū[T[�Z4erOX��.��@6>��9�>Bl��W�~��7��2e�t��qg4�Z��|1�^Ig��E��r�$t�c>UzIyht�$Cę1g|h��}l?z!��b:#q+BH0��nF��x��.W�-�߫�s��J�u��J�ک�'��Y��w��N:UbL��K|�%I4�b�-�]��b�@J٠�V��mN!N@p�1�N�>+0��\��1f5��3��D��;3��D�-��d��5@2��P�2��-��N�vYQ}�*r��VC>�Х!w��3�tEK��X�d�t�]�<�fVj�ʐ\��8��.ߥZ3��S!b�U��u"53]j��ب$i�i��%ψ��=�7^R�R`�.d��`Dlq>��u��N�`}��;��}��V#��-��@,"r��"��bȌb�O1�1��k<)Jw㐭�}>�;p,��|��̠ot��h��o�O��y(�r�2�zGL�}��]8NV��(S��A4U#�'=��araW�a��^�e�̒E�٘%q{ �`�� .=�Y��1v��2ӯ�Dԡb�h��4m�P�m�@�(�5ƕ+]�4�Iٴ!`��Q�S\�BK;fS\@�F1x]5��R�X�}}�_��-�*u�m��#��e9� ��e6�w�Eܰ�R��r��m��Q��)��;ԕ&ClX�Ftll�[`g�Nh7�l��|QK�`��}X��Os��Iϖٻ� ��h�jy]��=��k�X�.��Y��Y'��>UN4_D��v��#x�h��֖��l-� <�뛯�/a�M��dk�>KDKe>��A6P�c}�C��K�J��%5d��9YU��/�}��]M��ki8:��uL��{LU��h�ʄ��0ȓi^��M�MR5-�d*��ۚ��7U��-=I0)ޑ�5aϠԼd�Ct��9�K�Ԓ?�j�)5��u�+;��{�`]M�,:O6��y+P�J��Ȫ��7H��"��]x�}L�&uS�Bk˝?+��s��׹ŋE%k,��K�ob�U�T��L��xA�C��w8D&��\��v�)�Q��,��N��䱝��zy�O��(o�ϴj�d�}��a��Y�ˏ�-�#��nq��h�d�G��@,��L�%e�9��X��T��@��)L� ��%5.��g"�bO��)��1��8�Aū�2.#�Y)�Vr��2�U*�@_�.~h��OR�"i��CG�E,��g�18�q��r��"SM}�&�*|v��a��t��>��r��!��s�ˏ��7��JK��"�5q��rX��hx�6�Τ��7�X�±�j(�b{��9��v��3ؤ�' ��+�2�o9bI��W�X�d��VM]��ذ��Be�`4/21��K�7Ss��+X��Y�P��O\�؏�F-��AOj�~�1�Rtw3�7 H�d>o��}��u�R Sc��Q�X<6Q�p��f�0B'b��Ȕ�D0�� xFC��}+�C��M�K⋦t*�h��c��^��L(0��D��04_OY؋xEg��~��Ǹ�M�b�1eT��\3SeFX��<>c��ݸ�\Uɹ�˱�s�)ǚZ5:��)��ܥ��__L��r�::��Q�$�":�A�b��e�DKJ�{� 12H��A��Bp<�u��bЀǱO@(ҫmCxY�q,s��;+p5�*T��&�N�E�B��31�@�y��W#�2&��l��r�\\w��l�b/�Eyp�gE��f��gEwE��A��˒04��!�7��c5��Z9��.q�N��UԷ��}9|�]X��i�>W��IdW��*��kM�Y²M��B��;��[�J�I"A��j�<�Qj�P�,e�h>�}�%��O.��ZNmE/RJ��b$4Q�ˢ�h|bh)��mn|��yb\��N��=ߩt�]��3�r��v�_P6�`�e��4��w��@|�"�(� �?k�!�VHt�!��F!�T�V�T��:k�B%<8��se�� L|�+�Pޭ�j��;�2��*�y��q$@��б��y1�9+B"��D��)&��$��u��E�-��}�l�|�/��D@u@i��iش�06�0�@�}�7/��0o��G1X{�FCb�>/Ga�Ԡ'!��C9�ޏBKPꟴ��^�g^��e��}g(�i�Znt��V=ؖ�p%�)_n��y�i��>;m��c��9�N�9�W6ږ��O��@b�8��.�M�� Y�nc��ښ��G��'J� &q��Q��^�,�J�),� ��w.�r�8��E�T��!g�q�m��|t��om�i#Z�>�>��=m�{b%1n�E��V��a7��XT�I��.��r�Z�ݤ�$ϧ�5�j͈p>��B�qH��W�bx�`6�8l`��0��E�in+�j��3��BF��q��-!�%�t¯��O��Z��)�";�S", "J�Td�}��?a��jƧ��!��'�Oǩ�T]�=ܮ�q�?Q�l�߫��E��8b��ޫI/ʨ{�On�f��U6->y4��M�۹�l��Ow��߮?��e4��$��_��駛O��9ͥW�ΐć��Dl��ӧ(M�~��k�X�|�O�٠}u��w.��ce�xb�x��=�ev��84�8�`��w��q�3ܟ��l��7uD�o=��o�&��WO��V-��_��![ �<�k��:0�jG4&T��q��$��a-(qL'%��i�LΥ �i�L��p.`�c��H�hу�rI�2�qG�V�>l�Ht�|��*.p`��.��6\XL�O��h��:�2�ݿ�<.�GFE��O��~�轾��ch�@^i��i��|b��l@��kվ�lq�Ȧo=�{>o|u�'*��.|��O1�M��Tp+��6X�ʼIX��Y�vq5ph�ȽB6Uj��E�24�k�l1�Z�o=��4��cj[��q�(��vK�q!��F��i�J��M᤼��f3�.��e�:��jm��h�d��N��$�n��n�U-�{��X��5`D "��/L�~?%��TW��R"�Q%�Uư*e)�X)�n��e�H�^�>��Jƀo�S��J��o��l�n^��`�j�8p��Qg�v��2�x�9�q�bZ�Pm��2{��S��9�eTizu!��xz��\㕕��`ԁ{�1��͍��S�O�i6myM��`sf��N|��5Wj��_9��_.~I0�9��&gA��3�;MJ�K��|Q�\PJX��j�O�-��s��t�Ћt�o��x7}u[�4��-b�=;Ǣj%�7�K��tAj�"��я@��F"lQ'5�U�q�5�:�-�1B�2[��U���)Z��8��+�?�<��\��1@�2v>��tыq|�K�M'8{�#D0��{a:��^��y�O��ʨ.Q�}��j�A��4��f�̷[Ds߮��$�%��3{�'0��Z��1�L�q��L�9(��/� �+��x��AM�hp3D��Ę0��YO�0��HJ��gI�՗]�/�;�J�6��0I��Y[�`��er�Q��&��h��4"(�˘̃��/]_��9�7�;�n';H%Q�k��6�c]��[Մ��wP��ڌ�4^�V��\��i��35�9n��3��X��vT[>mb{w��洩�bT�5熁T@�kpY�0��8-=@W8000e�)�k�`�5��B��B�1 µ�8��**�X��-X�wL�}C��c]E�)��B�!��זW�!�B��7uc�V;��fN�oV��J�W��آB��3�~�8��2�kcV�i��ڈlI{�=�A�Ty�v��%�kj��"p�l�6�U��=�`nf�b6��p�A|��٬�&��\`/(0�VV��˱>��x��3e��ZJ:3��3c3hcs��\�9lA�҃�S�GE"�"��`�@��^r��sf92'ֹ�ahN�|6D6(��.��yK�Ts��G��PY�u�U��N��h�X�̮%2�3ς��+d��ЋE�n�/S*/E��j�!�v5�$] �[Qъz4X홪�w��G��j��`Y��X��_�T�촅�F$S/[\�o�N�K�fH�c��k�Ղ$|,��ȍ>��}��Z�p�pV+�f�W�+~��kmw�W}P��>��m6o��YT�7��-�=]�͡N�ر�nǖ�1�q!��ѕ�S��0�ͷ��*y��@�YWB��s;��R�Րi��X<��*�a��UǦ�X�rK��J��Ř��b��#7�\)vV�ɅI)�IΠgx�^�tkF�+L@��DƖ&��s[��ʫ��j\�Tܯ�շ\T�]�$�g[��F��g��Lx�mǰ��/��?��6v��_��M|��Ʉo��Q�|��9D�{�R�ۿ�M�ٱ�ܢ��R*{�k��Tmqv�ɴ\��@�*�ޅ�k��Qui��p�6�B�qI��W��ӆq��T!W�2�\ژ��c'��:�B\��#��1�Y�b�386ٲ��DsJIc&�|��j�7Zͦ=��Qb��:��p]($�� Q �]KX'�wp�j�3uU�k��P�к�)�=��,��w_<�t��Y��~��(�(WQ�7�v�C��v��q�4��Y�(�A�&2[��K(��l��e�{"��/_>��%[+�^�]V^�qo�}��\G��W{0��1��Ŷu$|�D��Ŵ0+D{��F�A��`�w.�l��NxB+H��E��/��♪�ڧ� a�I�$�"]��Wt�x��%�sVB�ӻ�`=�ؿ&�~6�S��m-T�f�?`��M��j�C��G�pm�R��k>��1��Z�h��p�ζcB7m\�ԜWb~V��`�w|�Js9ͣ�}G��H��f��ȍ��mCP�*G��I}�,�G4�c�J�p鈉�� *J�ZoA��]� c�e��a�hA�B��,�J#��ѫ}�8�|ce1��Ct��h^G��<��M��f9��M��Y"85|u:4i�j��;�m�sYj6Z\��:� �߲d��-X3չ��4�R7T��{��cǨ�n�9��u��I�:F��=�h�D.�'Z��ʀ��Kd�K��Q�a��^'�f��DAA��f�1�%R'��G۬�_��г*�K��C�>��7 B�"�ủ�P}m��N��D``=u�һ�#E��Da?�^m�,��zg��S��T��1�/��,��2�(�4�:"<��p��ad��AV�>�=�0��s�m6rt��-��g�n ��nx:]��J�i��3l��0��q��m�:��X(�s}��%qV��*��"y13X�>��ܚ��ywɸQ]�'՟)��LD]��0��W�3�"�(rS|=`�r�1 �)?$7��e�L��U8�1!:sQ�,��\��mMPq��9�c�ݥ_ɒ�~�)��6"�c'�\_��x��Q��pH�V=b��x�I6y�e�P��{��{��]�E{�E��'i_�h��l)>ǩ �s�x)b��#��s�D��8� �j�q��\r�7�č)�1��˺��[0fh�{�\_�?99�G ��7;[��:��G�ۻ|�s�s��vqe�%��v��U|�>|o�qY8��i�u%��Qx��Ink�4W۪��}�==�/L�_�',H��*{d��,�U��cg�f!��rH��U��V��^@�}�eX^"{�v��X�X�q~+�Mp��)d9��P�Iؼd�K��9��u�D@)��Jr�?�-*��,lb3{�'�h� C-�U�;��4��N��ԣ]+��_�]��ǡ��A�?�aE��۸-�=��%m��R<�>q�M��u&��]��3��C�b2��9�"|�a�un3�z��,r첖2#�f��JZ��\r*sjL�hL�R7�0B5B�I�\,.��LIVa�8��*�7�7��!��[�<�0�s��7�@�6'�c}�b�z��;O�`�n��{��8��%��3�8w�;m��'��wc)��,�.�,7�F0�s{��<�$�g�>F�Wh��w^��l�^��Q��v�<�=��S=��ivM��g��>nm�O�;�Nv��u��;|��;��?UO}G�u|pt�?S�|W��ps��Y��;r�r��v��9��Q[�';��_��c%8�d�߃1��%r��R�i(M��Nv��{�z�J��:�9��Hѣ��Qov�w��Sգ��Q{��A��T�Zg��~��Q+ͽ��z��=W=jm�⨃Ý}�H��B��js�ytrxt��s|�u�5�NC��g��zhO�zj��N�B�k�F2}u�>�{��_{�֨��>��`s��c�^�u�]3��z�~N_��<�z��T��U��¹'&��L�J�|��k�ٚyjRi��!Vcw��=��'��N��?[W�֫��O��|��=�s5kz��4��9��Ӫ�ަ�4z��zNͨ�aw�Qϟp9��(Z��'G��u��*_%8�eP��?Uϩ��ެ��G{��g��3�rMjݖ��V��T��~��%�\��J�[*�^��/��9��]��+��Q��ix�4o��3�)I��8�Q�-Cq�k��ч�߫Uף��n��|��Sc��L�z�P�h�F��)�:5n�&d��}��iAA��MFI��\��:5�i��U�a��|�ZaG�ݺ�D�z�A��6��-'��eZ��J2��t��3��3|c�c+;u�3��#Ѐ��_vZ٩7�1=h?k��g�잵�`��J�z��_��N�<;��@uQ��Vy�1��f:��#�$Zm�}�7�aYZ�:G��.��{:�57�+��X�镍ү�vv�g�I�h�FT��k�٤��2�x끣��@[��y��O(c3]�{��˛*#}�IOg�0orx��1�H��5�S��t�uʴ^�_r| >��*M??�|O��5��:M?�:��,T��5��$�\gB�z��@��=�tZ�kX�UR�5��h)�a)7�u�W�_S�S_P�g��V��|4FG��g��i��{��sz�\?F�~�~_?A�_�璨s�~��-��b��R?5\?��^�ƹ��6�|��OM�K�5��9b�k�)��S��F�-��RV��덬�D��p��耦�S��f�t��ۻD$�~��<��.3�܌�ۃ��C��(�S3L��,*}|��[��4�O�/*��~=�V4?J��E�ŭ�(wt�~��ZQ��i��o�6��g�fV��w��C��~B��{�c�u��,��]�ӈ�� ?n<��,�o�v�w7�Edwdw��Pkq#�&��6��"Ft��N�Ml�]#��8�p�u��u��1�k�<��'$ʁ[#Ns�f�D��ɛ�#��O�?�s�~a8�K�´�%b�H��ei�},�,H;��:��BVP��rd<��^�p]q�#��7u��4��c};��=�*�rd��@`XZ��d��8P��Qh�6�{\�32�1�U|�ا�b(M��U�'��7~��B_v7��١L�}�� Ľ8�gP�Y!�G�H��C)��}��z��b�JY��&T��P��Rne ��[�y��g�?�S��d�H��;^ow^�`q��rD[/��6Qgk"2р��:ꏃ�=��1D��ͣm��#�[o��7�(ӯ�f�:43��q�ψ�t�;��x�`?��uO��?9�'�Q�f��f�U�S?E��}o@NDՏ�q�7G�p<[Gœ��p�c3UҍP��\��U>A!�:*��1��lER:*�g��K��9Ge��牣�vL�Y3��Zn�@��y(~��+-��C�"�Lq� �Y�(��5�/��s�W�&�/�5]֎o��^�}�uE)��u;˫��ο˞�� b�.��z�s��N&d��6I?s&�;��T��h?@��`�j�;��[��sU��1�G�*Z��+��lʦ|c'E��FX�s�3��,Pn[��eq�gz҂�!��y�MǑV�oW��f�p4��DyfJ,��#N�s��㿓R��b��^�HJ��A�G�ޖ�Lܱ��3'#�X%��L��Y��Ita��؆i��С��z� ��L��:p��D�t=��G�v�>=��I}��39�/��^Itk�؁æ?L�FA�;�N5L'M;��<�v¼��+؈.�dne��GC𰐳�*?��N��X�w��`��5٢�d��t��q~~�i4�v��tM��x��j�Bd��&J�ך�̀H<��`�z�'�$��lT�=�Ts��O��S��Q��\�w�Om�Q��.X�rQz��=*Q{6\��O�1m|NC�Ÿ(V��n쎀��>�M�_��$R�4-t��A8L�5X*K�� ^rI��zl�w\�/��@��w��ټ3D,C�H�3D?�`�T]��t�>�<9��,ؙ�v�j��8��N�CO�<�MK=v�K�:A�{��#�!U��aKBs�s��t�P�o��<&:��;��*!�nP��[r 1��*��~vO5N@��`�6��Y{�Uoxv��Q��f�_��Y=��Y��qlrIժ?G�E�#�SO��&�A:�6��ÞH�@�m��Ԃ�*a��0��žUls�`��ѐƴM�L� _M�'��$8uFY6�Y��QA�$��<&E}w[F�p��@b�-��&}"��Lq�t��}��Z��/�8|o�Q�N��gP0\��#s��\왋��/�n�6Nj�2��:��4ѻ>NB�)lIyYY�0A%ISW]��gbB��rB�u�J�9��@p�� h{=��-�)��o7m��p�&��g ��P�W/a��e��?�W��Z��wP�}��b[�[�5_��o��T&��C��iW��0��է`�Yă)@�Ʒ%&y!�9l�Mj֟}�h笑u`Q"!��PqBǆ�g�d��}q��%,�s��&��@��WYe��~5�4��`ƀp��NM@h�Oa�ؑ�,��qM:��MwUp͈Z��Ҙ�b$Íd1��\��Qڙo��ԥ-�X*N2��l]�ml�y��9��4��1%�v��E��Wj�qj�zq�hSjW2��v�t��C��f��co�u��A_υ�*�4�`#C��x/��bVL\cmpH໐�s1Ԝjv�+6�N��@�[S"k.݄�]�>�H�%v"$ƃ(��^M��W�ݞ�8w�>Ƿ~�~�_7�v�{��6?2o�Ɵx}S�'�M�v��åBĈ�Ԍ��lJb�)�NXW#�xƫU��[��f'�Z�8&��N0a�e��V�k"qL`��I��(�z��d�=��z�0�h��0��g�Ƞ!~+1��a�=��5�K�t��a��WYO��%1{��W0��><5�Z{�t,�!��)�m�IƹW�>�IN��O��_ݭ��;̩ۿ��"R�v|1�L&%d��m{/�樟Qۜ�K;��/��(f�B�3�_�Å��m6�kl��%>p��dnt�kH�lt+d�ޗ�Ml;�Uv��K��"�Nܟ&��I@�O��ֻ��9��*��O��?>�B��+��զ�W��:T7�@��jO�W��J�&f��Ƀ^�I�X��*7�p|[&��˓�&>�Nh4*��qx J�I��Y�򕺕Jo��D�TffW�$9.�e�M�]g��K�[)�"5j��Ct".Q`� �+ͯ=��w GO�Nc�kbtbV��6�88v9��0�o��&8>��~�|��zZ�@�5��}`W#U+i>~�h�B�eR�l��7��_+}��ƣ�C{Wp�W�P��|�i��Kĳ_��v@D��ڵv�*�>�%�)/��2{ӊ��jl��r��zO��5�䅖x�U�0;�>�?��J��*K�/$G��/Q��Z{��ѺlU�m>\��]��O6YX1�5U�@Uj�d!��R�']�H��=�]u�cp5��߆�_'��߬02I}��t}��ws�_�qS�תi̦�s"5�7��^G"�`��Yj��IB��z��9jz_*�2T��X��:���P�?8T||�M�+srր�Ή��s�z��8xA��k��s�2�?��C�&�-�� Ț]��UO0��C��+��:!�o��k¼�4�5�b=�0�v��J+��/��TM��<��h�+�G|�-�[�}�&�==��sZq��;��ĸ�#��$*|�-�iKb�e.w)��Pb��?1ۋT��g��֬M��ڐg��<@BZ��5�"��z�W�B0{E"�1��Wa��1��\q��5'Wz��*n�7�-�Fp�^F�D&R�MlB�쭬�u,�B�o�Nh�4��#�$\G��I;��$�w��"��W" Y��"�S��Xf(x�X�b!�I�w��Tԑ�:�RCV'I�'qX��=��&��:psr�?Ñ�r��/��ñ�*j}ȯ��}=��D��[�bЄ�f'��En�67�Hc��WL��<4�m��b��3�$ '&��Ex_�.a��<��T��w)��E��8U��*�ߣ��Y��SQ�hx��了�g�ˆ�X@L`I�KsA�c��~��.�-�ҥk�?�j��O�y76�ৗr��]��ˈ��k�5�{M�V��{U��WYr�U�H^�Iq_�f��\H؎��%�G2/�hl%rZߵ�l��=�\k��{5��4:��-��26��U,Dv�X��-;��oM��RT��,-�(Ω��_)��ʁ��LU�Pu<�X��j�4E��k��T61�/Ya�1��A��Ҫ�hZ'f�f3;X)=��iJ3�+ h�V�%��%�j��2%��x��34 �L��n'M��d(Ҷ��e�L86��8*^eT@ӠF�X�B�,��qMD+�n$�8�6W/C�[�¼l��G^i'�+KA�W��0Dk�c7<�UO{�q+�4��1�0<5b5췫k��P��;�;i�D�2�.�GMԵ�q�7�/��p��?'�:g��H��*S��x��?�$o'�4�V��aC�w�A�CmD��qC�$��2�S�CW5~��PE�7WV��q�X�4'�4=v��z��1=�3�mͬ/��a��c��8�k+�s�v��U��n�ǫN��;j�&ǀ��0�\fWL��5P��R��E:m{)�x8�ڴ$A�$u��{��k��Uc�v��^*��e��?�ȇ��/q��R��V�-6�tl3)zt�G?�5��!Eg��(��As�Mq��RNS��R*m~*�>�הb>�6>%��kh�^W��_m=@��'�X��2+C ��qy��ğ��_�ߢ=7ʮ��?NXBn�/��U��7��3�y�S�?KRWyi6��k�rر��-4#�d�D��/��5$#�h�9:�.Ҁ�O�:��8:��Ã談��^Dji٘`q��ĴU�K�Ge��i�%�U^��M4A��A[I�Zt�O��.��!]|�� R;��{��f@滰W*��u`~*��(��zd��g��:Q��P�m�9��̀�ĵ�_��?�t��P��Y-B��'��o��g��^��Ү��0(h��H�G8̔��$��v�jO�QnnwjCe@��t�MVV��>d��V��{��#�;X�tz��A$�.��\�ܦ��tI&�;��V�Ԑ}�M��7��>5l{e�ҕ]��R��yi‚4�M�5A=s�0C�!��S��]n%�C��;߻��|�>!�z��NͶ�i%��`u�]@16��}�j��1�*�M$��j~�k/�W��.ȍ7|��So��7�罱�y�7~n|j�Qp�4@0��E��<�T7�[V�W7�~%d�:ǂd�[�u}��.��ɠ~�u{��Qণ[�eI��ɭȝ�H�)g��60�n\[I�#@s 8-�A�.��C?�+��?�:�8��%��F��̚mݺ�U��n��6 ��iыsd��Qcd}i�OM��W�M�0��^�q��b�wJ�Y�aƠ��I�M"1뎋��'lRK��a��|v�j�� 7�|kES��{�U�U��\*\��4��C c\��j��D��:�d��ֻO�+��R��$Ȁݽ�Q���9L��X'�9�1ĝ�$�� c��I�HR�3��M9o��c6��w��X_7J��`�r_��קǫ3��'��Mل&�cG��4?֝�ɮ�[\�N��V�� M�6��Oci�΍�Vvu��[=)�To�8K�+y��;Gu:2��Cz�\��1�)��T�)�^b�Wa��w��R�B{DiS��'&ڨ�Ww��曉س<,�`A��F{��$s��ܪEЎ��vDXΏ��ԈG<�5E&6�1�ǖ?ճ*9X��=th��/(�f�]5%�~�96��bٶ�:��i�w+e��5s�U��o��]�Sj�y�7_S��-ê��Ѩ�uBU�� jl�wu��YnF��0j-D��^�HI2}�Օ�A97}�Y��ԹD�6�&�U�xH��l��3\��pJT�9��7x��8Z�p$<��ŀ��f��q�Y{x6jƍ5�M|QYF�Ur+��T��q�H��{�\_�ge�(HT��PgdI��d��D'`S^��t{��{��O��Dv�Z��ݳ�Lڡ�EQ�Wt>R��[�:Ԍ�x �j�P�6��l�k��?��6nc��7H��+��%k�"��"¸��O��m�.QQ;y��<;lD]26��e�'U��C<�ꘑ�͚�/��(�ՁSI��q;@F��1Ti暩�zh�1M�Q�es�ᄖA��pk{?Y#1��v�"�/}��dd��͊C�>*b�#Y��>h��!�]��oy��w�PI��.[i(UO��YÜ֫`�?|�j��&HuIĄ�(�"�J��1lJ�}[��SܗI��]mi4^�fB��ෟ/��䀃n�T��`,F�t*Q��H�ӳ��;�& F�H��Es�<��Y�wP��!JT��&Cu��Ҡ� �k��(q�U�k�DB��!�<`'j��p��C��U��o��g#�p'Q㥋;�B��֧��Z�5�a?�L/��4,��Fv=ɫ��i}cg��5m;��F�SY��Z4uC� ��#5��)�]�5J�E�&�hPihP�5�wmܼoe|s�OF(0��[4_XOZ��N�#-@�a�D��6��m�3`|"O��Fvl o��)!S}o�v�K��D��0�b�ZO��2�E��(nv�1��Tg��]"�j��*p��B#�7bȳ>I�}nۑ��G��@=�kS\%l��E>h<�{��q�]�Q��x��9��>:�S��t��3��/�8�fiC��7o+�=F,7冐��࡝O��F6(�%��h9O��u."YC�Q� rr��qjpi\�3/\CM(�d�&'�ؔ��Pr�H�o�ms�˻�h��V��b��|��^kvۏ��s�Mi�f��_n��a�25��k��N��O��`A�Xe8��w�ó�<�`e`<�P=�4٭�o}�tf��\�q�I46Q�*�t�!_��*ܯ�`߀�Z��kn��P� �f�j��5WFC��3��X�)/s|��K�03y3��i.#�4Q��k��ã\�ȡ�Z��ȉ��OnG�1?U�>�7��:��>N��O�Y��CSՅ�]�B�z��Gj8"�S��9�1q��or��#5aN�z!��=��v�oqʒ�ҺJ縉w�#�[y�L_;�\"��I�Ç^?��.�(�%�]��nT,j�"M�"��1VOP�ex5i̹N��aXCl;��w�j��"�{�ڊ&�J�jn%Ы*�T��6�q�~�� )�s�I;�0u|�If��M��h�=��A�ܒ�'#5�]�5��g2�a!?g5��"��X��⯭��9��}�� TH��H]2�}`n�|��K3��Y�z!��5��/�C>�=䋸��g��K��z��p�f��H]��[kF��t��]~s�;�-擯��<��5�ߠT��k��XS��TQ<��҆9me�Ӧ��d�(�+AdeS}�\x;�Ծ}xϿ��F�j&l��(8�f��Lآ��G�N�D�;�u:��s�Z�|D��ˈ�nY��ILo�7��]*S��M|��&��0K�v�J�/N��#dr��.4Ip'��hKx��~�~�;�E��e2�t��M��O޼�i�CvI��i�H�t�z��(s|#�ej}��7Dwa>��ng��|�0��r��9�8�<:"�͖TV됀��iX��L~��Y��a��g��]�?x�W��_<�ZŖ'��x�MU��*;s�h�"��3��s�*7ؽ��$�l$��ۄv�4��.ۧ��83K��j�~�xw��M��8�6�X�Ӊ�x>�~²+�<|�T�U��YNp��QxE�Z�&Dh��y��z��%��)5�q�9�D"1�Y�:�,��A�k�\�yI"�)�$��(�{�kϱ�BM�_ڣL��o�(h�^��F�%I�zhꔥm!��8��^�'�U$-��uM6{`}�s��_�~O�u�Ep��*2�{��/ݦ�,��ù�_Ǯ��]~��?�S�rL|�8K��>��2˅"O0��*�9�l�l�X�"�Q�8+5.A�i��:�f!��Џ��i>�|�(`݁l��Ԗh:(w��굢2OK��(�)h��4��*�i�S�{�)}��h�>�C4\�;e��oP��[�+��:��x��j��6�v[Y�)�>1�۶T5�E|y^I�b�]y�@��vGA��j�`�u��qX��D�xҹ*��_��/@e�Np$��{�nR�Zb�n�J��A@k�v�EFܕ�q< )%g�VҹA�k͌��G�ڰ��8�C�o��AԴ�x5�.^'�8��1��[u��t��VsT��0��efP�&�IP��J�f��&=2{`ζ��1��3G�b/n�,�p>�[~�k6h��s)��}?��H�?�&��R�}?�w�^E�\Y'�b��?R��|�A��HQ%ZlK*j�cX�2��f��Q/�5��o��S��Z��(��o�� i�zڳv�ۗ.��y��qT��Kn��p�1&�Z*�c�xji��{z��@6I�Y,�v�e��Z�E`�u��QKa�P��h�-��#2/��%�R�qS�M;�%ۦ�J�6��T��|�3�~��0�u��Y�Kۺ�H"I"�5�3�:��q�wd4��V��X��,c�w�F�Ǫ%Hj��=~(��D�.6�m�o��1��P⮗�n�׎F��uox�#v>\xs��髟�q�ڢ��p1���k{��r`%y�`��l�wwv�AF�:R7Ĕ�t��N�p��o�5G��U��N�~��1\WN�=ΏF�<��6��=.�K@rq�n)iw(��i�r�ō�+5�X�SrTWbɠ�es�[�� *x�r��]��S6ڥ��-��A��+{�V?��Lpt@uv𱒗ݶ��شF�ZC\1�t�Ѱ$A�S��/"�d�Y�\9��ޠ�8o�M>oЯ��w�Yh��&v��-�N�ǵ(Si��6�W��u�h��|mi�|ר��0�;L�c��k�m\��Y��R7b�<��2h?]��$V��\�+�j(�6��8��0�u��]@��9.{��C�e�W��"�؊lbI��n�[[p^��fa#;:�`�2Rӆ(!q�V��[�p��Y�3��N��W_]Y�J"<�C8-��!6/mLC��F��;��v�h�Y�x��N�v��vNl��2��s�1-\N��4iKB#"�M,�r�q��cYԸ�"P��= C(�5�L��a��@V�\t0�ny`G#��EE%R{��^�Ge5��wJxX�Q1��BN=�\c�&�q�(�l�H'eW��wL�[��<�+_#jl=f*�Kr�Ռƻi��B,�j��1��_q6�[�ߨO�pd^l{��kcrc��v��6��.��+�0m��}׾?U׺=�遳Cե��>�{@�ҿG��7��;��V��;Cv6��A/%��ې�?�V�ސHT��cw�z~T?��X�V�].�CQR3��[��|�:��`;�s�O�4�ֽ/��H�<~��4�;�kl��w�o�z��x�>��蓻= b6�,��H\��S�~�cG��#ޮ�e�5߇KaMو"g6�T��$��e�H4XdG�X�EW˗]Z�2,�qi7��>�O�.7�\O��?��&�5��P_��L0+�[| И�bA��ǒhH:��v�Chy.x-��a/+nƻ��4��D��Ƃ]j�]��o�1��܂Pl�8��Uj5��R=�A8j�8�Qǰ#��>߆�j&�K`Q�/�S颜��L��JV蹴��U�K~YmV��c%m��v�'�z��}��d�B��e��"J�F1��.u��k_��Kv2��YC0��lg��P�YB3A�W��A�FFol;<�/C�:ֵ4m�&+ �C�L��[��ɜ7�y^C`��l��Ġ�!O�*��W<{}Z�"��>��B�@&�pj|"��,J��Y��2��:�b�|�H(�k�A��>��7�*�/�w��~�֯�L�_u��c:��%C��s&��Q|��c��9��i@/�$NҲ�:�u!j�Hk�@��6y��Oy�Vلl�9�[gt�~��p��g��:άX�I"B�(�`&Q�;@qh�� P�6�4�e��9=�ښ��<�'�c�l�fN��yZ��g�[�@�¡vU��p�AL.-m�'�1)��B.�N��#A��}��A�]u -Y��~��;�BXK��s�YhU�W� ��$��O�0�%��H9*�:<�H$b&�k�/hP�{1�/�^��n�E��_�E��1�UG��c�q��m��!0�'F�K��jDATƺ�F�3�W�<��l�;�vK�1��$U�>�SYn��N@�*k�FA�M��c�+[As�S-�×�a��Ҿ6��U3D�j�X�� aVC�|>�ĈR�:e��G�@�T� �PD��2��iۡYct��r�p��-K�#\jN�מ�[pIk��E��wՖ_��pW�42�Y�$�k��S4B�f�&]��:�a[":%-o.l@Ffj�q�R�b;+��֘��w_�5"��DR%��؋�g�6{PN3��d�{�h%��xF=��D�� Q�6��5��+��p��W�ޗ�Ô)��o�%]z��2B��_m(Q�v��}�� Z�"ϡ�G��-�Vغ|�B��5æ�p͑Ie��Ç]l��ࣞg��C+:�Hb�z{��:�g��D��0��$�� 垶(y>��;g� iuƏ�ȼW�� y�ͯ��_F��G;;�N�a�}��+њF��L��WW��<�S>ĩ��7�@�cg��?I��J��`�v1��T�^��J�D��u�$q�4��!HD4�[��KB�a�vٵ�wGƓ*�HUhk��W"�w8��C?�%ױRXT(�T"�� 6�ҭ��h`��Έ�Yj�p�)i��q��&�/D�?݈��/FT�e��M��j"{I�V�}kt�g��άH':��/�!��hbO�x!�пi��bʩB�eq}#[��Jy3�L�ʚ��䶂4d�9�~|zw��9�vV��!b4�-z��D�)l\�P�ϱ^gW<��6�94#�ȴ�@%�0�0�7��B�h�7P-�;Kc4�*+3;L�a�ˠ@J�^��3�e�9�ta!��l�D\ �<��@�j�r$ 匪��q�¼61��.��T��Uj�p�J�e��m�X�� PYWY��X?F��vu�q�� '��H_�Bse751X��j��x!�Q�wܣ��Z֋LM�LGCQJ�=�1*��G.\��@u�t2l0WY-�Y��?A$�a?u�7�8�S��gD��t.�p�"�a�#B�|�45��-�W�fr?�ǳ��aۉ��]2+�'��wƎ�ׇ�X\g�~�!�ō*�;K��`{��-�^(��j�ۈ#^�%�oT*�p��ҷ�n&&)��[��U��>��*OC��wt� �5�|�Q�K��^H.�e�ܗ��M�ͥ��f �~��q��ſ.uwa14=?at?�sm_�Rd�{�m��ƕ��!�B��f�@��qc*Y4��J��JK��j��*7JW��=��vW�V'��q]+��˚0�l2��^�\��86��S��P]@��1��&�f!��nn8�'��ݸ��]��9flv�I��#5W��)��N?̤{�u��W�:�>��C�^}Yh��([v��E��qx ��IXs�W-x��1�e�ς[=��Ӕ��S�W�!0a��KuD|Xfn��l؏��7Z��ul��eڴ)*-��J�p(��ׯƵ�(��i�Y�q��r��6�q�)ͭ��J�xKc��fyeV`܂�ES�[��E��6KY��5�߶�ݗ�p�8Y>t�2yb:'o��F�(�'�g� ��~�K0[�i8�ҦU��w.�1.�ִZ<�@�T�+��:� @�rY˽x��=l�$U�h�uF�:[��7��ѳ��@�@mK�Зyے14&&�/��gP`�(�ZS��F�Ru��5�Waa=�d}�>�z\� oB{UXc��~7&zE�zq�NV?�t��4�T�;��G&�3��c[g�[x~Ӝ:��~GV�#d^r�5�D6n}�'�V3I-eL��2��ᚕc�Y��ǽqj�"n��w}mn��@*��.��f�-��d�}��V��}9�k��oW��T�-U3Hw�~��N$��>T��$e�~�j>��z��Rp�t��Y��C`D�{u��0�bӤ��D-��u�ɒ�&6�=3G��v��kI¿��jd57�h�ޕ��Z��[��|��5k��oW��:��X�`c�.��~*h��˕�t7�iک|�#szj#�A�] �g��b_��S��}�L~&�z�S��^�2*��g��(��Q��V��e*J��d.!��^��dB/�`�7��*��TM��S�P��u�NY�@ Bp��[�LH�w��`��ZA��S�B�w�G^ZlĶ�F�U��Z��؎��q͏act�k��Q��x�A��Jآ��/�*��Ѣ^�� v��RU�+`fw��p�A��"W#�/�޴��w��i�^y�B��#w��L��ĭ��d�U"��Q}A�ɷj��q@x\×��#�D8�<��&�Xh��U)�Z�D�)$��P�HjG�[�]��X`?��v��,e६��>!��$��}Q�6@�mr&=gj��>;Uy3��v)��<�p��r5O3;��w0]Bʔ,p-�Ip��f��,�b��.j#�Fp�e��^O��皑e��15U25/3�8oZ�g)_��%H�;�i��!Q��Օj�!;��ȳ�p��7mu�2�/.��X��:�bAA��]��}��͌� k�L\kT��4�]�mŁ<�R��QL^%� j�yv�լ)��$d��7�,��jq?tu��݇D{c�v]^��G�;��F�t�k�d��/�ߩ��Z��wȄo�z�=��gO�YБ��M�4��j�%��ZW0)�9Q��kR�O��j{�?i�i��Y�1S�Fʝ]��&<�*2E��F.��[މ�$��BԠ��$�B,��ؚy�n��!��!d��Q�P�>B�L��U7t��9~��v�hxB��z�X� �#(,)��%P1ްq�q��TB��!2�BB�Yz^ԕ��tJ��z�X�p�E��p[��V��%YVn�\�z_0F5%�ؠ�ޮ��Lf�6�u�\�w!��ɽ�I4hn>O4��~+�_fp��87�1�\�_��\��Ek��={��%�M�iu~��Qe�^uS�B��V��xl��]��R" ��V��3��X&��-��la.�[�BՄ�u!��ZȭA��X�� S�N;�T��f�OG&�|�;&�X�}Ӥ�:J��n��{ 6f&��y~��CJF۳в�e��"�6�T�5�[��r�l��O��x"܌�C�1o�ܸ�z��ʀ�n�|�İ��!��R�[$ x��-/�؎�g��EJ� �]'r)��*]�[�5$.��$��Y̍�Hb�&-��)��O��j�mX��p*҃��ڍ�˃��n?_��5w�{M�F��g�HN�k�R�f8�U�R��թGi�2f��3l�Bƃ癱s�X�6�޼g3��&s��r~Z�>-�Oŀc8V�AJf��W�<�A$��)^%72b��y�p�5�YL`t�e�Xo�V/�ĺ54��jr��VZ�1G�S�o��ӫ�79w�X�3��(�L��rx1��M5�[h�8E_��FMj_n��g��v��4��n��^��U��^�}�ʮ��^��k�Ф<�F��p�:�X��F�fl��w��xU��FhO��̵��f�jH��Slڊ��r�01��օWY��0��[��݌�`ʋ-�.��7x�!�[�M|�B�V�׸��;�6=_21�n�MI5�[��kVDf��5�V�ʁDkh?��&��-��@�^3iȁ��AH_PV��73a]Lzw!�kbQ끤8�7vE��M��6��%X��K�Y4�a��x"�y6��و��;s��0�^6|��G��Q�scǇ=ql3��ʐ3�N��I� ��ı��C��s�2a��Q�c̘��'3�`��(��E9�:ݶf��8i8�\�Q�t��%J��&!��9��Z�5��8��y�\��;��Ɗ�j��2Fs��H��Jawf�> xM:%ʵ�nԨX*�t��L'_��2�?W�7��ęa��0i9�|��u�k�4� '��^�]��=z�x��J:��됯�Ѓ0��c�l��ⵢj6Rs��X��^�t�4rc�N�o�d��"��Rz�S+ҝ��1�� ;�U\�F<�j�z��q��kĆ�Z�. �c_W�Z ��(*D��lz��Fto1�M��DҁR�F�{mm'��؂��7Y�� 1�+6`ϡ?�ʰPT�cs�l�fniM�ҐOY��r��Er�-Qޓ��G��tj(:�;��#��r�X�1ށSz�s�yD�.5�W�Þ5|�ۯ|�Wi|��C�&<�e��z�EX��|�"@��_&PW%�\fS��1q�Sz��Ur�_��%]:�^m��u�\`��"��.�B��R^'+f��YW��=g��A��,�βF�bjŮ��*��5@��ڋ��ۿ��=�e!#\�]�Gb꧋�t9��i�Nš8��L��'ވq)��:Kߊ��7^��PJ|��T|?�7�I��g�B�_Ħ��g��n#+��/0�>��K� ��?=�H�P�1��p�KuKx��u�Z�n��;�*�T��i�S~�6<��C:�GDAO�xV��E��}mb�5��i��W��#\.�qk6��&�q�k�^��~� b�EW=�;�z_��[_��-\�֜�?c�y@��Ҩ\��u��SOpu�Y�+��}i�.8гor��u�^j��Y[�j��h�I\WN�ķ2V�Rf��'.��&O��s��=�Z}E�;b��"��)D��@�ki�S�NijvGFrB��ʴ͔q[�~�{i��ʿ�AKK��o��'�S��/��V5NM|ȵ�Q%G҄��ٌi�G�8Z��đ��4�m��ԁ�y��Y�S(9�TG,�{��:.K�?�1�O��Qҧ�F|��D��"��'�L�{܉r�=`%�+��w�67Nc�cy)��=m��f��zIM��+U�+y'?�g��&?ɧ��(��U)�;M��Q�kp�r#�ۼֺ!��һ�5��MQ��U��!Ȋ=��l6�0��a��k��ݿB��GҪT5Y�"�V��VI��΍�%!�qڸUӅgE��N?��P�(�td�\j�f$ ��4��5>Ѭ�J�W�KC;���s ��+(��?f�9��8@Wv�K\�O\�O��ki:Yp�蓂�s�x�um��m��f��+�8&��[�/��_�G#ZU�%�T��JC$aE�i�Nc?��'�[�"B8-7��7g�4�F��P�ět�O�@"Β��VL�-��b�иv�2�wM#��-O�b9�KI�T��7��GU��`�2s��ڤ�h��oX�j�G4�o��$~Y�yk/�$󋬒��Qy�.�=~;�2�%�!��R�r��r��樼��NNN=�P~��gc�e��j��1�ͳ�n�qZS?rgU\��]:;�ϝ�`�G��*��P��S�G��$q+�xqN��q7�3ڿ+�5+�%>m4�iQ�M�]��7m@A1�ۘ�2�)[�kG'��n��e-M��Ţ��/l�CHȠ��*IC(�0=+�� 8/K�8 !b(��p�OdӇ�t��G��ebc��Z��?�#l�F��u�4�I��o5Ҙۡ0��ݯ��kv��,�V��b�и��kp�+�9�~��èk�R��trJD�ʳU�x�S��I�^"uH�p�Ot��gŚZ/��c��^��R�G�e�?��tv�K�s��)�C��ġr8P��?%.$2y�*sWD�+��2_�b`��vU��}H[Ĕ`�87�ca�&}��jAn]ǂ�\"�}�pD,Elfe"-7s��#\0��.ub��c��D�`:�gY��\�w��$�܍s�-d��i5B�:v�cW^�tˇr��,�V�(~MG��t>��0L�JLO�B� �:h�$�q�:��x�4{��S��ls�8\K��h�uɎ��=��01�3-�t�<�7l#��H��_��K\~��g� 6�4��nU�㙁�ۂ��W��z@��&�o�7qo��6��+�3�+]:�MH&�� v�G�$3CX��d��<�a0�o��Z��w7c�V�ԟ�U�UO��q�B�a�ش��;M�ߵh�;��f��ɂ�4��#�l�\�O>�#B�r�@Қ�O8ꞩ��g��s8(��(�r�z�h��c��x=��\&��Lןv3��)��I�د�%W��m��s��q�#޾��&Eo%��ݗT�k`�C��\=��G�C��ͨDp�˯�1�t��\��!/��;��õI�X�0$�ܗ�r�H4Kp�!��p��EmʞS�` /'nb��I�l��H*e�>-��^�H:��i��{�͞s�B��;��3ޮ��J��RY�L6xǥ=pʮ��8>M�o�H�ؕ��I�H��c��1�F3nV>85a��]y�0��c��Pi��q)68n�<_�%=�_��R��l�)�q'�p�xHyfV(�J��B�7��:'��7��j"��l��b��̈́i��:J�E��l�e6[fk�ʗ�t#��.y�@r�EZ'�a�Z�(j�c��섓��d��A8�8��g�{R�]�XM�sb0g3p�q��$Ç�a2F�8�2��1��:'q�EK�!��`(:"X��ʽ��M�<��i��;v��nѧ�΍z&|;��~�q�0P��E��+b��%� ��t��*�Y�>l�Z.b��I�tq�p#�3�?(~��͗�F{�ø�67��Ke}�W�W�>�G��Y�ub]��5��^��%�^�!?ŝ�z�%l��u��=}܇��OP]lF�c|��+c]��f�c1aC�R��80��|�Y�w[�!q�N�i�S��S�xa�g�>Ǐc\E&'1��r��rΔ4�f��c\P��`s6�ji�1��7k��$7]�lQۅ��US��;�q�u8�V3\�Q6al��>Θ�"�؁l�kB� �`��M�_��{s��S�6>�kj��y.��R��%ER��Pe��m��?��-l�l5��4��b�|r;#һм��y�4��2;s��y ��qՇ�h�%�}�D:��r�imC�;��9?�bB>�Yk��f�:�4Ry�Sۊ��l#s�ꆥ�4��x��i��0�H�o_0�eT�@�&��c| ��\��g��=�ʥ��#u�>��4z�6��7!�9pe*��g��ErZ�@�n�k��bK8ҭJo��(nQ�ˇ�Xf��C��c��]��{-;�^�TU��g�M�Ҷ��$�B�q=�|�&|�_"��Y�Y]�ͩ�Ӗ6��f�0��`B��4�A ձ�mskaa/X�n�J׋��B�q+��r��Dϵo�$�Ly=�h�n��$��[r�PH�K��5�$rN�NE��X��9�!��2/��Ic}�2&��e�a0JL��F_�(�Kӽv��v6�j+�b��ٌ!X�:du��±��P;MT5#�}�i&�e/ �o�0�ia\��/��`��kb&B4:��(��*��eޔ�w��hެ��0��G�`��6�3ɾ��sk~��+��?5��r��^U��.l'��ꌿ��Z:�y��>�x�#�ݾ��G$h��?�M��[��a�O��۩��@��+�2��\@��s+��?�̩�9�2��=��2+J?��F7ɯ�?S9�-/Ǭ�]Od�w_IG�t��`%�*`�y��dT�$��n�a�F�g-&P5+cJh��LFl�5˽�l2�d)Q@�%�x�v�$�hwK٭}��xdt�Θ��Mw7P�]�֡-?��wو.��!ĵ�@�޵c��a�g��ծ��*�x��?�$��x��Ղn��ŉ%�K�~��X?l�6��~vDD.K��U�e��8p'��-��9�PӰU�.Ց��ӣI��if�Ddb+�ϔ�Z��l��SK��P�U�BI�6z��i>��խ&e�t��C��E�p��Uw��?�2)�)�v4ˑ��RJ�:K;_��>�y�^5�Ё0.�`�y~z�O�?\��\0�`癩zS2�;�F��e~L\�pr=��L��(�p�`�0��͎��+�/z��x�e.Q�z0|_.��gyC#�y�R\8��&u�9@i��q�q$��dB�5��q�C2� ��&)B:�q��I<)b�b� �M��*&>�< ��YyV-Z�F~6s��l��9+k��>�NDoi:��AAy�W��p��xJ�3}� �p��8Ϧ��~��a/��tS��F��5��0��e3ӊъ�E+��{��S��P�`��S�C�D�Ԟ�;�ļ��킶��Kyk0��6��$@>j|U*��W7�D1��le��`׿ZY9�H#�I��xA��q��i��s��w�W3��ĉ�I geUى'�;)�x�LӲ��f��;�Q띴�1��Q��4��q{��T2��A>hjN\]�e_��#J~g�0"��83��Q�J+Έ3$扣�ԩ��JHي�1~M=�ڨ�\�C�=^ n|1Yy$vӢlM#�Ƣ�B@��b�&��ݐ�jM&v�+�3�f��~g��h��0��':m(��ȟn��à�'Snou��I�O��O�yR��lݩ{9�6��`�h�k�i4Ӛ-��ZH��2b�$�c��^͈ߛ֝=��y3��fl��$l��W3��8?5[� �0�x*s6��ULMwd��lW�s�}>��I�GYp��򇶈�8C�:�M�I|r�g��%O]g�w2!��v$� 1��K܂��gQ��Ȝ�a[oC�e�Ix\��L[�e��U��߈<�x�|Ob��+�C��I�\$㤼6�Q�c@��K��u��Q�tg�)��EL�딚o�W��ј��\&;��!��H{��o��R��=V��O��O��#uHw|��cu3z��q�-/\��Gc��{n��q;��̳�ٿ[�V��@4�_�Z�3�ȥGU�T�R#�ۭm~O�ǉ��Z�/�P��/�:D��s�t��4fC^?E�R��5��)gM�"Rb��[�8kGc�k*��D�R��Zi�M�(�9��L�~ǩ��3dg��'��q^��u�c�1�O� ��EJ�])�8�Z��Z;$.�i�X��E�.�q&?>�3kL��~dE��i�Bs��G� 3�$g��l�v��ͱ�򾷜��A��VOUx%1'�D�bU%�v��jzV�}�JΗ/�� N'�S�v��G%h��=_Wmb[o��c)9��m0��3no �`@BJB��֊$�Ï�{��[�x��r:vB%��͟^�٦1:�~��0��A��:i�pf�u�C�)�[�xc�J�<�E��ߧ97E��$`߽"��^SY^��˖\��Ҵ�Z��KÍh6��H�ML��W��UYn%K�LMe�7��2��֑��g�I3:��2�I�s �cf��<��@|��w ��$ZW�Z�A��v�ʊU�g3�+�֟c��P��ސ#^T1Q𡧏��d�M�pm׌O��׈��"��>�P�]��i��f��0L񖩓��^��+&�}�@|�n��ϱg��<��)A8w��+[gF��x'y'/�$苑/�P��M�&�n�r��'��J��G^h��iy��B�C��O��ߡ{�'�ذ�aZ�TοF��#*��?h4��.�*�m��Χ|�zg�Z�)D~�I�-�I�kSƸ�$�� io��h.��#=v��C�1ȡ�/,~:|hk�y�a�z�D)��U܀�ȆK@��YKS ��4�3�v��f3�"�[/��x5:�� (�˵y��*��]�hE�#�~��YE��Fsy`��_韮�\� �]��:�nd��.��4$b�ɲ��g�߀��T�g��>��L9��g�m�,\s]��(��f7q��\9:ǣ�y��[�8[d�E0��1�WVzO�/]��9�I��U��Of_�)Տ��b�̲�q��:KK��eX ]�1M��j�r�Je�p��8/p؞�G�b��j�S7�G!��R�4��m��͘�ޔ��P��ի��:�SqUz�� 2��{Κݲa�?j!��][g�-�j�[5�I��@-��Ҫ��G��YU��D�U��[⼧��ҵ�~X��%65��Zd57t_�I�J]��2�%ۂ�^#�l�s��L�R�X&q^��Y��wl$�TP�h#Z��b"}ȵd�<��`�f�L�-�C��08�#W7,�f8�1�!�1|0J�B�,:�ve;�<�/%x��ڏ]'t8��XA͙�D��[�r$Ml͑TJB�c��St�UO�?u��{��O��Z{��s}zF��{��X�� {b��ޱ�&y팕ۆ��*=~"��랝�;�y<$�|u5�G`\�b�Q��l�m��. 5�8mҤO7TgZ��_o�{���-�uKĚN�h��O{�29G`�i+��x�7��?�:�H �Ы��'�@NAvNhF��G8=gܨ�4�4J2�sVOT��"��N�\ei�:O��H'��$-��35�ٓ�|]�$ƋH�:2�LY��c��>��-��k��F��;_��0 ��zaV<3��N�Gٞ�FIB+�^B�E"�k�{s�{��$g�l+e�8�YN��e�պ��N�J{Ӧg�k�vv�Hp}��;��G�h��č;eV�n�|��r>��;�#��F�#��D 6�[�+a$��\XU��]�l6�^��K��2��=D�!��-�f��e��z{94P)��8K��E��`m��s��՚[��H�@��`{�=HN�g6�ZB��1D~�at�e4��X��V4�m�V�;iv�?erE3s�Hr�U��I��d�#w��,�$�U� -�6��!h�v��!ن�o�G��m�c��m6��e��ͱ�$�b��5�d�h�U5v��34��J��]��Ƹ��aǮN�[w��ОW!úlJ�[�WD�2�փS�lw�WN�r%��\�Pٵ⯝�u�ZI�lvS;$��:��Ѡ_��///~�Ű~�qc�DE�=��ƂҴ��N�.�@J3�$��")��@�pfH��ԥB��мʁ�vї&;ۮi�%|3>e-�'�J��U�&O�Xl$�2iג]��m~�eR<�o��UF�炮c_̯��}ځ�H?�q�6%�o�v3�8��zu}�攳��Ȇeg�f�?i�{�s/��0��Ύ��*Z��$i��?�{�+^'��m��R�@��v��{�b6m��>`P��.0?��(�A�+�^�^�f��T��y�~FL��ŧ>1�}��c��>��=��c��C��k��iv.��p�_��Ɨ��.I�|vԟ�r;.i��h��G�Jwں�Q�q"]�D��CT��p��&$J]u��>�", "K�\��r3�#N�A~��mH�WV�u��ji��v7��۞v��Zш��5�Ѡ?��"<��ghӿ��n�C\��,P��Be0ṉ+�xkl��y�r�^�G�c��zaN�oޜ��n��[��1�Y"i��*�{�r��U��U��~��c-|�n��_F^E�j;�-�,S�P�`O�3CZ��c�5�|-��zZk6v^ճX�ml�J�6��A��`��6�5ؚţ��4d��V^D��2��^��@;��P5�Զ��]L+ X�\��!3j��(�H!0��kuAޮ�7�-*�lɈm�B�|#�_�gA��i�,k�푎wb�z�Hmؗ_�E{��זO+��:˷�b��Q�:��p�e��#u8Bx��2.��~9�F�E62W�#��Ϻ]%'��7�D��8a,.i6nNK�Λ򡣶<�t4p��;~}�E\��s�,"WØC��b� Wr�Z�+�Bט>�+LWFGC��9��r�#F�P}�{�:�0��X��l5�H�G��\P�Q��8JR�G�?O{N��e��'@Ux�5�*�8N�S_��`u~�K�$�2��}��zVY��+��ͱi�Nu�v!<䜕�۶�q=��z��f�;0º�4�g��<�-+~��;��E�ʛQ�N܃��<��l˽��.Օ�U[�x�Gs��e�qμ�Q�.�K��u�W+�Ob��r�/��d��{�]�]u�cR�r䷭�6��Q`��a|q�rw�S8�爐l.�ة�.>8߲��]oc\u�*�o��Ⱥ�w��7Qo�r#�C�ǡv�#k�EP�"J��<��#�SU��Q�|��Ep1��zwD�{��a�!�4�p�Jɀ�j�Y@��=�K�rZۊb&�#Q��JX��~�[�0�4-r�E3z��g�,�)��0�$X��4��vu�.�|��;��b�m��l��J��O�Ćfo�Պ�pW�A�9��Dty��a\#>��/MA�8Xں^��W�~ ��D�g�σ'��m��d7��K��.��$��:K��Ї��_��s�B�#��jyY�,��Z�Lb6dJ0�.��'��on�*��s�+;w��C�8lglr��j0��#ɝ�mCDG�z��z%��e��H��l�7�N��E&"�4�.E�٘��]��P��N��/��Fsŷb~��^D�F3�[`G¾��?��Y�ў��w��+��"�_ӫ��"Ѥ�C��k|�1�V�*��Ok��O�@��Z��n\ntA��^3lqxq;c#g?�1��v��\r-r��]Z5��z@�M�K��Ǝ��v�YYY��N��ؕ,gǴ��>`�_�%�)��}��Ųi@�2z5�f�͡a�UIv@`p<\��{��,��m��f�|�U��;��uzsJ<��8��fugU��@�9�wS��[��x��q#�0��2#�6�L��g��¼��pð�U�h�R��_/��z{n�,t��a��>�x��o�c�r�z��kt��x�2B_y��ᐝ��` ��5bJ��H#�Ʋ��Sa�{��{��b�7�1�{ng�$�{/��*��qZIP&��uD��e�Vy^��c��WL]�?��0B�n��.lm#��_��,i�82�LƠ�C$$�If<�x�-��Ȳ��~��[j�"��9�d��7��=��q��f��GӦ��^`��v��`��0"��D}�="�ak��K�ЇU�`7+h��ӚΦ�집�sL��Q ��+�]"��j�9�q��>Ÿ��k��2j&:݇<��2>�'T��HR��ͯ__��m�0��g��?�t�|�;��*��Fh�@�VF�L��M�"MB�j��DmnX�n��n��FG3�S��{2�N��S��V��K80d��^�Ν��mc�I��ߣf�q�h }<��t��:��dt�C�S��!��dT��>y��{b�4�<ȳY�Ú�j�DqX��٦C:�e*�+��lZq*��%0ؕc�%�7��Z$'-��bCV�:`��v��RP�C�H;wc�H�e��![@��U��L#x&5��r<��*�V�d��~T��O��<6�Lhf�ᨇ_��=;�f�{�-j�"Z��*n"4A7�z�7��0�3.��~�e:>J"��@A�M*�!�t(3��)tW��9��e��i�ԇDqP��Ýa�S��g�b�l¯�'�@~�ۯmqx��70��e��K��O�ջq��x;��W��Y�H�i|UTYA��HI��+��gh�0�Mp�Mp)��5�$��~ � ��7��&��^��Uzl��m�[��fl/h�1��z��]z-q��e��-�%��z�ܞ�Yp�]w��1�i*��;��6mmhF�M�^.�f��2p�v�|�#�b\��O��H��`.(�pz�xG�Ŷ�-(#��7B��J+�5��'O��`9#��{x��aG°#4�v�;z�h��6��^HI醎P��3L:�O�$j��hkkT�+6[=6�,H)�=(�{�w��@H$D%i0��kP�I�mnt��O��Iv��:ыz��C�ŷ&hʫɅ_Y-|��6�#�+�owA1�l�{6,��ès�>�� =��Ò��__?�_F@Fa�1ޜ#��j@Xh~��k1c>�#��[[c��ѱ�v��N��*��XZ��l'+��N�4j��5�&��m��i��P�9\.��%��r��d��1�9r��h�?�1�8%��݂"��`�ca��i3!T�^�̏!Pu6��̓��r��餚.��@\Ĺ#8�x��Ҙ��i�@1Q�u]�B�Zi��@��(-�&>ͰxB��n�Y�.��^0��OU^�0�e+� �`��SI7�l͸]ޚh�q��h��S�Q٠�K�̵��L��F��R�SU��d,̂YPUp�̰�c��=��3�6Ý�E��9�:[0^�u`��J|&D�}2r��8\�tKY�e��Lܕx_$d�c�\�7i][6uQ+��C��p�Vn_zE��#�^�c��x��v��@6��N��Y��GYŰm7:��l�p�ѐi��:��^�&�~pR�V�z�n�کyhw1�W��k�whh ��l=W��7�$2�5��RV��Zqy/�c��J��#LYTQ��J�n�4��;��.��>�)[�5��w��X��>Z��N��Ҩ�U۟��qZ9b.��P�R��c��#�k�E��w�Ի"u*O��mB.רQ9ڇN�l"��Jw�Nۏ��H�XȄ!G3��l7�<�2$5m{��g�$��Ean�Y��2�s��E�"��L9r`��`�U��C�5/��~rБ\��׊�z7p��GY�v�4��?�̏��(��#�<��Ş��S}p~��|0oT��5X��Sp''��U�{>f��?��c}��l�+ӓ]��sQ��ο��cm��k)�,݁�`��u��l~��ϥ�0]��Wiqঝ��v�9��)ߙaA3bN��U&��C|�'�E��ӛ��Ɇ��h[��y��y&0 ��(��kU�J��ܳ�_�>�;�U�0F��SU�9��O��Q�p*'�(��f��晭i��o��e�U��%�f�[��jHO�ќ{�c)��hw�_��"vmb�(�M�Ք�sEޕ��F��T�ܐ[nc�K-ɛ �6�y�Սm+�o��{g�=��\��L}a&3��T��O��^�&�L��rZF��Z�Ӕ9"]�Y��㩎b�(gBX�Bݰww��ʻ�n�>�H�T|G+E^6�O��\ڈ�n��05�3`��xc/-ԧ�u?{NK�6z��c��tv�O�9��"��s�mЪr'vk�;��G��Q�8Զ�B��e}9=y��%xs��$�l)��t�R�-ﶵ߅f"N��y��ݍ��z��ҪX��,�� @��)�8�7\�bD4+�K>�;;�BuF�d��u��KƜ�J��LTӛ��`L�t=�'a�ջ��a��}��~{�z��#�un��ϒ�V�Q�>�Jюj��e�7��A�_W"�=f�CG�/~�iV#�Y�D�ر*F��cڕ��{�[z� {��$x�Y~��h�c��ݥ)�h�{��cw�i�;~��^�� n��B�|-SA�p��O�ڍ��hY��1��4�ݟ?0�+]�e�<>h�F��'|�|lC��6��s_I��@��IV�'�`�Y��/|�sC��\4��ڿ��.��Ra��Q�3d̍�F?4F��^ma��hD��L3B)Ւ_��x��E��rv��r�%0sv�3-%!Kh*��g��f��J��ױbV��&�~�֥�g�IR"@�Á��L�1��X��'��_�W�?�qH��f��p��xB�۳Xq��p��m>��)��w��Kgol��vW��IRR�a�"��.��4O��Bal��R;��#��8�B�9(6��q;ee��+��̥��*�$��4��(��:�Ci�?�Zb�/L!ֹ zM��-��=>x��3⽡G��P'/��2K��,q��7,qM�^B�/�'��Zώ�%��D&�;Sr\K|��e�y�kL�g��Lmޢs��^4��R|�e�`o[�{�v%��A0��sj��zb��-�Q��n�W��ł�P�g�j��8E��w1��cyo�x|��Y�U��9M�'ʠC��R�5X�-��B��z�%�E��,��!_`�l�o�y�h�{z�N�y3_)��2��E=��=��U��(��R�IԖ%��,��wrA��K��Jb�Ių�+Vr�?�O�c��9��,��{e�g>�١&�'x�,,��;�OQ:r7��`��K�!�}C��h4��tꇬ��h�K��u�::�!�p��̔��0��#�-��FC��h�w��зR��|�qZ��,Z��E�G6L��c�h/h_��K=|�u�,]M�Jc�l͠<��1J��Fo�M�� (/ѡ�C/h�;��;��S�żSA�$�q�)@QE�� >�l!��T��ڏ~n��Fۗ�w�8}��G��7~h6n�C��㞰.?mb��PJI��Vڌ ��ʶl%�sDr��K1z��S1z/��F��aN��"�zQIbbS�|��:N-��MRYh�whM�m��N�B�x��f�;��P��S)e�Epw�{��T��y��^\��F��6��Y�T�jg�Dڲ�/�8^�v�� `.��$��d�_�J��pkq3�i��E�3� ��Z�H�M�^HckSEB�3��SveV��x im�<�M|��2�"��_��$��xt�k!�(�?T2u��s��M=�c��b��-�_�~�p7`��oy��IE��aԓ��u��Q'�[f/��^��k<].9�OTlNL~kvl3�0��y)�Yq�$0ɮ�\��֜)��8znu\[D��Ia�8�KW^��v�F��U�� |V��Ԛ�Y�s��S�UT��I�d8p�M]�C�>!m�7)WT�iI��A�Di39�u3��ШN3'k�"Gj��j%�J�~m4�H��v�6}��+K�B�W͸N�\�vʊ''bg6�M��K��MFF�["�A�@@�%�1��Y;�֏"j��X��E�t�X�F��]@Pu\X;9��&��d��C�3�m�`�&�b�>�uQn՗�pA׫q=E�,نg��4��M��Ȓz�Z��l�t�,�p�X��p�P@�_;:vVK��nS�:Z�*駻2A�O-B�\�lY�ټ}L�S�<��i��k�nt�PLG�몧<��/]�Y�K��B=;��;�s��<[��Cv�@+��o�lak��)d�l�0�>�hV+E��gv��O�H׬��]_��1�f_z9��:�ox@�XV!�bkl��V[�p�Νs�e�ЅHQ�ԟ�M�0��y��/@��fɄ��gɈ.�-��L��KM/ݹ��i:��0�}ܳ8�7=�9��|��E_>]�G�4*��މ��8�Ĉh�@��r+��wq&>�q*��'�V�G⛸_�g�^�_�;��S�"�M��9�F�l ��e��4�>�b<��5`��{��PŨj��=��؉��!��%l�1��E�]��a)�J�8��B϶��G��c#��_s�kh�jUk�^�Z�t�!��8�Õ�E%�h�n��/�A�nܥ�{��ݕ!��M�/�w$�J슪��mڷ�R&�焙��|�H&��X��oi:>)}��sķ+��#��/��O�,-��2��xｯ��WTrĦM{x��{�w�z'r�V�H�(s�l��,�´�q4Uȏ�HQ�Va��՘�n��=��(��)3q74KL�"g�GPg͞��G�� E��y��)�'�)��O�A@sӧ�� v�ːI��]�>�f7(��S#"�ᕟPd��#�2��ӕ�FT��-�0��.�w-`�S��b�aǔ?X��b�+��i�ͻ�U�G�Yu��¸�h/��#g!d��SV1z)��}g��a��9�U��~Y��em�ҡWqo��մ,'ۄJ�Iayӂ��O��$��d��$��wt��a�+}�D-�X�|��Վa58�eJ��럙dS�!r_��p_$��!tp&��|�D�&j�*��H��Y��uBTfW��e�RP�DK�x�ܷg��۟i8p��L*��[P�-��"�� 6�LLF�^�3�A}8�޿�|kAs��N��/�?7��.��4�<0!�ęGL��(��[Da%�7��vm�W��X~:ah�!_C��;�o�K� ��j��Eݸ\}1}�zF�k{��{^��=��jpn1�B��#�M��(��A��f�R��GJfTi�zy�~J��Fl��pPL@z�zh=�[�0�f��s;��Y��ȜQ�|��3��Y�LSۚ[Q��H��FqZ�e�p�5ņ�Qm�Z[��*pK!P��ϐAmi��踮�DQ��n�J�V�#X��φ��`��;�io��r��>�z�-f�JЎx�FCN�� ;M��T3a�ݜ��)�o��0Q"�0Q%�e�ʻ�@��%��K4�nh#�㩼�Q9��{^9OC�Uِ�e��Z��6}v� };ee�r�y"9�£0�4�px�ڬ@Tb�5�� l��2�~d;�<�uZ��>s�uУR�x�x��E�Tw�wBm_��2�S�˅�FWkk�5�H�nÂ��0犍��tW�yR��;�ע�d:�j��^ʼd�l�J�k�-��b��du|��K��A*܇X�Pڭ�f��1�l�~{&��>2k�X �H��/ܟ��p� ��?9�5��}WԔ�CFVgg��벗�m�C7۩g��yan��z��tGS��)Gq?�$B]J)��>�8��u��VR+ �ɵ�!-C��m$��np�u]猆=D~*�&��A-��X�I�4uF��#-�C+�� (og�xN��4��w��pJ��ɪ��ۏ�t��i�c��S��t�G��[/��'ᠬ�z�J�� z��K��/��y��)�!C��=�C+l~J_��=l��t$�X_��67��-H�SЅ۹��E|��wCmO"D�O�_��?�~��|�1?��k��p��r��<�{�vʼ�<8"��)�U�@b�3(s�8F��ǁ+�O~�]��*��D ��?�ꀼ��ڟ�5��=[��1��ܴX��.��舝0��z��>�}��Y�"L��I�!5)�?�9��K��8�SB��:��O��]��R�I$;J'��#Xv��II�C��)�3��$��&?�y��P&�PVO5��e2@�5=��gl�ri~�f�o�-�c�g�So��՛��p�\��Z�=G��}"�d�N|��bN�K%��PZ�B_t̀�3�P-M��.��d�\��I�3uv%��q��U�6PZ߾�`�$��*��Χ�q�!0>�ﷶ$�݅��׀6��,>��W�t��R�}J�i�*�~��cfG^�C�Ժh0�Q$�Js:2^��n�P��|�.~F��X��A�%8�S�b�3sHoh!V=Sa��A13��>�9G��Y��33�=�"�g��rq.�� Aw�v�L��r�`5TB:�^+�<(5�Ėx_i@�R8%C�/kg��(��Ä��y;��߈��ҞS�y9�8w�\8�t�hqL��w�t9|�?ߤ�Ӹ��t��{��=�\?�2c$��)��p��j��0{��}�{;�K�k��AP��d,�r�OV2A�6-L�wO~��ٸ�Ӑ�A�/��a�y��2P.RD�{��uD��6D0�>T��8V�Cm��:�vi�੄��z��G��~��!��D8��Q�LF��.��ưP��(�Tx��,I(�n�r�f%/�澬��p�yX��M�LI@~��RUw2[nV�Dq�v�SW��bո��/5Te�K�xk��ּ&^I�E��#%��xsݛ��w�ܗ��o$��#|�3>��y%��2T�O�0)ة��`�y��%wh7�6��"�n�ͻ�qR��=�WC�i7��Z��{e(j�*��?��O�uaP�Jk�`@��ŏ�hT��"\[b�A��م��JD��B�Y�¦=2��=2��$��jdA��_ͻu��z?��M��fl��K�]��V,Z�a�9�L#y�cq�Q.%��Ь@��ճ��ji��S��=�q��ƵRP��G��y#�Y?�K� $f�m�s��Y�0��`�G��**Q|�.��y@A��B�q��#y]��s�R�^��۞%�~�g�J�B.�^��=��r��|*�!�F�o5��di��Y鞈�i5��+�j�E$^ʥ��̓�7C�X��^��T�2a�C�wV�%4@Nњ��$/d�Z�p̙Dװ��P#8�@(�d��Ty��3�_'�t��]��P�a��Β�#�:�e��f[��𝕚+5"t�ŕ+@��17�5��KD�-�7i��cl˻�uO��W��[�}eUXÞ��q��A{t�|D�N��a<��Ҿ�L��催Q1Ne�Fgw�D��IZ�[�i��b�'�A�O��͆l�S�&>��Ƹ&pv�p��G��&�Yܴ_��7��f�{o�!؟��o��;WjM��B$��N�J@K_��!��2/��>��&�<(G1��D�x�x�i��5n~q:l��^��u��7��We>�Q�Ώ2�gޚ1F��'WJ��ƫ�k#x�o�+��]��M�J��j]�("PM;�>�K�n��H��5*j�*5��y��J?&�߷�2ꍋ��i�:��q�j��@[mJ��bM+~(nFbT��&c�>�!ȡ'�Ĺ{G[[G��e@��A��}��͉�;�>0��$~n1�m��c8"�b��y��3h��n@G(�T �tqۛ��mk+��o��x��1Z�kCD�]{޳]*�l�| y�1��(|�+DaME4mE5�}�L�G��g�Nh̨�e��lnB��z�V��aj�2��@��|V+�IM>:k�>��ȋv�QFr�z�0�h��*T��mFoC]��6&��L�T�D�r|G�׍.�͟A��9�7*úh{{��&Iq��VB��+��f@�ի�(�4�Qy`�;SHt"��=�3�IJ�LB�J-R�+�3�I�:s��dΫ��?^�/�S$�:��><::�x�l7^��)��a��/�7�k8j��Ց�ebFW��г�d�)�KZ6�U��>��@��nF��Ȍ�x�#��X��Y%0W��J�b%�ċ�`��פ�~��(7t�2ظ��7�|�zL��{sLS��1@Gn,�L��T���?Y�C�Z;�,��T��vm��)8�j�\an�\��nSJ�+��NQ��6ڡ8�lϼz�s|��@�̿�R~�R��}��(�Ζ)Y�k�+��g_W��?P L��7ۤ��W��pV�#��^�[qށ*JA֛��N�:�1�n�ފ��@��B6��|��"��k��ŴJ��ɴq�c!y�{��S�?*��e�?Ζd\>��I��Q�ydw�p{��7��n�E�hK��b%ϻ��V-�x�-3��Y�z2|"��y8��lz[�p�x(ñN^.A]-t��*��ʞy1��+�+r+&��S�Tl��Rڟ�7bPǹSm�o��#�UR��LZU�bL�]��;su�S�<��r�tN!�N�MGr��+ۿ�-y�6{򬯻��Wŋ�ٲ$Q�� ?i��-5��V��A"�OhF+�k�6��bU�V��cX��"�0ݧ�z>a��H@Q$�S*T�A�h�)_��Y-�["�۵,��I��A��ˤ$��e��'_g��}��̹��@r9�"\�5N��Iݽ�=/�a��T��qX�`��P�FG�v.[�xxx�T��&a��=^OV��G�©!�KK�vY��Ǟ)�jw4��F�k۬��i1�A�so��ǐLQ�-7^��1E�+XQ�2.މ�8��X�P�\YK�'��%P��<'2��F�ل��Vu�Ć榔�3�B(0�h�Y��1�P�a�;�n�;nk�}ɋD��ө�.��+pa��ͥ�p��Ӝ,��?^�L�;��zC��F�Vp��@@X<3��[��x&��؎+bF�]��3�f��Q�W��s-��_(��f�T8GC1y��,�m�E��b6ۮ�Θ;Bzt�Ć�z�Fɗ�VpꎰXtA��Nz*,�Q��Ʉ�qJ8��axrѻ��n)�8Ju#�K��Q�U�崗ԭ�K'�L�]X��x֓��w�Χ2=O��x�!�2�C��p��1�)aJ#�<"�HE��q��OH��<&��|��F�!�H%o��<�2v��O�7�7 �kʝ��(�81`�7�;�v�r��+&qO?sO�(]c��q6T"��#'�j��TΘ�3V�N*��p��'y|�2�6�f��B��:��y%�(݇��!*�#�VՋi��;ngO.|�Yn+{÷�F�`ʭ�\��s��䴩T�<�;�ގ�\��ϴ��gU��?��)w��!��q�hW�?q�q�I��*��c$��a3A��M��T��T��6x�aO�j��kn&}�^��%u�j�5Tɦ<��Gn8��t��]�n��a�gH��ݒE��G(͠��2��;J%>�Yt�y:�3�:�h��ڄ��D4��C�#�:P�R��8�'8��D�^*w��(�Rn� S4v�\�(��h��_��f��cV��]5�$�R<��I/G��{c*�Y/�c�d@��9�.e�?cC&k�x��"Mzq��S�8�.�� ڻO�1�(�)9��0NM��Y��Q�S�S��g��V��9�#��" {�$q��'��k�!�Vl��h�qб��DyZ��ᤈ0��㬶*��N7�G�[E�*2�l=l��3�X�;C��Y�ۅM\0G��b��mo��z7#`�d��rg�u`��|s!R��3�^�X�z�B�^ϛ�_Bxr�%o3a0��]ay�-�pw�X�WZ�d܌��«Fso��tˇ�(��Η|��Y�,.�qt4�9��1��b�3ҿ8m(�P7bk�Nf�e��m6�ڪ`LF��,x��xa]E*3�48�nC�POx��꽸�b7�Y�ɹ��~4|ы[qKД!��i&�AϞ�R5�B��a��5�Y�q�}�� Aa7�@g?܍��tzK_(�Ə+�S�'��¥��[��8تԇd�3vN��܇1��"�+㰰�s��+��/oku��+��V%�6�Q��h��zo��d�漏#�C�J�ݳ�1�(��u�'��em��Yt�p��f�]�o�8UO�'��۲\�5#�:��5;йA30sWm>h>��"rI�Ow�'��䏗�'~2ޕ��o�>6��O'C��ӿ{��]|��~7��x:\��F<ݸC{�g�N��2��Y��n�5��(�f7�(�-{�M�G�6�v~�Φ�r@G*��~�.�n��I��=�|�'Q/��R��M�S�~��"��o��?��n>A:#�t��?H�.��+q�z�덦��̋�K��)�©�$��ߝ��O�ޠr�6\k%�6��Nͱ�q�~�R�)Ei�X��*�xڴ>˅�8�lR��B��K#��ɴ2��]�$5��/gAg��p�fP'c�8��?6d[�~נ�#�*�T��&H��z��W�.Lc��̽P/2+"��ˌ��:@{�Oi�]l|�Vft�0#�p��V��ӚEd顛G;M[�n"?�u��4�]C��77Fp��i�i�H��$��hr|��'�m��E�R@6�ډ�7�'3(:�E�C4�XL�`|�c��ް�p\�Du��sNƋe1�'�vC�O��>�b��Q��T��p��x�B�<�:�urm�%�T��tk˘^z/��5,�8G�+#��!0��6�·K�$;kES��m9.��?7ZV��1��$�5�=��.O��v��*�H!�w��"��'0�oFƘ��M��F�]�n��(��;��;��u�f��+�ԓk�C1z);�g�c\�1\_��P��J�d�ٓ��O�v�XmB&|V�yM�4�&�4��y�\�GJ&��ߺ�}�a�Mf�M#�#�1�K�y��w|#�ǯ��ɻ�A��t5�K��=G��:R�%��*&gl�q�,J��dt�%2�F��<6�ҟѲ��M 8�P��,�3aa5��%��w��<��6˪��=i�G�`�K��>�%��~ŕ]�)�P��.G9=Q".qF+�Q3.��ͧ�yDnJ��K�x��2��j*�c��r�#Ȫ+�,��w�#��Ic�|tm_`��rN7z˛Gs�D`��K��s�\v��)$�I+6"��N^��6ٙ�t��gwT��hM�b�;k��52�\<�D]Z��8��a��DF��N��G8r΄__f�1x�uBݙ/��)w3�G��3��ʟ�;P-�.�_�â.G��/qo�}�f\{�g2��>_��UV�D6��6�lkk��1*6�?(�n=Y�(K�N+:5��:��#��Ρ=bGض�;}J`U��t�*��Fe�n��Y�rE��K�a�S޹��F��^,�DVw-��r��w֪M��xr��*��?{�>+V��l,EBss��>I�G�#S0��n�N��4��&%��迥��ހn�'�x��7��zC@��"�|�)3~w�Y��ʦf��<�I9�V<�2��EeJ��ԣʸLظ�sN/�u:�7�R�h��g�u��$��3ni�_��Hf毫�8�l�$��N�X�d��(ب��m��\3j��M3l� ��k�&15h~|�\�%s��}5�._�;�t�Q�'dt?s�؉8+5A�z'&s�ks1��A��]�� J�h0�3��E\E?� ~��K駋��9:��/bFy��/�2�2��#�X��AͰ�3��e�J�i��ӝb��,;\�F�a��s�򩐱�A�G�,��D��{*��*Y�!�r��`�k�o�"��@wa̮�dW}��Y}J&e1�?��R��ïkF|�m��)"馔�J=��N��=[MJ|�V&X�o�'k��vE�Oy@U�y�'/�~B0V��'D��i~r��Tf�d.8�q��B2o�ŵ*��{��Û�c@'��3��y1��=��T$K�#2nf*�y�܌%Q��Ӕ#Jg��x�I��ԂQ7�$Fk5Y�a�t�wxڡV��d6�Г/�a�M��:�{�#4�6�g��k��F5$��f^��RJ��3�J� �S�>��l��3��A�辱�-)�>uZQ��!�8u+d�.[�q�g�Cpce��ٙHt7��uy��N��V).f�T�G��SU��|�2��<}�L&��Z��j��!�-Y��ϸ�`��t:b�6a��T�H�EGI��r��-cH^�n��N�&��H�EB��p��MA.ձ�"v|�6Q-�"?m��'�y�ޕ^Q*�c~q�;B�h^�u�u��S��࿿�ߗ��w��;�Y�4\��?\v*V�G��X��0�Վy�7�� o�懅�7��ٖ��rLE�H˛SYAO��~�t��m�cY��x�Y��þ�U65V�'�(%�L�z��b8�b&�ҁq�8�7��GXc!aumN��cc�i"��q��A<�0m�L��;/0��C$2|��ػ#��'��η��P�}c�ژΈ�+�}�,��3��|@��~�Ey~��"��=�W,�a�~��Fk�]z�v,��S ��4r��w0p��֦��е��jN�#u�a_�yO?,�]v�j��]x�}<��rW�"/m��F>('_��s0��2�m�p�؋��P�c�a�(��3q?@ŔC�)��|hʑ�LK��>�7��b��3��=��)<79Ⓔ��QH�O:��yG��CY��Iiٷw��;O��'�L��'?��~┧Hɐ|9�I5��]~��دFϦ?��s��Þ��yQ�/z�?o�x�7I��(r��?E2�h��c?��o�KasC�F~t�+��鞛,�=�v��ǲ�a�m��~��_Q�W�6(w��x//��h��||��?��ȃ�O��Ǭ!)��y;t��Yԕ�F��&��vN?�밨�P�/��?��+�*|yT��l]>k�(��%̫�^��Rzz��M��E�kvK9�ԛ>�O��k��/WP�=�Q�u��o޼g��Yޓȋ��}+�޵��D��p/ր�!�K1�C��_`��b#�~+�G鷈YJ��%b�p&ߴ!ZϢA�)�@�5��](��%R��i7�~(ᛳ�&��ib��B�\��,�+�qq\��FGy}�Wֹ)׹�:�򯬲(WYp�#T��k��P��r�1�k��$��E��q��\~�x.��ۏ<��t��cO�˞ޓ��~��!\��i�k/�KC� U�:~T�6ЕBz~��ʅ��Y�ɯ�b;�;��U�d��Oa��-V��T��p��-�ʐQ�hI3s��R�q6]+ϻH�M�K�VH��:�*ᅷ�"ߒ�W�cCa��X�\��eM��n�U��R�꽶bmJ��)0�.�qUH��P43��&��ңfb��N��/׳�p�"{�$��\x_%#KD�.��<=�7q�aCzѶ�§ec,b�!��L��[�K�]��ҋ&x-1⬄��)��w�8I�wW��D��<�L�mG��҆�� FVi>f��f�%��{��ڀ�D\�lg��D�˖X�|�\g�J�G��2�oq��߱��v�SpY�>�~^��2]�R�0�n�cT��W��x�\��b4�k*�]vQCy�XO��Z��5M��wyv[�W�7��h�F�AN��g9��l�N��%��E��>�i:�c�A:��҄��j4��A��~w�y��^ɢ�F�Q�S*'�rE9�f�{;hK|R�j4*�F��K�q,�JM��D�Z�uZI�]�7��T�˘H��<��n*��ra��K�1C#��X��-�3k�,�5f;M��]�`u)'��&��?2tc�;�h��Z��a��x�Gs�C/��r4K��#iN��8�8��rz�z��F8N:f��6�T<��N�%�{�Q�N�B�q��wӺ%��9��_)�@�S�/�Кo��n��0pCn��#00U�G�'�ŕ��}��'�mH�Ҕ��)؈�I��YB�2��ۧ>��ؽ�I�.�Qz^Ӱ�>�^n�`��^��/��xn}{XMQ��o6t�}�I��!��<�-�F}AB��♰rTqê�5k��_V-�Y�C�.��)¡�BX^J��]�֯��Q|ô��O�vD��¨G݆��A�+ֻ�L�｀�g�A<�Q��dᵟ NԴ��O:��'�$��'��n��TwWK��=�D��u�^��}�P��'��ʹO,0��Cڗ��w��r��0WB)��\�%:�4��3RJL�'e�S��4��XK�.&��WH�q��19�=�}�p�.�C]a�9z��zO��yNŤ�a=9m��+��~��>X�\��m�!�9�A�{�M��!��!]��[�9\�j�?��:�^h�>��Mm�Oa��)U7�ט��鲐Ƚ�!.��R�cq-.��}�A��:U��*�z�&T/t�qjǅ؜f�V9<��ӱ��OB�v�y��%;n��-Ѓӿ��,��k��y(z�s�^yo�O޹��]k+�3!#��=�y�3��yG��w$�x��t��x_��ׯ��_�,��Wy�]��e�q��'�ro��=�K5C�]+B��=�lpF8u��qY멕6�T�3�9�,6�qd��QW?�{��]��zJE�8�IZO�L°B�[�=�Jd�n�PX-��X=��I�m��}o��\�;�N��V��U�Ђ��iq�Cv�j��΢��f�гۊvЅ^��rB��I3"��l<�x��҈6Ct��ٓ>!FЁ�'N넕�l�I�į$\Ї9>SZ��s�e��sSNٖമ�ۄ{��M�m��m��i��Jh�a�Y�F�`d�w/Is��t��s�}��Tښ��>w�Uͺdãe�o��^=��d�g�O��\g��<ˡO˶8F��q`X��J��mA�C��V��prc��^�d�ir�#��S��Sj�P�d{��rT�N��k��[�;5I�!_^��qv��*<��zl��1~'�xۯ߫k��ڇ4^�TG��x�=AܘqǘA+݇��y�ŘllUr��.{��>��H�6�C��c�Bۂ�Z&�0�@�=:Qވ,�0�Z7Ҥˈٽ��3�x��H;]��Np�%∰ ��>\Q`iN�_1��\4z�ˣ��@lf@X��,�u��[Dd�Ec�tּ&R>D�e6�)�u�}qf��o�|�}�g��hg=z�u��u[FjmQ��w`��Ĥ:��s��'��N� ��m�nnXL�d�2�'G"k�>��%B�K��򷶚�\G�P�p�N�g�@4�g⯱��!��{�*��N��)]e2�i�Ȗ��P�3B�.�"�Q��e�#]��Z��fpY�1�rݙ��ɬ��|��]w�i��B��W��k�9��=��?ƙ��(�xp�l-?@@@��ɔT�J��2r4rS�f_G��~>��fer^��3��ʁ��/��bN�l��dL�a_zL-��?�?Øf٥��)"*�S榙]*M�[[ߙ�p"/�9ի�邗��Ԭ��j�Z�2&�u�j��L��Ղ�}v�2u�� }��*�\vh��YY�q�Bk?��n��sN�<�ښ:�Zm77 U đ�K��Mѵ��.�F�ۙGeh9HGLXt��Y�e��(n0_�$ʌ��o*֘�k�H-��I!��'��na*K�Cƃ¨*k=Ġ.�@9VE�@��M��#��ZmN�h��r��¥�m��kF3��9��y��KL�j��y��r�_#{Nhq.�삫��50PN�OKy&��R#�%њ�5�0]�L��h$˃Ŀ�X�c��V�Y~e"�R$�d4��26a��_Fu�T4�m%��0ՠ$`H"{��4��m�m��M�e,֍�`p.o�#��r�J��&�l�f�]M�OԝCвk��v�ǯ�8�vb�r�&� 6_��Fs�!��gąm�H��]��Q�'Y�o�c�cxT=@�v��D�LZ��R�O��zo��U��ե��;P��vb��\�,��C�LżI[E�%�|��Ci{�֐Y�ӡ��Hf�1��jbTWJ��Rc��B�U*&�g�2q�NB'�h�WC�+�&wE>4٧߫��E��; v�'*�P��'�=Ǌ� �a4�Tu��K_߼\.�6�K��!�\�>�8�rW�y%��2S'��tU��#�QM]�"�&kTuYI;��M�c�1��WaAp+5_��xFȍ��V��K�m��Z]��ބ(�6ib�h�A�.��[>��̕�ȗ�%��'��Kn�iƨ�1��9��3AݑP(��@d��n�F$�@Ŵ��\��]��U`��B�S��O޿\�oa�B�=0s$b2&�*(p�t�G�V7�IW`p��&f*��Z��4{'X1��m16ju��b9�5FH�A�� l�F�P?�>�%�!��⏔ì^j(2(��7pQz��dM#��'�CY_��RCb>�>L4�x+:yPmYDx�͹v*e��OU��O�"G��L�sW�.|�]��y��,KYN�["��c1𾉹�1$�nL�da(y�{Š�yÌ�Nc�c�ϙCG��]��S7�F?��|��ھL�5O֑`�M�~UU_U5B(>R=��z~��2��;�-K��eй��kD��tp��n��tkJ�<��&��#��JȘf�Q��.�kq&��Y~-��I3i��7Ù�z_�K��a�]2�u=�#�l�tj�be�*�tG|��ƧD��Ve��ڧ]��$dw .�M?�Q��g�*��V��scg��{2�M��޾��>�9��/�(�k��F�<�w�wBX��a��i��C�;�!��L�"^�4��%-,%%/s�f��D��F۪!J��J��R��n~��d[��G��gu�ݳ�馭ڮ�c�)W?ّ��r�fV��0��l�L��Z��=o��TxC�I�&73�${��}�*�a��C��<��gH�g�55ȑ�G��Ӿ�p�I^�|��L�5�5��sBN��pBF`yh��{!4��r�+�iFs��[��V�1��n9?�nڜ�P��I�r��G�Q��(r�8�N~#CƷ]�ץ�n��0W��[i/�iYX��-�D��b��k�k~�ֆ��xwĊl��Es��f2��WPsa-��T��59�B'˼��c\槝p{ؙo�%��ĐS<��K8�g��T��a�qOT��YK�n�:k�e(&Ӝ$-X��/SS"�yl��z�Mfh�+�З$ǿ��0��S�|��d�%S�Qy��4��a��#�d�٠G\EJr�h�+Z��@��6I��B�9��@��s�_�M�~��\��|D|b��j,d�/�?��wg;`�ɯ�;�!M�t4E��r�'=J��04�}�T%n�:��6dU��(1*ā2^��}�W:�" �I��Ź])�@��_��A�Ս��r�ѝk��d|�OAy��k��n�-�#�5��8(�*PT��8�!��pc��v��ڍ�|�j+��d��&��hvH��i6�h�l�h��8$�L��;�;!��:�;n�|��҉ϓ�+`"��¢$>DC��Ľkڗ!�!S��r4#��oߠ;��Rh|��E.n� ެ��QA�[mq/�( b�i��.(��1N��P�kQZ�_߾�(7�^N��SȔ�1��>hT��wjA#�΄�$18Rb&�p[�nn�߰��`�ⲾP�h#d��=�]bn��d�Z��$��@�I��RС��-,7��{P�ho�u�@b��_?>��=@H֞�*��S!1��E��]�3꽂pf��=��z��q;��!Y�Ĩ�fa.��Ni��G҆OBe�PV�;f�؎pj8��g��͔X_b�{��^��)�=0�{��V-��7>x�\$rS�߹�+v�џ;c_H��flg.��j�v�%��c��T�Y��ȏ8�l7��U-q):3��/1 ^�S�.9�K9L��+�u�|:��b��S0� ��&+K6�\�2b��b�{q�6� ��m�w��f��@X�su�]��#Spѿ5�k�`��À��w��N��X��hv�I.x��{��;�Â�/��9�ƈ��s3��O/"�9ln�qW`��onB�̊��.�M%=��>H��O�r,��>y�^��hu�?�:ek�0�.�>�ǈB4�.��u8Ma *~�'�)��nAȼ��KiSJl��;��"��q�SS��3�*�w�i��t�j��>*?��Xw��3��6xj��>�(?�x�YT�v�77)��U3��_K�S4ldo>��36usCyh&��b_��C<��8�a[{(Y�%�DU��}��A�_��b��e�qz�z�{��u��X�^�Q0��JBB��9�2�v��"X��~�z��[�a�x|�#�+�n��7�Ě�ݔ�:��L��&��/t�L`JVWZ/�]�Ȓ�Jݟ��|�CܯVS0��T��.c�m>��\([D�砡׽`��d��ަ3��o��YN:�`_��k� =��=�nlt��!L}A�k��Z�ix��J��K�c��!{Q8ʼ�`�s=y� 8i�ԗv�j�ƦOT4'#U�ZO��J�Wf�٠_�ߩ�%D;��xR�K+?́��+�)R�IQ20G�B�lU��$z��1t�K��:�2ف�Y��*��@6㺚LHJt ��Ɓ�Dp&k�Q�Q�.%|e��a�W�Є�~�%�𺪮'��Z��ҍ��{��rS��ӄR��8�/̓�ܽ�pu��V�D�-��bu��uaB�a9�,S�Ō�s3<��=x;6�!�g1��l#�E��Z��rX��Y( ��X�o�~]�8"�=�夆�C!��.q�\8X��<�)�K�bc7�윤�π%(�� ,oR�se�0rvY��78�gj~�)��pj��@lڜU�9�Z;�CM�q5��2��}�57<�N� ށF��)Ӱv��&��b��eU��꒐"��{��Rⳉc��*�h��L��X}@_f�,��4Vg��Or�:�ǓJ�\��K}��aN��mx��p˷%�P;�x��E�;��J�x�>2Ո�:Ş�-sn�Τr_]�s��a-��e�p��ɋ-A0�[b�L4YVLf��nn�û�_yس�h�z�~퇇��`QW�g#<��פ��ߓ��*��C�߀��}2��j��k*��d˫�IHM��p��A�2�� bπv��6"��9yOkb��0p{ի�:D��]l�*�N�^�w�9��/&��>�e�/j�[�g��)N�Ȍq��V��_��Q;��5��}WE��O��sp�;��G�C��P>N)�c��G��W��lӌ@)�,��WU=m<[1��p;�n��=�m(*?<1�(��-j��qm��$F��M��c�-ٛаC9T�<��,�y/��a��Fk��(ad?�C�GJ��r�1g��[��ȹ)BӅR*CYM'7j肛K5.O#f]�.�M6/��'˟Z�X�H�O��}�=�4�(l~�E��[u𯕄ڶo^�V4P\�FL^�x��åXXG�;ɐJ��H��bwX��[uK*`�g|�a�[k��v�f��D�j�zu��:[�z��\��iO�Y:��'�F|r�a��H��ONt��a��> ��چ:C/$~t>�jD�𤤈�9ʍ�R��ڗ�cJ��.�6�=��{�g.l�2N8�wm3%$��R�sA.y�}��(��Ts�?��L�(s�:�TU�`�MW�qk!k'iH%.��5C�7591l}5��N�^�H|��WOA��aX"bA�9FH�.`Ϊ}�e�XFp�+��CB~�b��@��D݀.�dR��(F��:�]2A��9�W�e4 ?F��.��B��W�_��Y��|��ƣv��r:�x�0ɘP�57�z��}��v��!~��&9�S�x�>Ţ\%��Y#B��Z�p� .�yKt�i��lm��p��)�d��8D߫��k��4ʱz�|=)�5��<��0�65�E�U�>7�9=��.�KE��d��P;��U�=��Ν�{�*��Ci��`ڇڔ�!�R�"�kub��⌢3%��4s�6Y�ޖ�xG�:w~uk:|_p�YW�=tYx:��E|"�@s�GT��wˌsl�m�k�%$�ژ��S_l�/��_|�I��'2��6�'�<~��ϸ�v�Iрӛ�c�-��'��g�C��,D��y��6��vA~�{�,��i��y�*�HM�!��o{��G��_��ֽ��@��l�ȃs٭pї�J��fp��^�AX8�M�"�[�}N�^�Yh��Ou5��m�Ė��x��\��jG�j!�O��gap��ʇ.}ml(��ץ�/��^�PɯN�@��W��_��]�s�V�ܥ��w��U(�\,x:�?�3��dűH�Q&��!�K�H� 稧"V�b�x��klbb�ݺ�a��\��7��.z�a�>��"�#��at��f��k��|~VY��Y�/r��zS�;�5;��Vu7�0�0l�*D$�B��9��"��!9�ѥO�I��U�m��qU��m��+ͥl��%K�g��m#h�6�Pn[m(sW'�[e��w[HQ��f+;��s3��}��2=�S�{R��ل�/H"��X��{.��U9��(��3��Q��%Ayϻ7��%��YR/ߣ �d�*s+�d�y�n��1�J�e��E4]��r1 ��L-ŧ�|��[�N�h��>_�3|e�N��LjPx��1��;��F<��_�.u� ��l]4��{g9��4̱��RlW-k��'z�@r_��`��v꿗�ޯ~�l��"�4t�bLU~��Ϛ��b��8ј�G�uFqLX�~��3�.�AI�g��_�$��2�z3�lr�Zf��qv�]�9�fy!8��aa�'y��G��У�5_�d�&�AN 6򊑫v_�ތ�b{R��?.��!5��RH��?��k��7v�A��ȹ=\n!��Ju�u�GtS��@��]��S�q�{�lA6O�~��9��k�dv<(�XA^�FR�P �k�H�֌��k��KfcT�w*�&�W㫢nZz�006G`g��=C <*z�t(8�v�,�$�;��ʷC)pK��7�g��k��k��O��jB�o��A,�؊��~��)l��vܦ�=��Z��_�{h��ej~x��.�M�J"�6��э��'B��=L�g�ꗝN��;+��v��ԋ�f��_[o�M��n��(L' D|��g3�}]|L�k'�))\�&��^\k��P��B��t��Ԧ.j>��(r��c�O�4q��^�O�(�)'��YV�r kN�<�mI�Cc��"c��"�6��nS�ԖI_�v稱��z�[�ւ!L)h��]�", "x�.�2 ��$��x��_��i��q8-J�9�f��N0"36:T789,Found URL "http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe&platform=0000&osver=5&isserver=0&shimver=4.0.30319.0://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe&platform=0000&osver=5&isserver=0&shimver=4.0.30319.0:\program" - Source: "00000000-00005708.00000001.78326.001B0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe&platform=0000&osver=5&isserver=0&shimver=4.0.30319.0software\policies\microsoft\internet" - Source: "00000000-00005708.00000001.78326.001B0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=app2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=0c39d439fe9a4e6c2141f99f9766f\??\volume" - Source: "00000000-00005708.00000001.78326.001B0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=0c39d439fe9a4e6c2141f66fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe&platform=0000&osver=5&isserver=0&shimver=4.0.30319.09d4df8d67a93c61beda74b476b4.exe&platform=0000&osver=5&isserver=0&shimver=4.0.30319.0storage" - Source: "00000000-00005708.00000001.78326.001B0000.00000004.mdmp") Found URL "http://gosoft.com/fwlink/?prd=11324&pver=4.5&slaunch2&plcid=0x409&o1=shim_noversion_version=(null)&processname=0c39d439fe9d141f99f9766fa4bf1cfc9d4df8d67a93c61bedo6b4.exe&platform=0000&osver=5&isserverrmver=4.0.30319.0c:\program" - Source: "00000000-00005708.00000001.78326.001B0000.00000004.mdmp")37:Teac,"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005708) "0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005708)38:T5de,Found string "\Device\HarddiskVolume2\0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe" (Indicator: "\Device\"; Source: "00000000-00005708.00000000.77961.001B0000.00000004.mdmp, 00000000-00005708.00000001.78326.001B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005708.00000001.78326.001B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00005708.00000001.78326.001B0000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005708.00000001.78326.001B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005708.00000001.78326.001B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005708.00000001.78326.001B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005708.00000001.78326.001B0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005708.00000001.78326.001B0000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{dcbfaac3-d863-11e7-b9ff-806e6f6e6963}91e" (Indicator: "\Device\"; Source: "00000000-00005708.00000001.78326.001B0000.00000004.mdmp")39:T595,Found string "CorExitProcess" (Source: 0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4, API is part of module: MSCOREEI.DLL) Found string "FlsFree" (Source: 0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: 0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4, API is part of module: KERNELBASE.DLL) Found string "GetProcessWindowStation" (Source: 0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4, API is part of module: USER32.DLL) Found string "GetUserObjectInformationA" (Source: 0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4, API is part of module: USER32.DLL) Found string "GetLastActivePopup" (Source: 0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4, API is part of module: USER32.DLL) Found string "GetActiveWindow" (Source: 0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4, API is part of module: USER32.DLL) Found string "MessageBoxA" (Source: 0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4, API is part of module: USER32.DLL)3a:T8ee,"0c39d.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "0c39d.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "0c39d.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "0c39d.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME"; Key: ""; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME"; Key: ""; Value: "") "0c39d.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "0c39d.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "0c39d.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "0c39d.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE"; Key: ""; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE"; Key: ""; Value: "") "0c39d.Spy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")3b:Td0b,"0c39d.Spy.exe" queries volume information of "C:\0c39d.Spy.exe" at 00000000-00004792-00000C15-51399264 "0c39d.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00004792-00000C15-51570027 "0c39d.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00004792-00000C15-51680522 "0c39d.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00004792-00000C15-52341014 "0c39d.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00004792-00000C15-52356540 "0c39d.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll" at 00000000-00004792-00000C15-52403172 "0c39d.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll" at 00000000-00004792-00000C15-52747266 "0c39d.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00004792-00000C15-52938141 "0c39d.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004792-00000C15-53218731 "0c39d.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004792-00000C15-53223590 "0c39d.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004792-00000C15-53223713 "0c39d.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00004792-00000C15-55325829 "0c39d.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" at 00000000-00004792-00000C15-56044069 "0c39d.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll" at 00000000-00004792-00000C15-56076433 "0c39d.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll" at 00000000-00004792-00000C15-56523718 "0c39d.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00004792-00000C15-57528871 "0c39d.Spy.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00004792-00000C15-575525933c:Tfbe,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004792-00000C25-51036965] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004792-00000C25-51246938] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004792-00000C25-51296176] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004792-00000C25-51330098] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\8d55d7cad944a3f21aeb1db491f3d6de\mscorlib.ni.dll" [Source: 00000000-00004792-00000C25-51385007] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004792-00000C25-51399894] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004792-00000C25-51439909] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004792-00000C25-51517368] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00004792-00000C25-51575731] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\10e5a0803d11b8b826dbeb56a1f98239\System.ni.dll" [Source: 00000000-00004792-00000C25-51622065] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00004792-00000C25-51876101] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\53fcc36b6b7c9cc86e5d7484c1f93bd8\System.Core.ni.dll" [Source: 00000000-00004792-00000C25-51950776] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\e4e680611f69d26d704e61dd8bfa4ece\System.Configuration.ni.dll" [Source: 00000000-00004792-00000C25-51964604] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\638ba173c955ab83f37edbab9b896f44\System.Xml.ni.dll" [Source: 00000000-00004792-00000C25-51994890] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004792-00000C25-52090935] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" [Source: 00000000-00004792-00000C25-53230905] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00004792-00000C25-53680382] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll" [Source: 00000000-00004792-00000C25-55415249] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00004792-00000C25-55586241] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004792-00000C25-55616127] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004792-00000C25-55719603] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004792-00000C25-55760167] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" [Source: 00000000-00004792-00000C25-55841188] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004792-00000C25-56846134] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\aspnet_rc.dll" [Source: 00000000-00004792-00000C25-57665747]3d:T96a,"0c39d.Spy.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindNextFileW" with parameter 8d55d7cad944a3f21aeb1db491f3d6de (UID: 00000000-00004792) "0c39d.Spy.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Bullions\* (UID: 00000000-00004792)3e:T739,"0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "0c39d.Spy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "")3f:T5e9,"0c39d.Spy.exe" queried SystemProcessInformation at 00000000-00004792-00000C13-50391945 [PID: 4792] "0c39d.Spy.exe" queried SystemProcessInformation at 00000000-00004792-00000C13-50397223 [PID: 4792] "0c39d.Spy.exe" queried SystemProcessInformation at 00000000-00004792-00000C13-52137956 [PID: 4792] "0c39d.Spy.exe" queried SystemProcessInformation at 00000000-00004792-00000C13-52140674 [PID: 4792] "0c39d.Spy.exe" queried SystemProcessInformation at 00000000-00004792-00000C13-55867820 [PID: 4792] "0c39d.Spy.exe" queried SystemProcessInformation at 00000000-00004792-00000C13-55869899 [PID: 4792] "0c39d.Spy.exe" queried SystemProcessInformation at 00000000-00004792-00000C13-56880171 [PID: 4792] "0c39d.Spy.exe" queried SystemProcessInformation at 00000000-00004792-00000C13-56882417 [PID: 4792] "0c39d.Spy.exe" queried SystemProcessInformation at 00000000-00004792-00000C13-58053420 [PID: 4792] "0c39d.Spy.exe" queried SystemProcessInformation at 00000000-00004792-00000C13-58055703 [PID: 4792] "0c39d.Spy.exe" queried SystemProcessInformation at 00000000-00004792-00000C13-58412626 [PID: 4792] "0c39d.Spy.exe" queried SystemProcessInformation at 00000000-00004792-00000C13-58414603 [PID: 4792] "0c39d.Spy.exe" queried SystemProcessInformation at 00000000-00004792-00000C13-59425093 [PID: 4792] "0c39d.Spy.exe" queried SystemProcessInformation at 00000000-00004792-00000C13-59427065 [PID: 4792] "0c39d.Spy.exe" queried SystemProcessInformation at 00000000-00004792-00000C13-59674278 [PID: 4792]40:T1ba7,"0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Chromium\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\MapleStudio\ChromePlus\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Iridium\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\7Star\7Star\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\CentBrowser\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Chedot\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Vivaldi\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Kometa\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Elements Browser\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Epic Privacy Browser\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\uCozMedia\Uran\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\CatalinaGroup\Citrio\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Coowon\Coowon\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\liebao\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\QIP Surf\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Orbitum\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Comodo\Dragon\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Amigo\User\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Torch\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Yandex\YandexBrowser\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\360Browser\Browser\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Maxthon3\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\K-Melon\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Sputnik\Sputnik\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Nichrome\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\CocCoc\Browser\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Uran\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Chromodo\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Mail.Ru\Atom\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\BraveSoftware\Brave-Browser\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\CryptoTab Browser\User Data" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\odbfpeeihdkbihmopkbjmoonfanlbfcl" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhilaheimglignddkjgofkcbgekhenbh" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj" "0c39d.Spy.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig"41:T1fc6,0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb related to Yoroi 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec related to TronLink 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid related to Nifty Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn related to MetaMask 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc related to Math Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad related to Coinbase Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp related to Binance Chain Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln related to Guarda 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac related to EQUA Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne related to Jaxx Liberty 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi related to BitApp Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj related to iWallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih related to Wombat 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm related to MEW CX 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj related to GuildWallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig related to Saturn Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec related to Ronin Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp related to Terra Station 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg related to Coin98 Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn related to Liquality Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb related to Yoroi 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec related to TronLink 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid related to Nifty Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn related to MetaMask 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc related to Math Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad related to Coinbase Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp related to Binance Chain Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln related to Guarda 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac related to EQUA Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne related to Jaxx Liberty 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi related to BitApp Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj related to iWallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih related to Wombat 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm related to MEW CX 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj related to GuildWallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig related to Saturn Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec related to Ronin Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp related to Terra Station 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg related to Coin98 Wallet 0c39d.Spy.exe trying to open a file \Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn related to Liquality Wallet42:T5af,Found reference to API "IOpenServiceManager" (Indicator: "OpenService"; Source: "00000000-00002548.00000001.66903.73CF1000.00000020.mdmp") Found reference to API "IOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00002548.00000001.66903.73CF1000.00000020.mdmp") Found reference to API "IOpenServiceActivityManager" (Indicator: "OpenService"; Source: "00000000-00002548.00000001.66903.73CF1000.00000020.mdmp") Found reference to API "IOpenServiceActivityOutputContext" (Indicator: "OpenService"; Source: "00000000-00002548.00000001.66903.73CF1000.00000020.mdmp") Found reference to API "IOpenServiceActivityInput" (Indicator: "OpenService"; Source: "00000000-00002548.00000001.66903.73CF1000.00000020.mdmp") Found reference to API "IOpenService" (Indicator: "OpenService"; Source: "00000000-00002548.00000001.66903.73CF1000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00002548.00000001.66903.73CF1000.00000020.mdmp") Found reference to API "IOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00002548.00000001.66903.73CF1000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00002548.00000001.66903.73CF1000.00000020.mdmp") Found reference to API "IOpenServiceManagerInternal" (Indicator: "OpenService"; Source: "00000000-00002548.00000001.66903.73CF1000.00000020.mdmp")43:T1186,Contains base64 string in header "Keep" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "User" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "digicert" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BWU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"44:T502,Found string "" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_0c39d43") Found string "" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_0c39d43") Found string "" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_0c39d43") Found string "" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_0c39d43") Found string "Twitter" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_0c39d43")45:T659,"" (Indicator: "github.com") "" (Indicator: "github.com") "" (Indicator: "github.com") "openSourceFeedbackIssueUrl: 'https://github.com/dotnet/docs/issues/new?template=customer-feedback.yml'," (Indicator: "github.com") "{ name: "adegeo", url: "https://github.com/adegeo" }," (Indicator: "github.com") "{ name: "Youssef1313", url: "https://github.com/Youssef1313" }," (Indicator: "github.com") "{ name: "gewarren", url: "https://github.com/gewarren" }," (Indicator: "github.com") "{ name: "Thraka", url: "https://github.com/Thraka" }," (Indicator: "github.com") "{ name: "mairaw", url: "https://github.com/mairaw" }," (Indicator: "github.com") "{ name: "nschonni", url: "https://github.com/nschonni" }" (Indicator: "github.com") "href="https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md"" (Indicator: "github.com") "data-original_content_git_url="https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md"" (Indicator: "github.com") "" (Indicator: "github.com")46:Ta25,"GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 74528 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 04 Dec 2023 09:31:23 GMT Etag: "614b5ba7-243" expires: Wed 06 Dec 2023 09:31:23 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3055 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 04 Dec 2023 09:31:25 GMT Last-Modified: Mon 04 Dec 2023 08:40:30 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 313 with response body ==>308201350A0100A082012E3082012A06092B06010505073001010482011B3082011730819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5914 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 04 Dec 2023 09:31:35 GMT Last-Modified: Mon 04 Dec 2023 07:53:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 575 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 04 Dec 2023 09:31:35 GMT Last-Modified: Mon 04 Dec 2023 09:22:00 GMT Server: ECAcc (sac/256F) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32.......47:T85c,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrj" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdi" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "uNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0B" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"48:T419,Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002548.00000001.66903.73D30000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00002548.00000001.66903.73D30000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00002548.00000001.66903.73D30000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00002548.00000001.66903.73D30000.00000002.mdmp") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00002548.00000001.66903.73D30000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002548.00000001.66903.73D30000.00000002.mdmp") Found reference to API "GetKernelObjectSecurity" (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00002548.00000001.66903.73D30000.00000002.mdmp")49:Ta24,Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002384] Dropped file: "6B2043001D270792DFFD725518EAFE2C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00002384] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002384] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6]- [targetUID: 00000000-00002384] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6]- [targetUID: 00000000-00002384] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002384] Dropped file: "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A]- [targetUID: 00000000-00002384] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002384] Dropped file: "77EC63BDA74BD0D0E0426DC8F8008506" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002384] Dropped file: "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A]- [targetUID: 00000000-00002384] Dropped file: "6B2043001D270792DFFD725518EAFE2C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00002384] Dropped file: "77EC63BDA74BD0D0E0426DC8F8008506" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002384]4a:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791686356008,"unified_at":"2026-10-11T02:39:16.008Z","metadata":{"hashes":{"sha256":"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4","sha1":"1fbb4af43654e44a7b0df370db46859c44ec3c71","md5":"fbeed9c8bab55bfd3a1d9bdd943ead67","sha512":"c9867eadc4fb74aac225ec398f71aa0bbd122c46e013b8f95cf91a215f7447a03e4361e7b8215b4dd65f57d8827df45ef5177ab3f5c91ff77b673f387c75f1e1","ssdeep":"6144:Dc2vDqKynK3EtMaXliaXF7A9bipAoTWryiYx2OU54ik1QNZGGq1cpF2l+O325Nh:42vD6KQXHF7A9KS0IIGNMGq1i2l+VL","ssdeep_chunks":["6144:Dc2vDqK","6144:c2vDqKy","6144:2vDqKyn","6144:vDqKynK","6144:DqKynK3","6144:qKynK3E","6144:KynK3Et","6144:ynK3EtM","6144:nK3EtMa","6144:K3EtMaX","6144:3EtMaXl","6144:EtMaXli","6144:tMaXlia","6144:MaXliaX","6144:aXliaXF","6144:XliaXF7","6144:liaXF7A","6144:iaXF7A9","6144:aXF7A9b","6144:XF7A9bi","6144:F7A9bip","6144:7A9bipA","6144:A9bipAo","6144:9bipAoT","6144:bipAoTW","6144:ipAoTWr","6144:pAoTWry","6144:AoTWryi","6144:oTWryiY","6144:TWryiYx","6144:WryiYx2","6144:ryiYx2O","6144:yiYx2OU","6144:iYx2OU5","6144:Yx2OU54","6144:x2OU54i","6144:2OU54ik","6144:OU54ik1","6144:U54ik1Q","6144:54ik1QN","6144:4ik1QNZ","6144:ik1QNZG","6144:k1QNZGG","6144:1QNZGGq","6144:QNZGGq1","6144:NZGGq1c","6144:ZGGq1cp","6144:GGq1cpF","6144:Gq1cpF2","6144:q1cpF2l","6144:1cpF2l+","6144:cpF2l+O","6144:pF2l+O3","6144:F2l+O32","6144:2l+O325","6144:l+O325N","6144:+O325Nh","12288:Dc2vDqK","12288:c2vDqKy","12288:2vDqKyn","12288:vDqKynK","12288:DqKynK3","12288:qKynK3E","12288:KynK3Et","12288:ynK3EtM","12288:nK3EtMa","12288:K3EtMaX","12288:3EtMaXl","12288:EtMaXli","12288:tMaXlia","12288:MaXliaX","12288:aXliaXF","12288:XliaXF7","12288:liaXF7A","12288:iaXF7A9","12288:aXF7A9b","12288:XF7A9bi","12288:F7A9bip","12288:7A9bipA","12288:A9bipAo","12288:9bipAoT","12288:bipAoTW","12288:ipAoTWr","12288:pAoTWry","12288:AoTWryi","12288:oTWryiY","12288:TWryiYx","12288:WryiYx2","12288:ryiYx2O","12288:yiYx2OU","12288:iYx2OU5","12288:Yx2OU54","12288:x2OU54i","12288:2OU54ik","12288:OU54ik1","12288:U54ik1Q","12288:54ik1QN","12288:4ik1QNZ","12288:ik1QNZG","12288:k1QNZGG","12288:1QNZGGq","12288:QNZGGq1","12288:NZGGq1c","12288:ZGGq1cp","12288:GGq1cpF","12288:Gq1cpF2","12288:q1cpF2l","12288:1cpF2l+","12288:cpF2l+O","12288:pF2l+O3","12288:F2l+O32","12288:2l+O325","12288:l+O325N","12288:+O325Nh","6144:42vD6KQ","6144:2vD6KQX","6144:vD6KQXH","6144:D6KQXHF","6144:6KQXHF7","6144:KQXHF7A","6144:QXHF7A9","6144:XHF7A9K","6144:HF7A9KS","6144:F7A9KS0","6144:7A9KS0I","6144:A9KS0II","6144:9KS0IIG","6144:KS0IIGN","6144:S0IIGNM","6144:0IIGNMG","6144:IIGNMGq","6144:IGNMGq1","6144:GNMGq1i","6144:NMGq1i2","6144:MGq1i2l","6144:Gq1i2l+","6144:q1i2l+V","6144:1i2l+VL"],"imphash":"d4d7d390eccd590f3d8a8f7059611b1c","pehash":"68017e13223a760c9d0feca51b50a0489cfe86fc"},"file_info":{"file_name":"0c39d.Spy.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":511268,"entropy":6.64,"compile_timestamp":"2023-11-02T07:27:37","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1698920107000,"last_seen":1789907401000,"last_multi_scan":1789907401000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":5,"import_count":0,"export_count":0,"embedded_file_count":1,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":107341,"raw_size":107520},{"name":".reloc","virtual_address":"0x1c000","virtual_size":9399,"raw_size":9728},{"name":".rdata","virtual_address":"0x1f000","virtual_size":20592,"raw_size":20992},{"name":".data","virtual_address":"0x25000","virtual_size":365128,"raw_size":357376},{"name":".qbjfz","virtual_address":"0x7f000","virtual_size":4096,"raw_size":2268}],"section_names":[".text",".reloc",".rdata",".data",".qbjfz"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","redlinestealer","informationstealer","backdoor","evasive"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":83},"sandbox_signatures":{"informative_count":204,"suspicious_count":20,"malicious_count":13,"total":237},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Evo-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Kryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Redline-10033254-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HVCX trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.00002031","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:TrojanSpy/Stealer.h","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005ace5d1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_get_geographical_location","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-ACN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Kryptik.KVJ.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusT.DTML","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.4707714","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Capa_get_geographical_location","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"RedLineStealer","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Creates new processes"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"suspicious","value":"Able to check if a debugger is running"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Decrypted SSL network traffic"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains reference to licensed c/c++ library"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"References URL in command line"},{"type":"suspicious","value":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"},{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"suspicious","value":"Contains ability to terminate a process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file contains unusual section name"},{"type":"informative","value":"Dotnet file packed with confuser protection"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Drops cabinet archive files"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Communicates with HTTPS web server (GET/POST requests)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"suspicious","value":"Opened the service control manager"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Executes WMI queries in order to detect local security applications"},{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Queries list of installed browsers"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal crypto wallet extension (file access)"},{"type":"malicious","value":"Tries to steal desktop applications information (file access)"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://sectigo.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$28","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"tim.kosse@filezilla-project.org\"","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-63","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Contains reference to licensed c/c++ library","description":"Found string \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\" (Indicator: \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-462","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\"), Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"sample.bin\"), Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetUserObjectInformationA\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStrings\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStrings\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-115","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\"), Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"tzdjspepszlnhozcunjzwlnrlxonjikwnqdgsdjibrjdupweaoxoxnkyluijneazkxszkeegmdaesgasaqwbdjfgeczkp\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\"), Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"GZipStream\" (Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"LoadResource with parameter {'hModule': '1973485568', 'hResInfo': '3671568'}\" (UID: 00000000-00005708)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")\n Found reference to \"CryptographicException\" (Indicator: \"CryptographicException\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")\n Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")\n Found reference to \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")\n Found reference to \"CspParameters\" (Indicator: \"CspParameters\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file packed with confuser protection","description":"Observed string: \"ConfusedByAttribute\" (Indicator: \"ConfusedByAttribute\") in Source: 00000000-00005708.00000001.78326.002B2000.00000020.mdmp\n 00000000-00005708.00000001.78326.00425000.00000004.mdmp\n Observed string: \"Confuser.Core 1.6.0+447341964f\" (Indicator: \"Confuser.Core \") in Source: 00000000-00005708.00000001.78326.002B2000.00000020.mdmp\n 00000000-00005708.00000001.78326.00425000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1027.002","relevance":1,"id":"string-232","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 7590-2107-0041146F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005708-8678-10-0040C36A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005708-8678-26-0040A47F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005708-8678-27-0040A7EA\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005708-8678-1015-0041146F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"DecodeBase64\" (Indicator: \"decodebase64\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"b__754_0\" (Indicator: \"DecryptRSA\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")\n Found string \"DecryptRSA\" (Indicator: \"DecryptRSA\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")\n Found string \"EncryptRSA\" (Indicator: \"EncryptRSA\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")\n Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005708.00000000.77961.001B0000.00000004.mdmp, 00000000-00005708.00000001.78326.001B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Decrypted SSL network traffic\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 31304; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 31925; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 499971; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 508750; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 508997; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_UserName\" (Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")\n Found string \"get_Is64BitOperatingSystem\" (Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005708-00000C2C-224893163\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005708-00000C2C-231396974\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005708-00000C2C-231397177\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005708-00000C2C-231397509\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"00000000-00005708-00000C2C-232928773\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005708)\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005708)\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005708)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005708)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005708)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"IsWow64Process\" with parameter \"5708\" - (UID: 00000000-00005708)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"GetActiveWindow\" (UID: 00000000-00005708)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005708)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00005708)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f6777700273a77f42ee271c04e1f00a035e27150273a77e8dd5700c02e1b00b2f4777760273a77f8dd57000000db710000db710000000054dd5700f0000000f000db710000000064dd570053000000f8de57000000000001000000c8dd570040f577770000000000000000b4dd5700 (UID: 00000000-00005708)\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"GetVersionExA\" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005708)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005708)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00005708-8678-710-00411CE9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005708-8678-710-00411CE9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005708-8678-710-00411CE9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.dll at 7590-924-00418825\n GetLocaleInfoA@KERNEL32.dll at 7590-926-00418859\n GetLocaleInfoA@KERNEL32.dll at 7590-979-00414A9B\n GetLocaleInfoA@KERNEL32.dll at 7590-981-00414B33\n GetLocaleInfoA@KERNEL32.dll at 7590-986-00414D79\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00005708-8678-227-0041555E\n EnumSystemLocalesA@KERNEL32.DLL at 00000000-00005708-8678-239-00414EDB\n EnumSystemLocalesA@KERNEL32.DLL at 00000000-00005708-8678-240-00414E9F\n EnumSystemLocalesA@KERNEL32.DLL at 00000000-00005708-8678-242-00414E38\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00005708-8678-251-00414982\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005708-8678-629-00418825\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00005708-8678-631-00418859\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00005708-8678-718-00414A9B\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00005708-8678-720-00414B33\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00005708-8678-725-00414D79","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"USESHORTNAME\")\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"APPENDPATH\")\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA HTTP unable to match response to request\" (SID: 2221010, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00005708.00000001.78326.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1\" - (UID: 00000000-00005708)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"150.171.109.71:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00005708-8678-18-004100C1\n Sleep@KERNEL32.DLL at 00000000-00005708-8678-46-0040E35A\n Sleep@KERNEL32.DLL at 00000000-00005708-8678-62-0040E315\n Sleep@KERNEL32.DLL at 00000000-00005708-8678-176-0040E3A6\n Sleep@KERNEL32.DLL at 00000000-00005708-8678-1038-0041C000","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00005708-8678-25-004166FC\n LoadLibraryA@KERNEL32.DLL at 00000000-00005708-8678-1038-0041C000","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"9071312,5972,3191,,ShellExecuteW,Shell32.dll,\"252:05:55.862\",RX=0,PX=0\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005708.00000001.78326.001B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Registry\\Machine\\Software\\Classes\" in Source: 00000000-00005708.00000001.78326.001B0000.00000004.mdmp\n \"Software\\Policies\\Microsoft\\Internet Explorer\\TabbedBrowsing\" in Source: 00000000-00005708.00000001.78326.001B0000.00000004.mdmp\n \"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00005708.00000001.78326.001B0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$2d","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"logo_net_1_.svg\" as clean (type is \"Unknown\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-2.dll\" - [base:0; Status:c0000135]\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-0.dll\" - [base:0; Status:c0000135]\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\\\mscoreeis.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Registry\\Machine\\Software\\Classes\" in Source: 00000000-00005708.00000001.78326.001B0000.00000004.mdmp\n \"Software\\Policies\\Microsoft\\Internet Explorer\\TabbedBrowsing\" in Source: 00000000-00005708.00000001.78326.001B0000.00000004.mdmp\n \"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00005708.00000001.78326.001B0000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00000000-00005896)\n Launches browser \"iexplore.exe\" (UID: 00000000-00005992)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"iexplore.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 778E0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75960000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1300140054f4de75@RPCRT4.dll\"\n \"1800190068e86868@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e86868@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5f6868@ntdll.dll\"\n \"150016002073ce69@ADVAPI32.dll\"\n \"0e000f00e473ce69@ADVAPI32.dll\"\n \"0e000f005074ce69@ADVAPI32.dll\"\n \"11001200d47dce69@ADVAPI32.dll\"\n \"110012007c7ece69@ADVAPI32.dll\"\n \"12001300cc7ece69@ADVAPI32.dll\"\n \"12001300387fce69@ADVAPI32.dll\"\n \"14001500e4b7ce69@ADVAPI32.dll\"\n \"1400150000b8ce69@ADVAPI32.dll\"\n \"140015001cb8ce69@ADVAPI32.dll\"\n \"1700180038b8ce69@ADVAPI32.dll\"\n \"0d000e0054b8ce69@ADVAPI32.dll\"\n \"1100120064b8ce69@ADVAPI32.dll\"\n \"110012007cb8ce69@ADVAPI32.dll\"\n \"0d000e009c7fce69@SHELL32.dll\"\n \"0d000e002880ce69@SHELL32.dll\"\n \"0f001000ecb9ce69@ADVAPI32.dll\"\n \"1400150038bace69@ADVAPI32.dll\"\n \"1400150054bace69@ADVAPI32.dll\"\n \"0c000d00a8bace69@ADVAPI32.dll\"\n \"0c000d00b8bace69@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" touched \"Network\" (Path: \"HKCU\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\SHELLFOLDER\")\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\")\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" touched \"Application Registration\" (Path: \"HKCU\\CLSID\\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4\" has an executable section named \".text\"\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4\" has an executable section named \".reloc\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4\" has an writable section named \".data\"\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4\" has an writable section named \".qbjfz\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4\" file has an entrypoint instructions - \"call\t0x411ce7,jmp\t0x40a68e,cmp\tecx, dword ptr [0x47b490],jne\t0x40a7f4,repz ret\t,jmp\t0x411d7d,push\teax,push\tdword ptr fs:[0],lea\teax, [esp + 0xc],sub\tesp, dword ptr [esp + 0xc],push\tebx,push\tesi,push\tedi,mov\tdword ptr [eax], ebp,mov\tebp, eax,mov\teax, dword ptr [0x47b490],xor\teax, ebp,push\teax,push\tdword ptr [ebp - 4],mov\tdword ptr [ebp - 4], 0xffffffff,lea\teax, [ebp - 0xc],mov\tdword ptr fs:[0], eax,ret\t,push\teax,push\tdword ptr fs:[0],lea\teax, [esp + 0xc],sub\tesp, dword ptr [esp + 0xc],push\tebx,push\tesi,push\tedi,mov\tdword ptr [eax], ebp,mov\tebp, eax,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00000000-00005896) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"iexplore.exe\" (UID: 00000000-00005896) was launched with modified environment variables: \"Path, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"js.monitor.azure.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00005708-00000C2B-224177949]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\\\mscoreeis.dll\" [Source: 00000000-00005708-00000C2B-224532647]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreeis.dll\" [Source: 00000000-00005708-00000C2B-224706371]\n Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00005708-00000C2B-225257397]\n Observed system executable string:\"%WINDIR%\\system32\\ole32.dll\" [Source: 00000000-00005708-00000C2B-225724266]\n Observed system executable string:\"%WINDIR%\\system32\\MSCTF.dll\" [Source: 00000000-00005708-00000C2B-225922515]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" searching for class \"IEFrame\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch ...\" (UID: 00000000-00005896)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:5896 CREDAT:275457 /prefetch:2\" (UID: 00000000-00005992)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch ...\" (UID: 00000000-00005896)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:5896 CREDAT:275457 /prefetch:2\" (UID: 00000000-00005992)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$2f","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"SendAttachment\" (Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateService\" (Indicator: \"CreateService\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"iexplore.exe\" is creating a new process (Name: \"C:\\Program Files\\Internet Explorer\\iexplore.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$30","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"learn.microsoft_1_.xml\" has type \"Unknown\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"~DF9DFA4827FE18F2AE.TMP\" has type \"data\"\n \"~DF07BAD5D126EF85D3.TMP\" has type \"data\"\n \"~DFE3DD4E93112D58D6.TMP\" has type \"data\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" reads file \"c:\\program files\\internet explorer\\iexplore.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" trying to access non-existent file \"C:\\Windows\\system32\\mscoree.dll.local\"\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" trying to access non-existent file \"C:\\0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe.Local\\\"\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" trying to access non-existent file \"C:\\Windows\\System32\\MSCOREE.DLL.LOCAL\"\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" trying to access non-existent file \"C:\\0C39D439FE9A4E6C2141F99F9766FA4BF1CFC9D4DF8D67A93C61BEDA74B476B4.EXE.CONFIG\"\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" trying to access non-existent file \"C:\\0C39D439FE9A4E6C2141F99F9766FA4BF1CFC9D4DF8D67A93C61BEDA74B476B4.EXE.LOCAL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTPS web server (GET/POST requests)","description":"Found requests in header \"GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: js.monitor.azure.comDNT: 1Connection: Keep-Alive\"; in File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-505","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00005708.00000000.77961.00820000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$35","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"41.11.2.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$36","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"file/memory contains long string with (Indicator: \"HTTP/1.1\"; File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"js.monitor.azure.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5182f54f9c6e99d117d9dde3fa2b4cff","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"150.171.109.71\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" tries to directly access volume data \"C:\"\n \"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" tries to directly access volume data \"Z:\"\n \"iexplore.exe\" tries to directly access volume data \"C:\"\n \"iexplore.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"ZIndicates if the text in the edit control should appear as the default password character.\" (Indicator: \"password\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$38","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"b__1284_0\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")\n Found reference to API \"b__1285_0\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")\n Found reference to API \"DeleteFilesWhere\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005708.00000001.78326.002B2000.00000020.mdmp, 00000000-00005708.00000001.78326.00425000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" opened \"\\Device\\KsecDD\"\n \"iexplore.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF has high entropy\"\n \"3B7CEBA4139B7484BAF665AC9E712D61 has high entropy\"\n \"E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959 has high entropy\"\n \"E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F has high entropy\"\n \"B54B00CE250A47F2A29BFE4A70858A02 has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"app-could-not-be-started_1_.png\" has type \"Unknown\" and extension \"png\"\n \"app-could-not-be-started-details_1_.png\" has type \"Unknown\" and extension \"png\"\n \"repair-tool-no-resolution_1_.png\" has type \"Unknown\" and extension \"png\"\n \"repair-tool-recommended-changes_1_.png\" has type \"Unknown\" and extension \"png\"\n \"repair-tool-changes-complete_1_.png\" has type \"Unknown\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4\" was detected as \"Visual C++ 2008 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to check if a debugger is running","description":"IsDebuggerPresent@KERNEL32.DLL at 00000000-00005708-8678-26-0040A47F\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00005708-8678-27-0040A7EA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":3,"id":"stream-75","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.dll at 7590-905-0040F060\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005708-8678-15-0041011A\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005708-8678-17-0041068F\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005708-8678-18-004100C1\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005708-8678-20-00410614\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005708-8678-42-0041077B\n GetModuleHandleA@KERNEL32.DLL at 00000000-00005708-8678-608-0040F060\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005708-8678-690-00410A24\n GetModuleHandleA@KERNEL32.DLL at 00000000-00005708-8678-1037-0041D960","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.DLL at 00000000-00005708-8678-791-00411A47","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/24 Antivirus vendors marked sample as malicious (58% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"suspicious","category":"General","name":"References URL in command line","description":"Process \"iexplore.exe\" with commandline \"http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0\" (UID: 00000000-00005896)","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":1,"id":"target-174","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 150.171.109.71 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 150.171.109.74 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 150.171.28.10 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 173.223.146.43 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 184.29.98.3 on port 80 (TCP)\n Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 2.22.234.112 on port 80 (TCP)\n Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 23.61.214.42 on port 80 (TCP)\n Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 23.56.109.136 on port 80 (TCP)\n Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 150.171.109.72 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 150.171.109.71 on port 443 (TCP); Domain: \"js.monitor.azure.com\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"ExitProcess@KERNEL32.DLL at 00000000-00005708-8678-14-00410145\n TerminateProcess@KERNEL32.DLL at 00000000-00005708-8678-26-0040A47F\n TerminateProcess@KERNEL32.DLL at 00000000-00005708-8678-27-0040A7EA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"1JH54RYU.htm\" contains indicator \"ActiveXObject\" (Line: 36; Offset: 79742)\n \"1JH54RYU.htm\" contains indicator \".Run\" (Line: 36; Offset: 37490)","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 4987 bytes 1 file at 0x2c last modified Sep 04 2025 20:23:24 +A \"disallowedcert.stl\" number 1 1 datablock 0x1 compression\"- [targetUID: 00000000-00005708]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n GetCommandLineA\n CreateFileA\n GetStartupInfoA\n VirtualAlloc\n WriteFile\n IsDebuggerPresent\n GetModuleHandleA\n CreateThread\n VirtualProtect\n Sleep\n TerminateProcess\n UnhandledExceptionFilter\n LoadLibraryA\n GetModuleFileNameA\n GetModuleHandleW\n GetTickCount","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4\" has a section named \".qbjfz\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/24 Antivirus vendors marked sample as malicious (58% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"0c39d439fe9a4e6c2141f99f9766fa4bf1cfc9d4df8d67a93c61beda74b476b4.exe\" called \"ShellExecuteW\" with parameter http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0 (UID: 00000000-00005708)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6aafd1c7afef6c3f550e477d"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"0c39d.Spy.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"0c39d.Spy.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"0c39d.Spy.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004792.00000000.67212.0041F000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00004792.00000000.67212.0041F000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00004792.00000000.67212.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00004792.00000000.67212.02830000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00004792.00000000.67212.02830000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - [-]?\\d+(\\.\\d+)?; Source: \"00000000-00004792.00000000.67212.02830000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004792.00000000.67212.02830000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004792.00000000.67212.02830000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004792.00000000.67212.02830000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004792.00000000.67212.02830000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"0c39d.Spy.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"0c39d.Spy.exe\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; File: \"0c39d.Spy.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"0c39d.Spy.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00004792.00000000.67212.0041F000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004792.00000000.67212.0041F000.00000002.mdmp\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00004792.00000000.67212.0041F000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004792.00000000.67212.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"0c39d.Spy.exe\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00004792.00000000.67212.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"0c39d.Spy.exe\" issued a query \"SELECT * FROM Win32_DiskDrive\"\n \"0c39d.Spy.exe\" issued a query \"$objects\"\n \"0c39d.Spy.exe\" issued a query \"SELECT * FROM Win32_Process Where SessionId='1'\"\n \"0c39d.Spy.exe\" issued a query \"SELECT * FROM AntivirusProduct\"\n \"0c39d.Spy.exe\" issued a query \"SELECT * FROM AntiSpyWareProduct\"\n \"0c39d.Spy.exe\" issued a query \"SELECT * FROM FirewallProduct\"\n \"0c39d.Spy.exe\" issued a query \"SELECT * FROM Win32_Processor\"\n \"0c39d.Spy.exe\" issued a query \"SELECT * FROM Win32_VideoController\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$3b","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"0c39d.Spy.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"0c39d.Spy.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\ElevatedDiagnostics (UID: 00000000-00004792)\n \"0c39d.Spy.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\ElevatedDiagnostics\\Reports (UID: 00000000-00004792)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00004792.00000000.67212.00425000.00000004.mdmp, 00000000-00004792.00000000.67212.02372000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM\" (Source: 00000000-00004792.00000000.67212.02830000.00000004.mdmp, Indicator: \"select * from\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"0c39d.Spy.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8d55d7cad944a3f21aeb1db491f3d6de\\mscorlib.ni.dll\" at 6FA30000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"0c39d.Spy.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6D940000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"0c39d.Spy.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 772F0000\n \"0c39d.Spy.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 74520000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"0c39d.Spy.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 70F20000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"0c39d.Spy.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"0c39d.Spy.exe\" queries basic process information of the \"C:\\0c39d.Spy.exe\" (UID: 4792)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004792-00000C26-53709299\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"0c39d.Spy.exe\" called \"GetUserNameW\" (UID: 00000000-00004792)\n \"0c39d.Spy.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"0c39d.Spy.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"0c39d.Spy.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"8477788\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; Source: \"00000000-00004792.00000000.67212.00425000.00000004.mdmp, 00000000-00004792.00000000.67212.02372000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00004792.00000000.67212.00425000.00000004.mdmp, 00000000-00004792.00000000.67212.02372000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"0c39d.Spy.exe\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"0c39d.Spy.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00004792.00000000.67212.0041F000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00004792.00000000.67212.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00004792.00000000.67212.02830000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%APPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00004792-00000C28-14122408212\")\n \"%APPDATA%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00004792-00000C28-14138742680\")\n \"%LOCALAPPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00004792-00000C28-14211031818\")\n \"%LOCALAPPDATA%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00004792-00000C28-14243843500\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 0c39d.Spy.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"},{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"0c39d.Spy.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004792)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$3f","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"0c39d.Spy.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 4792)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"0c39d.Spy.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00004792)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"0c39d.Spy.exe\" issued a query \"SELECT * FROM Win32_DiskDrive\"\n \"0c39d.Spy.exe\" issued a query \"SELECT * FROM Win32_Process Where SessionId='1'\"\n \"0c39d.Spy.exe\" issued a query \"SELECT * FROM Win32_Processor\"\n \"0c39d.Spy.exe\" issued a query \"SELECT * FROM Win32_VideoController\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"tim.kosse@filezilla-project.org0\"\n Pattern match: \"sales@zzzprojects.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"0c39d.Spy.exe\" called \"OpenSCManagerW\" requesting access rights \"0X0\"","origin":"API Call","mitre_attack_id":"T1569.002","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"https://api.ip.sb/ip\" (Indicator: \"api.ip.sb\"; File: \"00000000-00004792.00000000.67212.02830000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"0c39d.Spy.exe\" trying to touch file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\AppData\\Local\\Coinomi\\Coinomi\\wallets\"\n \"0c39d.Spy.exe\" trying to touch file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\AppData\\Roaming\\Electrum\\wallets\"\n \"0c39d.Spy.exe\" trying to touch file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\AppData\\Roaming\\Ethereum\\wallets\"\n \"0c39d.Spy.exe\" trying to touch file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\AppData\\Roaming\\Exodus\\exodus.wallet\"\n \"0c39d.Spy.exe\" trying to touch file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\Documents\\Monero\\wallets\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$40","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$41","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal desktop applications information (file access)","description":"\"0c39d.Spy.exe\" trying to touch file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\AppData\\Roaming\\Discord\\Local Storage\\leveldb\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-97","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"malicious","category":"System Security","name":"Executes WMI queries in order to detect local security applications","description":"\"0c39d.Spy.exe\" issued a query \"SELECT * FROM AntivirusProduct\"\n \"0c39d.Spy.exe\" issued a query \"SELECT * FROM FirewallProduct\"","origin":"API Call","mitre_attack_id":"T1518.001","relevance":7,"id":"api-80","sources":[{"report_type":"sandbox","report_id":"654453eb5c5224de490e0ab2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$43","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00002548.00000001.66903.73CF1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"cacerts.digicert.com\"\n \"ocsp.digicert.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002548.00000001.66903.73D30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002548.00000001.66903.73CF1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"$44","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$45","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$46","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"656d9bc2c7ecf5547f0d19e7"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"Found string \"