24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 58:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T504,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Prometheus.Generic Sample 3f54db25b01a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3f54db25b01a…. Malware family: Ransom.Prometheus.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba","keywords":["Malicious","Ransom.Prometheus.Generic","malware analysis","sandbox report","threat intelligence","3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba"],"about":{"@type":"SoftwareApplication","name":"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Prometheus.Generic","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1433,Found reference to "iXaQyAes4xBhp7BqR4o" (Indicator: "Aes"; File: "3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004292-00000BC0-870591335") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "iXaQyAes4xBhp7BqR4o" (Indicator: "Aes"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "WJRC2XGxHydJMyib4A1" (Indicator: "RC2"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "lOidV2S8olBPpBcEWW8" (Indicator: "Oid"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "OOid4iyLihhixeN3xVr" (Indicator: "Oid"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp, 00000000-00001440.00000001.119165.04FD0000.00000004.mdmp, 00000000-00001440.00000001.119165.04FF0000.00000004.mdmp, 00000000-00001440.00000001.119165.05030000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp, 00000000-00001440.00000001.119165.04FD0000.00000004.mdmp, 00000000-00001440.00000001.119165.04FF0000.00000004.mdmp, 00000000-00001440.00000001.119165.05030000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp, 00000000-00001440.00000001.119165.04FD0000.00000004.mdmp, 00000000-00001440.00000001.119165.04FF0000.00000004.mdmp, 00000000-00001440.00000001.119165.05030000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00001440.00000000.118983.00AB2000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00004292.00000000.119858.03510000.00000004.mdmp, 00000000-00004292.00000000.119858.1D880000.00000004.mdmp, 00000000-00004292.00000001.119948.1D870000.00000004.mdmp, 00000000-00004292.00000001.119948.1D890000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00004292.00000000.119858.03510000.00000004.mdmp, 00000000-00004292.00000000.119858.1D880000.00000004.mdmp, 00000000-00004292.00000001.119948.1D870000.00000004.mdmp, 00000000-00004292.00000001.119948.1D890000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004292.00000000.119858.03510000.00000004.mdmp, 00000000-00004292.00000000.119858.1D880000.00000004.mdmp, 00000000-00004292.00000001.119948.1D870000.00000004.mdmp, 00000000-00004292.00000001.119948.1D890000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004292.00000000.119858.1D880000.00000004.mdmp")26:Td95,"++*+(+(* s}s} }i{(1*^ 9})(* *:(* (C*&(U *F +{+Y*+.+{(*+^+{%+{&*+++*++{'+'_d}'-++{(+Y}(,*++++++.+{+*++++,{'+({(__d}'++{(_}(*+++++2+*(7+++++b`*+(M++(M++${&+ {%-Y-+{(-c-X*++++ +++b`*+oq ++oq +b++*(+ +(+2#+*( +2$+*( +2%+*( +2&+*( +2'+*( +2(+*( +2)+*( +2*+*( +2++*( +2,+*( +2-+*( +2.+*( +2/+*( +20+*( +21+*( +22+*( +23+*( +24+*( +25+*( +26+*( +27+*( +28+*( +29+*( +088:&,!88},8{8{8{~ f+uo! o ~ tf( ( ,- s" s# ($ * 8xs8s8t8v8t8{(98{8z( 80R89&8~ Kf8898~ ^f888~ Uf( o% ~ ,f( o% ~ ;f( o% ~ f( o% 9~ f( o% ~ f( o% ~ f( o% ,~ οf( o% ~ ſf( o% ~ f( o% ~ f( o% ~ f( o% ~ f( o% ~ tf( o% (*o& +L(' o& +(' ~O (W,=(( -- o -(( -o %-**s) 888( 8o% 88( 8o% 88(Y08 + X+ +++(, +(+ ++&݁98} (8y8~8T8QJ o- XRXTXo. YT+gXJo/ ~3XR+\XT-+.~XJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ o< XJ1~? o< XJ11XT+~@ XJoA XXJXTXJXJ2~B o< XF-~C +~D oE ~F o< oG & oH &-JXTJi?* 8I8}oI 8}8|8{@ )3" /C20Z,:3%+%+ , +#+(++--,*(J +(+ +( +oK +oL +08[8\ (8X8]8^T,8-8U8VJ8U8o3 (+ .9~7 (+ %8(+ oM sN o: ~; o< (+ oO XT+]XJo8 (+ 34~P oQ _oA ~R o< ~C oE +,XXJXTXJi-2~F o< (+ oG oH 8&JXTJi?* 88oI 888888A=P02rp rp ,8 %-~S~ r p8,98~T~ 8-~W~U8rp88~Z~Y+3+4(o9~\(r&-(:,+(l+,~Q(Z*s* 8((`8FsT 8O(c8Y(f8f(i8f 8eI0S+/, f%, a+$+&~-Y+~--++*++*+++++(-++('+0|8%E+Q-B8%L+A,8%M+1%,8%H+!--*(J +(J +(J +(J +0 98:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2s - 9 +%X 2,s .* 8H8P8T8W8X8f8i8k8s0\8%K+9/-%,8%F+'0-%,͍8%I+<*(J +(J +(J +08%I8^=9%G8Q> :? 9@-\8/+-~?8)08(Xb8&-~@%X88 2+&~?8 Xb(I~@%X 2::+(~? X b(I9~@%X 2+~?Xb(I~@%X 2:A9B:3 +(~Ab(I9~B9X 2*(J 8(J 8 888(I8 8880+f8g{+8c8dX}+-+^ 3,+Uz,+V{)+R+S{* X}*Ҝ--{* _}**88 88+sV ++++0T%98 8X8 {T8XJYE"n88{: 8}*88{8TJ/*{(;J9_, 9e}JcE8+H{(A,}+1~-}"~.}#}+s!}!}*{()%}/*{(;}{()-/*{(;}X{ {{(ET{XJY}{- }*{(5*{!{(Q-*{!(O}"{!(2}#}((*9** 88888/8;8C8B()8C0| ~ +\~]8X8Y~++&+ - -++ "+oW ++++~^(u-+(-** 88(u8+4J0D 88{ 88888{T8JYE0/8, 8{ 8(%Y% /9'*{"{(G% _, /#%:X/*}#}"}*~ Y}~ Y}{1J}X{{()TXJ/*-{{(;{XJX} }:{#{(G/*~}~}{1K }X{{()TXJ%-/*{{(;{XJX}{ {{(/{Y,} <* 88(.8888888#08{(8<8{%8{&3:,o*,88{'8{$88{% X}% _{${% X}% _b`{(_b`}'{(X}({'n-_b-%,Yj_i*82868:8>8R8Q8U8Y8X08v8{~C uf8~C Df888888~-sX ~(+(+~C 3f( o[ o\ o o% ~C "f( o[ o\ o o% A( 8Z( 8_s] 8Z8Y8Xo^ 8S(+8N&~C uf( ~C f( s] o^ (+~-sX ~(+(+~C ȼf( o[ o\ o o% &*s) 8 8 v0 8p:d~_8f8k%988~C ߼f88~C ּf88~C f( ~C f( -~C f( ~C f( ~C f( T+4J ~c~a ({({(+,XRzJXTJ-i2<88( 8 8( 8%8$&XR+ ~C ߼f( ~C ּf( ~C f( ~C f( ~C f( ~C f( - ~C f( XT,+j XJXT+?XJ~O~c~e({({(W,XRAXXJXTXJ,i2XXJXTXJ: i? &XR*XF* 8(x88A4=I i 0Q ~f+++0- %,j\ j\i-+0%,+,sa +(~++ +&*+*+FF0I88~%X9&88 _-888-e~7 *8,,@_-?_b~%X-X +7_b~%XbX~%XbX-~%XX- -~k~j~h(~(( ~l~j~h( i((~,(@ &-*888888 888` 088{+8X%}+8 18z8{*8Y _8-v 8-Y0c{*/Z0L{){){*(b {*X}**{){*X}*{)%X %Y0*(K*8483878>sV 8@8@8D 8J8Q08~_88%9y88~C hf88~C {f88T+3J ~c~a ({({(+, -XRlJXTJ,i-29nH(x8]8\8f8d( 8j8i( 8o8n&XR9*XF* 8 0,v8{%8{&/8z88X880880i1sc z_,3{'%X _{(_b`}'{(X}(}$}%}&*8e8isV 8k8k8j 8j8j8k8j0P++{69+"+#{2+{5++{6+++*+ +++++(b ++s +0r-~S~m+9~C Ff+4+9-,!~S~n+/~C ]f+*+/,-*%-*(+( +(`+(+( +(`+0f+T8Y-+- -+++++ +!+"od ,)++++oe +++ -o *sf 8 8=D0c+N+RR~q~o++++&+ X+FR'(+(++(S+++&XFR+XF* 88+ ;E 0 8~C 0f888~C f88-/8~C 0f88~C 'f( ( ,'(B,(g (,(g (3,(g ~C Bf( o! o ~C f( ( -+~C Bf( o! ~C 'f( ( ,-:V~C f( o! ( (,,(g ~C f( o! o ~C f( ( -+~C f( o! ~C 'f( ( , (R,(g ~C f( o! o ~C f( ( -+~C f( o! ~C 'f( ( ,'(h ,(g (D,(g (J,(g ~C f( o! o ~C f( ( -+~C f( o! ~C 'f( ( ,(8,(g (+,(g ~C Žf( o! o ~C f( ( -+~C Žf( o! ~C 'f( ( , (>,(g ~C f( o! o ~C f( ( -+~C Žf( o! ~C 'f( ( , (<,(g ~C f( o! o ~C f( ( -+~C f( o! ~C 'f( ( ,(0,(g (J,(g *8H( 8Mo! 8Ho 8C( 8H( 8C8D( 8Io! 8D08X8Y8Z8_98Z8[(H%c8S8TbY {z}@8GEy8(HTJ9XT+SX(HTX(HTXJ9io &XJsXJ(=&XXJXJXTXJJ2+w9%J(J 9%D(J (6iYoi (:-,o r_p 8ropsj zrpsk zol * 88s$8888 8 8 8+0b 8B,~_8;8@88~C f88~C f88~C hf( ~C {f( ~C bf( ~C -f( T+4J ~c~a ({({(+,XRkJXTJi2<8583( 8988( 8>8=&XR ~C f( ~C 8f( ~C f( ~C hf( ~C f( ~C f( ~C f( XT+j XJXT+BXJ~O~c~e({({(W,,,XR8XXJXTXJi2XXJXTXJ i? &XR*XF* 8(x88A4'; 088T8{%,X.B8uX8t8u8v8w{ +vTXJXJXJXTXJY-J*(&-{ {+1 {@J* 8z8y8z88888(N80j 8J~_8F8K 88~C Ⱥf88~C ۺf88~C f( ~C f( ~C f( ~C f( -^~C f( ~C f( :V~C qf( ~C df( T+4J ~c~a ({({(+,XRJXTJi2<88( 88( 88&XR9 ~C Ⱥf( , ~C ۺf( ~C f( ~C f( ~C f( ~C f( ~C f( : ~C f( ~C qf( ~C df( ~C wf( ~C Ff( ~C 8f( ~C -f( ~C 4f( XT+g XJXT+?XJ~O~c~e({({(W,XRAXXJXTXJi2XXJXT9!XJ i?&,XR*XF* 8(x88A4Vo{@0U~ +=-~]+6+7,~+ + +-++om +-~^(u ++(u+&* 3QQ0 9&~r+B+G+H+GU-~R +>,#~r+;+@-+<,LY j/XR9/(+++(n +(]+(++(n +&:v*XF* 8uu05@888888XT+D8X88XJT8XJ18XJ8%JXTXXJXTXJi2TX TXT+uXJJJXJXJY_bXTXJ 2?XXJ _TXJ _TXXJXJXJYXJY_cXTXXJXTXJ>XJ:},X T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{,(XJ(IXJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ (o 8?8>(L89(o 8482810T :8 8 ()%?8{ 8%2 -88_88-c*8ceTX_TXJ()%2{ J c`_(;c*X{(TXJ(){ J c` A_XJ0_(;-c**X{(TXJ(){ 2_XJ0_(;c** 88888 8(;888 0H~>+5_b~>+*c_b`~>+c_b`~>+c`h*++++0s,.~s+2~C f+-+2+7~O+3~C f+*+/+4--,1sp +( +(+ ++( +(W++&*+*+hh0,_+N,Z+Y{)+U+V{*+R+SX}*+M+N{)%X+F+F{* _}* _%Y =*+++ ++++++0888{*T88{+9 p18{++#88{*8{+YX _TXT---XJYTXJ%-"1'{) XJYXJ(b XJXJ{)JY(b {+XJY}+{+/sV zXJ* 8$8#8"8'8&858=8<8@0G+%{59++{2++{5+++*+ ++++(b ++s +0888T+Q8%X88{'Ҝ88{'d}'88{(Y}(YJXT{(10-J*X{&{%YTXJ1XJ{${%(b {%X}%{%{&Y_,4{$X{%TXJX}%XJ _}'}(JX* 8888888880888{4T8JEJ-+8p8q8q}58q{5/*8h{5 X}5(;}4()}6{6/*{6X}6(;{5{6X}8{89}2}4()}7{7/*{7X}7(;9}1};}4+AX()TXJ/*(;{1~<{;XJҜ{;X};{;{72{1s }3}1};}4+<{2X{;TXJX};XJ%}:{;{83*{3(G%_,/*2}:Y}9}4X~0{9TXJ() /*XJ(; ~/{9X +'{2X{;TXJX};XJ{: %Y 0{;{83*}48n 8h8g8f8k88()8880 8~_8888~C ʻf88~C ٻf88~C f( ~C f( ~C f( T+%J(F(r ,XRJXTJi238[8Y( 8_8^( 8d8c&~C f( ~C f( ~C f( XT+o XJ -XT+B XJ~O~c~e({({(W,/,XRAXXJXTXJ, i2XXJXTXJ i? &XR:0*XF* 8,(x8,8+ D{z}ZLW@#^ҸJ2:KE1SʶUU6n0Z2zB'ۤ۩<팰$L[b[ e.]A.¶vZ5Vwj|Jqn(4x&[2ט8ۇ, 2Ⱦba!ǡʜ O'@?/5+"ЩyEhE"&u-j 8U 7LK K.,]ꝏ,#L%>ZܐCknaq)k( p@ᝥg kBsDVŮ)I{dGl؈<1k Nol7ո3U#f5r򚂢j]bl*B_I:=&Cxܙs_HC( vC_.<=ɲ1N:b0sa&luqs$TYs&0d#/ ]77Zzse4Y9~'Cs~AnfnLv)gb37D^C @tkGBSJBv4.0.30319l#-`8 #Strings!#US"#GUID"T#Blobw< %3I;t rEJ/u ;|d9 n } %/! W^E 22}\2wo} }}}S}DffRfYf}D2? W}gw8P & b vE IE kkEJ a $) /! =#C$ C% DUNUNUNU NUNU w %NU NU PX R[ S^ Ta Ud Vg Xj Zm [p ]s _v `y! f|$ h' i* k, l/ m1 o3 p5 r7 s %uw*NN Wrz~31*1*33331VVVV 3333 6633 31311114 W3333333333 "",66DDI!T T$T#T'T&T*^)^ h/r.r13579<;>2 1 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~U&}['#H# P#hP#h]#nH# # *r?8-n-2o j ` # # # # # # #`/n0# # #1nH# $ 1n$H# 2n3n+$4d57\8:; p=#@@@5$B,C#PD%4E/E#G$6S$UIDtypeIDSystem.IOLdarg_Svalue__mscorlibSubSystem.Collections.GenericMicrosoft.VisualBasicget_IsStaticReadThreadAddDynamicMethodmethodOpCodeEndInvokeBeginInvokeIEnumerableIDisposableget_HandleRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleGetModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandleget_MainWindowTitleget_Moduleget_Nameget_MachineNameConfigPluginNameget_UserNameget_ProcessNameDateTimeget_FieldTypeValueTypeOfTypeget_ReturnTypeownerTypeget_ParameterTypeWhereSystem.CoreMethodBaseCloseDisposeCreateDelegateCreateGetStringDelegateMulticastDelegateCompilerGeneratedAttributeAttributeUsageAttributeAssemblyFileVersionAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeReadByteTryGetValueSetValueBuildTagO2nbgConfigSystem.ThreadingEncodingFromBase64StringDownloadStringToStringGetStringMathPathget_LengthiAsyncCallbackcallbackTransformFinalBlockCallTailcallkernel32.dllshlwapi.dllGetManifestResourceStreamMemoryStreamget_ItemSystemSymmetricAlgorithmICryptoTransformEnumget_MetadataTokenMinPluginget_TerminalServerSessionSystemInformationSystem.ReflectionManagementObjectCollectionArgumentOutOfRangeExceptionInvalidOperationExceptionFormatExceptionInternFieldInfoMethodInfoMemberInfoParameterInfoComputerInfoSleepSystem.LinqCharAesCryptoServiceProviderManagementObjectSearcherEnterToLowerGetEnumeratorGetILGenerator.ctor.cctorMonitorCreateDecryptorCreateEncryptorIntPtrdummy_ptrSystem.DiagnosticsGetFieldsGetMethodsMicrosoft.VisualBasic.DevicesSystem.Runtime.CompilerServicesOpCodesGetModulesGetProcessesCreateMemberRefsDelegatesBindingFlagsStringsget_TicksSystem.Windows.FormsContainsSystem.Collectionsget_CharsRuntimeHelpersGetParametersGetCurrentProcessAttributeTargetsManagementBaseObjectManagementObjectobjectGetSystem.NetRetSystem.Reflection.EmitOnInitExitFirstOrDefaultIAsyncResultresultWebClientSystem.ManagementEnvironmentget_CurrentCheckRemoteDebuggerPresentThreadStartConvertCallvirtMoveNextSystem.Textget_NowInitializeArraySystem.Security.CryptographyGetExecutingAssemblydummyCopyget_TotalPhysicalMemoryop_EqualityEmptyMemberRefsProxy{c6cf4687-62c8-4193-867c-25ba4a74a2c9}{11710c1e-2f1e-4e7f-b6bd-fb70c101177c}{9d03f632-95a4-4c86-bf28-c41d3419552e}~01461M{9d03f632-95a4-4c86-bf28-c41d3419552e}versionaSelected compression algorithm is not supported.Unknown Header,P͔HC94Vz\V4 ?_ :%m%! = A I Q I Y a a a aaa a ) aa q ! ! %!%)a ei e8%LX\d` \TXm\\ X`dXX q %X TX`\X`Xl \ XdX|x = A I Q I Y TWrapNonExceptionThrowslD@ mmm"aaAm!!IIIII IIIq lLqYYIII| _CorDllMainmscoree.dll% @0HX4VS_VERSION_INFO?,StringFileInfo000004B0$FileVersion$InternalName(LegalCopyright ,OriginalFilename(ProductVersion,Assembly VersionDVarFileInfo$Translation0", Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PELbb" Fe @ @PeKt H.textE F `.rsrctH@@.relocL@BeH\f,c|w{ko0g+׫vʂ}YGԢr&6?4q1#'u nZR;ֳ)/S [j˾9JLXCM3EPfHa5WiَU(ߌ BhA-TR j068@|9/4CDT{2#=LBN.f($v[Im%rdhԤ\]elpHP^FWث XE,?k:AOgst"57unGq)ŉobV>Ky xZݨ31Y'_`QJ -zɜ;M*++*+(+( s}s}}i{([*^ Z}( *:( (*&( *2V+*(+2W+*(+2X+*(+2Y+*(+2Z+*(+2[+*(+2\+*(+2]+*(+2^+*(+2_+*(+2`+*(+2a+*(+2b+*(+2c+*(+2d+*(+2e+*(+2f+*(+2g+*(+2h+*(+2i+*(+2j+*(+2k+*(+2l+*(+2m+*(+2n+*(+2o+*(+2p+*(+2q+*(+2r+*(+2s+*(+2t+*(+2u+*(+2v+*(+2w+*(+2x+*(+2y+*(+2z+*(+2{+*(+2|+*(+2}+*(+2~+*(+2+*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+0M83~ 8/~8/~ :.&828788~ f8/84t,%;of T+6J( o ~ (Vo & ( JXTJi2~~%-&~s %o &~(+(+~ LXRLX( ~ ~ f(~ f(( o ~ ~ f(~o .o LXF,( ~o >~ տf(o T9 ~ f(o TXX(~ f(o TXX(~ LXRLX( ~ ~ f(XJXJX.o ~ ~ f(XJXJX.o LXF,( ~ f(o T,;~ yf(( ~ Tf((+( o (~ Of(o T9X~ f(o T~ bf(o TXX(~ f(o T~ bf(o TX X(~ LXRLX( ~ ~ Af(XJXJX.o ~ ~ ,f(XJ XJX.o LXF,( ~ f(o T,;~ f(( ~ μf((+( o (~ f(o T9X~ f(o T~ bf(o T$X(X (~ f(o T~ bf(o T,X0X (~ LXRLX( ~ ~ f($XJ,XJX.o ~ ~ ˼f((XJ0XJX.o LXF,( ~ f(o T,;~ f(( ~ μf( (+( o (~ yf(o T9~ f(o T~ bf(o T4X8X(~ LXRLX( ~ ~ tf(4XJ.o ~ ~ f(8XJ.o LXF,( ~ f(o T,4~ Zf(( ~ μf(( o (~ ]f(o T9X~ f(o T~ bf(o T,:,)P{o P~ Tf(o 8~ ӽf(( -~ f(+~ f(%%%~ f(%%~ f(%(%~ f(( ( ~ Tf({( o (JXTJ{o XT&(Y 9_& ( ( :or -9o 888&*838485s 80(86 85Ados&-08T8T88Q~ f88~~%-&~!s %8;8@8Ao ->o 8( s, ( , (-s } (S(~ ؽf( ((W ( (k&sM} { ~ f( (&{ (as }!-s ( &{o %->,)P{o P~ Tf(o 8~ ӽf(( -~ f(+~ f(%%%~ f(%%~ f(%(%~ f(( ( ~ Tf({( o (JXTJ{o XT&(Y & ( ( :-or o 888&*8T8U8Vs 8Q(8W 8VAdxZfs-z08888}#8T8T88Q~ |f8~~%-&~"s %o o -$o 8( s0}(( , (-s }%(S(~ ؽf( ((W ( (k}$,2sM}&{& ~ of( (&{&(as }'1s ( &{%o >,P{%o 8~ ӽf(( -~ f(+~ f( % %%~ f(%%~ f(%(%~ f(( ( ~ μf({%( o (JXTJ{%o XT&(Y & ( ( :or &*s/8] 8\8[8Z8^8_8_s 8Z(8`Adcfr BX0s8+808182}*8.T8-T8,8.Q~ |f8(~~%-&~#s %o ,o -ݳo 8}( s4}-( -Ws }+(S~ ~ ~ ~ %(V ( ~ f((R ~ ؽf(( ( (W ( -F%(V ( ~ f((R ~ ؽf(( ( (W ( &( ~ Uf((Q ( ,t%(V ( ~ f((R ~ ؽf(( ( ~ Uf(( ( ~ Uf((Q ( ( ~ hf((Q ( ,t%(V ( ~ f((R ~ ؽf(( ( ~ hf(( ( ~ hf((Q ( ( ~ ;f((Q ( ,v%(V ( ~ f((R ~ ؽf(( ( ~ ;f(( ( ~ ;f((Q ( +( ~ Jf((Q ( ,t%(V ( ~ f((R ~ ؽf(( ( ~ Jf(( ( ~ Jf((Q ( ~ ( +M ~ =f((Q ( ,#~ f((Q ( ,+X i2( , ( (+({9R ( (i,&~ of(o t%(+&s },5s (+&({+o >,P{+o 8~ ӽf(( -~ f(+~ f(%%%~ f(%%~ f(%(%~ f(( ( ~ μf({+( o (JXTJ{+o XT&%(V ( ~ f((R ~ ؽf(( ( (W ( & ( :}( ,:nor &*s38 888888s 8(8AdjB,0,8888}/8T8T88Q~ f8~~%-&~$s %o o -o 8( s8}3( , (-ݿs }0(S(~ ؽf( ((W ( (k&sM}1{1 ~ f( (&{1(as }29s ( &{0o >,P{0o 8~ ӽf(( -~ f(+~ f( % %%~ f(%%~ f(%(%~ f(( ( ~ μf({0( o (JXTJ{0o XT&(Y & ( ( :or &*s78f 8e8d8c8g8h8hs 8c(8iAd``lEO0,8888}58T8T88Q~ f8~~%-&~%s %o o -o 8( s<}9( , (-ݿs }6(S(~ ؽf( ((W ( (k&sM}7{7 ~ f( (&{7(as }8=s ( &{6o >,P{6o 8~ ӽf(( -~ f(+~ f( % %%~ f(%%~ f(%(%~ f(( ( ~ μf({6( o (JXTJ{6o XT&(Y & ( ( :or &*s;8f 8e8d8c8g8h8hs 8c(8iAd``lEO08888};8T8T88Q~ Ժf8~~%-&~&s %o o -$o 8( s@}@( , (-s }=(S(~ ؽf( ((W ( (k}<,2sM}>{> ~ Ϻf( (&{>(as }?As ( &{=o >,P{=o 8~ ӽf(( -~ f(+~ f( % %%~ f(%%~ f(%(%~ f(( ( ~ μf({=( o (JXTJ{=o XT&(Y & ( ( :or &*s?8] 8\8[8Z8^8_8_s 8Z(8`Adcfr BX0 ,8888}B8T8T88Q~ ޺f8~~%-&~'s %o o -o 8( sD}F( , (-ݿs }C(S(~ ؽf( ((W ( (k&sM}D{D ~ f( (&{D(as }EEs ( &{Co >,P{Co 8~ ӽf(( -~ f(+~ f( % %%~ f(%%~ f(%(%~ f(( ( ~ μf({C( o (JXTJ{Co XT&(Y & ( ( :or &*sC8f 8e8d8c8g8h8hs 8c(8iAd``lEO0 ,8888}H8T8T88Q~ ޺f8~~%-&~(s %o o -o 8( sH}L( , (-ݿs }I(S(~ ؽf( ((W ( (k&sM}J{J ~ Ⱥf( (&{J(as }KIs ( &{Io >,P{Io 8~ ӽf(( -~ f(+~ f( % %%~ f(%%~ f(%(%~ f(( ( ~ μf({I( o (JXTJ{Io XT&(Y & ( ( :or &*sG8f 8e8d8c8g8h8hs 8c(8iAd``lEO0U +++0+5 -+2 -+/~ -*(% +(+s +s +s +0m~~+1+2~ f+-+2,~~+++,~ f+'+,**+(+(+(++(+(+(+0m~~+1+2~ f+-+2-~~+++,~ }f+'+,**+(+(+(++(+(+(+0m~~+1+2~ [f+-+2-~~+++,~ nf+'+,**+(+(+(++(+(+(+0m~~+1+2~ [f+-+2-~~+++,~ f+'+,**+(+(+(++(+(+(+0m~~+1+2~ f+-+2,~~+++,~ f+'+,**+(+(+(++(+(+(+0~ 88{8~ f888~88/ݖ,~~+,(v3{,{( +( (+&~(,>~{~ f((~ f((-~ f(+~ ˻f(~{~ »f((~ f((-~ f(+~ ˻f( {~ ջf(({~ f(({~ f(({~ f(({ ,~ ({~ %%~ f(%%~ f(%%~ f(% %~ f(%% ~ f(% %~ f(%(o ,~(? 8d8c8g(8l(8g8f8j(8e&*ALJB08>{ 8:~" f81868;,~8485,G~8.{ 8*~" f((~" f((-~" f(+~" ϻf(~{ ~" jf((~" f((-~" f(+~" ϻf({ ~" }f(( { ~" f(({ ~" tf(({ ~" f(({!~({~ % %~" f(%%~" f(%%~" f(%%~" f(%% ~" f(% %~" f(%(o ,~(E88(8(8 88(888&*A4u00 ~ 8g8h{&8d~) Rf8[8`8e~~+*+/+0v3{$ {$( +( (++(+&{&~) ]f(({&~) f(( 9F{({#,~(- ~ (,ݺ{'~({%~%~) f(%%~) f(% %~) !f(%(o ,~(/ 888(8(88&*AL2Gym^0 :~8t%~. f888 %~. f8888"~. ϸf8o ((_(_ {-{*,"~ (-~(,,{,~({+~%~. f(%%~. f(%%~. &f(% (o ,~(U8(8o 8o 8(8o 8o 88(8&*A4m02,(8{18~4 Ļf88898{18~4 f88{3{/- ,"~(,- ~(,ݪ{2%- ~({0~~4 f(~4 Ӹf((o ,~(I88(8#(8 88"8&(8+(8&&*A4D..02,(8{78~: ̸f88898{78~: f88{9{5- ,"~(,- ~(,ݪ{8%- ~({6~~: ¸f(~: ٸf((o ,~(I88(8#(8 88"8&(8+(8&&*A4D..0~ 8W8X{>8T~A f8K8P8U~+5+61'~~+.(v3{<( +( +(+(+& :~ {>~A f(( ~ (10-~~( (v3{< (,+ (& ~ {>~A f((~(%-1-~~((v3{<(+ (&~ {>~A f((~(10~~((-v3{<(+ (&~ {>~A Ff(( ~ (,10~~( (v%,3{< (+ (,& {@{;,;~(-)~(-~(-~(,{? ~ ({=~ %~A ɸf(%%~A Qf(%%~A @f(%%~A f(%%~A f(% (o ,~ (/ 888(8(88&*A2MGJfJPVN08{D8~G f888-C8{D8~G f88{F{B,~(,ݭ{E%- ~({C~~G f(~G f((o , ,~(I8-81(86(81 808286(8;(86&*A4zD08{J8~M !f888-C8{J8~M f88{L{H,~(,ݭ{K%- ~({I~~M f(~M f((o , ,~(I8-81(86(81 808286(8;(86&*A4zD0y-K+K+L+T+X{N+W+Z~+++{Oo +(++,~(,(+(V8 8888&*'(B 8?8>(Z89(B 8482810:9`&~8[~8R8W9t~8R8S0~ *~8J8K8PT8~J(;\@JX~(YTXJ24~~~d f(XJ(;(A&JXT8~JX(;u3\:JX~(Y/CXT~~ JX(D X(G,~XK(A&JXT+~~J(;(A&JXTJ~(Y?~(*~(J,~~(M(P*~~!(5(8,*:~ ~(M(S&!*~~d f((,*~(J,R9~(;"3~ ~(Y(D~(V &. ~(J9~(Y~(;[3"9~~(Y(;].*(j~%o (\XT+0~'XJo (dXJ(_XXJXTXJo 2~_o *~(J9~~(Y~ (5(89~)(b~(;[3~~(Y(;].*:g(j~-~+%~.(5(e%o .(ht# XT+,~/ XJo (d(k&XXJXTXJo 2~_o *~(J9~~(Y~(5(89`~)(b% ~ ~(5(8,*~(;{3~~(Y(;}.*(j9Lo ],*~-~+%~.(5(e%o [.(ht$ XT+}~XJo (1X~ XJo ~XJo (Y(DXJXo (d~1 (nXXJXTXJo ?r *~~(5(8,(*~(;{3099C~~(Y(;}3(f** * 88(58(888(88(8s 8p 0%,r+tZ8n-- 8iT+P-Z+_+`X~4+Zi+YJY+VT~5+UJXJ(t({soJXTJi2* 888++++(q++0~68N8O8T8U8V8[8\8]],8^*~ao -~8T(z(+~ao ~bo -~:T(}( + ~b o 8~o (>~ o ~o (Y(DXo o ,"~3~ (Y(d(n+- o ,!~<~"(Y(d(Xo ?E*8(w8 88(j888o 880E 88T+<8{% 8J%88X%8-88JYTJ/Z{r{o&{t,~5~qY(t+XYT+/% XJ% XJaҜXJXXJXXJYTXJ/{~(-{s{~o%{jX}* 8888 888880!Q88PX8{R~>~=888R8PXG;8PXG @S8iX(jYU(XT{U,((X{UiT|U{UiLiXX( ++LjX}U:XjU8*XiXXLiZX(Udj.XXLXU,XXLi(uTXLi,XJ(&0XXL,XJjXLYXjXi(uTXL,XJjXLYXjXi0XJ(&XXL0XJjXLYjXXU4XXLi(uT8X4XJT XXLi4XJ(Ub~=P{Qj. {Qj@{Qj3S{U(XJXLiX~~? ({RXL XLXXii(}W8{Qj3K{U(XJXLiX~~({RXL XLXXii(}W+S{Qj3I{U(XJXLiX~~({RXL XLXXii(}W{U(XJXLiXXL XLXXXXii(}X{Qj3_{U(XJXLiX~~? ({RXL XLXXXXXii(}Y8{Qj3W{U(XJXLiX~~({RXL XLXXXXXii(}Y+_{Qj3U{U(XJXLiX~~({RXL XLXXXXXii(}YXXLjXUXLLC8DXiX(jYmTHXT+jLXiXHXJZX(mTdj3LXK(jY{SZ(h+ LXKnXi(jY{SZ(hHXHXJXTHXJDXK1iX(jY{SZ(h;8^8`8n(8i(8d8e8n8x&* 8A 0l"8~_808+ ~_88888!8"3*T~`o XT8XJo( :5".<,.H:.C+b-]5[.].+N{.}. +BJXT+:JYT+2XXJ(T+6J-~`o o ~`o +~`XJo( o* &XXJXTXJo Y?M~`o o * 8o 8s 8o 888o 88o 80p#9`&%~d f8%~d f8%~d f8%~d f88%~d of8%~d ~f88 T+t JXT+TXJ( ~d /f(( ( ,( (+~&XXJXTXJi2JXTJ --i?|K(8(8(8(88(8#(8+8+&** 8A4>Wb0V$+9+:+:+;+<+=X%b`+5+6+7X%b` -X%b` *++ ++++ +++0 %Y88I{R~>~=8;8;8@ @j8= X~C~A81~B~@8(8)s (((s ~ ((T$XT{V,*$X{ViT|V{Vi XKXX(++ XKX}V(XT8iX(XKZX(Udj.LXU,XLi(uTLi,XJ(&0XL,XJjLYXjXi(uTL,XJjLYXjXi0XJ(&XL0XJjLYjXXU4XXLi(uT8X4XJTXXLi4XJ(UXXL4XJjYjXU~=HXJ{\j_j:O{Qj3h{V$XJ(XKX{ZHXJ~~? ({RXLXLXDXJjXiHXJ{[i(8{Qj3c{V$XJ(XKX{ZHXJ~~({RXLXLXDXJjXiHXJ{[i(8){Qj@{V$XJ(XKX{ZHXJ~~({RXLXLXDXJjXiHXJ{[i(8{V$XJ(XKX{ZHXJ~~? ({RXLXLXDXJjXiHXJ{[i(+T{V$XJ(XKX{ZHXJ~DXLXLXDXJjXiHXJ{[i((DXDXJHXJ{[iXTHXHXJXTHXJiY>(X(XKXT(XK XKCF8{R~>~=((@LXjXi(jYmTPXT+GTXiXPXKZX(mTTXKnXi(jY{SZ(n&PXPXKXTPXKLXK6jXi(jY{SZ(n&XXRE88(8(8888s 8&XXRXXF* 8aA 0f&+T8Y-+- -+++++ +!+"o ,)++++o +++ -or *s 8 8=D0+s8t{z8p}~8p8q{{+p}+s}+qj}+k{| ~E{|{|i(,}}{ro*88(]888(]88++0T:8 8 (|%?8{8%2 -88_88-c*8ceTX_TXJ(|%2{J c`_(mc*X{TXJ(|{J c`,A_XJ0_(m-c**X{TXJ(|{2_XJ0_(mc** 88888 8(m888 0:&88{Ri18T8{8X8T+^-L8XJ8{RiY18~XT݇,{RXJ _ ., XXJT,\XXJXTXJX1XT:98]8\8d8j8k8p8r8|&,TJ*XJ* 8 0|'8,%{j8&8%a}j%{k88a}k%{l88a}l%{m88 a}m8g~e{j _~e{kd _ba~e{ld _ba~e{md _ba(( aTX~e{k _~e{ld _ba~e{md _ba~e{jd _ba(( aTX~e{l _~e{md _ba~e{jd _ba~e{kd _ba(( aT~e{m _~e{jd _ba~e{kd _ba~e{ld _ba(%X( a~eK _~eXKd _ba~eXKd _ba~ed _ba(( a}j~eXK _~eXKd _ba~ed _ba~eKd _ba(( a}k~eXK _~ed _ba~eKd _ba~eXKd _ba(( a}l~e _~eKd _ba~eXKd _ba~eXKd _ba(%X( a}m{hY?~e{j _~e{kd _ba~e{ld _ba~e{md _ba(( aTX~e{k _~e{ld _ba~e{md _ba~e{jd _ba(( aTX~e{l _~e{md _ba~e{jd _ba~e{kd _ba(( aT~e{m _~e{jd _ba~e{kd _ba~e{ld _ba(%X( a~eK _~eXKd _ba~eXKd _ba~ed _ba( a}j~eXK _~eXKd _ba~ed _ba~eKd _ba( a}k~eXK _~ed _ba~eKd _ba~eXKd _ba( a}l~e _~eKd _ba~eXKd _ba~eXKd _ba( a}m* 88( 88( 88( 88( 80U(~+=-~+6+7,~+ + +-++o +-~( ++(+&* 3QQ0e)~F8~d gf888~F8~d f888~H~~d If8(p~~d \f((p ~~d 'f((p~(5(t~H~(5(t~H~(5(tW8(8(8(w88(8(8(w8(8&*A^^08{8<8{8{3:,o*,88{8{88{ X} _{{ X} _b`{_b`}{X}{n-_b-%,Yj_i*82868:8>8R8Q8U8Y8X0,_+N,Z+Y{+U+V{+R+SX}+M+N{%X+F+F{ _}, _%Y,=*+++ ++++++0T*%98 8X8 {T8XJYE"n88{:,8}*88{8TJ/*{(mJ9_, 9e}JcE8+H{(c,}+1~}~}}+s}}*{(|%}/*{(m}{(|-/*{(m}X{{{(bT{XJY}{- }*{(*{{(-*{(U}{(}}(`*9** 88888/8;8C8B(|8C0 +9&%~? 8%~888T+88J8-*%8XT+F XJ~~(~I~(((,(&XXJXTXJ i2JXTJi?w** 89(8F(8I8I8H8K8J8K 8Wp10Z+9i+8Y,Z+0~5+,+,+,+-~5+-+.XiYY(t*++ ++++(t+++0|,~+\~8X8Y~++&+,-,-++,"+o ++++~(-+(Y** 88(8+4J0\~e+I _~e+=d _b`~e+,d _b`~e+d _b`*++++0+}8~T8}{%,U.?8rX8q8r8s{+r+vTXJXJXJXTXJY-J*(~-{{1 {@J* 8}8|8}88888(R80-888{T8JEJ-+8p8q8q}8q{/*8h{ X}(m}(|}{/*{X}(m{{X}{Z}}(|}{/*{X}(mZ}}}+AX(|TXJ/*(m{~{XJҜ{X}{{2{s}}}}+<{X{TXJX}XJ%}{{3*{(t%_,/*2}Y}}X~{TXJ(| /*XJ(m ~{X +'{X{TXJX}XJ{ %Y 0{{3*}8n 8h8g8f8k88(|8880G.+,+%%+%+&+&+'a+%%, Y+!+"-/--* ++++++ ++0/88T8X8{TiYT8XT+Z~K~~8}{T8yXJ8v8{~~(((-XJT+XXJXTXJXJ1J3+ J(W=8^8_8`8i8}8(8(8{&* 8 0?~~`~8888&8X88~888\3C,~~`~(;(A&~~`~X(;(A&X +J~(;"3~~`~(;(A&*~~`~(;(A&X ~(?F~(Y*88(;8(A88 888(;8 08+]+^`,+\jU+I+XXjU+TXT+)+NX+MXLb+I{RXJXn`UXXJXTXJY1XLU%88++++++&jUL* 8s }0b+A+B+CiT+AJ+Ai.*+XJe}X T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{(XJ(XJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ +<-+9+:a-+7+8a% (za,(za*++(+ +++++(z+0 4,+w8x8}%-S8z,+O-L~8n~~d f+c~Z~^~~d f+O+T+Y(;(A&X,2~(*8s 8~ 8}88(+(+(+(+0'8D%{j8>8?{h8:a}j%{k8283{h8.a}k%{l8&8'{h( a}l%{m{h( a}m{hY8g~f{j _~f{md _ba~f{ld _ba~f{kd _ba(\( aTX~f{k _~f{jd _ba~f{md _ba~f{ld _ba(\( aTX~f{l _~f{kd _ba~f{jd _ba~f{md _ba(\( aT~f{m _~f{ld _ba~f{kd _ba~f{jd _ba(\%Y( a~fK _~fd _ba~fXKd _ba~fXKd _ba(\( a}j~fXK _~fKd _ba~fd _ba~fXKd _ba(\( a}k~fXK _~fXKd _ba~fKd _ba~fd _ba(\( a}l~f _~fXKd _ba~fXKd _ba~fKd _ba(\%Y( a}m=~f{j _~f{md _ba~f{ld _ba~f{kd _ba(\( aTX~f{k _~f{jd _ba~f{md _ba~f{ld _ba(\( aTX~f{l _~f{kd _ba~f{jd _ba~f{md _ba(\( aT~f{m _~f{ld _ba~f{kd _ba~f{jd _ba(\( a~fK _~fd _ba~fXKd _ba~fXKd _ba( a}j~fXK _~fKd _ba~fd _ba~fXKd _ba( a}k~fXK _~fXKd _ba~fKd _ba~fd _ba( a}l~f _~fXKd _ba~fXKd _ba~fKd _ba( a}m* 888( 888( 8880;5 888i[T8J.'8J.8J.~d f88z8JX}h{hX:s XTXT+0XJcXJ_XJ(l( XXJXTXXJXTXJi2X{hXbTXJT8XXJYcXJY_( TXJJ]-*XXK(z(~gXJJ[YaT+ J1XJJ]3XXK(TXJcXJ_XJJYcXJJY_( XKa( XXJXTXJXJ?@-lXT+WXT+2XJXJXJXJ( (\( XXJXTXJ%,%92XXJXTXJ{h2* 8888 88(8s 880+688T8XT+T~[~8{U8XJ{W8~888-XJT+XXJXTXJ{Ui1J3XR8J~a~_{UJ{Y~]{UJ{Y~d f((X(,%,(XT89XJ~cXJ,(X~ XJ (>TXJ1XJ~ XJXJ(D~]XJ~d f((,"|TXJX( +{TXJXJXXJXTXJiY>GX{UJ{XjY{SZ(nRE8/808?8C(8K8O(8J(8F&XRXF* 8A 0y7~K~~+(~+(+)++~d ϴf+&++ %-+*3 (++(+(+(+(+ +&%,*+ --,*+bb0~S~S+W~d ڴf+N~Q+N+S~d f+N~S~~P+D+I~d /f+D~d f+?((*+(+(+(+(+(+(+(+(+0[*-,&+4+4+5T+4X+3+4T+3+4+5XKdK`X%3*XKbT+ +++++++++0b$+E+Fb+C+D,-2+?+@X%b,-`+1+2+3X%b-` X%` *++ ++++ +++0Y8+.+/+/+/,+0+0+0+4+4((* +++(+++(+++0988{8X%}8 18z8{8Y _8-v 8-Y0c{/Z0L{{{(C {X}*{{X}{%X %Y0*(}*8483878>s 8@8@8D 8J8Q0:88XZ88X88YT8XR8XJ8XJ `, jU8EXJ3"{R_Ҝ~d(U8XJ 3XRXTXTXTXF,{RYYXTXYT8XJY2lXJ{RXJXJY_c XJ_c_{RXJYXJ_b`ҜXXJXTXXJXTXXJYT+5XF-.XJ{RXJXJY_c XJ_c_ҜXXJXTXJ<>~d(U78d8m8l8m8l8m8q8v&jUL* 8%A 0o-H+G+H+I+J}j,%-"+D+E+FX+E}k-+BX(l}l-X(l}m*+++(l++++(l++0L;+0-+%%+&+'+'+(aҜ+%Y+$,+"%-%-/-* ++++++ ++08-+++,&+Y,,++--* ++(X++ ++0+f8g{8c8dX}-+^ 3,+Uz,+V{+R+S{ X}Ҝ--{ _}*88 88+s ++++0<%,'+^8_8_8_8_~ +]+`-~++--~ o +(+,~(- 8888888&*-+X0+Ou--&~F~o f+:~~$+5+6+;+@+Ez+I+Jt-(q(}i}n*+(++(Y+(+(+s +++0,!8{i-~o f88z8X8i1~o ef88z8X8i1~o Df(sz{n,({i(v(+({i((*8K(8Ws 8R8R8T(8]s8X8W8Y0~'+T+Y- %,Z%Ћ+He Z%Ќ+8f-%,%,Z%Ѝ+"g*(% +(+(i +(i +(i +0=8Q8R{p8E{p88{p8*{p8{p888T+6~{pJJX( t(X{pJJcTJ9/~{p( t(X{pXT+F~{pXJXJX( t (X:_{pXJ XXJcTXJ%9/XT+wXT+W~{pXJ( t{pXJ({pXJXJXXXJXTXJXJ2XXJXJXTXJ?~X% 3*>c{p{pXT+F~{pYXJ( t({pXJXXJcTXJ08 8888888(880)>8888{p88X88_8% 8a% a% a% a{pXX _c% a% a% a% aY8=8<8A8M8M(8Ys8T8T0A8 + X+ +++( +(% ++&݁98} (8y8~8T8QJ o XRXTXo YT+gXJo( ~3XR+\XT-+.~XJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ S9-oB(g?Wl5N~K`p5Z -y?j\{XEPoN4= 0yBʶ\ {5Viu.#]"Vz)EU ]-TL /X2s+ T Lk)z5|j F\n5g4xK5Me-u%2`vv3Euh<+LyϛHXz>ڍZO*¢X-2@#μPkƢFм"ʍǣʗa.]%ȯ 3vb\NMSVwPs" ec,}bv4R0<҂ݦX_PWӰ&hh ND`c89%o4Z4[ob:TMUavmb~أ[k"$4LD4!rO-iy nIGmǖ]ق鱦9 Xѫǹg@DMB=%¬pE8N n iŠܚR`&Fy-;:hU1nUCbtBSJBv4.0.30319l@#-A8#StringsPS#US0O aO C O o O 0: O O b O nO jO 4 O O a O q fO 9SkO O sO O O "O 6 O O O u k t s [ * ~ ' EO S O O vO $%" O ' FO O O OPO O jO O V pO zO :O 5O Z ;O . !) #/$0*3+4/7085;6<;?<@BCCDHGIHNKPM WN ZN [N]N_PcR dRdReeepppq B~@ ! $ ' * - 0 3 6 9 < ? B E H K N Q T W %Z &] (` *c ,f .i 0l 4o 5r 6u 7x 9{ ;~ = > ? @ B C$ D( E, F0 H3 I J L M N O P R T" U% V) W- X1 Y4 [7 \: ^= `@ bC dF eI fL gO hR iU jX l\ n_ oc qRi s++x|06,,#####(---304?CR3v 333+!3##++,!!!!+#3#+ #0 5 : ? C 3_ 1133d 331++Vl Vl Vl Vl 3 3 3 3 +++++ +++++ 6 6 3 3 ++++++ +3 1 31 11 13 3 3 3 3 3 3 3 3 3 # 0 0 > > C C M W e s s --$-#-(-'- -+-0-/-38EEQQ]]llxx"%)(-,1047:=@CFI)L3O@R@UEXS\d[d_oc{gkosxw| ) 5 C N \ a l l y y !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+ -./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~% % .3> E> OZk%0%39(= p@ CJM@Q!T&W+% 0,[$ 0%$ 0% 0%0[0%0\0 &0\0C&0]0]0y&0% 0]0&$ 0% 04a0&$ 0% 0% 0d0&$ 0% 0% 0e0&$ 0% 0% 0g0'$ 0% 0% 08i0,'$ 0% 0% 0j0E'$ 0% 0% 0n0^'$ 0% 0% 0Tp0w'$ 0% 0q0Tr 0% 0'$ 0ra0sh0t{0v0,z0{08|0|0}0}0'0`0D0'0'0000'00(0 000T00D(0080!0]((0L00 70 B0(H0P0(X0`]0g0Ԥn0 |0(0\0(0ܬ0l0|00)0h00000ĵ00()0T)000 0T22`)2x)2x2Լ2U2#2.2h32D22)282xB2`G22|2DR2`2$p2)2x222$!2)w222#*22 222/*2822;*$ 2222 2% 22T*2$2X* 20$ 222% 22`2Z* 2o* 2 222D 2d 2y*$ 2* 2* 2* 2*& 2*& 2* 2$+$ 2% 2=+ 2E+ 2N+ 2V+ 2N+ 2V+ 2% 2tA2$ 3EG 3 46M 7X :_+ ;_+ ;_+ ;_+ ;_+ ;_+ ;g+;$ ;;_+ ;_+ ;w+ ;x$ ;% ;+ ;$ ;+ ;% ;$ ;l$ ;+ ; ; ;F;+$ ; ;F ;+$ ; ;F ;+$ ; ;F ; $ ; ;F; $ ; ;F ; $ ; ;F ;+ $ ; ;F ;8 $ ; ;F ;E $ ; ;F;R $ ; ;F ;_ $ ; ;F( ;l,$ ; ;F5 ;y,$ ; ;F;,$ ; ;FH ;,$ ; ;FR ;,$ ; ;F\ ;,$ ; ;Fj ;,$ ; ;Fx ;,$ ; ;F ;,$ ; ;F ;,$ ; ;F ;,$ ; ;F ;,$ ; ;F ;-$ ; ;F ;-$ ; ;F ;"-$ ; ;F ;/-$ ; ;F ;<-$ ; ;F ;I-$ ; ;F ;V-$ ; ;F;c-$ ; ;F;p-$ ; ;F%;}-$ ; ;F2;-$ ; ;F=;-$ ; ;FJ;-$ ; ;FV;-$ ; ;Fb;-$ ; ;Fq;-$ ; ;F};-$ ; ;F;-$ ; ;F;-$ ; ;F;-$ ; ;F;.$ ; ;F;.$ ; ;F;/.$ ; ;F;?.$ ; ;F;O.$ ; ;F;_.$ ; ;F;o.$ ; ;F;.$ ; ;F;.$ ; ;F";.$ ; ;F.;.$ ; ;F8;.$ ; ;FY;.$ ; ;FJ;.$ ; ;FX;.$ ; ;Fi;.$ ; ;Ft;/$ ; ;F;/$ ; ;F;//$ ; ;F;?/$ ; ;F;O/$ ; ;F;_/$ ; ;F;o/$ ; ;F;/$ ; ;F;/$ ; ;F;/$ ; ;F;/$ ; ;F;/$ ; ;F;/$ ; ;F;/$ ; ;F ;/$ ; ;F ;/$ ; ;F" ;0$ ; ;F. ;0$ ; ;F: ;/0$ ; ;FH ;?0$ ; ;FS ;O0$ ; ;F7;_0$ ; ;Ff ;o0$ ; ;Fq ;0$ ; ;F~ ;0$ ; ;F ;0$ ; ;F ;0$ ; ;F;0$ ;o Bh B'*,-.4w t h 7 i q7 @ & [3 @ $q)q 0q08=iSBJ H-NqYq YqyYqMY]mc -l10yqqy_ qq+ =!F y) 1+q qhh = "q h7 e"II+7f UIDtypeIDSystem.IOxu6ViFRTIyXrul1sGxPdZ8UeZ4MmsbirPluginSdL7JbvqciGCtDWrOnStealer_RSWQXzRSCMprHSNQLdarg_Sxu6ViFRTIyXrul1sGxPdZ8UeZ4MmsbirPluginSdL7JbvqciGCtDWrOnStealerWorkResultxu6ViFRTIyXrul1sGxPdZ8UeZ4MmsbirPluginSdL7JbvqciGCtDWr_FyCWbztSzH2Z0P7Tvalue__vHxOzL9DJL06VAbaProtectedDatamscorlibSubSystem.Collections.Genericget_IsStaticReadThready9U9ew29JJrCZ7bdAddIsDefinedTrimEndAppendDynamicMethodmethodReplaceIsNullOrWhiteSpaceIsWhiteSpaceCreateInstanceOpCodeget_Unicodeget_BigEndianUnicodeAddRangeEndInvokeBeginInvokeGetEnvironmentVariableEnumerableIDisposableDoubleRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandleFileget_Moduleget_NameGetFileNameget_UserNameGetDirectoryNameOneCombineXpICM9ULUEcg6pW4jgpRd7nO23eMzWSe_OnInitDoneCloneDataProtectionScopeget_IsGenericTypeget_FieldTypeChangeTypeValueTypeget_ReturnTypeownerTypeget_ParameterTypeGetTypeGetElementTypeget_PropertyTypeCompareSystem.Coreget_InvariantCultureMethodBaseget_OrdinalIgnoreCaseCloseDisposeTryParseCreateDelegateCreateGetStringDelegateMulticastDelegateDeleteThreadStaticAttributeCompilerGeneratedAttributeGuidAttributeAttributeUsageAttributeDebuggableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeGetCustomAttributeSuppressIldasmAttributeExtensionAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeIgnoreDataMemberAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeCLSCompliantAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeReadByteTryGetValueSetValueget_IsPrimitiveget_SizeResizeIndexOfBuildTagStealerConfigSystem.ThreadingGetEncodingSystem.Runtime.VersioningFromBase64StringToStringGetStringSubstringForEachPushMathGetFolderPathget_Lengthset_LengthiAsyncCallbackcallbackTransformFinalBlockAllocHGlobalFreeHGlobalMarshalDecimalParallelFindAllRemoveAllCallTailcallkernel32.dllGetManifestResourceStreamMemoryStreamget_Itemset_ItemSystemSymmetricAlgorithmTrimRandomICryptoTransformget_IsEnumBooleanget_MetadataTokenMinJoinGetExtensionSystem.GlobalizationSystem.Runtime.SerializationSystem.ReflectionGetGenericTypeDefinitionArgumentOutOfRangeExceptionArgumentNullExceptionInvalidOperationExceptionFormatExceptionArgumentExceptionStringComparisonInternCompareToFieldInfoMethodInfoCultureInfoMemberInfoParameterInfoConstructorInfoDirectoryInfoPropertyInfoZeroSleepPopSystem.Linqxu6ViFRTIyXrul1sGxPdZ8UeZ4MmsbirPluginSdL7JbvqciGCtDWrClearCharAesCryptoServiceProviderIFormatProviderStringBuilderSpecialFolderStringComparerEnterGetDelegateForFunctionPointerBitConverterToLowerForGetEnumeratorGetILGenerator.ctor.cctorGetConstructorMonitorCreateDecryptorCreateEncryptorIntPtrdummy_ptrSystem.DiagnosticsGetFieldsGetMethodsSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesFormatterServicesOpCodesDebuggingModesGetDirectoriesGetPropertiesGetFilesGetModulesNumberStylesCreateMemberRefsDelegatesReadAllBytesGetBytesBindingFlagsStringsSystem.Threading.TasksContainsSystem.Collectionsget_CharsRuntimeHelpersGetParametersGetProcAddressAttributeTargetsGetGenericArgumentsExistsConcatSubtractGetUninitializedObjectobjectUnprotectDistinctGetRetSetop_ExplicitIsDigitSplitSystem.Reflection.EmitExitget_DefaultIAsyncResultParallelLoopResultresultEnvironmentget_Currentget_CountGetPathRootTrimStartConvertCallvirtIListToListMoveNextSystem.TextReadAllTextWriteAllTextInitializeArrayToArrayToCharArrayget_IsArraySystem.Security.CryptographyGetExecutingAssemblydummyCopyIDictionaryLoadLibraryFreeLibraryCreateDirectoryget_SystemDirectoryop_Equalityop_InequalitySystem.SecurityIsNullOrEmptyMemberRefsProxy{7edf35e6-cf9d-4325-9fa9-f6c138e44b03}{a43f8007-6b20-40b5-a39e-fbf31689258b}{14711986-99bf-47e6-8eb3-00b08e9bcc2e}~~~~~~~~~~~~~~~~versionaSelected compression algorithm is not supported.Unknown Header1235M{a43f8007-6b20-40b5-a39e-fbf31689258b}֏K!Rz\V4 ?_ :%)!%UY%Y !9!A !9!= 1%!Y!=!A ! U 9q99 5 y} 9}y}9 9e9 9 9 ee9 = A U e9 y} eee = E )EE%E E EEE U aY %)eEaEY 9 9u y q 9 999 9 E 99 ! = A t x | !%% %! !%%()p4< DLT\dtx - 1%5!9!=!9!A ! 04%p ( ( p$ ,((9 9p ! (p 0(p (,, $ 4( pp(< 0 ( ! p p , E9 !(,40HPDTL\` d h lp Ut x | 9q 99 5 y} 9} y} 9 9 e9 9 9 ee 9 = A U$ ( , 0 4 e8< 9@ D H L P TX\ ` d y} h l pt x | e ee TWrapNonExceptionThrowsG.NETFramework,Version=v4.0TFrameworkDisplayName.NET Framework 4lD@?%!%%%%%%%%%%U,p%U0p4%U8p$<%U@!D%UHpL%UPpT%UXp\%U`pd%Uhp %!q fHa5WiَU(ߌ BhA-TR j068@|9/4CDT{2#=LBN.f($v[Im%rdhԤ\]elpHP^FWث XE,?k:AOgst"57unGq)ŉobV>Ky xZݨ31Y'_`QJ -zɜ;M*((*B++ }*++:( }*b++*(G +(g+>+%*s+R~++*+(+>(("*>((*B++ }'*++fs })( (!*.+{(*+B++ }(*++B++ }**++.+{+*+B++ }+*++>(("*>(%('*B++ },*++>(("*>(((+*.+{-*+B++ }-*++zs }.s }/(*f+ {.++*++o +f+ {.++*++o +f+ {/++*++o ++{.+ +{/+*+o ++o +z+{.++ + *+++o +R+{.+*+o +f+ {.+ *+o + *b++*(G +(g+**R }E( *&(P*++gF*(G +(g+( }Z}Y}[}X*.+{Z*+.+{[*+.+{X*+.+{Y*+( -~] ׹f(is zo) t}\*b++*(G +(g+"( *(^*"(_*( *+*++{+'_d}-++{+Y},*++++++z~+ {_+ t*+(+.+{)*++ ~+ +t**++(++${+ {-Y-+{-c-X*++++# _b,+- _d%,Z,a*+++ +++b`*+o ++o +^+{+{*++.+{^*++++,{+({__d}++{_}*+++++++++b`*+(++(+,+n.+t.,+,- * *+*+++++ _d+- +Y%,_-b,`*++++F +{Y*+.+{*++++ dm++ -X++m+,*+++(x++++(x+.+{*+z~+ {\+ t*+(+b,++*(G +(g+>++*+(+( s}}s}~}wi{}(*^ g}( *:( (*&(0 *2E+*(e+2F+*(e+2G+*(e+2H+*(e+2I+*(e+2J+*(e+2K+*(e+2L+*(e+2M+*(e+2N+*(e+2O+*(e+2P+*(e+2Q+*(e+2R+*(e+2S+*(e+2T+*(e+2U+*(e+2V+*(e+2W+*(e+2X+*(e+2Y+*(e+2Z+*(e+2[+*(e+2\+*(e+2]+*(e+2^+*(e+2_+*(e+2`+*(e+2a+*(e+2b+*(e+2c+*(e+2d+*(e+2e+*(e+2f+*(e+2g+*(e+2h+*(e+2i+*(e+2j+*(e+2k+*(e+2l+*(e+2m+*(e+2n+*(e+2o+*(e+2p+*(e+2q+*(e+2r+*(e+2s+*(e+2t+*(e+2u+*(e+2v+*(e+2w+*(e+2x+*(e+2y+*(e+2z+*(e+2{+*(e+2|+*(e+2}+*(e+2~+*(e+2+*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+0 8~8~:&8~ ݾf88Y98d8i8j9&~ f(i(" ( :9~ f(i(" ~ f(i( ~%-&~s %(+(+~ %-&~s % o ~ f(i(" ~ f(i( ~ %-&~ s % (+(+~%-&~s %o ~ f(i(" ~ f(i( T,[+_s J} {s o o 30 {~ f(i( (+ s o JXTJi2~ ¾f(i(? ~ f(i~ f(i(" ~ f(i( (+T( ~ Of(i( o (+-~ ¾f(i(? ~ bf(io ((888&~ Af(io Y9s XR(, ( -~ 4f(io 8~ f(is ~ ޿f(i( T+oJ( oY o ,Jo o ( (4 ~ տf(i(" ( (+(o XRJXTJi2&(+(+XTXF,X(+T~~ f(iXJo ~ f(iX( ~ ~f(i( (? ~ uf(i( o (~ Pf(io Y9;:~ Gf(i (w ~ *f(i(" ( 9 ~ *f(i(" ~ =f(i( (+~%-&~s %o ~ 4f(i( (+~ %-&~s % o ~ ~ f(i(" ( ,e ~ f(i(" ( T+=-J ~ f(i ( ~ uf(i( JXTJi2~ (ro +x( %%~ f(i%%~ f(i%%~ f(i%%~ uf(i( ( :| o ~ ּf(i((" ~ f(i(? %~ f(i%(%~ Sf(i%(%~ Jf(i%(%~ Of(i% %~ f(i% (% ~ f(i%%~ f(i% ( o (+ ~ f(i(? o (~~ ƽf(i o &~ f(io Y9(4 o ~ f(i(" ( ,9~ f(i(4 o ~ f(i(" ( ((4 o ~ Rf(i(" ( ,9~ )f(i(4 o ~ Rf(i(" ( (&~* 8]o 8]o 8_8^(i8co 8^A|Cv!0,D~~ ~f+8~+8{+4~ af+/~+/+0+5~+5+6(ݷ(i++(+(i++(+(++(+&~( ~(~~ ~f(i~{(~ af(i~((~((~(--&*~0,<-9~+T+U+] j/F~~+S+T+Y~ Ѻf+T+Y-&,!, ~~+Ls ((**+s 8(8+s +(+(i+(++0T~~ f+~+++ ~+ +!,%&&*(i++(+(++(+(+0~~+r8s8x~ df8s8x-P~~+t+x8}~ 7f+{(-*~~s (~ Jf(i(**8s 8(8~(i8(8~8s 8~(8y(i8{0T~~ f+~+++ ~+ +!,%&&*(i++(+(++(+(+0T~~ f+~+++ ~+ +!,%&&*(i++(+(++(+(+0888,*888888YEg38 }o/ ( }o *: }o/ ( }o *o %92o/ (.~ +f(io/ sz }}o *X(:XF:-( }}}}*:" }}o Jo /Jo o (* 8l8k( 8f8h8go/ 8c(8^8]8\08\8]{-~ ֺf8M8Rz~8Q{8M/$~ f8E~ ֺf8@8Ez-{(%o /$~ f(i~ ֺf(is zs o 8r( {3 ~{(o 8B:{-',{s)P{8{3_s o 1? o +( {) o ( -o o u8~ f(isz9F{:~{~(X(,XJs& +=~{o~((, Os +{s) o 1@ o +( {)o ( -o o o38{@s, o 1@ o +( {)o ( -o o o3 u+A{-{+-{3o#u+~ Vf(isz( : o ,~ f(isz** 88(i8s 88(8(i8(i8s 8AdD#g0$T$;0,8-~0 )f88z-8288{.82~0 f88z~o (,~0 f(is zo (,4~~0 f(io ~0 f(i(s zo${.o {/o o *8(i8$s 88"8$8#o 8#(i8*s 8%0\,+4{.+0+1+6+7{.+3+4+9{/+5o o &--,*++o + +++o +++0~8{.888888,&,?8{/8{.o o o &-/{/o o ,+9{/o o {.o *8m8qo 8lo 8g8fo 8a(8\8`8d08-~0 )f88z~888 ~0 f88z8o (,4~~0 f(io ~0 f(i(s zo${.o {/o o *8L(i8Ss 8N8So 8N(8I(i8Ps 8K8K0+j-~0 )f+b8gz ~+f+j8o ~0 f+k+sz8w{/o o - {/o o * *8(i8s 88o 8(8(i8s 880,+~-~0 )f8s8xz~8w8x8} ~0 f8v8{z8(5-,'-{/o o &{.o &%,*%-*8|(i8s 8~8o 8~(8y(i8s 8{8{0~9- 89~8- 88~7- 87-~6- 86,]~788+A888-"%,&3( ,+( -~7o> &X o 2,(G ~7o (*s 89s 8@s 8Gs 8Qo 8Z 8Z8[8Zo/ 8U0888%:888888b8o -e,o c(G o ,3c(G ( tco ( -o , o ,X-i,?U*( 8.s 8) 8(8.82818584(G 890+Ou-&~~D %f+:~~+5+6+;+@+Ez+I+Jt((}>}C*+(i++(+(+(+s +++0,!8{>-~D f88z8X8i1~D ˸f88z8X8i1~D f(isaz{C,(t{>(q(|+(t{>((|*8K(i8Ws 8R8R8T(i8]sa8X8W8Y0~+T+Y- %,g%`+H: g%a+8;-%,%,g%b+"<*(G +(g+(( +(( +(( +08Q8R{E8E{E88{E58*{E58{E888T+6~{EJJX(t({EJJcTJ9/~{E(t({EXT+F~{EXJXJX(t (:_{EXJ XXJcTXJ%9/XT+wXT+W~{EXJ(t{EXJ({EXJXJXXXJXTXJXJ2XXJXJXTXJ?~X% 3*>c{E{E5XT+F~{EYXJ(t(}{EXJXXJcTXJ08 8888888(880) 58888{E88X88_8% 8a% a% a% a{EXX _c% a% a% a% aY8=8<8A8M8M(i8Ysc8T8T0 8c + X+ +++( +(G ++&݁98} (8y8~8T8QJ o XRXTXo YT+gXJo/ ~3XR+\XT-+.~dXJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ(= 8?8>(89(= 84828108~8|8}-*~8y8y{@~8r~8n8oY8r}@(o ],*o [s XT+L~XJo ~XJo (Y()XJXo (zo XXJXTXJo 2*~(&[3k~~(Y(&]3O( o s XT+# XJo (zo XXJXTXJ o 2*-~(&"3T~~(Y(&"38~~~(Y()~e Qf(i~ (,*~~(&(/-~(&-3[~~e f(i(,$~ ~((&O*~X(2&XJ*~~e Lf(i(,Y*~~e cf(i(,Y** 8z8~(8y8(&8}88(8(&80o-H+G+H{?+D+E,%-"+D+E{@+AX+@-+B{AX(-{BX(*+++(++++(++08-+++,&+Y,,++--* ++(++ ++08X8Y8Z8_g8Z8[(%c8S8TbY {z}@8GEy8(TJgXT+SX(TX(TXJgio^ &XJsXJ(&XXJXJXTXJJ2+wg%Ч(( g%С(( (iYo (~-,o rp rps zrsps zo * 88s8888 8 8 8+0l8~6808+ ~688888!8"3*T~7o XT8XJo/ :5".<,.H:.C+b-]5[.].+N{.}. +BJXT+:JYT+2XXJ(T+6J-~7o o ~7o +~7XJo/ o> &XXJXTXJo Y?M~7o o * 8o 8s 8o 888o 88o 80\+7+8+9+>,+<-+9+:a-+7+8a%, (a,(a*++(+ +++++(+0l8~e Zf88 t~e -f88t8888 (+(+(+(+(+sCsOs[ sV % oQ%ioRg%ioSoT&( o ~e 8f(i( o *&( o ~e 8f(i( o *8(i8o 8(i8o 8( 8(+8(+8( 8)*0L+0-+%%+&+'+'+(aҜ+%Y+$,+"%-%-/-* ++++++ ++0f+T8Y-+- -+++++ +!+"o ,)++++o +++ -o *s 8 8=D0K+3 _%-+$ +"+#,-+" %+ a*+ ++(+++0; 888i[T8J.'8J.8J.~e f88z8JX}={=X:s XTXT+0XJcXJ_XJ(( XXJXTXXJXTXJi2X{=XbTXJT8XXJYcXJY_( TXJJ]-*XXK((~7(5+(i+(+(+(5+(i+(+ +&,*+*+0 ~8N8O8T8U8V8[8\8]],8^*~8o -~T(;( +~8o ~9o -~T(>( + ~9 o 8~o (>~o ~o (Y()Xo o "~~(((A+- o ,!~~(((DXo ?E*8(88 88(888o 880|!~k+\~8X8Y~j++&+,-,-++,"+o ++++~(G-+(** 88(G8+4J0,_+N,Z+Y{+U+V{+R+SX}+M+N{%X+F+F{ _}, _%Y,=*+++ ++++++0>"88T+<8{T% 8J%88X%8-88JYTJ/g{G{ToA&{I,~~FY(+XYT+0% XJ% XJaҜXJXXJXXJYTXJ/{S(-{H{SoJ%{VjX}V* 8888 8 88 88 0~~~ ~e f+)( %~e ٶf++#t+#+$+)+*-ݐ(i+(i+o. + +(+++&~~~ ~e f+,( %~e ٶf+!o. t(,,#(i+(i+&~e ~f(i*,*jUii[0888{T88{9,p18{+#88{8{YX _TXT---XJYTXJ%-"1'{ XJYXJ(+ XJXJ{JY(+ {XJY}{/s zXJ* 8$8#8"8'8&858=8<8@0#%,r+tg8n-- 8iT+P-g+_+`X~+Zi+YJY+VT~+UJXJ(({HoJJXTJi2* 888++++(J++0?~~7~8888&8X88~888\3C,~~7~(&(M&~~7~X(&(M&X +J~(&"3~~7~(&(M&*~~7~(&(M&X ~(?F~(Y*88(&8(M88 888(&8 0~~~ ~e f+)( %~e Ķf++#t+#+$+)+*-ݐ(i+(i+o. + +(+++&~~~ ~e f+,( %~e Ķf+!o. t(,,#(i+(i+&~e ~f(i*,*jUii[08-8888T-8X88K8TXXK(T,XXKaTKXKaXKaKXKa- (aXKXK,a(aXK-(a* 8d8f8e8d(8_8b8c8b(8^08D%{?8>8?{=8:a}?%{@8283{=8.a}@%{A8&8'{=( a}A%{B{=( a}B{=Y8g~;{? _~;{Bd _ba~;{Ad _ba~;{@d _ba(( aTX~;{@ _~;{?d _ba~;{Bd _ba~;{Ad _ba(( aTX~;{A _~;{@d _ba~;{?d _ba~;{Bd _ba(( aT~;{B _~;{Ad _ba~;{@d _ba~;{?d _ba(%Y( a~;K _~;d _ba~;XKd _ba~;XKd _ba(( a}?~;XK _~;Kd _ba~;d _ba~;XKd _ba(( a}@~;XK _~;XKd _ba~;Kd _ba~;d _ba(( a}A~; _~;XKd _ba~;XKd _ba~;Kd _ba(%Y( a}B=~;{? _~;{Bd _ba~;{Ad _ba~;{@d _ba(( aTX~;{@ _~;{?d _ba~;{Bd _ba~;{Ad _ba(( aTX~;{A _~;{@d _ba~;{?d _ba~;{Bd _ba(( aT~;{B _~;{Ad _ba~;{@d _ba~;{?d _ba(( a~;K _~;d _ba~;XKd _ba~;XKd _ba( a}?~;XK _~;Kd _ba~;d _ba~;XKd _ba( a}@~;XK _~;XKd _ba~;Kd _ba~;d _ba( a}A~; _~;XKd _ba~;XKd _ba~;Kd _ba( a}B* 888( 888( 8880$9&8~e f88888X89&XF-||%P(" Q}*}{o Jo /Jo o (* 8o8n(i8s8r(" 8m8m8l(8i8j0V+9+:+:+;+<+=X%b`+5+6+7X%b` -X%b` *++ ++++ +++0%888*% 8~&%-&~%s %&888+7+?+@{,%! s" (+%! s" (oA -+o# +,o -*s$ 8R 8Q8Po% 8V(+8po' 8k8jMM 0I&88~i%X9&88 _-888-e~ *8,,@_-?_b~i%X-X +7_b~i%XbX~i%XbX-~i%XX- -~~~ (P~i(S( ~~~ (P i(S(~l,( &-*888888 888` 0b+A+B+CiT+AJ+Ai.*+8R8Q8U8Y8X0*'88~~8~e ڹf88888t8-+P,o t-K-H~~e f(io2to*(-,o ݌~ (V-,-~(Y(8< 8;(w8@(i8E(8@(8;s86(81o981&~e ~f(i* *A4Gd0P+3+4+5Ҝ+4+5X%+1dҜ+.+/X%++dҜX%dҜ*+++++++++0H~+5_b~+*c_b`~+c_b`~+c`h*++++0Y(5+.+/+.+/,+0+/+0+4+3((* +++(+++(+++0+s8t{O8p}S8p8q{P+p}T+s}U+qj}V+k{Q,~{Q{Qi(Y,}R{GoB*88({888({88++0D)88{~88888{wT8JYE0/8 8{~8(Y% /9'*{{}(% _, /#%:X/*}}}w*~s Y}y~t Y}x{x1J}wX{}{x(TXJ/*-{}{x(o{yXJX}y }w:{{}(/*~u}z~v}x{x1K }wX{}{x(TXJ%-/*{}{x(o{zXJX}z{~{y{z({yY,}w <* 88(8888888#0G+%{g++{++{+++*+ ++++(+ ++s+0\~:+I _~:+=d _b`~:+,d _b`~:+d _b`*++++0[-,&+4+4+5T+4X+3+4T+3+4+5XKdK`X%3*XKbT+ +++++++++0+f8g{8c8dX}-+^ 3,+Uz,+V{+R+S{ X}Ҝ--{ _}*88 88+s ++++08"588 YEDB\\D8e .;8b".B,-+E8Z\58W/.&,+T\.+(+O{.+L}.+***,**,*%,%,**8w8z8888+++0T):8 8 (%?8{8%2 -88_88-c*8ceTX_TXJ(%2{J c`_(oc*X{TXJ({J c`,A_XJ0_(o-c**X{TXJ({2_XJ0_(oc** 88888 8(o888 05*@8888XT+D8X88XJT8XJ18XJ%JXTXXJXTXJi2TX TXT+uXJJJXJXJY_bXTXJ 2?XXJ _TXJ _TXXJXJXJYXJY_cXTXXJXTXJ>XJw}X T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{(XJ(XJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ s 8@8@8D 8J8Q0/~ 88888~,~e of8888~,~e f(i(o, ~,~e Qf(i(o, ,!~,~e df(i(o, +3,&~~~.o- ((( X&&~~~e f(i((,~~~e f(i((--v~~~0~e Wf(is ~/~e :f(i(t((~e f(i~e ȷf(i(, & K 8e8es. 8`8_8^(i8h(8co, 8^8]&* *AL/%s0088R8XR8 X8~8|8}8~8R:s :9T8w~J(&(9.;8XF XF_,J1JXT~(* XF9?-"~e Ƿf(i~J(&szXF9~~J(&((M&XR89^ XF,~~J(&(M&8JT~(*XF,~~J(&((M&XXFR:y+GXF,'~~J(&((M&XR+~~J(&(M&JXTJ~(?w~(T XF9~~(Y(&(.R+]9XTX~(YT+XXJXTXXJYTXJ2~XJ(&(.XJ]R~(* 8u8s8t8x8z8~8}(&8x(8s0T%98 8X8 {wT8XJYE"n88{|:,8}w*88{}8TJ/*{}(oJ9_, 9e}|JcE8+H{}(,}w+1~}~}}w+s}}w*{}(%}{/*{}(o}w{}(-/*{}(o}wX{~{}{{(yT{{XJY}{{{- }w*{}(*{{}(-*{(}{(v}}w(*9** 88888/8;8C8B(8C0q+@-~e f+5+:z~+9+:,~e qf+3+8z+<{/+8o --*+(i+s ++(+(i+s +++0b+E+Fb+C+D,-2+?+@X%b,-`+1+2+3X%b-` X%` *++ ++++ +++021rpgrph,i8kl%-m~~grp8,9l8j~2~h8-m~5~38rp88~6~+3+4(g~8(&-(~i,+(+,~(*s 8((8Fs/ 8O(8Y(8f(8f 8eI0S+/, f%, a+$+&~m-Y+~l--++*++*+++++(++(+0|%Т+Qs-B%Щ+At,%Ъ+1u%,%Х+!v--*(( +(( +(( +(( +02 g8:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2s g +%X 2,s* 8H8P8T8W8X8f8i8k8s0\%Ш+9-%,%У+'-%,͍%Ц+*(( +(( +(( +0%Ц8^g%Ф8Q w g-\8/+-~8)08(Xb8&-~%X88 2+&~8 Xb(~%X 2::+(~ X b(9~%X 2+~Xb(~%X 2wg:3 +(~b(9~9X 2*(( 8(( 8 888(8 888{z}2E&/^'@GB#/yCՇ>vʽ"H&ezc"b<၊=uZSC:ԛޘgY+~TF)|ں" fDx6Q _n19+zɷO/wVTtQ{Z3hf߼}/HATmC2q^4\6C}:[KqNsuݸ"7ϓˣ|S#(1DBTQ{CC)z<-S(v3e[-W}ršKEU%$[OsJ"H.A:&RW$Z;P@ccVW$еm{7A{Sjqfy<;fT7On)+rƈfF͊#crM*U Ggϟ [F`܂4ZwOWZ牮Z>`C~/A&:l6u:+0Pg VLv:|חh9Bo&~pGR":(-WZ ʞ :fՎU&?uH *]pX# &&Qo8DWgFv噠b(.ҪSq@)m2t=w C B G F KJNQT*W6[AZA_P^Pc_b_g_f_kkjkyy ~ ! %$)(,/2598?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~h%k0rt%{%# %){%# x9%)%){%# :{L;;{L;<<&# &# &#&+&#H=0?:&)S&){%# c&x&#&# &&#&w&&'&&-'#'#3.'?'#O'#_'wk'|'#'JTCPD' WD P']E-' Fc(i0( GcE(qE(_( +b()HI {%# J{(dK( pL){%# LO(# (#P#@Q(TTU#()(#*( 5( ):):)#K)){%# &# d)#m)# u)#m)# u)#{%# W? ZZ)H[_#9q le bp ~)# ~)# ~)# )w)]d)epfghcipij)hmm(n*C*oXqqHss$t|t'o*6v=*GyNzY*azh{cX|s~z~$pctLc **6hhzБ@Pcl + ԕ 4@+ n+$ ++ +3 ; hC ȜM V ] dc +$ $+j 8c|q X } 8 +)~)# ~)# ~)# ,z)z~)# ~)# ,#X){%# T,# )l,#{%# )L){,#e #9Fq,)#9Fq ,)#9Fq ,)#9Fq ,)#9Fq ,)#9Fq ,)#9Fq{,)#9Fq& ,)#9Fq2 ,)#9Fq,)#9FqB -)#9Fq-)#9Fqw!-)#9FqY .-)#9Fq;-)#9Fqj H-)#9Fqt U-)#9Fq~ b-)#9Fqo-)#9Fq |-)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq-)#9Fq -)#9Fq.)#9Fq#.)#9Fq/%.)#9Fq;2.)#9FqF?.)#9FqUL.)#9FqdY.)#9Fqpf.)#9Fq s.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq/)#9Fq/)#9Fq /)#9Fq-)/)#9Fq;6/)#9FqGC/)#9FqSP/)#9Fqb]/)#9Fqnj/)#9Fqyw/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq0)m hqqM1 1 A M !PXLLL q#(3e>>/CGJ;JP PkPP/UY ] ]pcgn s s!Zw ww w)cw1*w {& { {/ 7N?O 9}A/AA7 QzYi6 @y @ #V+I+ +++A/8;@G@`HM XanA2vA@0q=7 At AA+`1& 'Y # !#)# 1#A#I#Q#Y#a#i#q#y######## ##(# /$#9_?OV,#94f p# p /+wwf < 4# 4# +Ye< m DL/LV+>< T # <# T# ## Qw\qd'#dl4'4t|tV+4 lV+## # `#1' #Y & YQ%# # # # ZwQZw!#1#/#II+YI 'a%Qi#.i;yAqFyAyIAymAyAqMyk Ayf Ay@AqUyrAi_' gn2si#yyuA yAQ# nDD# <#4 < #J ## 'sn]H[GW# #v! # 1# 44444#9d\#9d# T #T$T%$ $# # Y#/TX\`dtx|.c.k.s.{ . .# .k Cccq Cc @`#{ @AC `ac !cbb#$%t1@ALBtCxD ,6AGTu &2:A_er{ { 012Z\^`bhjlnprtv%,39?FMU\cjryP `P!aP"bp"f""p###$X$h$x$$ e U #"$"%"10328797:7;7<7=7>7@?A?B?C?D?{}666z:'6CCC|G|LMQ~~~~~~~~~~~~~~~~~~~~~~~~~Ldarg_0Ldarg_1IEnumerable`1Stack`1Action`1ICollection`1IEqualityComparer`1IEnumerator`1IList`1Microsoft.Win32UInt32ToInt32Ldarg_2Func`2Dictionary`2m0000D3Ldarg_3Ldc_I4Int168PjL4j9p1T4HRGW6get_UTF8XleD8lmu2TukS_OnInitDoneZdHepKsnhZdDeeUG93ky9OjZ8GM5rlvnM8PWPluginUrWtnueHw9t59ZdHepKsnhZdDeeUG93ky9OjZ8GM5rlvnM8PWPluginUrWtnueHw9t59OnStealerZdHepKsnhZdDeeUG93ky9OjZ8GM5rlvnM8PWPluginUrWtnueHw9t59UIDtypeIDkDgA3J9dTGoVv4ZKSystem.IOLdarg_Svalue__ProtectedDatamscorlibSubSystem.Collections.Genericget_IsStaticReadAddIsDefinedTrimEndAppendDynamicMethodmethodReplaceIsWhiteSpaceCreateInstanceOpCodeget_UnicodeAddRangeTakeEndInvokeBeginInvokeIEnumerableIDisposableDoubleRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandleFileget_Moduleget_MainModuleProcessModuleget_Nameget_FileNameGetTempFileNameGetFileNameGetProcessesByNameGetDirectoryNameLocalMachineCloneDataProtectionScopeget_IsGenericTypeget_FieldTypeChangeTypeValueTypeget_ReturnTypeownerTypeget_ParameterTypeGetTypeGetElementTypeget_PropertyTypeWhereSystem.Coreget_InvariantCultureCaptureMethodBaseget_OrdinalIgnoreCaseCloseDisposeTryParseCreateDelegateCreateGetStringDelegateMulticastDelegateDeleteThreadStaticAttributeCompilerGeneratedAttributeGuidAttributeAttributeUsageAttributeDebuggableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeGetCustomAttributeExtensionAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeIgnoreDataMemberAttributeDefaultMemberAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeCLSCompliantAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeReadByteget_ValueTryGetValueSetValueget_IsPrimitiveRemoveIndexOfBuildTagStealerConfigSystem.ThreadingEncodingSystem.Runtime.VersioningFromBase64StringToStringGetStringSubstringForEachMatchPushMathGetFolderPathget_Lengthset_LengthEndsWithStartsWithiAsyncCallbackcallbackTransformFinalBlockDecimalCallTailcallGetManifestResourceStreamMemoryStreamget_Itemset_ItemSystemSymmetricAlgorithmTrimICryptoTransformget_IsEnumBooleanget_MetadataTokenMinJoinSystem.GlobalizationSystem.Runtime.SerializationSystem.ReflectionGetGenericTypeDefinitionSearchOptionArgumentOutOfRangeExceptionArgumentNullExceptionInvalidOperationExceptionFormatExceptionArgumentExceptionInternCopyToFieldInfoMethodInfoFileInfoCultureInfoFileSystemInfoMemberInfoParameterInfoConstructorInfoDirectoryInfoPropertyInfoSkipPopGroupSystem.LinqClearCharAesCryptoServiceProviderIFormatProviderStringBuilderSpecialFolderStringComparerCurrentUserEnterIEnumeratorGetEnumeratorGetILGenerator.ctor.cctorGetConstructorMonitorCreateDecryptorCreateEncryptordummy_ptrSystem.DiagnosticsGetFieldsGetMethodsSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesFormatterServicesOpCodesDebuggingModesGetDirectoriesGetPropertiesGetFilesGetModulesNumberStylesCreateMemberRefsDelegatesReadAllBytesGetBytesBindingFlagsStringsContainsSystem.Text.RegularExpressionsSystem.Collectionsget_CharsRuntimeHelpersGetParametersget_SuccessProcessAttributeTargetsGetGenericArgumentsExistsRemoveAtConcatGetUninitializedObjectobjectSelectUnprotectDistinctGetRetSetIsDigitSplitSystem.Reflection.EmitExitget_DefaultIAsyncResultZdHepKsnhZdDeeUG93ky9OjZ8GM5rlvnM8PWPluginUrWtnueHw9t59OnStealerWorkResultresultEnvironmentget_Currentget_CountInsertConvertCallvirtIListToListMoveNextSystem.TextReadAllTextRegexInitializeArrayToArrayToCharArrayget_IsArrayOpenSubKeyContainsKeyRegistryKeySystem.Security.CryptographyGetExecutingAssemblyget_IsReadOnlydummyCopyIDictionaryDirectoryRegistryop_Equalityop_InequalitySystem.SecurityIsNullOrEmptyMemberRefsProxy{7dd4f6ff-8200-4ae5-8a57-1edf78202c30}{7dac886c-d93d-41aa-ae79-d6fffeab5ea4}{b457cb8e-1ec3-453a-a0c3-b70d2a289d5d}~~~~~~~~~~~~~~~~~~~~~~~versionaSelected compression algorithm is not supported.Unknown Header154M{b457cb8e-1ec3-453a-a0c3-b70d2a289d5d}aܿJv0++*+(:+(@ s?}(s@})}"i{((*^ @}2(@ *:(@ (0*&(z *2#+*(+2$+*(+2%+*(+2&+*(+2'+*(+2(+*(+2)+*(+2*+*(+2++*(+2,+*(+2-+*(+2.+*(+2/+*(+20+*(+21+*(+22+*(+0W+<+8 +4 +0-+*+' -+!,-*+++++++08,2~ ~ f888~V88:~Z888~X8(O~~ f(~ f(o ~~ f(~ f(o *~~ f(~ f(~ f(o *(8o 8 88(I888"8!(L8"0 88888888T~~ rf8o ~ if(~ f(~ f(o ~-s ~(+(+(+o 8F ( ~~ zf(o ~ if(~ f(~ f(o ~-s ~(+(+(+o 8( s! J~~ Mf(o ( 1\~~ \f(o o" ~ 3f(( -/~~ \f(o ~ *f(( ,o~ Ef((# o$ ~ f(%(% (& ~ f(~ f(o$ o$ (' o( +r9~ Ef((# o$ ~ f(%(% (& ~ f(~ f(o$ o$ (7o( o 8( s) o* j[~~ f(o ( j0Ko* %,j2=#333333?o* j[~~ Mf(o ( JYj[l5o+ &Jo* j[iXT&(, :Co o( (+1~o. -~o/ &(, :mo (, : o To 8( J~~ Mf(o ( <_ 9O~0 ~~ f(o o" ~ 3f(( -/~~ f(o ~ *f(( , (1 o2 \/o3 8XT (4 +\~ f(XJ)~ f( (4 -((5 XXJXT o. -- o/ J s) (* j[iXT ~ տf((6 (7 o8 +-&(, :]o (+9/~~ f(~ f((9 o ~~ f(~ f(~ f(~(: o ~~ f((9 ( ~ f(~(: (; o< &9e* 8?s! 8:89s= 8483s! 8. 8-8,(88At{fYC5qH0,I+I-M&+M~ ߿f+D+D+I,+K~ ¿f+B~ f+=~(: o> *s? + ++(+(9 +o> ++(+(+0M+*+/-++-~ f+-*(A +( +s! +(+08 + X+ +++(B +(A ++&݁98} (8y8~8T8QJ oC XRXTXoD YT+gXJoE ~3XR+\XT-+.~XJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ8R8Q8U8Y8X0 v8{.8{//8z88X880880i1sk z_ 3{0%X _{1_b`}0{1X}1}-}.}/*8e8isj 8k8k8j 8j8j8k8j088T8{"%,X.B8uX8t8u8v8w{)+vTXJXJXJXTXJY-J*(!-{){41 {"@J* 8z8y8z88888(808X8Y8Z8_@8Z8[($%c8S8TbY {z}@8GEy8($TJ@XT+SX($TX($TXJ@io &XJXJs=(&XXJXJXTXJJ2+w@%R(_ @%L(_ (+iYom ( -,o rp )rpsn zrspso zop * 88sF8888 8 8 8+0T %98 8X8 {"T8XJYE"n88{':,8}"*88{(8TJ/*{((2J9_, 9e}'JcE8+H{((,}"+1~6}+~7},}"+sC}*}"*{((%}&/*{((2}"{((-/*{((2}"X{){({&(1T{&XJY}&{&- }"*{(()*{*{((--*{*(&}+{*(.},}"(#*9** 88888/8;8C8B(8C0I 88~%X9&88 _-888-e~0 *8,,@_-?_b~%X-X +7_b~%XbX~%XbX-~%XX- -~^~]~[(R~(U(X ~_~]~[(R i(U([~,(% &-*888888 888` 0D88{)88888{"T8JYE0/8, 8{)8(3Y% /9'*{+{((4% _, /#%:X/*},}+}"*~ Y}$~ Y}#{#1J}"X{({#(TXJ/*-{({#(2{$XJX}$ }":{ {((4/*~ }%~!}#{#1K }"X{({#(TXJ%-/*{({#(2{%XJX}%{){${%(5{$Y,}" <* 88(8888888#0U~+=-~`+6+7,~+ + +-++oq +-~a(^ ++(^+&* 3QQ0G +%{>@++{;++{>+++*+ ++++(i ++sB+0H~G+5_b~G+*c_b`~G+c_b`~G+c`h*++++0888T+Q8%X88{0Ҝ88{0d}088{1Y}1YJXT{110-J*X{/{.YTXJ1XJ{-{.(i {.X}.{.{/Y_,4{-X{.TXJX}.XJ _}0}1JX* 8888888880f+T8Y-+- -+++++ +!+"or ,)++++os +++ -o *st 8 8=D0888{=T8JEJ-+8p8q8q}>8q{>/*8h{> X}>(2}=(}?{?/*{?X}?(2{>{?X}A{A@};}=(}@{@/*{@X}@(2@}:}D}=+AX(TXJ/*(2{:~E{DXJҜ{DX}D{D{@2{:sB}<}:}D}=+<{;X{DTXJX}DXJ%}C{D{A3*{<(4%_,/*2}CY}B}=X~9{BTXJ( /*XJ(2 ~8{BX +'{;X{DTXJX}DXJ{C %Y 0{D{A3*}=8n 8h8g8f8k88(8880P ++{?@+"+#{;+{>++{?+++*+ +++++(i ++sB+0,_+N,Z+Y{2+U+V{3+R+SX}3+M+N{2%X+F+F{3 _}3, _%Y,=*+++ ++++++05@8)8)88XT+D8X88XJT8XJ18XJ)%JXTXXJXTXJi2TX TXT+uXJJJXJXJY_bXTXJ 2?XXJ _TXJ _TXXJXJXJYXJY_cXTXXJXTXJ>XJD}5X T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{5(XJ('XJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ (u 8?8>(*89(u 8482810+f8g{48c8dX}4-+^ 3,+Uz,+V{2+R+S{3 X}3Ҝ--{3 _}3*88 88+sj ++++0T:8 8 (%?8{58%2 -88_88-c*8ceTX_TXJ(%2{5J c`_(2c*X{1TXJ({5J c`,A_XJ0_(2-c**X{1TXJ({52_XJ0_(2c** 88888 8(2888 088{48X%}48 18z8{38Y _8-v 8-Y0c{3/Z0L{2{2{3(i {3X}3*{2{3X}3{2%X %Y0*(/*8483878>sj 8@8@8D 8J8Q0|~+\~`8X8Y~++&+,-,-++,"+ov ++++~a(^-+("** 88(^8+4J0+t8y+++++,-+++(w +o( +&+2+3- + - (7o( &- X i2 +(x +&*s! 8 8()0FU3>q02rprp 8%-~b~rp8 98~c~8-~f~d8rp88~i~h+3+4(p@~k(s&-( ,+(m+,~m(v*s@ 8((a8Fsy 8O(d8Y(g8f(j8f 8eI0S+/, f%, a+$+&~-Y+~--++*++*+++++("++(6+0|)%M+Q-B)%T+A )%U+1 % )%P+!!--*(_ +(_ +(_ +(_ +0 @8:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2sB6 @ +%X 2,sB7* 8H8P8T8W8X8f8i8k8s0\)%S+98-% )%N+'9-%,͍)%Q+E*(_ +(_ +(_ +0)%Q8^F@%O8QG DH @I-\8/+-~H8)08(Xb8&-~I%X88 2+&~H8 Xb('~I%X 2::+(~H X b('9~I%X 2+~HXb('~I%X 2DJ@K:3 +(~Jb('9~K9X 2*(_ 8(_ 8 888('8 888{z}Xy˒ZC`i=6ߊso/.9+xըR,* &tIl"^OlZ7Cc,$>zψҞXAK]VhR@lYR3yiW+3FwD7y\NxJ$Fy^$ʭ Hh|n=i+`Hc(}g1\d>JMuN#A|O|gR眤9`ދīͅ1{|r9yqAkaRBSJBv4.0.30319l$#-x #Strings#US#GUID#Blobw( %3F4mwwz f9p.I.`gr(TLsR};`(`x ;.#V?-rRm````o`fd6`qv` yT C o 8: ; <===-?2@5A 8C FELFLGVGVGVGVG VGN VG VG XJ YM [P \S ^V _Y `\ b_ cb de eh gk in! jq# lt' nw_#3=\dddluy31_1_3\3`3h3k1VnVnVnVn3333 k\\6633\\ 313\11\11\3333333333 !+55!A A#K&U%U)c(c !"#$%&'()*+ -./0123456789:;<=>?@ABCDEFHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwG%*H#X&[';x/ &U#p ]#T]#T0v/U#p d0}3v/3Npu#p u#p u#p u#p u#p u#p }#5#678##9X;= ?#pAADBB$3$Cc$`DDGG#,H+pK3o$%v/pFK%v/pFX%v/pFe%v/pFr%v/pF%v/pF%v/pF&%v/pF0%v/pF:%v/pFF%v/pFP%v/pFZ%v/pF%v/i +4+t!qTqTyYq]fokUsqyE~~qPPV" pp pp p$p c,S44,p qKyYq{!y')Fy1. 8ApA $C4jI @M KC bYq_)~yq$bq{h)yqnqtQ)s*p Pp p ]pf p Tbmmp )PvT|11Tp 1phrlwp|t.h.qCwwwww#C`wcwCcwtL t!x"3LQUioy$+18?FMP L MP!N`!Op!P!Q8"RH"SX"T"U! !"9;=[[~~~~~~Ldarg_0Ldarg_1IEnumerable`1List`1ToInt32Ldarg_2Func`2Action`2Dictionary`2Ldarg_3Func`3Action`3Ldc_I4Int16m000047get_UTF8UIDtypeIDNV9SMSystem.IOLdarg_SFJb2Vvalue__addDatasetCustomColumnDatagetDatasetDatarawDatamscorlibSubSystem.Collections.Genericget_IsStaticReadOnLoadAddDynamicMethodmethodReplaceIsNullOrWhiteSpaceOpCodeAddRangeEndInvokeBeginInvokeEnumerableIDisposableRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandlesendFileget_Moduleget_NameGetFileNameConfigPluginNameget_UserNameget_NewLineget_FieldTypeValueTypeget_ReturnTypeownerTypeget_ParameterTypeWhereSystem.CoreMethodBaseCloseDisposeOnAPIDelegatesCreateCreateDelegateCreateGetStringDelegateMulticastDelegateCompilerGeneratedAttributeAttributeUsageAttributeAssemblyFileVersionAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeReadByteTryGetValueSetValueRemoveBuildTagConfigSystem.ThreadingEncodingFromBase64StringToStringGetStringMathGetFullPathGetFolderPathget_LengthiAsyncCallbackcallbackTransformFinalBlockCallTailcallGetManifestResourceStreamMemoryStreamget_ItemSystemSymmetricAlgorithmICryptoTransformEnumget_MetadataTokenMinPluginJoinSystem.ReflectionSearchOptionArgumentOutOfRangeExceptionInvalidOperationExceptionFormatExceptionInternFieldInfoMethodInfoFileInfoMemberInfoParameterInfoSystem.LinqCharAesCryptoServiceProviderSpecialFolderOnStealerEnterToLowerGetEnumeratorGetILGenerator.ctor.cctorMonitorCreateDecryptorCreateEncryptordummy_ptrGetFieldsGetMethodsSystem.Runtime.CompilerServicesOpCodesGetDirectoriesGetFilesGetModulesCreateMemberRefsDelegatesReadAllBytesBindingFlagsStringsContainsStringSplitOptionsget_CharsRuntimeHelpersGetParametersHostAddressAttributeTargetssetStatusConcatObjectobjectDistinctRetSplitSystem.Reflection.EmitOnInitExitIAsyncResultOnStealerWorkResultresultEnvironmentget_CurrentCountGetPathRootConvertCallvirtToListMoveNextSystem.TextInitializeArraySystem.Security.CryptographyGetExecutingAssemblydummyCopyDirectoryop_EqualityIsNullOrEmptyMemberRefsProxy{371c3b25-07f8-4959-89d0-1ed463edbf00}{89c0f160-8fda-4456-bcc4-2db1b302c877}{f4c49c79-c41d-499d-81cf-d1b27951827e}versionaSelected compression algorithm is not supported.Unknown Header0231M{371c3b25-07f8-4959-89d0-1ed463edbf00}]Dd"ObĪz\V4 )%%!!1 AE Q U %! ] ] ] ]]] ] 5 ]] i !%G )-%111) ! )-%1)5] ae a8` `\\ \ X\pXdh \\ ih\`d`\\`d\ !P\`hd |x A E Q U TWrapNonExceptionThrowslD@A!!!!"]] pPi i!Uh}~} p}_CorDllMainmscoree.dll% @0HX4VS_VERSION_INFO? StringFileInfo000004B0$FileVersion$InternalName(LegalCopyright ,OriginalFilename(ProductVersion,Assembly VersionDVarFileInfo$Translationp=", Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PELsOb!Nnl @ @lW$ H.texttL N `.rsrc$P@@.relocT@BPlHL`lLH'},\[+ #+3;CScs HlRtEZ !1Aa 0@`(" *b++*(# +(+(K *>++*+(+(" s}s}}i{(3*^ 6}%(" *:(" (4*&(M *.+{'*+F +{'Y*+^+{!+{"*++.+{$*+++++b`*+(:++(:++*++{#+'_d}#-++{$+Y}$,*+++++++++,{#+({$__d}#++{$_}$*++++++${"+ {!-Y-+{$-c-X*++++ +++b`*+oZ ++oZ +2"+*(+2#+*(+2$+*(+2%+*(+2&+*(+2'+*(+2(+*(+2)+*(+2*+*(+2++*(+2,+*(+2-+*(+2.+*(+058 8%888-8 8:88o o o ~ sf(o o ~ Ff(~ ]f(( o o o o ~ Xf(o -o &( --&d%9S( ,+@8%s 8 88!o 8!s 8!8 ,o *(! 8 8A4 08 + X+ +++($ +(# ++&݁98} (8y8~8T8QJ o% XRXTXo& YT+gXJo' ~3XR+\XT-+.~XJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ o4 o? & o@ &-JXTJi?* 8I8}oA 8}8|8{@ )3" /C/0Z,:0%+%+ , +#+(++--,*(B +(# +( +oC +oD +08[8\ (8X8]8^T,8-8U8VJ8U8o+ (# .9~/ (# %5(# oE sF o2 ~3 o4 (# oG XT+]XJo0 (# 34~H oI _o9 ~J o4 ~; o= +,XXJXTXJi-2~> o4 (# o? o@ 8&JXTJi?* 88oA 888888A=P02rprp,8 %-~I~rp8,9 8~J~8-~M~K8r p88~P~O+3+4(P6~R(S&-(!,+(M+,~T(V*s" 8((A8FsL 8O(D8Y(G8f(J8f 8eI0S+/, f%, a+$+&~-Y+~ --++*++*+++++("++(=+0|5%@+Q-B5%G+A,5%H+1%,5%C+!--*(B +(B +(B +(B +0 68:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2s) 6 +%X 2 s** 8H8P8T8W8X8f8i8k8s0\5%F+9+-% 5%A+',-%,͍5%D+8*(B +(B +(B +05%D8^96%B8Q: 7; 6<-\8/+-~;8)08(Xb8&-~<%X88 2+&~;8 Xb(>~<%X 2::+(~; X b(>9~<%X 2+~;Xb(>~<%X 27=6>:3 +(~=b(>9~>9X 2*(B 8(B 8 888(>8 88808X8Y8Z8_68Z8[((%c8S8TbY {z}@8GEy8((TJ6XT+SX((TX((TXJ6io &XJsXJ(/&XXJXJXTXJJ2+w6%E(B 6%?(B (2iYoN (!-,o r[p 5rkpsO zrpsP zoQ * 88s8888 8 8 8+0I88~%X9&88 _-888-e~/ *8,,@_-?_b~%X-X +7_b~%XbX~%XbX-~%XX- -~X~W~U(Y~(\(_ ~Y~W~U(Y i(\(b~ ,(. &-*888888 888` 0,_+N,Z+Y{%+U+V{&+R+SX}&+M+N{%%X+F+F{& _}&, _%Y,=*+++ ++++++0D 88{88888{T8JYE0/8, 8{8(8Y% /9'*{{(9% _, /#%:X/*}}}*~ Y}~ Y}{1J}X{{(*TXJ/*-{{(,{XJX} }:{{(9/*~}~}{1K }X{{(*TXJ%-/*{{(,{XJX}{{{(<{Y,} <* 88(#8888888#0G +%{16++{.++{1+++*+ ++++(R ++s+08{$8<8{!8{"3:,o*,88{#8{ 88{! X}! _{ {! X}! _b`{$_b`}#{$X}${#n-_b-%,Yj_i*82868:8>8R8Q8U8Y8X088 %,8{'Y888888X {&YTXJ1:{%{&XJ(-TJXJ3/J{%XJY(-XT+{%{&(-T{&JX _}&{'JX}'J* 88878>(S 8?8>(589(S 8482810888T+Q8%X88{#Ҝ88{#d}#88{$Y}$YJXT{$10-J*X{"{!YTXJ1XJ{ {!(R {!X}!{!{"Y_,4{ X{!TXJX}!XJ _}#}$JX* 8888888880U~ +=-~Z+6+7,~+ + +-++oT +-~[(e ++(e+&* 3QQ0+z8{T8z{%,R.<8oX8n8o{+n+r+vTXJXJXJXTXJY-J*(6-{{'1 {@J* 88888888(080888{&T88{'9,p18{'+#88{&8{'YX _TXT---XJYTXJ%-"1'{% XJYXJ(R XJXJ{%JY(R {'XJY}'{'/sU zXJ* 8$8#8"8'8&858=8<8@0f +T8Y-+- -+++++ +!+"oV ,)++++oW +++ -o *sX 8 8=D0 v8{!8{"/8z88X880880i1sY z_,3{#%X _{$_b`}#{$X}$} }!}"*8e8isU 8k8k8j 8j8j8k8j05@858588XT+D8X88XJT8XJ18XJ5%JXTXXJXTXJi2TX TXT+uXJJJXJXJY_bXTXJ 2?XXJ _TXJ _TXXJXJXJYXJY_cXTXXJXTXJ>XJ7}(X T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{((XJ(>XJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ T0XJ 0={(4XJ,XJb0XJ`h4X4XJ0XJ_bXT4XJ 2+z8X{(4XJ _TsU 8@8@8D 8J8Q0|~ +\~Z8X8Y~++&+,-,-++,"+o[ ++++~[(e-+("** 88(e8+4J0H~:+5_b~:+*c_b`~:+c_b`~:+c`h*++++D{z}PȾ +MJք,Te@98TE|k6,vS(]WB*BSJBv4.0.30319l#-xX#Strings#US#GUID#Blobw( %3>0[ff [lUBEEVr8(X(( w (I///PdE;[H(u*(lQ4^$ rrm %(+ 9?? ??I?I?I?I?I?/I? I? JB KE LH NK PN QQ ST UW VZ X] Y` Zc\f31133331VVVV3333#''146'6'33' 83131411413333333333 ) ) 3==KKU__mx !"#$%&'()*+,-./0123456789:;<=>@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdef?%H# P#<'[h**> 9 / i# i# i# i# i# i# q#,-i# i# #+@.H# # .#+H# /40#+#;1A3#;5H$P$V5\)$b7hD8oT9vK$p:;4<<$ >>?$VB\,EhE(F$bGlJHKL F>%F>%%F>2%F>"?%F>.L%F>8Y%F>Bf%F>Ps%F>Z%F>d%F>r%F>}%F>P%vzn!!IQ2Y Yh%a+Q2/a4i qdUIDtypeIDm00003FOe1bejaNTWAXp4pMSystem.IOF3FEgHshImOjFr6RLdarg_Svalue__mscorlibset_VerbSubSystem.Collections.Genericget_IsStaticReadThreadAddDynamicMethodmethodOpCodeEndInvokeBeginInvokeIDisposableRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandleIsInRoleWindowsBuiltInRoleget_Moduleset_WindowStyleProcessWindowStyleget_Nameset_FileNameget_FieldTypeValueTypeget_ReturnTypeownerTypeget_ParameterTypeSystem.CoreMethodBaseCloseDisposeCreateDelegateCreateGetStringDelegateMulticastDelegateCompilerGeneratedAttributeAttributeUsageAttributeAssemblyFileVersionAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeset_UseShellExecuteReadByteTryGetValueSetValueBuildTagConfigSystem.ThreadingEncodingFromBase64StringGetStringMathPathget_LengthiAsyncCallbackcallbackTransformFinalBlockSystem.Security.PrincipalWindowsPrincipalCallTailcallGetManifestResourceStreamMemoryStreamSystemSymmetricAlgorithmICryptoTransformEnumget_MetadataTokenMinPluginSystem.ReflectionArgumentOutOfRangeExceptionInvalidOperationExceptionFormatExceptionInternFieldInfoMethodInfoMemberInfoParameterInfoget_StartInfoProcessStartInfoSleepCharAesCryptoServiceProviderEnterGetILGenerator.ctor.cctorMonitorCreateDecryptorCreateEncryptordummy_ptrSystem.DiagnosticsGetFieldsGetMethodsSystem.Runtime.CompilerServicesOpCodesGetModulesCreateMemberRefsDelegatesBindingFlagsStringsget_CharsRuntimeHelpersGetParametersProcessAttributeTargetsset_ArgumentsConcatObjectobjectRetSystem.Reflection.EmitOnInitExitIAsyncResultresultEnvironmentGetCurrentStartConvertCallvirtSystem.TextInitializeArraySystem.Security.CryptographyGetExecutingAssemblydummyCopyop_EqualityWindowsIdentityEmptyMemberRefsProxy{c8ddd6f5-d75e-4b94-a3da-d6b9b6a31531}{973ad592-e92b-4355-bbbf-0b2fabfaa094}{15f3c0cb-0e6a-43b2-84a3-037c606636fb}1157M{973ad592-e92b-4355-bbbf-0b2fabfaa094}versionaSelected compression algorithm is not supported.Unknown HeaderUC#++*+(6+(I s;}!s<}"}i{!(*^ L}+(I *:(I (,*&( *2"+*(+2#+*(+2$+*(+2%+*(+2&+*(+2'+*(+2(+*(+2)+*(+2*+*(+2++*(+2,+*(+2-+*(+2.+*(+2/+*(+20+*(+21+*(+22+*(+23+*(+24+*(+25+*(+26+*(+27+*(+28+*(+29+*(+2:+*(+2;+*(+2<+*(+2=+*(+2>+*(+2?+*(+2@+*(+2A+*(+2B+*(+2C+*(+2D+*(+2E+*(+2F+*(+2G+*(+2H+*(+2I+*(+2J+*(+2K+*(+2L+*(+0 | :&~S~P~~ f888~ ξf889~T 88XR~W~: ~U~ f8~U~~ f( o; ~ f( (N((N(Q9~S~R~[~U~~ f( o; ~ f( (N((T(E~U~~ f( o; ~ f( (N((H,XR~](WXF:~S~P~~ f( o; (E~ ξf( (H9~e~Y~: ~U~ f( ~U~~ f( o; ~ f( (N((N(Q~U~~ f( o; ~ f( (N(~U~~ f( o; ~ f( (N((Z&~f (]~h~h~h~h~h~h~~ f( o; ~ f( (`~ f( (`~ rf( (`~ if( ~i(c(`~ xf( ~j(c(`~ Kf( ~R~k~ ^f( ~ f( ~ f( (f(E(`s< ~ls= ~ f( (i(+ ~h~ ֿf( ~ f( o; (`~h~ f( ~ f( o; (`~h~ f( ~ f( o; (`&~S~P~~ f( o; (E~ ξf( (H-"9~p~n(l(o(? ~p~n(l(o (@ &sA ~q(r~s~p~n(l(o(B ~p~n(l(o(C ~p~n(l(o(D (u~_(WsE ~v~t(x({~a(Ws= ~U~ kf( ~w(~(F U~ Jf( (G (N~{~y(~ ef( ~U~ 4f( (N(~~}(~(( ~~ f( ~ f( ~ hf( ( ~~}( (~ ~ Kf( ~~ Bf( o; ~ 9f( ~~ f( o; ~ f( ~(~(~ f( (&8~ls= ~ Kf( ~~ Bf( o; ~ f( ~~ f( o; ~ ܽf( ~(~((i&&* 8( 8o; 8(E8( 8(H8(K88( 8ALvh&0 ~~ f888~ ξf889 8k~~ ½f8a8f~ f8a(H o ~ f( ~o ~ f( ~o ~ rf( ~o ~ if( ( o ~ xf( ( o ~ Kf( ~ ^f( ~ f( ~ f( ( o o ~ f( %o o ~~ f( o; o ~ ξf( ( 9},s= ~ kf( ( (F ~ Jf( (G ( o ~ ef( ~ 4f( ( o ~ jf( ~ f( ~ hf( ( o o! ~ Kf( ~~ Bf( o; ~ Ǻf( ~~ f( o; ~ f( (" ($ ~ f( o% &8s= ~ Kf( ~~ Bf( o; ~ f( ~~ f( o; ~ ܽf( (" ($ ( &+( 8( 8o; 8( 8&*( 82o; 8-o 8(( 8-( 8(A708 + X+ +++(K +(J ++&݁98} (8y8~8T8QJ oL XRXTXoM YT+gXJoN ~3XR+\XT-+.~XJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ+0 +}8~T8}{%,U.?8rX8q8r8s{"+r+vTXJXJXJXTXJY-J*(-{"{-1 {@J* 8}8|8}88888(80~88~~+888~888sz +4,~ L~ f( ({ (&-X-,i2~R (EH(8w8v(8q8p8t8s(8n,-~c(W9*(8 80H~@+5_b~@+*c_b`~@+c_b`~@+c`h*++++0 ,_+N,Z+Y{++U+V{,+R+SX},+M+N{+%X+F+F{, _},, _%Y,=*+++ ++++++0 8{*8<8{'8{(3:,o*,88{)8{&88{' X}' _{&{' X}' _b`{*_b`}){*X}*{)n-_b-% Yj_i*82868:8>8R8Q8U8Y8X0 888{6T8JEJ-+8p8q8q}78q{7/*8h{7 X}7(+}6(}8{8/*{8X}8(+{7{8X}:{:L}4}6(}9{9/*{9X}9(+L}3}=}6+AX(TXJ/*(+{3~>{=XJҜ{=X}={={92{3s>}5}3}=}6+<{4X{=TXJX}=XJ%}<{={:3*{5(%_,/*2}+0D88{"88888{T8JYE0/8, 8{"8($Y% /9'*{${!(% _, /#%:X/*}%}$}*~ Y}~ Y}{1J}X{!{(TXJ/*-{!{(+{XJX} }:{%{!(/*~}~}{1K }X{!{(TXJ%-/*{!{(+{XJX}{"{{(({Y,} <* 88('8888888#0|~+\~8X8Y~++&+,-,-++,"+o| ++++~(-+(/** 88(8+4J0 +f8g{-8c8dX}--+^ 3,+Uz,+V{++R+S{, X},Ҝ--{, _},*88 88+sx ++++088{-8X%}-8 18z8{,8Y _8-v 8-Y0c{,/Z0L{+{+{,(y {,X},*{+{,X},{+%X %Y0*(*8483878>sx 8@8@8D 8J8Q08X8Y8Z8_L8Z8[(%%c8S8TbY {z}@8GEy8(%TJLXT+SX(%TX(%TXJLio4 &XJs9XJ(&XXJXJXTXJJ2+wL%K(i L%E(i (iYo~ ()- o rp 4rps zrsps zo * 88sB8888 8 8 8+08 88T+Q8%X88{)Ҝ88{)d})88{*Y}*YJXT{*10-J*X{({'YTXJ1XJ{&{'(y {'X}'{'{(Y_,4{&X{'TXJX}'XJ _})}*JX* 88888888805@848488XT+D8X88XJT8XJ18XJ4%JXTXXJXTXJi2TX TXT+uXJJJXJXJY_bXTXJ 2?XXJ _TXJ _TXXJXJXJYXJY_cXTXXJXTXJ>XJN}.X T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{.(XJ(XJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ ( 8?8>(#89( 8482810I88~ %X9&88 _-888-e~V *8,,@_-?_b~ %X-X +7_b~ %XbX~ %XbX-~ %XX- -~~~(~ (( ~~~( i((~,( &-*888888 888` 02rprp, 8%-~S~rp8,98~~8-~~8rp88~~+3+4(L~(&-() +(+,~c(W*sI 8((H8Fs 8O(8Y(8f(8f 8eI0S+/, f%, a+$+&~-Y+~--++*++*+++++(/++(!+0|4%F+Q-B4%M+A,4%N+1%,4%I+!--*(i +(i +(i +(i +0 L8:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2s>/ L +%X 2,s>0* 8H8P8T8W8X8f8i8k8s0\4%L+91-%,4%G+'2-%,͍4%J+>*(i +(i +(i +0 4%J8^?L%H8Q@ NA LB-\8/+-~A8)08(Xb8&-~B%X88 2+&~A8 Xb(~B%X 2::+(~A X b(9~B%X 2+~AXb(~B%X 2NCLD:3 +(~Cb(9~D9X 2*(i 8(i 8 888(8 888{z}O/ˁelf N-?> ^Q`'§}6e}ZkEUGh!_@clhJp.eZULb㈯CتX%IW%i˪ ξ|-:|&|; FdPeCpUre/^ËMFdn{g$̥StX5p^dj740%%X x-Z^>nQ/zn)d-in?̲5xvܠS@5nLK Įeӷ茱PP s)L-FViQ6GՀ˶'f =Q5hH_Zj@ !UJ\v9dmw%P(Kb"Pgvoc'J5Gfr]>JpmfawW1Vtn~Km0Kֹ-4gAJsY49q[_`<[Y渗l_sXЄ|58n/Zm7 SNڸgB07Qan8F/޼( 2SJ@XҢՏjUSX\xߙAuQq1HgBQ໫1MhEZr YK@;DzPfXQ.k@aABSJBv4.0.30319l#-dp#Strings'#US(#GUID(#Blobw( %3PNf I tH, T mW W u T W / f G L 1 W Z L8 8 _ a ( P8 ''' _ 4 = f9& G A' t8 F8 $-I X 1 2 3 4446 7 89 99&;+< .=1??AEB ECOCOCOC OCOC j AOC OC SF TI UL VO ZR \U dX f[ g^ ia kd# lg% nj( om* qp, rs. tv1 uy3 w|6 x8 z; |= ~@ B ! % ( , / 2 5 9 < ? B E H L At|Z|31133331VVVV 3333 6633 31311113333333333 $$////// //#9"9%E(P'P*\,\.a1m0m3x658;:=@?B! %$(,+/25#9.8.<=?=BBEMHMLRKRP_O_TlSlWzZ]a`edhlk !"#$%&'()*+ -./0123456789:;<=>?@ABDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~CH# 'Ox0 s# {# 4m8 7@8h# # # :`;#=@>#>? @(AA$C+`C0C8D?G4HJG $L*$RKXZ$L|$R$_K0LeNl$vO}S$_,TG$# # # $GUVG# # %DWs# C% W[%s# X8Yj% Ft%F%F)%FZ%F%F)%F4%F>%FJ%FU%F.%Ff&Fr&F}&F*&F7&FD&FQ&F^&Fk&Fx&F&F&F&F&F&F&Fk&F(&F3&F4&FG'F'FW!'Fd.'Fq;'FH'FU'Fb'Fo'F|'F'F'2y2y O P NN^P I. .I~ 2Q;8I* =Y! CY CY,IYD aJ iD qJ Y5NyTIZ``,dk$puaza> V1 IB II* R !yd!U !iAdiC!Q)Y a.i q3:> LE7Lt LPLLCY1 k. 1T^A.g{.IALInAs@z6YI D Ll { b Y51! !b91p16L V&A.A.I Q Y )p 8 ak)Ei LIgNQWi.yH^ 1dLPTX..CjjCc#CtLt x!EY~ 'P E FP!G`!Hp!I!J8"KH"LX"M"N - !}k~~~~~~~~~~~~~~~Ldarg_0Ldarg_1Microsoft.Win32ToInt32Ldarg_2Dictionary`2m000043Ldarg_3Int64Ldc_I4MD5Int16get_UTF8UIDtypeIDmmiKHH6M54HVHget_ASCIISystem.IOLdarg_Sget_Xget_Yvalue__UploadDatamscorlibSubSystem.Collections.Genericget_IsStaticReadThreadOnLoadAddSystem.Collections.SpecializedAppendDynamicMethodmethodReplaceOpCodeFromImageEndInvokeBeginInvokeIDisposableRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandleRectangleget_Moduleget_Nameget_MachineNameConfigPluginNameget_UserNameElapsedTimeDateTimeOnStealerDoneget_FieldTypeValueTypeSecurityProtocolTypeget_ReturnTypeownerTypeget_ParameterTypeSystem.CoreMethodBaseCloseDisposeCreateCreateDelegateCreateGetStringDelegateMulticastDelegateCompilerGeneratedAttributeAttributeUsageAttributeAssemblyFileVersionAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeReadByteTryGetValueSetValueSaveget_SizeDeserializedwoQN1OowL251Plugin1VDvC7y0FbnQfBuildTagConfigget_PngSystem.Threadingget_EncodingSystem.Drawing.ImagingFromBase64StringEscapeDataStringDownloadStringToStringGetStringSystem.DrawingWorkLogComputeHashMathPathget_Widthget_LengthUriAsyncCallbackcallbackTransformFinalBlockCallTailcallset_SecurityProtocolGetManifestResourceStreamMemoryStreamget_ItemSystemSymmetricAlgorithmHashAlgorithmICryptoTransformEnumTimeSpanCopyFromScreenget_PrimaryScreenget_MetadataTokenMinCopyPixelOperationSystem.Web.Script.SerializationSystem.ReflectionNameValueCollectionWebHeaderCollectionArgumentOutOfRangeExceptionInvalidOperationExceptionFormatExceptionInternFieldInfoMethodInfoMemberInfoParameterInfoBitmapSleepCharAesCryptoServiceProviderStringBuilderServicePointManagerCurrentUserEnterToLowerJavaScriptSerializerGetILGenerator.ctor.cctorMonitorCreateDecryptorCreateEncryptordummy_ptrGraphicsGetFieldsget_BoundsGetMethodsSystem.Runtime.CompilerServicesOpCodesScannedDirectoriesGetModulesCreateMemberRefsDelegatesGetBytesBindingFlagsStringsget_TicksSystem.Windows.FormsSystem.Web.Extensionsget_Charsget_HeadersRuntimeHelpersGetParametersHostAddressAttributeTargetsConcatImageFormatPixelFormatObjectobjectSystem.NetRetPUcCx3SuTQiftget_HeightSystem.Reflection.EmitOnInitExitIAsyncResultWorkResultresultWebClientEnvironmentConvertCallvirtSystem.Textget_NowInitializeArrayToArrayCreateSubKeyOpenSubKeyRegistryKeySystem.Security.CryptographyGetExecutingAssemblydummyCopyRegistryop_EqualityEmptyMemberRefsProxy{f2553ab1-f51b-48e1-afcd-a5919dfaf2e2}{a939bb7b-371d-4ab2-995f-90bbdebb96f2}{cbfe422f-504f-4f14-b6b8-eb7310dbb04a}~~~~~~~~~~~~~versionaSelected compression algorithm is not supported.Unknown Header122M{cbfe422f-504f-4f14-b6b8-eb7310dbb04a}#oO~z\V4 ?_ :18V6N5 - A Q U1Y ]ae 5ei m u u 5 - 0 ] ! ! `XTX X X \`d T\XdXlX\\ XX`\X8LX\d` xt| - A Q U 1Y ]a e 5e i m u $ ( 5, 0 4 TWrapNonExceptionThrowslD@--1MUUUUUiMi $% lL 5Ѝ _CorDllMainmscoree.dll% @0HX4VS_VERSION_INFO?,StringFileInfo000004B0$FileVersion$InternalName(LegalCopyright,OriginalFilename(ProductVersion,Assembly VersionDVarFileInfo$Translation>", Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PEL#b!Rq @ @pO$ H.text$Q R `.rsrc$T@@.relocX@BqHO(!NM:`&^ #+3;CScs DdhøO!Q !1Aa 0@`2+*+(( *++~ f+*() +( +(+(Q *>++*+(+(( s+}s3}}{io**+*++{%+'_d}%-++{&+Y}&,*++++++.+{&*++${$+ {#-Y-+{&-c-X*++++++,{%+({&__d}%++{&_}&*+++++^+{#+{$*++F +{)Y*+.+{)*+^ 9}'(( *:(( (6*+ +++b`*+o` ++o` +++++b`*+(?++(?+&(a *2!+*(+2"+*(+2#+*(+2$+*(+2%+*(+2&+*(+2'+*(+2(+*(+2)+*(+2*+*(+2++*(+2,+*(+2-+*(+2.+*(+2/+*(+0+,++(++(+&*0~~ f888~ lf889~ {f8888o o o ~ Jf(o ~ af(( ( ~ f(~ f(o ~ f(( o ( &#(8]s 8X8W8V&( ( (! %: 8 9~ {f(s o -o o ~ Jf(o -~ af(~ f(~ f(o ~ f(( o ( && X i?<*,o" 8 (# ~ {f(s o o o -F~ Jf(o ~ af(~ f(( o ( && ($ :g o ,*(8go% 8bo& 8](8b( 8]47'0M~M~K++ + ,%,+,%,(D+s' +(G+ +&%-*+*+??08 + X+ +++(* +() ++&݁98} (8y8~8T8QJ o+ XRXTXo, YT+gXJo- ~3XR+\XT-+.~XJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ XJo? XXJXTXJXJ2~@ o: XF-~A +~B oC ~D o: oE & oF &-JXTJi?* 8I8}oG 8}8|8{@ )3" /C20Z,:3%+%+ , +#+(++--,*(H +() +( +oI +oJ +08[8\ (8X8]8^T,8-8U8VJ8U8o1 () .9~5 () %8() oK sL o8 ~9 o: () oM XT+]XJo6 () 34~N oO _o? ~P o: ~A oC +,XXJXTXJi-2~D o: () oE oF 8&JXTJi?* 88oG 888888A=P0|~+\~N8X8Y~ ++&+,-,-++,"+oR ++++~O(J-+(** 88(J8+4J0I88~ %X9&88 _-888-e~5 *8,,@_-?_b~ %X-X +7_b~ %XbX~ %XbX-~ %XX- -~S~R~P(M~ (P(S ~T~R~P(M i(P(V~,( &-*888888 888` 0U~+=-~N+6+7,~ + + +-++oS +-~O(J ++(J+&* 3QQ02rprp, 8%- ~U~rp8,98 ~V~8- ~Y~W8r p88~\~[+3+4(h9~^(k&-( ,+(e+,~`(n*s( 8((Y8FsT 8O(\8Y(_8f(b8f 8eI0S+/, f%, a+$+&~ -Y+~--++*++*+++++(++(+0f +T8Y-+- -+++++ +!+"oU ,)++++oV +++ -o *sW 8 8=D0 8X8Y8Z8_98Z8[o@%c8S8TbY {z}@8GEy8o@TJ9XT+SXo@TXo@TXJ9io &sXJXJo!&XXJXJXTXJJ2+w9%G(H 9%A(H (iYoX (-,o r[p 8rkpsY zrpsZ zo[ * 88sA8888 8 8 8+0D88{88888{T8JYE0/8, 8{8o,Y% /9'*{ {o7% _, /#%:X/*}!} }*~ Y}~ Y}{1J}X{{o#TXJ/*-{{o${XJX} }:{!{o7/*~}~}{1K }X{{o#TXJ%-/*{{o${XJX}{{{o.{Y,} <* 88o08888888#0T%98 8X8 {T8XJYE"n88{:,8}*88{8TJ/*{o$J9_, 9e}JcE8+H{o',}+1~+} ~,}!}+s;}}*{o#%}/*{o$}{o#-/*{o$}X{{{o/T{XJY}{- }*{o(*{{o8-*{o9} {o:}!}(*9** 88888/8;8C8Bo#8C0 +w8xT8w{%,O.98lX8k{+j+n+r+vTXJXJXJXTXJY-J*( -{o11 {@J* 88888888o280|8%B+Q-B8%I+A,8%J+1%,8%E+!--*(H +(H +(H +(H +08{&8<8{#8{$3:,o*,88{%8{"88{# X}# _{"{# X}# _b`{&_b`}%{&X}&{%n-_b-%,Yj_i*82868:8>8R8Q8U8Y8X08 88T+Q8%X88{%Ҝ88{%d}%88{&Y}&YJXT{&10-J*X{${#YTXJ1XJ{"{#(\ {#X}#{#{$Y_,4{"X{#TXJX}#XJ _}%}&JX* 8888888880,v8{#8{$/8z88X880880i1s] z_,3{%%X _{&_b`}%{&X}&}"}#}$*8e8is^ 8k8k8j 8j8j8k8j0+f8g{)8c8dX})-+^ 3 +Uz +V{'+R+S{( X}(Ҝ--{( _}(*88 88+s^ ++++0,_+N,Z+Y{'+U+V{(+R+SX}(+M+N{'%X+F+F{( _}(, _%Y,=*+++ ++++++088{)8X%})8 18z8{(8Y _8-v 8-Y0c{(/Z0L{'{'{((\ {(X}(*{'{(X}({'%X %Y0*(-*8483878>s^ 8@8@8D 8J8Q0 88 %,8{)Y888888X {(YTXJ1:{'{(XJo)TJXJ3/J{'XJYo)XT+{'{(o)T{(JX _}({)JX})J* 88878>(_ 8?8>o&89(_ 8482810 888{(T88{)9 o18{)8+88{({)YX _TXT---XJYTXJ%-"1'{' XJYXJ(\ XJXJ{'JY(\ {)XJY}){)/s^ zXJ* 8%8$8#8(8'86898:890 98:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2s5+ 9 +%X 2,s5,* 8H8P8T8W8X8f8i8k8s05@888888XT+D8X88XJT8XJ18XJ8%JXTXXJXTXJi2TX TXT+uXJJJXJXJY_bXTXJ 2?XXJ _TXJ _TXXJXJXJYXJY_cXTXXJXTXJ>XJ@}*X T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{*(XJ(=XJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ -\8/+-~=8)08(Xb8&-~>%X88 2+&~=8 Xb(=~>%X 2::+(~= X b(=9~>%X 2+~=Xb(=~>%X 2@?9@:3 +(~?b(=9~@9X 2*(H 8(H 8 888(=8 888{z}9ab`,ˬՐʃԄɑ bal;|*ݾa](%6ϰUmFz`\8X Tce=G돳᫳k3#Xn:o3Ճ>QvK=w:cX܍?^<- Fݨs{}BSJBv4.0.30319l#-#Strings|#USh#GUIDx#Blobw( %3A1`ooa%hVIB\BBT7ZKMkM.M % -%n %3O{spf77m777UM`@O5r%p "#',*4 -8 ;=A?ABKBKBKBKB KBKB KB LE NH PK QN SQ TT UW VZ W] X` Zc \f ]i" _laoI3;111?1C1K1N1QQV_V_V_V_1111QQQQ QN?QQQ?QQ6611??QQQQ Q QQ111?11?11?3333333333 )4>IS]]iis"}!}%$ !"#$%&'()*+,-./0123456789:;<=>?@ACDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnoBH#N&{<&T)U# ]# ), T- ! M'H >5# # # # # # #T/T/T1Y1 2T# # D3w3#570:p: |;#x$&$V$ $xT??@$$Bp$ 4C $8D|GHKLU# pL L M $%3%F !FM=% !FMJ% !FMW% !FMd% !FM q% !FM.~% !FM9% !FMC% !FMN% !FMX% !FMb% !FMn% !FMx% !FM% !FM% (%,gI)Q.a4aU4ix9i>qFy_Ly=Qq>W \a gq>kp x } }) Ly/y}}uzyQ A1@y yAAAQZYAayYIrii%y'+qI0y/+yN+yc+y+qI7yr+ym+y+qI?y3+iIQQ8Wakrwi}Byk+1y+ $$$ .} $ 1UIDtypeIDSystem.IOLdarg_SIs1jm2w0L3MH28uSvalue__mscorlibset_VerbSubSystem.Collections.Genericget_IsStaticReadAddDynamicMethodInstallationMethodmethodReplaceOpCodeEndInvokeBeginInvokeIDisposableRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandleIsInRoleWindowsBuiltInRoleget_Moduleset_WindowStyleProcessWindowStyleget_NameConfigPluginNameget_FieldTypeValueTypeget_ReturnTypeownerTypeget_ParameterTypeSystem.CoreMethodBaseCloseDisposeCreateDelegateCreateGetStringDelegateMulticastDelegateCompilerGeneratedAttributeAttributeUsageAttributeAssemblyFileVersionAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeset_UseShellExecuteReadByteTryGetValueSetValueBuildTagConfigSystem.ThreadingEncodingFromBase64StringGetStringMathPathget_LengthiAsyncCallbackcallbackTransformFinalBlockSystem.Security.PrincipalWindowsPrincipalCallTailcallOnInstallGetManifestResourceStreamMemoryStreamget_ItemSystemSymmetricAlgorithmTrimICryptoTransformEnumget_MetadataTokenMinPluginSystem.ReflectionArgumentOutOfRangeExceptionInvalidOperationExceptionFormatExceptionInternFieldInfoMethodInfoMemberInfoParameterInfoProcessStartInfoCharAesCryptoServiceProviderEnterGetEnumeratorGetILGenerator.ctor.cctorMonitorCreateDecryptorCreateEncryptordummy_ptrSystem.DiagnosticsGetFieldsGetMethodsSystem.Runtime.CompilerServicesOpCodesGetDirectoriesGetModulesCreateMemberRefsDelegatesBindingFlagsStringsInstallationPathsget_CharsRuntimeHelpersGetParametersProcessAttributeTargetsset_ArgumentsConcatObjectobjectRetSystem.Reflection.EmitOnInitExitIAsyncResultresultEnvironmentget_CurrentGetCurrentGetPathRootStartConvertCallvirtMoveNextSystem.Textset_CreateNoWindowInitializeArraySystem.Security.CryptographyGetExecutingAssemblydummyCopyget_SystemDirectoryop_EqualityWindowsIdentityEmpty79jwYs1UOc5hFmuyMemberRefsProxy{d43ce598-bc32-44ec-be58-db0883b2bfa0}{8b3c3c07-a856-4692-89cb-689f20605fe4}{80bab5b3-69fa-49c5-b0ed-800b07e79bcd}1117M{80bab5b3-69fa-49c5-b0ed-800b07e79bcd}versionaSelected compression algorithm is not supported.Unknown Headerz5dlIOLz\V4 M% -5 A E u } y %Q Q Q QQQ Q ! QQ ] MM!Q UY U4H ]TX`\ T T T \t|px % - 5 A E TWrapNonExceptionThrowslD@yyyyyy"QQ E] hH]pq q_CorDllMainmscoree.dll% @0HX4VS_VERSION_INFO? StringFileInfo000004B0$FileVersion$InternalName(LegalCopyright OriginalFilename(ProductVersion Assembly VersionDVarFileInfo$Translationp 1"57:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMzMzMzMzNzMzMzMzMwAAAIiIiIiIiDiIiIiIiIgAAACIiIiIiIg4iIiIiIiIAAAAiIiIiIiIOIiIiIiIiAAAAIiIiIiIiHiIiIiIiIgAAACId3d3d3d4d3d3d3eIAAAAh3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cACId3d3d3d3c3d3d3d3d3eIiHd4iIiIiIiIiIiIiId3iIh3f//////////////3d4gId4//////////////+HeAB3eP//////////////h3cAB3////////////////dwAAeP///////////////4cAAB/////////////////xAAAAIiImIgREZ3QREZlXAAAAAGIiJiJERGd2ERGZeAAAAABiIiYiRERndhERmXgAAAAAYiImIkREZ3YREZl4AAAAAGIiJiJERHd3ERGZeAAAAABiIioiRER3dxERmXgAAAAAYiImIkREZ3cREZl4AAAAAGu7u7JDO7u3EZu7uAAAAABmImpiRER3dxERmXgAAAAAd3d3d3d3d3d3eIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////+AAAA/gAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAABwAAAAAAAAAAAAAAAIAAAAGAAAABwAAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAHAAAAD8AAAD/AAAA/wAAAP8AAAD////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790970809908,"unified_at":"2026-10-02T19:53:29.908Z","metadata":{"hashes":{"sha256":"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba","sha1":"0fc13324c27a80df7ee4888847c7d727d3c3cce0","md5":"5b2143f96b4320321dd6df5f40a98d4a","sha512":"3a4377466ab3adf4033a170aa6a4721ba191e9fc270e8909e99bcb160a99ba9fd12743ff7b1512ba493411e66333a8f949bb592a11160d98b9b06a3ef5d77702","ssdeep":"24576:U2G/nvxW3Ww0t6wYIH9+6GMvCA889s9bb00a+7B8cyZjEvpwuDUxWIFO2jTCE:UbA306w/GiCA8Jl0B+7CZcHDUQyh","ssdeep_chunks":["24576:U2G/nvx","24576:2G/nvxW","24576:G/nvxW3","24576:/nvxW3W","24576:nvxW3Ww","24576:vxW3Ww0","24576:xW3Ww0t","24576:W3Ww0t6","24576:3Ww0t6w","24576:Ww0t6wY","24576:w0t6wYI","24576:0t6wYIH","24576:t6wYIH9","24576:6wYIH9+","24576:wYIH9+6","24576:YIH9+6G","24576:IH9+6GM","24576:H9+6GMv","24576:9+6GMvC","24576:+6GMvCA","24576:6GMvCA8","24576:GMvCA88","24576:MvCA889","24576:vCA889s","24576:CA889s9","24576:A889s9b","24576:889s9bb","24576:89s9bb0","24576:9s9bb00","24576:s9bb00a","24576:9bb00a+","24576:bb00a+7","24576:b00a+7B","24576:00a+7B8","24576:0a+7B8c","24576:a+7B8cy","24576:+7B8cyZ","24576:7B8cyZj","24576:B8cyZjE","24576:8cyZjEv","24576:cyZjEvp","24576:yZjEvpw","24576:ZjEvpwu","24576:jEvpwuD","24576:EvpwuDU","24576:vpwuDUx","24576:pwuDUxW","24576:wuDUxWI","24576:uDUxWIF","24576:DUxWIFO","24576:UxWIFO2","24576:xWIFO2j","24576:WIFO2jT","24576:IFO2jTC","24576:FO2jTCE","49152:U2G/nvx","49152:2G/nvxW","49152:G/nvxW3","49152:/nvxW3W","49152:nvxW3Ww","49152:vxW3Ww0","49152:xW3Ww0t","49152:W3Ww0t6","49152:3Ww0t6w","49152:Ww0t6wY","49152:w0t6wYI","49152:0t6wYIH","49152:t6wYIH9","49152:6wYIH9+","49152:wYIH9+6","49152:YIH9+6G","49152:IH9+6GM","49152:H9+6GMv","49152:9+6GMvC","49152:+6GMvCA","49152:6GMvCA8","49152:GMvCA88","49152:MvCA889","49152:vCA889s","49152:CA889s9","49152:A889s9b","49152:889s9bb","49152:89s9bb0","49152:9s9bb00","49152:s9bb00a","49152:9bb00a+","49152:bb00a+7","49152:b00a+7B","49152:00a+7B8","49152:0a+7B8c","49152:a+7B8cy","49152:+7B8cyZ","49152:7B8cyZj","49152:B8cyZjE","49152:8cyZjEv","49152:cyZjEvp","49152:yZjEvpw","49152:ZjEvpwu","49152:jEvpwuD","49152:EvpwuDU","49152:vpwuDUx","49152:pwuDUxW","49152:wuDUxWI","49152:uDUxWIF","49152:DUxWIFO","49152:UxWIFO2","49152:xWIFO2j","49152:WIFO2jT","49152:IFO2jTC","49152:FO2jTCE","24576:UbA306w","24576:bA306w/","24576:A306w/G","24576:306w/Gi","24576:06w/GiC","24576:6w/GiCA","24576:w/GiCA8","24576:/GiCA8J","24576:GiCA8Jl","24576:iCA8Jl0","24576:CA8Jl0B","24576:A8Jl0B+","24576:8Jl0B+7","24576:Jl0B+7C","24576:l0B+7CZ","24576:0B+7CZc","24576:B+7CZcH","24576:+7CZcHD","24576:7CZcHDU","24576:CZcHDUQ","24576:ZcHDUQy","24576:cHDUQyh"],"imphash":"fcf1390e9ce472c7270447fc5c61a0c1"},"file_info":{"file_name":"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin","file_type":["peexe","executable","compressed","sfx","rar"],"file_type_id":"exe rar sfx","file_size":1785474,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1769480252000,"last_seen":1769685010000,"last_multi_scan":1769685010000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["autoitinject","dcrat","spynoon","ymacco","autoit","evasive"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":84},"sandbox_signatures":{"informative_count":208,"suspicious_count":14,"malicious_count":7,"total":229},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/MSIL.DCRat","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Prometheus.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Uztuby-9855059-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Backdoor_MSIL_DCRat_MTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Prometheus.2 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Spy.Agent.DTP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.eklw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.Generic.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/RarMal-R","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/S-1b09bef6!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.UTZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Prometheus.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Able to manipulate a file/directory time format"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"},{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"suspicious","value":"Reads VM-specific registry key"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve system time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Able to download remote files using web shell script"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Contains ability to use Webdav for network"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")\n Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00001440.00000000.118983.00AB2000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00001440.00000000.118983.00AB2000.00000002.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00001440.00000000.118983.00AB2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"nulstart \"\" \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\SavesIntoperfNet\\SessionbrokerDhcp.exe\"del /a /q /f \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\\\69mv2oDVEO.bat\"\" (Indicator: \"w32tm \"; File: \"69mv2oDVEO.bat\")\n Found string \"w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2\" (Indicator: \"w32tm \"; Source: \"00000000-00004924-00000C47-1746547842\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-519","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")\n Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")\n Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"00000000-00001440.00000000.118983.00AB2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00007680-46106-75-00B25341\n GetProcessHeap@KERNEL32.DLL at 00000000-00007680-46106-77-00B252DC\n GetProcessHeap@KERNEL32.DLL at 00000000-00007680-46106-80-00B252C5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"SessionbrokerDhcp.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\SavesIntoperfNet\\SessionbrokerDhcp.exe\" at 00000000-00001440-00000C17-858328868\n \"SessionbrokerDhcp.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Security\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Security.dll\" at 00000000-00001440-00000C17-860948891\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00004924-00000C17-865201520\n \"SessionbrokerDhcp.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Security\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Security.dll\" at 00000000-00004292-00000C17-872900798","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00004924-00000C17-865201520","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" - Source: \"00000000-00007680.00000001.118606.73371000.00000020.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00001440\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$48","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001440.00000000.118983.03050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in file \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\"\n Found registry query API: \"RegQueryValueExW\" in file \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"nulstart \"\" \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\SavesIntoperfNet\\SessionbrokerDhcp.exe\"del /a /q /f \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\\\69mv2oDVEO.bat\"\" (Indicator: \"\"del \") in Source: 69mv2oDVEO.bat","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00001440.00000000.118983.1E4C0000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004292.00000000.119858.1E2F0000.00000004.mdmp, 00000000-00004292.00000000.119858.1E7F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"SetFileSecurityW\" (Indicator: \"SetFileSecurityW\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"3f54db25b01ad924cf34808063d6e13c9d1bab97693fc7bf5f7d73d37771efba.bin\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"SessionbrokerDhcp.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"94A29F035391DC010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"697b4018b9ef7ea9bc0415c9"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"