26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4dc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.MSIL.Basic.8 Sample a3f191beb1c2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a3f191beb1c2…. Malware family: Trojan.MSIL.Basic.8. Threat score 100/100. 12/28 AV engines flagged this file. 4 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a3f191beb1c2fd9542d8ea5fa25e5d375d55c9ace02640a9d95e2a694db3113b","keywords":["Malicious","Trojan.MSIL.Basic.8","malware analysis","sandbox report","threat intelligence","a3f191beb1c2fd9542d8ea5fa25e5d375d55c9ace02640a9d95e2a694db3113b"],"about":{"@type":"SoftwareApplication","name":"a3f191beb1c2fd9542d8ea5fa25e5d375d55c9ace02640a9d95e2a694db3113b.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"a3f191beb1c2fd9542d8ea5fa25e5d375d55c9ace02640a9d95e2a694db3113b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.MSIL.Basic.8","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T40a,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00000812.00000000.102639.6F471000.00000020.mdmp, 00000000-00000812.00000001.102881.6F391000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000812.00000001.102881.6F421000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00000812.00000001.102881.6F421000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00000812.00000001.102881.6F421000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000812.00000001.102881.6F421000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000812.00000001.102881.6F421000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000812.00000001.102881.6F421000.00000002.mdmp")28:T6a8,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000812.00000000.102639.05BC0000.00000004.mdmp, 00000000-00000812.00000001.102881.6F421000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000812.00000001.102881.6F421000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000812.00000001.102881.6F421000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000812.00000001.102881.6F421000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000812.00000001.102881.6F421000.00000002.mdmp, 00000000-00000812.00000001.102881.6F485000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000812.00000001.102881.6F421000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000812.00000001.102881.6F421000.00000002.mdmp, 00000000-00000812.00000001.102881.6F485000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00000812.00000001.102881.6F421000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00000812.00000001.102881.6F421000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000812.00000001.102881.6F421000.00000002.mdmp")29:T1ab5,Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00000812.00000000.102639.05BC0000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000812.00000000.102639.05BC0000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00000812.00000000.102639.05BC0000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00000812.00000000.102639.05BC0000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00000812.00000000.102639.05BC0000.00000004.mdmp, 00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000812.00000000.102639.05BC0000.00000004.mdmp, 00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00000812.00000000.102639.05BC0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00000812.00000000.102639.05BC0000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00000812.00000000.102639.05BC0000.00000004.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00000812.00000000.102639.05BC0000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000812.00000000.102639.05BC0000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00000812.00000000.102639.05BC0000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00000812.00000000.102639.05BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp")2a:T4ea,"" - Source: "00000000-00000812.00000000.102639.6F471000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000812.00000001.102881.02940000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00000812.00000001.102881.04AB0000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00000812.00000001.102881.04BC0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00000812.00000001.102881.6F391000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00000812.00000001.102881.6F391000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00000812.00000001.102881.6F391000.00000020.mdmp")3b:T723,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000812.00000000.102639.02940000.00000004.mdmp, 00000000-00000812.00000001.102881.02940000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000812.00000000.102639.02940000.00000004.mdmp, 00000000-00000812.00000001.102881.02940000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000812.00000000.102639.02940000.00000004.mdmp, 00000000-00000812.00000001.102881.02940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000812.00000000.102639.02940000.00000004.mdmp, 00000000-00000812.00000001.102881.02940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000812.00000000.102639.02940000.00000004.mdmp, 00000000-00000812.00000001.102881.02940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000812.00000000.102639.02940000.00000004.mdmp, 00000000-00000812.00000001.102881.02940000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000812.00000000.102639.02940000.00000004.mdmp, 00000000-00000812.00000001.102881.02940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000812.00000000.102639.02940000.00000004.mdmp, 00000000-00000812.00000001.102881.02940000.00000004.mdmp")3c:T9e4," @ `K H.textD `.rsrc@@.reloc@B H&0^+(1JzS( s ( ( = =rps z*J+(iD(3(*b+(?X(3(( *j+(;)h(3(( *+(ӀB(3(s s s s *0+(}B~o 8*0+( sl~o 8*0+(v>i~o 8*0+({J~o 8*0`+(1 ^~() 98 $e OFa~{a(5(! o* s+ ~ 8*0 +(|n~ 8*>+(K7*0L+(j8( Cw= b ya~{a(5~o, ( t 8*+(5.(3(s(- t*b+(8W(3((. *0+(A%s1~ 8*0+(('>( ??8p ᛝ wa~{a(5@('@( AA8< ǻ Şa~{a(5B('B( CC88 8*0i % 1y D*ya~{a(5 8" (%9 8 i: 8*0,s8 }(8 9s9 (+8*0(; (1 9 (< *0 ~ (( 8*0 () 8*0o= (> ( b IWa~{a(5o? (> (@ Ef Na~{a(5(A 9(* 8 8*0|E&I8g~ 9~ 8D8T~ 9~ 8!81~9~ 88(, 8(! oB oC (; ϣZ c ɠ)a~{a(5~~ (+94 X ̋Da ga~{a(5(5 (D 89E8$8& 88(, 8 8*0e |8 P[Ya~{a(5(E 9- 'a~{a(5(E (F :(F 89 (5 8(G oH 9 89 8(; + lǲX Lya~{a(5(I 9 % oY \a~{a(5oJ ; 897 oK oL oK (I 8? @ 89# /7| $wa~{a(5(I o39 8 o7i9 8oM 9di8JoM 982(N 9> 8* *0 (.(/ 8*0 8*0- s2 ~4 ~4 (&o3 8*b+(y\K(3(($ *0f+(4 k~.o~.o9~.o~.o9~.o~.o(< 8*0+(X9!~.o~.o(N 8M9!~.o~.o(N 8 9(P 8 8*0q+(B/0~.o9~.o8 97~)oP oQ oR oS oT o" ~.o(>(C*0+(.9Y(D 9(U 8 9 ~.o(?8[ oV 9( oV oW (A 9 (@(X (Y i:(A(Z ([ *FA0+(dV@(8 8*B+((Jo\ *0+(Ʀg(1 9 (; (] &~.os^ o_ (> 3a +a~{a(5(I % rkY wa~{a(5 % " >X a~{a(5% e a~{a(5% Fp b a~{a(5%% =a~{a(5% hɚ .a~{a(5% %< }ލa 4a~{a(5 % \y !2aa~{a(5%% fk ka~{a(5%% vZ- b a~{a(5% |8 e0xa~{a(5 % m C}X T\a~{a(5%% 뵍e (K?a~{a(5 \1 )a~{a(5 ǻ xBa~{a(5%(` %(` % (` %(` %(` (a (S*0^+(ohYsb % , X a~{a(5oc %od %oe %of %og (h &*0t+(-:~.o~.o`9 ~.o98-~.o:~.o8~.o(q ~.osi % sj ok %ol om on so 2sj op oq l#@[(r os l#@[(r st ou (v ow sx %sj op %(v oK oy % oz ({ oz (| st ou om o} om o} (D(~ 9 8~.~.o s =LGa a~{a(5%~.% o % S%% o %%%%%%( :8 ( ( o( ( o(|*0 y+(%N] ջh Ǘ}$a~{a(5 tI( j~.o 91( X ̋Da ?a~{a(5o t (E~.(L( o ~.~.o ƅ ia~{a(5( %( ( o ~.~.o Q`: Ia~{a(5( %( C ""a~{a(5( o" o*0 +(7Y3 3f *na~{a(5( (%W( (%X( i8i]a>i 8 i]a >i 8i]a > 8*0!+()CKCsK 8*b+(CW^(3(($ *0#+(.>E~ o 9o 8 98!o o" o 99 9(O(R9o 8*y0$+(lK~ o ~ o o o" c Ha a~{a(5 ; ֔RY -Ia~{a(5( 9o 8*f|0~%+(~6(7 Ve 'Wa~{a(5(G wf Ma~{a(5( (@ (D 9 (Q 8 8*0&+( 1_Y 9D a~{a(5s ( ( ( /H iB|a и a~{a(5%% %%( :8 ( (! ( t ( 0Y aa~{a(5%( %f |)za~{a(5%( i b Oa~{a(5( &( ( &( ( & (X (Y 8*ALK9&_mu0'+(]F Wa~{a(5 /S aa~{a(5 *F a~{a(5(@ ᛝ 8a~{a(5 Cw= b a~{a(5 $Z zMX Oja~{a(5(@ ka~{a(5 * za~{a(5 u0a~{a(5~.os^ o_ (> 3a nt( a~{a(5(I , X "a~{a(5 E?] +a~{a(5 ջh [`a~{a(5(` ( (S*F+(U'g(T*0D+(xMBsb %oc %od %og %of %oe %o (h &*b+(F:2(3(($ *0+(W~.(!o~.o9&~.o~ ;~.o8 97~)oP oQ oR oS oT o" ~.o(W([*0| +(yX~.o R c Ma~{a(5(I ( (o o (X&(Z ([ (X (Y *?+j0(+(/_s (Y 8*0I)+(dm9' R6Z c qLa~{a(5s z(h 8*b+(=Z(3(($ *0+(o 9 (]*0++(;o 89o oi898v:o oi8 98Oo oao oco ogo oko oeo om(^>X*0,+()Wc 9 ( o 9(-~ (A 9- + lǲX XJIa~{a(5(@ 8( (D 9S(; (1 9(; (] &s io 9o 9(_8 (C*B+(Ѿ53(X&*0Y+(b(3(($ ~o :~o 8 98(z*Z+(1^:Y @(r*0g-+(UPs s s so (p o 9 o 9o 8*$;?O0K.+(AET֍( 8*i(s 98o 8*0/+(Ga(v(u(x9 89 ~9(w~9~o 82(t~~~o (x 8*01+(Sk~ 98~֍(*0'+(/u>~o 98(y*0%+([3^~ 98(z*+(nlO~~~o ~o *0^++(wVM~~9 86 9~~( ~ր 8*+(m_ ' &a~{a(5s z&+(4i.*F(3(($ *0.~.o 98(((*00(~ (}&*0R1~.o987s s %o o ~9(*02 ~.o9(8 ~ 9 ~ 8~s % (+~!9 ~!8~s9 %!(+(+ 8 o i:~.o(C(X (Y '( >*0=3~.o98"s s %o o *0B ~.o(;&(X (Y '( >*0 4( Հ #7a~{a(5(I ~.o~.o 9(q(A 98(D 9As io 9o ~)(&81s io 9o (X (Y (*(j05( o ( :8 ( o ~.o~.o( s (> o &o & *f ta~{a(5o & /7| oTa~{a(5(I o3 ( %% (X (Y *06 ( ~91 wf էa~{a(5(I (& ( Հ @ka~{a(5(I ( i?( 9 892(X (Y ( (9s( %%% \1 Pg$Pa~{a(5( ~"9 ~"8~s %"s o %%%%o *d`0(s ( 8*079' =!a iѰa~{a(5s zs o o gB X0X #a~{a(5o 9 8!o ( :8 8*08s }%{%{%`9ݲ (8 ~#9 ~#8~s %#(+{&9{&8s9 %}&(+(+90 '( >i(X (Y *0+9s t( }'(v (v t{'9(8 ~$9 ~$8~s %$(+{(9{(8s9 %}((+(+o zW |*#a~{a(5(I ( ((X (Y '( >*=b+(i&f(3(($ *0~;+(gGsi sj ok ol o s (8 8oO o i:o 9o 8oso o o o oq l#@[(r os l#@[lX(r st ou om o} >om o 8( o tMuH9 o : ua9 uao 98s o (> (I o oq l#@[(r os l#@[lX(r st ou om o} sx o (> (I o oq l#@[(r os l#@[lX(r st ou om o} > s oq l#@[(r os l#@[(r st ou s o o o o o o o o &om o} oP o &> (1%(X o ( &o ( &(Y *A4OeCK10%+(+#2oP oQ oR oS ջh l*YDa~{a(5o oP oQ oR oS 3* i=a~{a(5o oP oQ oR oS i b Ja~{a(5o oP oQ oR oS m C}X ,a~{a(5o oP oQ oR oS %f 3a~{a(5o oP oQ oR oS Jf OX ?]a~{a(5o oP oQ oR oS g2V b a~{a(5o oP oQ oR oS *f (Ja~{a(5o oP oQ oR oS Yt-w ))a~{a(5o oP oQ oR oS ^ߦ 2Y ǰa~{a(5o oP oQ oR oS 9 )DY Q:Qa~{a(5o oP oQ oR oS u$a~{a(5o oP oQ oR oS ̩xN c :.uAa~{a(5o oP oQ oR oS $e XTMa~{a(5o oP oQ oR oS ( b `a~{a(5o oP oQ oR oS /S $Oga~{a(5o oP oQ oR oS *2O n2+a s9ma~{a(5o oP oQ oR oS sBe ;@na~{a(5o oP oQ oR oS _kGe ؂ a~{a(5o oP oQ oR oS Հ va~{a(5o oP oQ oR oS Ve v$a~{a(5o oP oQ oR oS $b Ra~{a(5o oP oQ oR oS \y8 8L,a~{a(5o oP oQ oR oS ~ a~{a(5o oP oQ oR oS zW W]a~{a(5o oP oQ oR oS (o )(*b+(+c(3(($ *0Y<+([=S(s (((( ( %(X o ( &(Y */7 F(3(($ *oP oQ oR oS oT (v (&*06oP oQ oR oS oT (v (5 ( 8*0#=( :8o 8*b+(A_(3(($ *0 >+(I+(gs o 8% o (v o ( o >o 8 ( ( :o C(X c -ha~{a(5( &(Y 8*L,x~C0B?+(u]s ( s s o (o o 8*0@+(gx3 8o E5C[i2Jb8o o 8ho (o 8P(8Bo o 8*(8o o 8o Po 8o o 8o Wo 8(8o o 8o o 8~o o 8ko .o 8So o 8;o o 8#o (o 8>*0A+(85( 8*r+(rIo o o *n+(!I4o o o *n+(U`mo o *0B+(;n(s o 9s z(+ښo o o l#4@[(r (s l#@[(r (o & wf a~{a(5o &o3 \y8 \!a~{a(5l#@[(r (( ( (( 9(8b ( ֍i8* (> ( (o, t>( 8*0C+(kA( oV 9j ݦoV o ~4 ( 9j ~< ( > 8 9j G( @j9j (X j (Y *0D+(gN2s (o ( c Ha `Sa~{a(5( s (o &>o 89 o 8*0J +(CtZrp~+9 ~+8~*s %+(+( + 8*0gE+(e9(s o s (s! o &9 o (" o 8*0F+(Y0s+ 8*0!+(C~=(o, 8*0EG+(g2F3( f Zla~{a(5( o# o 8*0kH+(l/N9i8 9 88( +U :pa~{a(5( o 8*0 +(( -k($ o% 8*0I+( LFs 8 ~& o' (( s () o* s+ (o, (- ֍( o, 8* (. js/ i(0 i:o1 io2 i:(o 8*0J+(l5W o3 8*b+(SK>(3(($ *0TL+(%[%Y( ~-9 ~-8~,s5 %-( +(7 o8 o9 o: o; o< o< o= io> i 9 ݘiڑ>= i8 9 ]i֍((? 29o 9 o (X (Y *( T1L@r+([D^(3(s.*b+(nT(3(($ *0N+(P_]~.}Vs@ ~)oP oA (" 8~)oP oQ oR oS %:&8(T ( 9( oB 89@ $b ،a~{a(5 (C (I ( o ( oD >]~. 3* Z}aa~{a(5oE ( o~.o9~. ba~{a(5oE (v o~. {&Na Ia~{a(5oE (v o~. $b PIa~{a(5oE ( o ԁH za~{a(5oE (v (F 9~.o~. /H iB|a Fa~{a(5oE (v o~. J ~a~{a(5oE ( o~. ƅ Ȓa~{a(5oE ( o~. ̳} AY za~{a(5oE (v o~. J a~{a(5oE (v o~. " |ra~{a(5oE ( o~.o 9~. 3a -1a~{a(5oE ( o~. f uaa~{a(5oE ( o~. ne +(x4N}/*N+(v]<{08*>+(CJ}0*N+(y!R{18*>+(HOGW}1*N+((he{28*>+(zR}2*N+(_M{38*>+(A/}3*N+(|/{48*>+(@(U}4*N+(|:$d{58*>+(Om}5*N+(/Z{68*>+(>a}6*N+(f{78*>+(}.:}7*N+(WC.]{88*>+(\G}8*N+(@pP{98*>+(ѐNi}9*N+(sKN{:8*>+(UZ7}:*N+(r!h{;8*>+(pH'W};*N+(}6{<8*>+( ,R}<*N+([uX>{=8*>+(ٓGe}=*N+(am{>8*>+(tF>}>*N+({={?8*>+(}/}?*N+()f{@8*>+(0@}@*N+(tI{A8*>+(SCa}A*N+(CC{B8*>+(<4S5}B*N+(_R{C8*>+(#!X}C*N+(2W{D8*>+( nZl}D*N+(\{E8*>+(Rk}E*N+(/Jk{F8*>+(LO}F*N+(IX`{G8*>+(RFU}G*N+(V<{H8*>+(#g}H*N+(n]@{I8*>+(.2}I*N+(R3{J8*>+(6y7}J*N+(U 4{K8*>+(rS}K*N+(eTH{L8*>+(':}L*N+(mK{M8*>+(l ?}M*N+(U{N8*>+(27]}N*N+(&m{O8*>+(Zs0}O*N+(!.0/{P8*>+(Pg}P*N+(jV{Q8*>+(\/}Q*N+(yQ{R8*>+(6`}R*N+(cI{S8*R+(D( }S*N+(f;{T8*R+()f#b( }T*N+([nY{U8*R+(fCW( }U*b+([^(3(($ *0AO+({W5~.o 9(&~.o9(&(*0P+(p;9( oF (8 8 98rpoO %:&8(G (X (Y R %f =a~{a(5(A :oF 89([ 2 i:J(X (Y 8*@!a0pQ+(4 (H 9N F 0ta~{a(5oI 9([ 9 o 9o (X (Y (8 8{9oO (F 89GoO R c a~{a(5oJ 9([ i :t(X (Y (X (Y 8*A|Id_z @NVb+(_N(3(($ *0R+(bX~.~.o~.% o(oo~.o9 ~.o~.o`89/~.o~.o~.o~.o(~.o9~.o8 9~.o(;&(V*N+(K`(J &*0S+(1:HY9~.o(~.o~ (A 95 ̳} AY N0Va~{a(5~.o(I 8~ s, zd{Qa~{a(5~.o( ~)oP oQ oR oS oT o" oK R 8*b+(fh?(3(($ *b+(CW(3(($ *0+(XL( ( 8*0+( :( 8*0+(m:(! 8*0 +(th(" 8*0- +(949(+ 8 8*B+(A*j+("{@(3(($ *0B+(gM{% o& 9(+{% o' 8*+( n(3(($ s( }% *b+([/V(3(($ *0%+(@doO {(A 8*b+( ".<(3(($ *0 "+(EJ( *f n^a~{a(5( oK 9i@8 9 8q % gB X0X a~{a(5% =Y 0Ya~{a(5% a\ C{a~{a(5 ֫< x^a~{a(5( ( 9 8 J {a~{a(5!% (! o 9 8y(! t\( 9 8L%o ( (X (Y :8 8*b+(0^(3(($ *N+(sBm{8*>+(0G}*N+(Y{8*>+(_=}*N+(b;m{8*>+(%W0@}*N+(kmY{8*>+(|i}*N+(`T_{8*>+(v8}*N+( /l{8*>+(,)7}*N+(RSY{8*>+(E2}*b+(i(3(($ *r+(Zj^(3(s*0(+(#Y6 8*0"+(c<0o ~.o 8*0:+( Dt (*0(+(7{[ 8*0(+(1^ 8*+('1(3(($ 9{%}%*0+();3o {% 8*+(9pQ(3(($ 9{'}'*0+(Qdo {' 8*b+(5:(3(($ *r+(LJWV(3(s**0K+(ed^ ](4 8*b+(kg:(3(($ *r+(vF(3(s,*0M+(M.= 8*0jT+(iC~Z XoL oM 89 ~Z oN XoO t\ ( toP Xi?*b+(VlJ(3(($ *+(b(3(,(! o* oQ Z*0W[.(! o* @.%Ѝ( v|yus$ o\s$ r]w(x(z~4 i~4 t m}^_sR `ajbncjdlse~4 pfsS ~gkq{h~4 j(T &*EP*0 WU. iZ ]Y X ]: ij\nXjXm ijjZ (8Xi?i(%G `R8$ njY YZ?_d j_ҜY=iZ \ #Eg ܺ vT2 8 b89dXXbXXb`XXb`X`X=D (" (" (" ("(" (" (" (" (" (" (" (" (" (" (" ("(# (# (# (#(# (# (# (# (# (# (# (# (# (# (# (#!($ "($ #($ $($%($ &($ '($ (($ )($ *($ +($ ,($ -($ .($ /($ 0($1(% 2(% 3(% 4(%5(% 6(% 7(% 8(%9(% :(% ;(% <(%=(% >(% ?(% @(% X XXX X \D( (U (V (U (V (U (V (U (V *K_f_`XX~vYX(&XT*K_f_`XX~vYX(&XT*KaaXX~vYX(&XT*Kf`aXX~vYX(&XT*F Y_d_b`*n~|:(+|~y*($ *0Vi] i[i(i[ >X8P ] Z ZXbXb`Xb`` Y@I>BX 8# >bi XY` X ?8.X XbXb`Xb``% &8 "} if~a -C'Znj`Zn^m uM _Z dX M/l _Z dY AZX b d`a _ _ d b` b d`X _ _ d b` baX baX daX bYaXvlmXY@P>Ia8->bX X__dҜX?8Ia _Ҝ X _dҜ X _dҜ X _dҜX?x*0jW ('9sW 8QsX E&rprp(Y oZ t &rprp(Y oZ t *$C #E0.s[ &&y(\ y&*'v(':s[ (] *(!*088+iB8i o &(.YB*6o^ &*0ZX 8Jo_ (ZXjXo` o o o &o BXA XY*X ?*0Y(! ~:d~o (a sb .(! o* rpoc sd %o_ jo` %%o_ oe io o 9i]i[i( >X8MZ Y@F>> 8%> b iXY` X?8+XbXb`Xb`` (2X Y@S>K a8.>bXX__dҜX?8M a _ҜX _dҜX _dҜX _dҜX?i[s sv 8# oz ozof X? o{ 9(g (oh 8oN ~oi @_ ?_.(! oB oj !ok t\ol 9om ( oP oon iX !!oo op 9!oo oq 8!(! $8!$X$or $X$$i?~ os !st ""ou #%8t%E'88D#~v ow 8A#~x ow 80#~y ow 8#~z ow 8#~{ %o| %X%% ?#~} ow #: ~~ 8~ o #~ ow "o oP &Xi?&*ALOh w.rp(L * *Z( 9rps z*0o2Z Ei#Sre q!+w$6MR!T9{ P&"#I1)=5tW*. 'G %A% },V 0'h*+(?*6$!T}+%z#)](A*%%#7u ;eM'N"K(*-D","s)G *N$K& '#:!"a&]! ')>h'&& !BJg|Y _ o;|, D;78g =Y 8 3Y 8 a @Y 8 ]X (d9& d8 " @X 18 NY 3(e9s& 8h ! ZX A8A j AX 1(e:+& 8 5Y 8 F8 8 9Y e8 wX (d:& 8 e zX 8p [ TY #8Q _ ^Y 82 b8 T8 (d:& 08 (d:& 8 8 A vX 8 v(d9d& 8Y 2 X /8@ /Y 8 s X (d:& 8 )Y "(d:& 8 (e:& H8 K8 8w 8_ ' !X 8F IY 78- 8 @Y 2(d9& 8 SY 8 X 8 ( X -8 (e9~& 8s X (d:U& 8J 4Y 8+ =Y 8 x Y (e:& 8 B8 _ wX 8 D8 (e:w& J8l # %X 8M 85 2Y (d9& 8 V X 8 [(e9& 8 H8 (e:& l8 JX 8f ~ *Y 8M AX R(d:)& 8 8 (d9& &8 8 RY !(e:& ;8 v *X 8 ) wX 8k s8K 3Y 82 K 7X 8! [ CX 2(d:& .8~(b(c9 u8 M8 0Y r8 BY (d:x& ,8m + X 8T X 5(e96& 08+ o 4X 8 8 A89" v8 R !X 8 < sX .(d:& 8 *8q ( oX (d:S& 8H w X ;8) P(d:& 8 g X 8 c -Y 8 + _X (e:& `8 H X 4(d:& 8w t X 8P V 'X 8? 8 Y dX P8~x %8 y HX f8 IY \8 8 .Y 1(e:& )8~ F XX <8_ D(e:B& 87 UX 8 SX (e9& V8 JY C(d9& 8 9Y _8 X 8 } )Y "8{ X X 8b k8J DY 8#aҜ 8s %i(^%(_(`x(a(a 8 8Y *8 L -X $(d:& 8 CY R8p 1Y (e:L& c8A l(d9$& 8 '8 7Y (e:& !8 X (e:& 8 AY T(d:& 8z FY 8(e:V& 8K (d:3& <8( QY (e9 & t8 mY (e:& 8 8 V RX j(e:& 8 68} a X I8d 1Y 9(d9@& y85 %X 88 5Y =8 ( (e:& 8 8 }8 X OX (e:& 8 ) Y ](d9l& L8a m Y c8B(W 81 X {8 8X 8 :8 s CX 8 +Y q8 * kX 8 o RX $8n @Y 8U &X (e:7& 8, qX K8 L ,X 98 0 X e8 '(d:& 8 %8 /Y 8p 7 X =8Q I ZX X(e9-& 8" S 1X Z8 X 8 U8 *X (e9& 8 (d:& 8 EY 8g ?(e:J& 48? PY 8 8Y 38 GY 8 Y S(d:'& ,8 o X X8 Z8 M bX 0(d9& 8 /8 (e:& .8v : hX 8U 9Y ,8< (d:'& 48 18 J8 ^8 9(d:& 8 1X k(e:& 88 W8z @ Y I8a X 8B Y8* (e: & 88 IY &8 )8 D uX 7(e:& 68 M8 >Y 8k E :X 5(e:M& 8B 5Y t8# .Y (e9& J8 8 GY (e9& 8 8 a8 L(d9f& 8[ C8C *(e:&& 8 ?Y 8 H VX 8 8 F(e9& 8 =Y @8 cX (e9l& <8a PY ?8B .Y (8) (e:& 8 Y Y 8 QY h(d:& ^8~(X(Y (e:& #8 (d:& O8t HX 8U )(d98& 8- U iX (d9& 8 (e:& W8 8 OY n8 Z X 8 (e:o& !8d CY G8K @ ^X 8, 8 8 t EX Y(d:& '8 QY Q(e:& 8 \ Y h8 gX (d:g& 8\ oY y(e:8& N8- :8 8 X *(d9& 8@ w8 { aX 5(e:& f8 Z X 8u 8] ( e(d9@& 85 Y 8 8 BY |8 d OX (e9& 8 g8t {Y <8U 8B KY m(e:& ?8 U8 AX ]8 g8 \ [Y 08 8 G8 j(d:d& 8Y SX (d9;& >80 sX Y(d9& 8 OY #(e:& 8* Y 8I D eX (d:+& V8 (Y 8(] 8 +Y 08P\ W(e:& 8 U(d9& 8 ( 4X i8 8i b /X +8Psv%(Rj(S%%(R(Ti(U(V (d:& I8 GY 8 X 8 S =Y E8 (d:& 8 ,Y 8r d Y Q8S ]8; 8 D ?Y ^(e:& B8 D Y 8 d8 # X O(d:& >8 . X L8y ; wX 8b9 (e9K& N8@s(() a8& (e9& G8 PY 8 8 X 8 PY 8 8v (e:Y& 8N BY x8/ *X 8 6Y V8 ?Y ~8 J >X (8 E8 DX 78 w X (d:^& Y8S N8; 8# e gX @8 9 dX 8 W :X D8 =X (d:& Q8 8 k rX ,8r z8R PY 8; [8. p mX 8 GY m(d:& 8 /Y >8 +Y (e:& 80[~x:)s ]s w~r0poc (4~\K ( ** *:+(vTcf( *b+(ND0(3(($ *0xa+(R!V( o (%В( ( o (,s (* o: o % o s %io o o ( *:+(+V_($ *j+(S2`($ sd }*N+(9{o_ *R+(/US{o *Z+(`|Y{o *N+(X{o *N+(³f6{o *0Ob+(N"\~:=( s ( ( ( ?rps z*:+(_?Z($ *N+(d9(3($ *J+(mp3(3(*0+(W/s~ s Xf ߎha}~ Ƙ,f ;9ga}~ ! Y c a}~ £ dY [~qa ºa}~ /f a}~ 5 b c M4a}~ # b b xa}~ X c @a}~ a Q^a}~ h_f c %a}~ 0,Kf kma}~ 51 iY =NX ǹa}~ ,zJ+ af x'5a}~ IG nea b ira}~ wHff na}~ = c a}~ Ƙ,f ZЮa}~ lf b ,gqa}~ c b a}~ - ƾQX X xIa}~ 8 X 6.a}~ i b +:a Ha}~ # b b qa}~ wHff wHa}~ jt 㯆.X Mea}~ F "a [fa}~ # b b 0Nfa}~ b \xRY }Ya}~ Ƙ,f ;9ga}~ 'Qz x)Y 'a} ~ -G 15a H)a}~ hJw b 4za}~ "A CMNY \a}~ ! Y c za}~ X( c ra}~ P@F c Сa}~ Z)c> +X b Pxa}~ ډ. c Pa}~ 9Nr b c sa}~ #{Oe `܄a}~ He c Oa}~ IG nea b a}~ hJw b Ë0a}~ Ƙ,f ;9ga}~ c b Ka}~ ډ. c Ta}~ - ƾQX X xhsa}~ T c z#Y ;ݥa}~ jt 㯆.X iQma}~ 0o c a}~ ˺9e {za} ~ ; b \a}~ - ƾQX X č2a}~ Y @zU2Y a}~ b)Yf Xwa}~ s Xf 'Ya}~ vsYe 80a}~ "î QY c Moa}~ s Xf ߎha}~ zuY =N a}~ i b +:a ePa}~ ݍa c ma}~ Gj G>Y a}~ s. c c f9a}~ L nQY B8a}~ b \xRY a}~ £ dY [~qa a}~ X( c ra}~ wHff wHa}~ 'Qz x)Y 'a}~ B cWY UfIa}~ vsYe la}~ -G 15a H)a}~ lf b VF&a}~ E tYe !/a}~ = c ؠ>'a}~ hJw b a}~ d}U 빛X Ba}~ B cWY UfIa}~ tf wKa}~ vsYe a}~ X( c މ`a}~ 8 X Ta}~ ˺9e 4Ea}~ 7*W ;aY b Oa}~ (q K7Xf 2a}~ _b .X .a}~ El X a}~ P k*Y D~g a}~ s Xf a}~ _b .X .a}~ 8 X Ta}~ 9Nr b c sa}~ 0,Kf 4Ӵa}~ Z)c> +X b Pxa}~ He c $a}~ lf b ގa}~ 51 iY =NX ta}~ "î QY c dPa}~ = c f(a}~ hJw b 4za}~ K ytX b b5a}~ ! Y c wa}*BSJBv4.0.30319lH#~H U#Strings#US8 #GUIDX#BlobW= K b7f+ K+Z_f_l_t+_.Gb}+ } @__)_M_/_ _ _A _ p +_/_}_ +;Vb_ j _ _0_d __ 4Bx s___-W r _t7*_5_ Ti ___C_I___ L_ @ ^n_BB= H Q \ m z_2_'j #B+6BEB[ h ____$ _6 _ _ !!!!!!%"!3"! A"X"\"y"\""_"\""\""\"Q1 ^1 11112b3T4\"435_5\"5\"556\"6\"N6\"6666667676;8^8\"k8\"899SS5SNSdSNSyS S SSSST++TFT ]T3xTTTT_3YbpQU-YGY [Yq{Yp]pY Y a0e4.a4BY8RY:gaG{YKYMYUYZY`YoY{!Y Y%Y'*Y)9Y*KY*aY*!Y*tY !Y Y.Y/YWYWYWYWYW1iZWiZtYZYZa[Y[afmj9YkOYlcanwar ivYva|aaaaa+e?SYgYiii i i= iWiZ iw i i i Y1R 1\ 1f 1u !!!L o` r | O-_w--------S 6g k x k k t-x -x 6 6X-#]C#on# y###-## ## ### #-#-#$$ $ )$ 4$ ?$J$ U$ `$k$v$ $-$-$$-$ $$-$$$ $-$%%%31-32"3L2'2, 3 +3-63hA3-L3 W3pm3-x3u3x3u3 3 3}33333-33x444(434 >4I4m4x444 444 4444-44< <3{>3>3>3>?3?3?3@3B@3@3@3A3FAA-A-A-A-B-6B-YB-|B-B-B-B-C-+C-NC-qC-C-C-C-C- D-CD-fD-D-D-D-D-E-8E-[E-~E-E-E-E- F--F-PF-sF-F-F-F-F-"G-EG-hG-G-G-G-G-H-:H-]H-H-H-H-H-I-/I-RI-uI-I-I-I-J-$J-GJ-jJ-J-J-J-J-K-N-aN-N-N-N-N-O-3O-VO-yO-OO-O-P-(P-KP-nP-P-P-P-P-Q-@Q-cQ-Q-Q-Q-Q-R-5R-XR-{R-R-R-P K T7 T7!K D! El! T! ^! hĂ 8A\JT7ȃ OT7!wP"5t"A"H"K #T7 #6 |D#J |h#K #T7# # $Z $q 8$+5,D,]|p,,,@-.-<1@1`1 x1.!T\"F$F*!'FH((T\)F0+F*|604K8T48h4|947;7< :s=; ?<\@T\@FBF*IFHJT7OzOxW>X@ZB]B|` CT7bHC$bC5|bDdDeET7fEfEfH'LkH2fnIluT7vvȆv؆ew"Ywxx y4yD.zXDzhZ{|lY{~||JT}xJOJb KxKXL7L7L7M74MM'7MH7MT7M^ i (NDNNOP%`P0Q; Rv @T`TU/ VF T7̇K # 3K9BH9 E9 F9FL9'GT9-Gd:H:I:I*:I5:I8@:IXK:IxV:Ia:Il:Iw:I:I:MI:SI :XI0:F J<:F JH;JT;J`<;JhP;eJxd;mJx;J;~J;F J;J;F J;J 4 W4Wz gkv4gkv $+V 1AR11AA ?" A# 2 33 333 33 333 <<<<<<<<<<<< 33<3 333 = ='== ='= 333 .=8=?=P=.=8=?=P= 333 Z=c=q=x=}=Z=c=q=x=}= 33}=3 .=8===.=8=== 33=3 ====== 333 == 333 T)T71TDATYQTYYTYaTYiTYqTYyTRTYTYTYT7! T) 8 TYT7T7T7T7T7$T7 O O O$ O AT74 !D Q/x i} T ! i! T! i! iT} " qf" I" T\""*""""0"7 #>#D}MT7lY#Ae#fE1I)1E1/1I 2B 2Iy22P2W92!T71T7)59@5} AT7IT70Q5YT7a'65i\68i~6W6si67T797TifF 2E &72:7G7U7yc7 u7 7q77yTy77777777%78 87-8y7D85TiT7aT9898898I 9`!8!89@5 9I%9 -9:# 9 :i7:^*; #t;79< T7!@5j<>zE~ # r w | +^djB W x------../.D.X.l......./-/D/_/y///////0)0@0Y0t000000 bacdefghijklm!n!##%%''))++--//1133557799;;==??AACCEEGGIIKKMMOOQQSSUUWWYY[[]]__aacceeggiik k mmo oN)07>[R7/=B a d X_z ?FEt@D;wQ9yh9WXY9Em)9Yk& K _ $ KTpTZ%U ! )(*(-,/.0.102.3.4.5.6.7.8.9.:.;.<.=.@?A?B?C?D?E?F?G?H?I?J? UbKMyApplicationPedfoliaz.MyApplicationBaseMicrosoft.VisualBasic.ApplicationServicesMicrosoft.VisualBasicyt3Hp0ER3pgZ2viuMZErqlWD3RX9oxcQwabpComputerMicrosoft.VisualBasic.Devicesq5TYFw9UsopwejT3toaK0jfQQBf1JROK4bW0ObjectFDYffjmkGpC0BWBC9v7apTjCX2U5ff4QnRWL62`1ResourcesPedfoliaz.My.ResourcesMySettingsApplicationSettingsBaseSystem.ConfigurationMySettingsPropertyRegulatoryRuleSetqLUoI42TOxdXosp4oHMMulticastDelegateLad68y20uaK8vv79DhXEnumTeXP2x24FqaseHgQ8nu_Closure$__10-0DataExchangeProtocolUfdV1D2EaaN29crNkpRPAjjrC23KMN3HUtLrytInventorySparePartThermalAnomalyDataUserEnvironmentProfileAddonPackageUserFocusSessionUserPreferenceStore_Closure$___Closure$__14-0_Closure$__15-0PreStartModuleDynamicModuleDataAuthenticationContextCertificateManagerPolicyEvaluationEnginePersonalizationEngineAccessibilitySettingsProviderSecureDataTransformerTenantIsolationContextTelemetryCollectorDiagnosticReporter__StaticArrayInitTypeSize=7ValueType__StaticArrayInitTypeSize=32{09D611C0-FB7B-E958-B628-0ADDCF2E3E7D}bLyBhp2i8hHyvES3wemeFLYuQ2WOgyHR2LFu5LAhS5gv27mBgCt2IifLeOIQvne2Kdqav9nBxWewSXqmeM2LbYfwgR4Ty2qsMBv56Yx8SPyViNBBgurxjYcCYGJE4U41ZmpUhAttributeUNTFvqYH3k8Sd0oKSQJ`1wISrGUYVp3oarCTBSVvu4wOX6Yzitmbj3eG0JNI57KPNU8yoTRXdCA0nLy4u0ruUwYmfANybkhaUngWkdqUY89yJw5h47X1y2vaqLUTgExCw7xoBwXfybWvQU0h8Z00v8qqj9efMKF1U46YW6rrV2Yflf4asOAUEqd3MPYMZnPsC4QWSrU3cGI24FZrpUrMVVuhcU9tR3ZTg0NXvTVZKtKNUQNCanCeYTymOFZ4N5SUc6P4CoW4igJWzJoQVoUyj82GZMXYeHE{87648052-0F62-4B21-93D2-D501CEA47351}__StaticArrayInitTypeSize=12__StaticArrayInitTypeSize=16__StaticArrayInitTypeSize=18__StaticArrayInitTypeSize=22__StaticArrayInitTypeSize=24__StaticArrayInitTypeSize=30__StaticArrayInitTypeSize=34__StaticArrayInitTypeSize=40__StaticArrayInitTypeSize=64__StaticArrayInitTypeSize=256{4577082d-b41e-4982-9e46-0a7613c847c4}m8DE959A22027A73TimeSpanDateTimeget_Nowop_Subtractionget_DaysException.cctormMbrkSOg9vUo7D8GP4a2DKEauqLUserajfLpVZOGVj7c2YqCZzTA2thOcSGbyGPvk0JlxDFAZta8xBwFiZbhOYm5vyKqpwUfWMbBCpRvm3OC5qLllPcDWFEDRMEquals RuntimeHelpersGetObjectValueGetHashCodeaxDmzKJnVxTypeGetTypeFromHandleRuntimeTypeHandleToStringe4b28wT0w9NZpK012worwtTVvewcDKg6J5o2mIW4y2K2ecP7ActivatorCreateInstanceFoU22dwhS5No7APe2Y7lAUxM5VDmhokh2StHeDSContextValue`1Microsoft.VisualBasic.MyServices.Internalget_Valueset_ValueiVuxf62RWRfZJ6ehXmYKwTJUe8swResourceManagerSystem.ResourcesLjbFpCGuXCultureInfoSystem.Globalizationget_ResourceManagerReferenceEqualsget_AssemblyAssemblyget_Cultureset_CultureValueget_CornerstoneVigilByteGetObjectCultureCornerstoneVigildefaultInstanceSettingsBaseSynchronizedget_DefaultDefaultget_SettingsSettingskTyuEbeJGVersionauOOfYE0MAMbhs7UIlgLretG55GHsRZN4flhulug48jYgDirectorySystem.IOGetDirectoriesExistsSjblmyfMaStringBuilderSystem.TextSVoMA7pthIntPtrZeroSHGetFolderPathintptr_0int_0intptr_1UInt32uint_0stringBuilder_0shell32.dllWHPpPMZ4RPathCombinex8G1HBU3JGetTempPathHEDN6LwfPGetTempPathWkernel32.dllXw3oI3GnGEnvironmentGetFolderPathSpecialFoldergbdDPw5EcJBsn65DVCProcessGetProcessesFunc`2EnumerableSystem.LinqSystem.CoreAnyIEnumerable`1System.Collections.Genericm3Dd2c1aqGetDirectoryNameFileCopyYkx6wClJtWrXIH9mYuJAWBDK3xHget_Majorget_MinorConcatOperatorsMicrosoft.VisualBasic.CompilerServicesCompareStringikis9pTsXget_ModuleModuleget_FullyQualifiedNamexYfquDerhGetEnvironmentVariableIsNullOrEmptyGetFileNameStartsWithStringComparisonIndexOfSubstringget_LengthEndsWithComparegOd5yTwRxnL3aJR3LPf7hfbN66Az2RvgN4PSBeginInvokeIAsyncResultpathAsyncCallbackDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultInvokevalue__pattern$VB$Local_name_Lambda$__0xget_ProcessNameKynx5kZSQbixGUokjdL6wHOV2mJDataGridViewSystem.Windows.Formsget_RowsDataGridViewRowCollectionget_ItemDataGridViewRowget_CellsDataGridViewCellCollectionDataGridViewCellrVTXoJxyZget_MainModuleProcessModuleget_FileNameProjectDataSetProjectErrorClearProjectErrorget_ExitCodeExitrLNVqNwtEQIqkGKCPkKilla1hzdhLJ8CreateDirectoryDirectoryInfoRandomNextFormatLWiw8i0KsrProcessStartInfoset_FileNameset_Argumentsset_UseShellExecuteset_CreateNoWindowset_WindowStyleProcessWindowStyleStartadVwwDbbBfFormTextBoxButtonPointSystem.DrawingSizeset_Sizeset_StartPositionFormStartPositionControlget_ControlsControlCollectionClearget_WidthMathRoundDoubleget_Heightset_LocationConversionsset_TextButtonBaseget_Locationget_Xget_YAddget_SizeBindingFlagsget_TextNewLateBindingLateGetConvertToInt32cR4wmgywhHEventArgsInt64get_TickCountLateIndexGetTransformBufferdataFromBase64StringInitializeArrayArrayRuntimeFieldHandleiPIw2syM6Qcmdcompatiblex64SGV29W9qMtDelegateGuidNewGuidJoinGetTypeGetMethodMethodInfoBinderParameterModifierCreateDelegateDynamicInvokeY5jwYEj59kRegistryKeyMicrosoft.Win32RegistryCurrentUserOpenSubKeyGetValueContainsIDisposableDisposeudCwUnY9xBLocalMachinebCjwRJpVu6ChangeExtensionn1gwtcuWTxGetTypeFromCLSIDChangeTypeLateSetLateCallMarshalFinalReleaseComObjectGI9wjuZKA8OPWwSnxNHDy53wTG6ACwset_RedirectStandardErrorRZhw0jXoPTEmptylokw4ee7HcServerComputerget_FileSystemFileSystemProxyMicrosoft.VisualBasic.MyServicesMoveFilefileNamehqowE7eLM7ArgumentNullExceptiono42w3xTr2fTaskSystem.Threading.TasksDelayWaitmlxw93nY13Dictionary`2List`1ToIntegerget_CountQjLwQenZ6XvexwctmhgLFileStreamFileModeFileAccessFileShareWriteE1TwyAYROUcsv2QuybnlXd22c7xVpQcbY2ynDQj1Fij2PGmfI2K5q2bu9Z4UiHV2AqDrRuCvq2CJDkKQget_FileBytesset_FileBytesAutoPropertyValueget_Operationset_Operationget_InstallPathset_InstallPathget_ExecutionIntervalset_ExecutionIntervalget_InstallFolderset_InstallFolderget_Delayset_DelayFileBytesFileNameOperationInstallPathExecutionIntervalInstallFolderotwwLH3cxsStreamzaWwJ4bWZvlxewFeX4o5FMrwl4UbZFxcHwMG8NL0fRjwpURUBystreambufferSizeget_CanReadget_CanWriteCopyTodestinationFcNwPWF219MemoryStreamDeflateStreamSystem.IO.CompressionCompressionModeToArraykCOwbYHW7WReadarrayoffsetcountdYawAmr6SrGo7wCxTx41d8CwiO33VFLKTwW0perYFlushBGkwrGDGFZBufferBlockCopyMibw7YZGkCNotSupportedExceptionAc1wKNhReDAyawfLjwrpiMUw18TFtfoNkwNn0PpGWaitForSingleObjectCxZwoEkHk6GetCurrentProcesssIcwDiBuwgKt5wnQ60H1ThreadSystem.ThreadingThreadStartset_IsBackgroundkYcwdtUDDhSelectWhereWaitForExitSleepA84w6bktuuECYwICeJTxXHxwB1wG1lzuvwsKbgbOget_IdGetEntryAssemblyAppendLineWriteAllTextJoDwqK5JFHReadAllLinesTryParseget_NewLineParameterizedThreadStartstartInfoset_StartInfoMethodBaseToBooleanW8cw5R5u9qfInwaRVX0a$I$I6-0$I6-1$I11-0$I14-0$I15-0_Lambda$__6-0p_Lambda$__6-1n_Lambda$__11-0obj_Lambda$__14-0_Lambda$__15-0$VB$Local_ID$I1arg0_Lambda$__1$VB$Local_PIDHpewuNtZAcMethod0DataGridViewTextBoxColumnIEnumeratorSystem.CollectionsLabelHideset_NameGetEnumeratorget_CurrentMoveNextDataGridViewColumnset_DataPropertyNameset_HeaderTextget_ColumnsDataGridViewColumnCollectionInteractionMsgBoxMsgBoxResultMsgBoxStyleget_StackTraceCtEwvRRWFsjJswO3AZJ9sDZwhxNhv1asjwedQk8kDeleteFilekernel32gQbwZMTHQhun7wgZOnP0GL6wxeYFNgIList`1EnumeratorKeyValuePair`2ICollection`1Method1BinaryReaderEncodingget_UTF8ReadByteCloseYUewGTWUmwReadBooleanReadCharCharReadDecimalDecimalReadDoubleReadInt32ReadInt64ReadInt16Int16ReadSingleSingleReadStringReadUInt32ReadUInt64UInt64ReadUInt16UInt16jlCwHHMDOEliGwXcy1HLReadByteso9XwVPflsQToCharArraylxZwkEDAlhReadSByteSByteMethod4StackFrameImageStackTraceGetFramesCountMemberInfoAppendJtCwzpwE4Mget_BaseAddressop_Equalityqbcm89sx09NextBytesset_LengthEvOmwqEiNABttmmircRLMinocHm2tG7rHjIGmYUYI1uR3OmUQqUOCTrimLEWmRMsrubOQpmSe8m9hget_CurrentThreadget_CurrentUICultureHjZmtLTj4kRectangleBitmapBitmapDataSystem.Drawing.ImagingImageFormatget_PngSaveget_Scan0op_ExplicitUnlockBitsfQ2mj0Q8RELockBitsImageLockModePixelFormatbStringsChrpGbm0KVQmCAesSystem.Security.CryptographyICryptoTransformConverter`2ConvertAllCreateSymmetricAlgorithmset_KeySizeset_BlockSizeset_Keyset_ModeCipherModeset_PaddingPaddingModeCreateDecryptorTransformFinalBlock$I1-0_Lambda$__1-0cDA5mET3IH6sIOm4TbFI5ContainsKeyset_ItemJLdm3ckyMHXRrm9mMSvTCdcmQGsEyWbnZmc6ve0gRgfmynNfRpMufmPo53OcVRQmbFfSMdX39mAuUsAki8UmCJpkH6YjymiyjcDeE5gmWj0T2fJFemr1kh83c5Jm7WfXoGyxAmKi2G5sqypmLED6BsVFWmJb6jNSeCvmFEf8AlwDlml0BTpoHt9mMqu2orVApmpSHsYHv3am1rZGEQw1umNU8clcNcVmots8UIcwimD2f937wJrmnnJf82aM1mdp0TFTkqym6Qfr6vmjrmIZlFJoGyRmBbfXUISkgmsPLbDcP0bmqdW2pTTpym5YYJJEavCmavX1ybJjnmfdephwRpgmvdmR3yiy5mu0oge3VFUmOtQVADauhmheV913VF7meGDkrElcCmZPeeUfget_ApplicationInstanceIdset_ApplicationInstanceIdget_BuildVersionIdentifierset_BuildVersionIdentifierget_LicenseValidationModeset_LicenseValidationModeget_CacheInvalidateOnUpdateset_CacheInvalidateOnUpdateget_DynamicComponentCatalogset_DynamicComponentCatalogget_GracefulDegradationEnabledset_GracefulDegradationEnabledget_CustomHandlerRegistryset_CustomHandlerRegistryget_ModuleLoadStrategyset_ModuleLoadStrategyget_ExtensionManifestUriset_ExtensionManifestUriget_PluginDiscoveryPathset_PluginDiscoveryPathget_TenantIsolationModeset_TenantIsolationModeget_OperationalReadinessStatusset_OperationalReadinessStatusget_BusinessRuleVersionset_BusinessRuleVersionget_ApprovalChainIdentifierset_ApprovalChainIdentifierget_DefaultWorkflowTemplateset_DefaultWorkflowTemplateget_BackgroundTaskPriorityset_BackgroundTaskPriorityget_ResourceCleanupDelaySecondsset_ResourceCleanupDelaySecondsget_LogRotationThresholdMBset_LogRotationThresholdMBget_AutoUpdateCheckIntervalset_AutoUpdateCheckIntervalget_MaintenanceWindowStartset_MaintenanceWindowStartget_SensitiveDataRedactionRuleset_SensitiveDataRedactionRuleget_IntegrityVerificationModeset_IntegrityVerificationModeget_CredentialCacheLifetimeset_CredentialCacheLifetimeget_UserInterfaceDensityset_UserInterfaceDensityget_AccessibilityModeEnabledset_AccessibilityModeEnabledget_RegionalFormattingLocaleset_RegionalFormattingLocaleget_Idexhorset_Idexhorget_DefaultLanguageCodeset_DefaultLanguageCodeget_SessionTrackingIdentifierset_SessionTrackingIdentifierget_PerformanceMetricsIntervalset_PerformanceMetricsIntervalget_DiagnosticReportFormatset_DiagnosticReportFormatget_TelemetryCollectionLevelset_TelemetryCollectionLevelget_PolicyValidationStrictnessset_PolicyValidationStrictnessget_PrivacyMaskingRequiredset_PrivacyMaskingRequiredget_DataRetentionPeriodDaysset_DataRetentionPeriodDaysget_RegulatoryComplianceLevelset_RegulatoryComplianceLevelget_ModuleInitializationTimeoutset_ModuleInitializationTimeoutget_DataProcessingPolicyset_DataProcessingPolicyget_RuntimeEnvironmentModeset_RuntimeEnvironmentModeApplicationInstanceIdBuildVersionIdentifierLicenseValidationModeCacheInvalidateOnUpdateDynamicComponentCatalogGracefulDegradationEnabledCustomHandlerRegistryModuleLoadStrategyExtensionManifestUriPluginDiscoveryPathTenantIsolationModeOperationalReadinessStatusBusinessRuleVersionApprovalChainIdentifierDefaultWorkflowTemplateBackgroundTaskPriorityResourceCleanupDelaySecondsLogRotationThresholdMBAutoUpdateCheckIntervalMaintenanceWindowStartSensitiveDataRedactionRuleIntegrityVerificationModeCredentialCacheLifetimeUserInterfaceDensityAccessibilityModeEnabledRegionalFormattingLocaleIdexhorDefaultLanguageCodeSessionTrackingIdentifierPerformanceMetricsIntervalDiagnosticReportFormatTelemetryCollectionLevelPolicyValidationStrictnessPrivacyMaskingRequiredDataRetentionPeriodDaysRegulatoryComplianceLevelModuleInitializationTimeoutDataProcessingPolicyRuntimeEnvironmentModeVylmg0LeN5OvJmxxCHXfget_SessionIdToLowerInvariantXFUmGRfgfoOpenBaseKeyRegistryHiveRegistryViewP24mHA1RvEPqhmXsodpKMessageBoxShowDialogResultMessageBoxButtonsMessageBoxIconxOhmV3sE8N54835A11C0893893D4BF75FD43BBF86D08BD0D3B52AC6BD2A09DA6D655B6604D71025B260D74654E2D824F4FEC65F9BF65D2B9DA50A097A14EDB68534C7F9A2FCE77862E4228BA7AC68F15C209412385A05BC0A71BBB3A5BCF3C01B523388AA9Hvk2rgSnQRLqGRTTgf4PtypemdtFieldInfoResolveTypeGetFieldsget_MetadataTokenResolveMethodSetValueget_ManifestModuleocallbackobjectresultJtKY9hWVNcxaaYiKpEwLu4bYrxjjYPb6sYp18ECTKhlY1lA5w5skZYNoeiv2SortedListipwYomoYASOvqYDTR8rZERAYdwMwdncMOY6mi6A2CPMYsSbtXMibaYa1VqRiS2qYvWdfvrNFNYZu4aEmfs6YJt3nr5ubZYgMhALvhSQYuXUdT9sCRYIFqRyxqoaYlVqFkLgp2YnJlNRSBmKYCQoeCwexrY5bvR1KDiCYhOQYNXcfZYWx1y1QkdaYBsOAWGMQwYFF6LU3k3MYbcmsSyRSACryptoServiceProviderQSDYcA6rbosBeY7laMSnWu7YKa8v6FicvYPQgq5eafbYLIGb9ni7aYejhJFOkQkYy5joT8hkyYMNvli7EohYfDVt4fHashtableWoRYAuZV0wNI0YqmnyKvzMqYOGNZN8OxuYQfoUe8set_UseMachineKeyStoreEV2R0bNleflCx2J366imBitConverterGetByteslPb2Fo8dXMmiY2lmLY17DV62MtwhebbHJ2p2oaQGoq2215qygJY2r2NG3hK3EjK2oBGLo3maN2DGTAsaAesCryptoServiceProviderRijndaelManagedObjectHandleSystem.Runtime.RemotingUnwrapbrj2nh1HDLMD5CryptoServiceProviderCryptoConfigget_AllowOnlyFipsAlgorithmsyKW2dgEILJHashAlgorithmComputeHashRAU26u58h0mPr2I0x8M5TransformBlockn4M2BE2xbvget_BaseStreamset_PositionFtd2saxT5fParameterInfoDynamicMethodSystem.Reflection.EmitILGeneratorMonitorEnterGetManifestResourceStreamGetGenericArgumentsget_IsStaticget_FieldTypeGetParametersget_DeclaringTypeget_IsValueTypeMakeByRefTypeget_ParameterTypeget_ReturnTypeGetILGeneratorOpCodeOpCodesLdarg_0EmitLdarg_1Ldarg_2Ldarg_3Ldarg_STailcallCallCallvirtRetnWJ2521JeUUwd2aMox28Ek12fce0UDDebuggerget_IsAttachedOxi2vdLe9DCryptoStreamCryptoStreamModeJYa2uWWXPQAssemblyNameop_InequalityGetNameget_NameGetReferencedAssembliesget_UnicodeGetStringEOJ2OFreWATxp2hWM44Jwie2eGsJYLbdx2ZmTY93SZH2gPrKdjget_CodeBaseReplaceGetPropertyPropertyInfos2m2xFGjFILoadLibraryfLF2GckuUOGetProcAddressMQa2HF4oxYGetDelegateForFunctionPointereut2XZZq0MGP12VS3wS2EwV2koAKfjQAG2zIrfgWPVeY8YQePDgEHrfEJaJHKsYw9Zp9jscYYm4BMjApxiY2oZaKYL41YYmibIZset_IVFP1YUMsZR9jdQYRLQ8uXFGoYtJDfkIqDYYjYnuAosw4YS8XmyMQuMYTJn1nEHobY0HBQt2HHAY4eHOGRARiYEal4l8n2rY3xITmPhGVNs6UgiAcMlIPHVq8xUktyLUxOlMilsyiIESANHsRGUGpdIGpwgbj2daSLYJBUHN27JBr5SrihwrkpwDUXb8MwUl6tfIVJ8ss45UV6nJuSAULO9RReverseIjwmstUkBQePiNWh1EvhxFD84UzfmsENhwwHHtGetPublicKeyTokenPUCy03R8MokbLHksjaSJ85QPhRwyfNITKAZf2ilQHwKPRmD1gcHbhQK2VRI4nyiR2jrL9m7fFcr9aln2dqRYkRsfI7t3sgHIyOS2bRUO5F06YApj1QFlushFinalBlockf5vgvBRRaZ1SEE5yXxev6CI9BRtJ3Dmrb0wpmjGksUPBRjD4yZipudeEVget_EntryPointGqnHntRS3WEqullN90YYpOmWwUeM3ix60XQWN8cec4RhUZC2CGwtHuiGqGdafReYXkmfpxJVTQJNal8Ykw46dRCreateEncryptorToBase64StringclassthiscompinfoflagsnativeEntrynativeSizeOfCodedMUUmxI8oyWGlU2J13TLJjmUS4gsqJKCFlcDdR6LlCvUUlVOm1NYXURIQV9YAk6UtmGeeqKLMUjd5qyLhModulelpNamelpTypelpAddressdwSizeflAllocationTypeflProtecthProcesslpBaseAddressbuffersizelpNumberOfBytesWrittenflNewProtectlpflOldProtectdwDesiredAccessbInheritHandledwProcessIdptrl1IUPXFIEHzi6R4nHH3LAbs03DCEB56B5842C722DE2821DA9906CD70AB73267EAB1A3947BFD894D19372BC70E448EF5E5E60630BDDB19388CB6378436E3C65D03DD66DA7C6EBFF563BD857A128605DD5EC3F87EB915E0EDA22D0F52C595C0CF7986D911ED2CA1C403FB7B834BED3ADC52D4904075F6BBF279EC4ACEDE079533B95E229A29809542EA324A7B59058FDDE6089BCA6236FD2AE2D98B3ABB38A7BC80D8DD4C75CEFD7A5D24707462E6F13B53D67FDD780E20D89A6E8EE503B197AC16AC3F1D2571C147FDD324C9742EB14EC82FD7DCE8A8B8165C5AE7AABD3935C69B50E82F066C4890BD7C5D1F7F535673D836D3D77A97DB03EB3D71EA780F44372F5AEBECEBEDD696AAEB8378841F6FF48991C286754FBA5647CA30986070C8F457C22D30959D113010CC164C97E613E5A3A47DEC76B7E50D47644B35EA4322F00D594D80D2F1C1F3644F8A4AC356AFF1A01C2B0DA472E584C8E3C8F875B9A24280435D42836A77B19F5A8C18C61B1941CF756EB7551F7C661743802362728B785ADC22E860D269713DFB01A6D5B7247C497788CF0031CEB06E3DF77A45FEF59F1E49633DC7159816D64759B5F1C3EBE78BD8C38559BF3CFCC9A9FA37D221E31780774A3787E26160A61F5348m_cda21399255e4aa290b2f6f73cec5b99m_46b0abfd624740d598094db0208c9768m_7706805c84b149d7bef34c8893d89749m_76a344f63cd94781aac86d64c1ef1395m_7243fbf8f7864c9dadf22b0699e276ebm_11c82f5dd8da477095e92dc51e43b767m_a64015bc49f84985bf6f6be1125558e6m_f2b0d3db3de14a3ea710acb9a09022b3m_a9b1b10de1b7478f91f9eba2cb75a34em_f332a3c2a7fa463391b023655b5af4e2m_12cad31aebf14da8b77bba896fcf1059m_2128df63614442fd96d1a15b1e1eb8f4m_617d01f29a6a40e193cee3ef21d15848m_6423b77f8f304362b553d7457ef94b4am_9f86f5dc6fac42f4b9180f49039c20c3m_a6ead5751fe8449382aa4ab8e5dd068dm_504ba5d4861a4b9994353b35ce8bd317m_15ea6810a8c54cb5a32a3fb417b9c24fm_2fa0a243f4d24e2293ed72e1a4febf75m_26657321e19848ae8233898f6cb1412bm_de5d09c994ea4f0293f7616f3bf057dcm_e8be1d3299e1442c93d7c103a9f58f99m_4c59818de2c0475daac2888fe622c76em_e377f4d83ee7407a992c65eacc3407e4m_421a465ee37d421d9f2aae8e0082b710m_2d0fe0454fc14762b9f0ae0cb8e4a672m_a6ad0ad4f4d746e7b44f939f12ec02e0m_ce75a430360f4be3aa3f3b17464f4d3cm_7ce81f4d18054bf5830d0278eb0c9a10m_18ea392c8822485d8a71b02cf21466adm_620355afc89e493bbb54d8542eedf9d0m_423d12463c514d6988d90f7d285a15fbm_d753e51e6a314e4ebdf3e5535ab50d01m_6ede1b944af349a4b3ec1b4fecf54c72m_3e65d8727de2418982e3ad123c29e85dm_6df1f3c323ce45e09cea49690e3e0eb3m_0cbf50f83ef4428e87760ae44eae76ffm_cae915433d7246c1917bade759e36340m_dff1329e446547e1ae00aabc9f9cc7dfm_67c8b351501847f79829b69abe9edd7fm_50a562759c704b8cadd600af63a292a2m_36ef0788de6d4b5cb8b4280db91a7729m_30a77a945c344701bb26ca172e3985dam_773ebc752d284e008751e887ada328e5m_ad686d52ac0e4600a67fd069f10af790m_ba6493f2a11d4e9eb0569f6255941139m_56c4dc8b71044d4eb6d8a08904a3aa3dm_66f2e0e46aac4dddaa1eae50551ca8edm_23e576ac034f458fa0d29add86478016m_4514a248d14e4a0ab10deff1b237475fm_d422eaa26c4c401f931b860e6785f704m_e4958cefa4e5415da788805653f466c7m_ecb1d04fda264d3ba975d084deee37c8m_2dd670a2504945be8d3de6ceb54d5e2fm_bd0b6885a9e7432fac266d1aa707939dm_0fec0fb2a7f84528b9883c6f4b902c0cm_f5f8cc3272814f22819115df63d78c5cm_8fec1462058f45dd982267367f741afam_007814a856db40ad9722aed60e83e264m_06599c1abe524c768b27a9b2f9d8699dm_66f210f0f4294ae9bf1a613b53b61630m_330a01b8a66a4ffeb0bed2929bfc3005m_3e4d20d6ebeb4e74ad0743a9c0bae227m_a8da2fee41e54470a159c57034429f68m_13bbec68823a42e7abec8a3a4b64eb95m_ece8fe715af14668b6f6e424b983b378m_5f2841bdf7db40909b8c608c22844e5dm_8dbb5b7bc508413187c747cbbbe336d4m_13e8c4c1b62f4d7e85e2246fd00398f1m_0fd374623dfc41c889d505bed61a8da6m_bff9515805e447de98c9be00feffdcffm_a782909ce32f4154b1fbdeb7cc222b35m_f254978de46344548448d6edcf19a0dam_5e7d7eb107334f23bfb2eecc782f6ee4m_5951798aab7746eaacf4f452f089fb6em_65677bfc6e1840208d4675e113642eddm_442054690d384c278106030875f3f7e9m_68db675175364256b995a2e69c459539m_b974f6fd21e34b788dbfe05934ec8f0fm_60976d2f490d4f0c8c5e5ebb037abb92m_e9817a7434b2498bbd79690f3afaf8b3m_81f4120fa70a47259a5aa8113cab60d8m_de21bbbcf2924317b2cf19510c1cb8e1m_9450faaff6124f10a49784b4ec051f10m_f7c72fa067e14e2a90a79ed981808559m_05a494f731944484913a46ae6c350043m_cfc05f7a909e4322b552da5eb9b1c641m_567cb24fe814417284e5a0c63d2bb0a1m_012e64ccb6e34379b385e86230bff73bm_2dc83a918ad440fc8364cff70d9e54b1m_2d1b7929489043738c4f330bf9b0b6e2m_63e3abc0867e4578adc83ec5407a2ae9m_663448fbaa824a7da6effedb40e7c0a3m_5597c51931f94d24b16f998a1ad3d4d5m_a1980cdb0c954dfcbc9791f904db1a83m_4ffa863337614a298df933186a56af86m_3d8c575dc7ce4b1e8e4fb90c8a0ee3ffm_7ff92e20eea54f64a0b61a3b15227f8am_bafc4a18fcea478096dcd0c8fa44b726m_d6d7bcfb812847f98f752a7a7f4bf562m_06053a1f25b84a38998ff3f7ef810eb3m_f01ff852030b47d39f80de8b9ee9b039m_873c7d54778c4050a6c30b7c342adc50m_3c3441ab4cbf4339b3e6206de28a94aam_f2fbcca0629c42038a759b37d655511am_25e518d9e6054fe58078976a8d05254bm_8bf38ac667184a83beae2b0bafd1b05dm_4d090fa10ac44def8d6eaa0d67a59929m_d0aaf658c398418fb4772871a4be082am_ececee6425954922b654965e3e0f2680m_e0b82044d1354234a8314965ccf01d57m_b41616e4940b4fc8a152e8efb79a5b0cm_d7b3c6a1c04d4b33ab475551ebb97f72m_4d97122c5d1b41f1892d4540ba9e9ce4m_415474922c8c45f4b5a01ea4c573624am_845affe302e3449394368c29e2d1b142m_b753efdfb5374777b727cf0cbac9e93cm_ed48825a0f744284a1229a0126c352c2m_963f3a1b8f854ab3a4c7d8aaf581a867m_2b963ef7130342faa97bacfb2ae59ac5m_0532df0f3db042228223ea7518552812m_284a7ad96a244ee6ab278e8f6605d707m_70f973371191438e93f3e367303a9a14m_e2aded32079847a6b7ba57db694021f4m_e27f6d450fb14967a85517e8ba079eeem_5eeee015f81f45b792c4eb90fda62d83m_7ff48e2c0a674f6b82446d6f17fc2c3fg22bb60e56748437ca251b95cf39e46f3GeneratedCodeAttributeSystem.CodeDom.CompilerEditorBrowsableAttributeSystem.ComponentModelEditorBrowsableStateDebuggerHiddenAttributeStandardModuleAttributeHideModuleNameAttributeHelpKeywordAttributeSystem.ComponentModel.DesignDebuggerNonUserCodeAttributeCompilerGeneratedAttributeDebuggerBrowsableAttributeDebuggerBrowsableStateMyGroupCollectionAttributeUnmanagedFunctionPointerAttributeCallingConventionCharSetFlagsAttribute8D0IlUwIy9pOsJ6PbG.lYljxnmMhTpqYn6eM7Pedfoliaz.Resources.resourcesPedfoliaz.g.resourcesThis assembly is protected by an unregistered version of Eziriz's ".NET Reactor"! This assembly won't further work.System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089kSystem.Security.Cryptography.AesCryptoServiceProviderSystem.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089KkWDEf60bqCQdEVk2iG.qB8Mpx46PnyJT7fZPs)BQdmK0vW7NyrEybJOVV6#Debugger DetectedK8D0IlUwIy9pOsJ6PbG.lYljxnmMhTpqYn6eM7-UQFyis3MKZLVsMTOi546QW;GetDelegateForFunctionPointerfile:///LocationFind ResourceAVirtual Alloc Write Process MemoryProtectOpen Process Close Handlekernel 32.dll%1fVIi2ljD4edGFmuAP#jbx09H2s0a1w7v4B2'ZByLAZHGqb3ZfhHIDXX'DUOckXcOC9tdckwgDPOjF4RUdVyjdPozfj+W3F3FPHki06ggXX7t2lgL-FcqzztxqaLcSq5mGqfptgq+IKolrSY7mHQDKue5ALoctQ䍻ۀHG5Biz\V4 TWrapNonExceptionThrows Pedfoliaz Crop family rotation rules soil nutrient tracking via user-input data tables seasonal task scheduling via calendar integration. PedifalinPedfule61Copyright © Pedifalin 2026. All rights reserved.Pedifalin™ )$190242c8-75e9-4ac8-ba61-118575e4b3bc1.6.4.1I.NETFramework Version=v4.6TFrameworkDisplayName.NET Framework 4.6?_ :qu quu }} }}} 0 4 FD8 0000 40 y !%!) - 1 9 ) ) 5Y% ae imm qMuyiq }} }} m TTT T ((( aa q qM dh` d h6!5%y y! u u u % 15 1 1 m m m 5$55AEI) - )-M M IIEAI IAQU| ]aee ] m q a aae (( }}}uy } q ii E& q M q i a a i q i am a q qqi q ($, MyTemplate11.0.0.0 My.ComputerMy.ApplicationMy.UserMy.WebServicesA3System.Resources.Tools.StronglyTypedResourceBuilder17.0.0.0ZKMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator 17.11.0.0My.Settings a4System.Web.Services.Protocols.SoapHttpClientProtocolCreate__Instance__Dispose__Instance__ PSXqmeM2LbYfwgR4Ty2q.OIQvne2Kdqav9nBxWew+rxjYcCYGJE4U41ZmpUh+UNTFvqYH3k8Sd0oKSQJ`1[[System.Object, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]][] SUsSystem.Runtime.InteropServices.CharSet, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089CharSetl[7Iey[pZ"c)P2k0xJ ZNm$hvz-"Js |ȿZEXIf̶enT| D ]k}~l9ω-7YܞK۫Lі;Hs˷rh,A!3% mJN\lǉtN\?x2GT^vd0NĨNx#!'#6]7"*=l hB5*(YOLpLt9y6}9-b [H6A-8]ܡfԒ QJg08]0})) Օ渤VRsM3)EUt2:,ڌ{Clq&H=rsD\KK:wu"\ J mK7rͬ-Qܺ$ؔxs=~+?ŕs(>_h<@x (~MȟcD%KxCJxMX=ݟwMڵkģuo qIa;(h/jV/ĕ%()\Yh@C4y =kLCɏ^ KAx053; `#w+/axh8v0nar:BR*jtE|;oAtk9uuHrR0݇W-Ywx/Cxq\&49=XmG3Ą&cp,4j<+6w_ͭTUzVsϻ#eIO_WN2,SF 00X!v(Ƶ|=`k9\kkXPpWYvʅ̒ނ=חċ <_'!Mm񉂔Rm&ʑ\zYd2tSldDDu?Cg♉,bT}u :-'+'}4HO@yb;60M/2C^̔_\޽v 9Ϧ@=ѝZtRy{||Xe-MjS1 Qbq|gwECwzen +, w =+fDnfh s}gW \%? ˏY׮Uss$nFhGF߁LS*gdHDG|Xg-AYi\IQYQPe1f#>$xMݨ!9 ܩRzNkJh벘x"C4BQUQ5+>Q? 1E>Y '4I 0>FkWulyAiN;L˞5EofQxߪpLƝET;"HQ4;ϵN~G-)jY}\tlfٖݝy:B))Dj .bƺ91^3pvj4<8GUS%#㙡t_=@OwbܕMT/4׻?t9UoP[!@7 7c'`dP&<>?yO1{hgw.;t(r^b4- 7uOI&mGȄc)><7b4ƺΚق1{ f3pԑ чPspjZl;i҂_2F_< l]NY/"6:ѺֳzEI?͖j߻[$l(ax6y*ΎNElܫ* b {YtD6T fsHhBqĎ0hr5AfE f1bd>l]N6znwK\ cA՚x~K^$~ZRflULÍơn9R7)Eks7a#6` H۴Eg fK3:c1JcwHpT*S2CwvSIH]|@3#nL>Okp~nJy\"F/VZ5pu3ga:AY*En\BþLŷ݉6Sv6Z]E)݀u~qoxŴ-B!CmlSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADP|\Z CornerstoneVigil uS#:;ɗԸ/ҍ/::j<<*۲ŴH*(3]r\wnIRA W0Hb)d!ʃ_ʈE2naW^z(Cܡg ׂc @: H |2+l~=;*+ZSٶb[å(p$pXgւc>N)b/G[)B9!$I}:Ռt-\ @: O#'RUwr!{gZ~4c mekX}%*Y?%χF+JQ`fP;K8EtGL.FWM}4>ay{\<"#o:vMtqY_PI.}Tt4J'OmKjQۥS{j|~K*AEYȓ`t{yXq8!-P\N&RXՔF!Qd:V."ANw1Q|w »rvs5|pҼF]NEr12i0+Dᓌ]+Ur @,NR#zʲo \,( hIvR>_NJ]p\wJT)f42e[¬MW~S?GC[E9}SjYSYf$5#ta8zBl;gOaЉ6ݭ 7Ȏn'sq|XT~v1a²u;!r {!"K^s)&ׂ 5v{ L{uC7q#mrflވ(yL?sNFQ_Xi (rQ2܎j hmÏnơDUJDOk: *Sp[M< ZL_e֢N%y4.\<'GYtR)z?*n(OO/;[%e7efǪ2O97e1kJjws$m\m*0OE/,%# Hĩ@Q(uLCUےj^]H\^u5 AԠuY9b R=yȧ~C^ktۍdEHbQpL?Tbajk[N8{A!aLz`%QDȀKCw3N4">4hM΀uHKC*j/71# .8-{S6@eq-c"xTV\/2lRt'+O$/?a2͖*)'`耓v݄$㎵p\bns=g R4B.(U>zyPqo75NV[Tl۵5v1 պN*=`FܫZciō/,ORy~|ZZgyǭ&oLN0Ѥt{Vq1bKN&(<¨s+(JL3r,2h(S#c/wGD"U-lm>h!tkl W8ڣ.Ex%r'ZS%o!VzmFSRsnvBdi$JJa&;n |bqdwJ-PJ5NWy='8J@-`6˰b-ȭu%!8Zs˫<4 (@.HC5ї6;_i6zJܣa@$q-x1`=h8 yJb]8.anEv'_Ctlʜj'񇕫!+(J.N/k::5ٕyXu{"FNolvZùRR֏GΡn!3q#b )Kd1hɳYߢY~I7=8LUrfy,koRe2/4qI" rI;osb1~AFbtˏJ9C@*>SEK mlf#Zxy(\Oǆӎ(åج8kGVNYOEsBc,kFnַ;[z+?{W#%Gɽ-xն#&>C%z8 D~?P$VegҾuu{xоz%оA+˪qܘ`#2:~.bڰU0u)hhq8"IE"ԒTî!|NE>_;t9Ղ:}L6BEKx\I S_?(['J1*+ǲg}:7ڌTHӤS |soD.늦(ۼINy=;'=8뒂/CDͰuX~:y%!=*زԶ=*(ç5 ] n? /`Hȑ>>@: vH յ+G+ƔvbBSߛdn SS[s!΂c:IN ]P/Q9S(qgjz(UtJң,[]ނΔC9 *C~por8^s뢡yiAQ.s6 y`2 e `넢8vsHٶפ/( $/}XgۂcAn㒦b/W9J![!1M}:Րt!\,FJļ+? ,cllpaR颡yIIN)_i89iɓzK5/Ҹo3:j(@:SH~|25+nv3;b+U̶ţ/($}Xgӂc2B>b/iI9![!1KS}:Քt%\&,WIߦļH?,VhlpaU碡y!Iϴ@)[i896lcK)/ҡo8:j<)EŴ*(H3$]x\wmz4Ivᦱɀ/`HǘO>.&@:H |2Z+"|v?;b+DXŶ/('$Xg߂ccE`b/D9/[!1R ]}:t=\,Qļ?,"ilpܧa[]SyaIχH)cYi8q9ɓ K/1o?:jK0>)}VK@ѿ^Xz+)$Ax\HY%!fa*=9x6 j.vߖ#ځ8)I9=n28QL/(<ਸZwOx7JO޶ _:KY2pѷ"y#(|9 a4 evQ෥<}1muf(Q-r[sM\{GGFpnV&e/()!TkYs7Qcjeec?EM>K9JxkӜ̜B;̓MTіQTp@ֹ68`9]b;ȀîZ:㈭~[L-#aԃT` tcEBf.<麢DE F8A)/S< H ʰ`R:Z~IpT0:vsJB<;#\q=)//pMm7Fp+Ao)ՕbІ*YdH$RDBT2H(hc3 HVT)Q \i aL1!@ڛ«g@RVu#-T1bI` L]TWY)bJ$ j!\O~mgh9l*O8tGVMo+Özuv\ն /(G=p]vhvJswVYhcVvj6h^jb#} w|H ]Mc =}̫.Bb5u>']^9Vjeoy57Ʊ6lŢBX2![LP3$[;;[.B2VGANc77{z\])lƆ˝-⊼ʔx:NBȔ m8T';ڦ{ S=3+"O[fSx7E2XּFI,(XEgmHۘ:9dDi{T{cZm6e'˘{u@*z&өȗź"]7atGmfn%Q)-rF06[!3 ЋP%q=3I =B>VgYbf TɜQTp>D*ݲ{1YJެeᒠ@/*׌OMpϞr{HEʴ&CFdR|Bl`vڞUY̴EFKn1B k*&jN?p7ct\L~A<"{V{|xIK)+Ix$_V9L0!"ѤIk~lB%F|_[Ĥ7ꡏ[v~t)zl4pY'1n pKT,/| 崀|+J/Df 0Oӷt8q!y\h|reĆǁu:ň56xS2)]Tݧڏӣѭv3)[$UD__ա/qbZ!y`(= ˓s-1^Y05]'KZCZ:@r;ʼ߷RA4Bd`v^JďT$Axk\H^)> ;ͩ4dG%:4[';#<=)&ww/Dm3"G$ʌ+͡Ćog?ROά Jw4a s ̵"P9=q4P lOQYrބ2v(FZ֠ME0)(%=lbwݟG?b3YUo'[,!mѧBkB>Ŵܝ](K@)[ʓvqJ8)jpb?r {Ҿc˟ E|$M )tCI ġ~ƌWiDVg!j' 'z6uK p"~á=h:o`JV]F4MZԥ_99$" ۲{M[Nk%}w[Y 5`R:%H'~)޶\(hV/{N,#tZYJ]rN>'<ԝB$hñ ?p!Y !pMu(:YлI(qBQLYã-11>$I'(6P#z$PYf?x/E2tZib)?Xy::GAQHk)H~+5}M- t`vgqNgM_ma ѽoOhR_tQu\7%+zN4$W?KWho6'Ꞑ/L(z9_-9}-H8&)gTIc(K. -ӗK}<3F& S;=Ԝ*Ȝb3ylXkg@tꣷ!yWE/4Tb؍ŭZjw=,#(AWC]rrG*Om"bO5g;f9|(1f%h|V۞Mk`*N.j>} ŵФB<2bS]GmY8m)kl*ό뗘л[ƓwLA-(tS޵CMx>֢0I}wu5)rcA)qZ8yX=Q<Ȝ1f 05ȏ_KN^Z:@5hЭ{2Ζ󶎁4¹X\8r80`-#5`9OZeo)3vZgH翧I^N:08_O -rY-I V.;A0nIF_.\MR|~v{|iUY.P|}lf9sܧǈ=AuΆNNPvQ0E➴*{*T-r~2JٹH/wm)R̎}\8:Z£%ENX[8zf`6pmkĶ$g$͘+¹}V`^TN]^]:swδMrP˕[a~߲XҀ8 n& =פ9"Ol8Ն?g(\<-[[S$klqoc;vpIE+] ;ɀ伾KJ>Ўro0y%;<*ڲԶ`*(ȇ3Zr\vnxm¦/hH^;d*ZS񑵢P<(%pIe!c6d)c>G3([2 7 e}0Ƽs-\<.4pįc8.Glper]ꢠ({Io:Zi? 8;ؑAX/ڍn:+h<< ȂžH*)"ur\}DibׁHTmTdBh$ʺu|2+Ulv=;b+_SكŸ[a([$pXg1ch\l6q+O3w>rIӤMʓge[ niHakĭVO=:3}Nv(9:ςؘٙ@k#%2~g*ڗuǴH99ne-NVr(PYI>f%@x?/zhpW* m>]6ڀ6yԥBȿkB]&lSnȎ]C?r;1Y41Ƚ:(81'Ɉڊ+Ċ 2V]b*DPĝQL^:e K.zY쳫hL,R)8 an+GTMڒ3+6J%Eff T0@Ծ:Me:׽?a*߿ [т%Jk;$l%[#<|>ź'ȱIk)9`X 8_?;G89WSKnz#{ֵŲЩgq/r{ P{MБ^ai+A4"MJy {09ӧgLv;DfhYeL5E\8G 3+lmw|נfMK[ޝCtKN& iklpMa ^뢡yIE)?Xi89nɓKb/o);:jL(Ŵp((ºPs\wjlUO%q$slηږ_33 55Vs ]:֤(kSǂ/VmYWb W)[!=&xN}>,kOh԰}kj܈w=?`+;Zz-pڞkʹc.`\|ٜ*{/DPXYQw5Ffl]^*iN(14y> N6lݮK@f*3L5vw3ž6*(Ư;WH\wdzRpu@ǄXIf(FTə@)a_yh ka<;b͘+ZYⶵ&/ï;$rIaƆyefb>(Hr{f@P){Mƽ}IҌv `rNLƣM-*.PaNg(l[&4&kʜˬW45I]1,=0QB> ,ݲI8ۺYg ̏r;n UȆ9dI !8['W(#I[:x2I]ĔӤ.ÂߔL5klz|`8^촰,DQIBsѨb)+Xyu*GAJO87::nۤd,*]ŻH.*kM"vnx)^Ǚy- kOc͟~O.L.AvDA/ɆO(BAOޠƑZ:K6*(Ư:]it@nkizxň]8PJs2-~$ҒZ#d>&`ŝ<0`[_,)Sׂg>k٥(f8G0'H% 93P-;שdC^)J\ދs!NS"9. |p~31M#% jHɘ]y=8Bsn.ҍJb*j<<.մ٣HH3Jb\qrHꃦ/*v>*>; Jnպv+}VbTŻM]H]:k.å3o=)1Ay/QHm6bh0clwhj?Of8*Jt*|)Jv{lC(YA-tkne:{3JcxMR9v(kӮ8;͑KjS<֜E05*WQKOZ:b*;3MZrMuNGnD _OhWeJS= c|2+mv<;bl+pQj/iZ{ $qXgׂcyL(b-P,8(@,(tޒ:缉VՈc=\B,_Yڲ-M~A-tko9^ϵ8f);)]k9fȓԼ\ KMo8}M#:̤ŴL?3=wMpN(=AwП[IZxP:ݶH R+na-;K$Rٲ"ܽJ'$z&f ׆a4!)ǡ/VZ-eSc)?h^]k$\+xLdH*5M슂;-` ǡƯ꠹Jh^ TIQhˌܴLJ+uL R$@Ӓ#O.걕=LRݙz4[avQN/{OQpkǱ[~|)͠,i R/!LXgĄ=N┰8;/VA>cDV(- @:\H|2+mv=;be+Sf̥/ߥ( $Zg b0sF5"9. |piV˄=zT MS 6ոI/Җ5o0+m5)[pAKp=2x*LwرzMޑMڱH\)0@(wѲ'|Ihq ݿs]\:/á* )pP ׈r:럁虷.֯Ju}K_9iΌ#eV<х0LӣB _Yڲ--??ƽ ne:{38}I`qY'Ѱ5 ɓƿKC/҇5o0k7--ch>^LR^ecZc%_Lp)fNk<-py8$߬ MZv30k8.ӗ2KJ]e~%ҢE$~Ŋa+:G= Ly)@/Bcj%*wuu-X<[׹?kfaja8Tba#{p$mL?#*ɉѸKk/҇=pn[K-]9ėH*~=Rrr\_o-IK覣K/ɦH_^ @^ ְ|+Rl=;E|ZS孴yå(vpXoׂ?N)-/GO([: 9N}p\L)\559:ӎR D(`ϧ0I}v~>r3Oϵ;rF+iM )R`:l%~+l&"N;Ըhҩ/CI05N4K.\Ą#e H<㚈BY7 s*O?y]/\ZNMcx4)t_B dsn+͝Ek6U $fM CBR3cC]WsnR:IŲ9͚38vhġPH΂__>B.;^02UNOXq~MI":Ƒ];U9AiX=KqbAHR$Җ\OcMx>'&ki"n3Ǖ#5;Ļ0ͫA(KӡECǈ`V/BO&kf"(QIJ&b)Ey(GAO%"J< R'MZԲT,4W/ QA#; ]N)N˙!ݵ!-3o=1'эDCeZxKUȰ7b1{ҩ~􇶺Ǳa읷/ #ٰ5dITc労ln>ʜt O:[Ñհs#):SM"k)Rw:yq Z8FyҘNU?m-rG::l=ó<6۲H <A Tl+r=;f /\Kz[E: SmYհ|2+m~-z ]Zq& I8ۺZXt9тz";= z!@Tjys$$"$=l:^sӂR@ޥgSQy4)d//D(],?;& V!\pG1nzr';C:m)(B H]QT.U =ޮXZN^C+9;əԸAϗI)>tK<<*۲ߴHO(O2]rYzI?O/h@FpY,'"׳|2l{u1=QEȲ_*@ ͖ǻ$L#xGxVh4YƍzZT8-&R)פ'0 $#βRK*sc'Mp޸ik[0 Ǝkl{oc;#YevZ`5o8 9;˓Ըj_Kҍo:4hp~!h#oT r\sxZ^?NK^^:.զhvoq1}t25v9TP:.ٶ":Ϯμ8ۇpXt9ӂk*`ZShZ-ߞ`"w+lv=;b+Rv/_(l8pXg\ׂc2OS󒦫b.E1(_*(!zޒpVFجٱY+=_΄ļS)7-* 3p=~㵯kNE-\IcO)نZcOm}}tƊϬŴL/WՊ85xX=OqYOOƖH>dOfr$Wtl.NZy8yJTyN2t?V?^ z%:r#m ׆Ng7s*EX|눱̆o&q??kXłĽS="?nl3nj8^*(sy4E+i8 >9;ԸTI-k%6>A$۶ڸſ*(`J^82@: ư}+xv?! )'FٲzRե(|$v%p ׆a&=)`/g{ئ>PǗO?\Ռ%tM\<,[(?*hlpm92~!>Y e.D"ɗӘ/G@k p65i PX1𴅈$<`2Nw\nrIKH[;0C_հ|0+kn=;[l<>۲媢bBS`iŖQ i%wџ[hd<{<2"b&Ωz($$yxy\V9=Un `ۭ/A.;(Y 7"xőaM}8ՊKȬIKB:#];D6_[OqR楃LWeV\ꦧybC ieSY~a|EA]k)Pd=*l4[RL>Q۲;J**3QY-NV(SYoҽ^h__ vGeqy)!Oٲ/. .v|V`B(}e+*cA&DK\H\).Ly3ޒ@WBE_Æj I=:'~];/?4?cl ho8^(kI\E ipV)0UyۧK-rݧo>j4<{E: H F~2+겕vR:b+Z|ٶz/Ä)F$^g vc<\)Pb/9X!91 Ocx:Ռt#Y<,[ļS-?7,Svo7^􁑏({K͍S)qE8 1kD aYA1jG*ߨԼ2((¯1Y^\whZιà=Y͎%z!]HḅdkS,4B=)2PHJ]/x @9_})}.NԵ&֎ujK=dl55CO!MerIӤ\񊂾;M m Hv8^,շI""w4ؗǴ|se-9:<{rese)=R"U.!|,3p̀rПhrcݿإH ðn#Plqn;b+ZUЧ`quN=nYPv;/K'&ok6$\)/YZ/51 IbeI]1Hң7:VMƔ׹] 9:Kôv -ϓ@š fTM@E+"8 ;Ͼܘ?`߿IƕPe(w=XKQ`LrXuzX覷$qܡlاnc- sAPb\s鎇k:\]޻7ERZׂg-Iӵ,l:>>6r{5aPX{MOy,̵Պf<${ #sR6 <(>5j6WW\ꦰ##yE+Oi8 9;ڞŵCML ==Lp*ӝ#OB(Sɭ3c]vFᤰzK䟮袙c/fH^8[R: 3æʱz!$σW}`T¨&/;Hڜ(p0_KKsJZN^'{rk9cӓԼk ԭf:{>DJBAsmpXY[(pXf דa$u>@N]|([! 1?ňϸeG6礤f+e؟Yj*O&?AIE+{i8 pJBrW*UϺ'ҍo:j<<*۲ KB(6"]rdn|P> E @>e 0ְ_i/֋v9&G|R`S!)8~I+dk^G%(ʋ:[S($$wx} W9jP `۽/A.:(Y 7"xㄲőaL}8Պ5:d9H[[ѲMS7,hD\oLC~TWM)i8 9;6l+KK/ҍoj:j<<*΄ŴL5Q!D-N&.('ݯO+d+H] FbvuM W0(]0?GB(rٰG.MWV_G#~Of/Jm7B:({<^)* <95¿O{?&!T:]ēӤ肢įc.{so%^ +{IGZYi>t9?ԸKX/T:+hnݳ<82hr\wYOI馱J/`ӰH^>@ @:H/g|2+]lv:bsQ[; Zp9 p\G1t؜*B m lrYS蠯8:Ռv\8[[Y>G *C!"t T5QTc/]؈Uyi9$sV}]65Kgh+Ć'R054BKMZ:@UZFi$4JY|8A&\dfK(BA.Lղz'bjN?@G/i[p"Q:BeeHG=hñv#s ZNW^([2 ѱ MX:p2CL^'{}je;D,n\a/^ꢡ*yNM"\pVx0KڍG::l7oh6[?_eoJr$ $+jl=;c)!pٲR/* pXa#ׂpH)`ۃ/E.Xss 7 b1|3{OfxJ, {5 2a_h8ϳԹ|:!ZO3 ŧx*3_^\wj%,=$& mNE^>߿HHȰ(|2+9u<`;b+ZWԂV (If YpXcMwġB7 Hݠ`Cr L :S'Q>?^-\[[Âվ{?BJ?}[2]^yIG)bi8 ;-eԼ6KDH54ן8nm,`U>}I4ǛJ⣮袷oEh|K_j)=) հW|2ttH+uPٶz/E{%$& rg ӀN;)tC;[!=:'(>^-\[[ʂվ(?aumA8O~eÄ#C$GK0US!:O{*TvLZZ{xX(ٶV+,vxFvFIHM__O ([193[*{8ՈQ/t-|l@}ȣY[5_)klo|8^(kHEYi ɓҺKS5dR* Us^aRt rZNJdkP}d '@3Ӿ~;4!~\H ̜W4m'DINĝ+ZW͜~8&XXg ѧtdD)/OOs4Jy-+Ww[ƶ2: SQrXꢩ({IGRYi|ZSѶ/Ǧq&\Xg CVBpl#ijG)פ;93 Ǖc}>96 t@&Yꂢ -k}ryӆa8Zn(xX͍h)C]^)]8U0AD/үo::j' P3VCkxY ,d848@.SuOhmַ?k^ׂĽS=7tf[nL8^ڇꢲlIE+"D8 ?¸զKa/y::k>>Q۲؃L!:Yr\d^pI跳4/`^-#@= I u|!+lw=*b+ZY󶵢Juå(WpXmc8n1@ʹ6D9Ȥƛ1 꺝}0#Ոft'#<_[ļW>G7 GEr]χꢰ(yJCe~E|8ɓȸIKq-A:>X66-fn-hE0V2Nq\HnhI{"MC/)G{ @:\HɰT/l|:k qztz-ԉ|<(7pIgwc8!с) q/G-(J!Ի#UD#էt-\ ,=SP<*OM?5%Y`GY n/Yi+9m;ɆԸkMX7wpJ d/<"*۰ŴB33^\whzO*ǴruƝW a۸aO|>+lvPbZUʆz9å9hWPvF7WĶ /G9219LƷ`L0Et\[[Ղռs#.<[z2 r25laءꢡ0yKE/^Iܪcٕ!MX/Iw:+jr<<1%Z/e"=@7[wnzIvNp`J^> : !.j+Ye#.ȋ*J k~[eߢhە-툤/MKFc}k>hI})u-M{6Y@z klpQTH뢡3=L]r8B#*ɩԸKKkҍiuJbAM]ƴH=R1]rwgndHӎkH]9 @; J!SߚO|:+lt9b8jP޶z-(%7sX` ׂb^ &)(¤Qq~qǈ`"঱TahCbtdud7G)l|h;b?d⧳{Z{/࢑GR]v~J ֣׉JuUg߷\K ŗO};Վ=t'|@AOgΥ ?b,knpoz8\{s8b 'h/h;ɀ伾&KQ>.o.7UK ϰm]r\w!zܶ`v覱7/`/HǊ^>@: @)ao_'; p8agZIxbڶh-('$vp ׄo5nF ȆŸ5_t9!{tk|HS:Ոz4+aH[R!sP"9*klc_[8^곡QMa@7} 9,ɓָ崺Qe$X<ӎb*;3\rMwl&zM즹O/aYv>*j)=O հ|2+h~=;c)Y ٶJ:å(WpXa!c::)H/D>([ 93Y}1Ɍt\8,]qѲĻS>S,Alc_,8^곡Ea>VC7} 96løIK/Ҧ9:<`GeSM@)/~RBEPIyM/}Yؑ>: hNpZ/Y!?xv:b{+ZٶzS/`([$Yg 3cU?`=aIqǕ//̟ŪH;(%o[wtnp,)4*7NE^>7߿Hn(/]e;q>hZSǶZYWqi" ׂcܱa~ b-ۡ9, 7*<3oTa4?g+\T=3[[¢-W$&{ .`poǡ (yE)Y8 9;FԸKK*ҍ::u60;mqPMRJ=rV_p;ZK>"Q>-[N[zYMGG:Jg|VJb&Iܥz%㠷ȓ7RJf9c0=Â,[QЃƔ9b 5nw6n]^9=8QL/11 ͳCvPGNLY:y%=*Դh}xwCg0zI z: 4H հS3flw=bH+ZSgض:["R¥((7{aAۓ).)G?9^ﴎz#J:ūcZ3\~}Ǣ Yv+b(H3DwoI^u.|dY1/Ը*A[Wŕ<< 亲ύBӨ׌gнbǈ`%O%@ڵվo('>Z `hع_!'+7EsŉDS\:2å. 疦=)V/Kmtb>2~r{DP{Mj*sIz0 :Ơ|];B>/6ms T>QTp x: H !հ2~lWX9IbDoI^(5єOTy=8˅Z:-U%~3B:6;DӻlR^ZwnIyȞ[OH~7גh9*j*O_tvHxŝ;,/}ٷ4n7i" ׂc"N (G8[!?7y[ ë~ mS;*¥ ?b,k~poq)XGA{bohYi: 8;ոJ/ҍt<:x<*ŴB*%'ډyd}$I]CO.`*H턐>׺ܵH զk|2+iv|:b+ZٶРz/þ*$Xg ]c!Q(5CGLYc)Xəߩ|j2Wŕ&ŁR!-=R̐0]xM}pw_EI`Y;M/!h"초w m6+Dv7(gIZSȳtj(k$c^h crV_ pC2Y"q? LPlifn\}G\x$Z{ٶR/ɴ!>uOjׂi*DJh/T(NKG6&IJz/I7?9LކKN 0 -XS(1&3Ky8䑼t-F<{.^M,kQa8^ꈡ(6QadE8y'$pWlyZ:y+B9`[<*lŽd ȿ)WOrt~I観O/xHn)h Y!Mi 8.oA2njkZij R֦uC9L҂c<쒦)b/ߐ^))u񳡙Ƿ+8dLw4 []ǢS>'#=KA)r4}/={-|z=:;L+GAKI/OZ7OUe`**3Rr\n/I観O/oH^ @i H հ|+l=;b8jP߶z(7sX` ׂblo:y%4<*ڲԶKX(§Tr\vnxM講O/sH^? Q8%׷H+峥|3:v;q>,ZSض/ɏ(#pXf דaS9ْv/G;,^/=?& OW)Ҍu-MS,QqѲĴS>g,aFc_f8^곣GyIA!Yi9 ;8wԲ{M/Ӎ::`?/.ӲŵH;*MNv\n{IٱOsH^? Q87H Ӈ峥|3:v;q>,ZSض &/ɏ("pXf דKNe/G;[!3"Ol8cՆ?g.\<-[[$ļY,-k}r)a2t颦(xX͙ͥ)si+91;ɒԸHKh::k>S۸ŧx*/3_\wdibЎr3o0y%;<*ڲԶ'+*(ȇ3Tr\vnxM講O/sH^? Q8'O|5+ltޤ;bχ8jUiz/y>du/[p9B&?NUmYXb/(([ @9>ؗMIX-DX*\ܽ7)Âצ96 @LvI;^ۯn..yarE;q8 1y%3*-ryf3)3۰*(,*Nt\n\I/)E{ @:Hf OZk|2+v5 Dqz(ԉZaA $?(OׂHʞӄ܊.ax [!U1 -}<7\-\6Rֳ\&Q[+g,Nzra9f(\8EYi:Z$pg ׇc7/kY!{l>b5`OkĢĠ5j3O:phĸQ!?dDDlGa ٞ(YRH9@D)q8 y;͂xp&@k D%~+l9wj幩 w96d]YO2IҩK_``3^" @<%UH|մm'+@38.̺23HJ]D+(t$tx~FK;Na){"+gdg%NsA;NzM>OyFrt/M?uNbpk6[$nkhza:OК-rLq(ZֱYIJ[TD/o9:j< ,|Ŵ$*(f3]w\wzO覱ʌ/`HǰZ>X!@:H||2+0kv;;bK+tR,ʤ/($wXgԂcJb/C9i.[!J.lɗ}:St,\,[tļ-? ,MclpaY㢡yNI@)G_i89Bɓ^K/!o::j<.ĤŴ*(3]VUwnViU$I`mrn@`lnհn\[3`e>C\x:C~O U_W )1ؕ[Oa~[)qC{(_Zl5.Ѓˉ8%{+Z=t'M2/Ap:|OH89HLPT&:+!M6lGUl =;fu+^eVUwrKH%(r;QW /s3<*X~^]< 1oLdWHRe[ļWK?,z`G2a2A²(`ee36*Z n+G]X =9'pA~.\rccrX,~wF&`v?&f+!ޣ+G+L'ddaBr;kp%IJX>9ҁ$atGfn޺Z ޞ/;9, t9 /+fˆ:Ǚ=u+J==svjvZ.b_"YÏCzb֋aW|O)% }B\J<̜1.05gK7IZ:L-7{fNcRdI%YUYo_(`X2|5Lr/lrk;b RRߐљ߱* Ɠ|,x*Bgygxݼ:^O.oC'?QcÂ,[_;2jlvIMs<0 T8hay*3ϳqn"Ojҭ.!]ÐB*ŴL(©"ƃ]vMz֡i[馷\MOg*n1l@]PS!ͮ%lr;b +ZWў.pqXaؓOVeSO_uI G(7OO1&`w\ʝ9aI9x:Ɗx];i?6{wKY&9oeYL3}Z i+GTDL1d05N#K/KZ:v*,3c]vJ_pE'ئPlNO5W&&nIZv2le=*N.? 7%-B>Bw 3LݓQeDmiOaNqvӤ뱅9=l\vro8Q$L/GɗOLK>ۥoDT@~*ŴL%)«8 ZWȩmqBqQKO)h{d577RJG/s;b_Z:9=N1YzY߲b8+&A.פ͵1лmjcq҃pLգ83O;¯q?)Z +$^YgτKRc]NYx)**8$׆Z{$á=A#`JCr]1 MZŴh.ohLR&FZFP{Fp>geͦ>E%ķ!W|29v)̝کHB]:k7'޴Y*"QrnuFp_#gehpA;sM>\lD9,O'Or@ӤJ E'; GLTB;Yfxwi(aH;À߶]g߷dD#)-GQf)=R"NcpWBVi6ǉyПڎH!>$>t `y>2/Dmv;(e %^~ƂJr2å./t$p ׃p5n~<* b9HTg$'Ĵ`FtCңm('ّS6%+arp=AQ(r)I_Yc?!(91ށÐK^ܧR=8#/إ8q8 *4*k#fQo:j<:̚ŴH*í3r\nGIO/aY{ mְͦ+lv!-J-X{ضZj~IvErt9ԂjS=%|+lpka8T꨷+}y]ͦ9)]khu9?wԾJkeZ= [RxL򬈞ƴH gv\wh pމ荑-"Hv>&h0 C!H@SW==g==ŝOvo7he})r]-M$q,[ZԀ.S׸%WKUD4DꢡηIE)Yi8"aܸk1@<(ҍ6:ZS𶵳Z`Ѓذj" ׂca~ b/9&_7/1*8C~H0x-]6*;w[[`0>fd Iij"a8_[՝줢yBb ^i8":ԸM?05oHF;*!ŴNm(¯OZ"wni I!0u@Lf(F [9Wհm27 Lǻ~9ZGn_Sٛ/[($u1Dc.P([ ^?.!{bXżS>#lpin=Xꉁ3Im!)_ )ɕƹKc/ OK=GOI_Z:KN*;3WwrMwu+zHdOEě^8DVI$Y~NY(lԺs$7`?/( $c6r-\[[낢ռsAA9 p25ja=^ꢡʭ9)~7;81 _˒?~1-\Q [ļY:)kl[Oħv%(Y֧F)yv1;PK=ӍnD:j֧=< HѺ^F^pN4v3'U薜YNsH^ Q:-(!%s"w+Blv=;bxSَz#å) KxpY,`N֊b 9)#zXc΅է5$^t<[Ģv?:`kl[G*a>芳)k7C:Yo2gTWXG@*Qn' ^\A3$ŧx*/3_\wdibHt-'@c (̽zJfyx4b+ZSضz/å9b$pg gc~凇kZV8Jo)ܲEUR*In>ح̔`Xl]j3$Mã 9ȍ47}v72󶎎^b&͸ąAx4\H6Jƹvv#ݲ[HVHNohեћpV y[aRGTձf/OKm%B% g:J."ſO{)ƒu3Kң7u؂Yi)*b( j0TQTg^n)xXE(=5i839;"=.S%͆Cd::%<* H*3Vr\rnI6QYN/XH^>߬ : 7 %`\ Pʹv=;b*ٲ.z(/XwGq]v~Jb fC9,[U0IǷ.`4st$HIqsiX6l+K'.RkVj3l<*ݒ=Kp Nk.:?Ռ-\ _q膽S?ZE\^\P^ꢡ(єIE YiT.еɰ̅%iK/*::IRx<*֥ŨE*\yr\gnYKͮ覅>/dH*WG3: pxհ=P+lr=;A]N72ٶzx>׍$WUkgׂaӌ+\:$*[g~9.Eƽ\wvoV#XC2(.)I_'k\s.d|+}Ͱ;;6^-ZbB)Äkma X=D1U):?١/9?`8۫UN}:Ռu \=][ėS/u%*Fluo?^⢓(iAt"ni= 0ɢԥK[#ҍ,Ly:gU1*H*8¿=)u?\zoIŦO.`Xs{@/2՞|2k;UXf;b)KS䶛z?9> -Xbׂ.N)b;vF[!84O|* DAZ\=L[S? 9luo^ܢ(yhti=ЫɢԎ,KKQҍ0Y:g#*uH+(d\ro.IlԦpO/`jAo@?+}Վ5}2xꅔH;gyS0z/9XbׂNh͒t)b ߮[$8tm4O|:a:ՌJ\=~[+^S?0?luna^ԢK(ioIti: ɢԇJK{T,+<;kyŢI*8)j]zo#IN.axsg:A72;ܥ~}2]':wSiSƢ{Tö(ۘ3cX ̂p=/5A)zd["9< O+zޣٽWT<߷SlpSլHlRf]B8`ɢ!Z@fi =:;YKKC/Їަl$06!زwH*{R3wq\eyrD.coC]UbA9 $ 0a,p+G研u5qaTڶӬ!zf(ڑsXR<,8aS:>)vǏZ9!iѕOh.nTw}=8zuWcjl=Mg>3" joCFљ_o; ?=ɣK3E/̦| ?扺Km(z/`,i[ݲL* 7B#uwnOyf/`!H}?j: (ձ|n@w)b凸Z.;/õ(9%Pg ׂs3묡\wn'=/`#HM?|: ձ+|2n+ؔw!lb凸Z&/6(~ߴ%g ׂ<'ub#/3ف8֠!9Ѳ8cP^}:e ua<[JD?W-po8)iIy4I"(!8 к;Թ`)K|/nYjg ׂsdg ׂs<钎b/Ң#!9! ۗ}:ynI<<[kϦ?`6poq8LyI逦38 );Xע$K/aɥuj g ׂuʢ(zQ Yi8 8КKH,HI::jz?TŴH*+«+Ywr\wn<ĦO/cK& @: х|13-O=;bmYVz,+lpXg Ԃ%?08)a7o([!9w#JO}9ι(-\b/}ܤք!978cB+}:ʵ|2+Zb;ZɽU/õ(&ĭg ׂs @8 H հ|2+lw=;b.+ZSضz/å($tXg ׂbK/ҍm::j*ٲJH*3_w\|K|ul/am\T @; EH {X2+ns6b+ZS۶z(3$sX[*ׂg< cFE([ 91 O Y:w+y<@~[ǂSE,jlL`8 zlAEYi= 9;ɓԸKK/4mj*߲H*3$]u\:M{ຉl/aVl\ @9 ^H 7EY2+lt=;b䇓~S۶iz(B$qX *ׂbK/l&j(޲H*(3]q\wn~IO/aH_> @; H հ,U3+lw=;b+ZSڶz/å($qXX#ׂa] Q5ml8f8!@O@i$> 9>ԉh8$3SȄ;̜u̍H_3dknW;ȟo3N/eA>i@:FNI#HH|+:S乶LzC-/ɤ+-h`FAت#'W#,{QZj YŸxwu+nVAǕKȬ0Ki7Ho4\M/Hi9@=4 a| 5(0.LQ并y#BD*>ů`6N` ")WݾYt"A8Nv&v{Z&5aAZ DpS52w7[焍Px!a)\}cDжd*#?gڹZqҠ!(XO}[$]=0ZROmYғ̵,Ucwk$xE6k?9>1ApR}̤c?ُ9ͻK07¤E`b00ȭO~.O>5iAI1y yӁuCz0+d?j %ZZ-z!Ì(? XVH'Wx5CsmCUʏ@O+BIq}#q.gЅM M$TxdY#0i\9#@< H °|2+lv=;b+ZWٶz/ä($zXg ׂc-nlqod8Y⢦(xIN(Ui9 6; ɜԮK]/ōw :r$<6òũH*539@P\jngmͦO/}Hv# @ e .Հ|+N=;bG_Sٶ/($?Xׂc<);/߈D([!9OL3O经F}YE!v\6ORg_\ȨEO/5# .O[rՙ-EZ6T`jNhͥ'{8[t_:9lYQѬ-iGZj85հTo={hzL5i`v_W'mhj6vTBSf޸6 _MyD3}<\:2NLϣv@@oL1J^1A?bKXhb/\l_bTFLhZay˟K?Q2lU;g{05ە-GJjImLU|ǵLUJWA6Dm͡ThbޤRׇZTMUWf/>y~^}g*\'>ęs2쉢Mu'E`,n]iX^П{n!} ^8GLxN"{n83,3)x})_Qjg&HKHUXBg\ Zo3SN-ne5U8ENǖ)B/\L2O^PRbƤ5n˔zFY\@v* jIeѕX[_l84BMx8pfiNjb\ʸR{^q:9BDKhzKyd҉u3\%#d$أ`U1G@tdy;d@-!zb:Z37ڍ9BbMǖ8I8`gPZlw۵Ð[g[pwJ!jun0Ӫ 3LtL.Ke- 吵4QhkN=pZU ͥʑp bܳ]R/\Ǽ^jfډ 8RγY[nahxkˋ7H\iߏ<> -ST/}*H|׷|X)؉-{ k]{`"|mW^ߪxhQA؛o+0nӉh%JxN-b7л:P@<1V_g@(;ȠXYSE4k r⣫&#Pahb`X@}HǤ]FLGT2iнglЦU AaI5ϔphp.l9thµ9R # ~) cv&<{F׶,p@a+?3&*zU3ߠ'N|*OjHHB'<8֦m7ݏ jN`r d󶥽x)SwvHZ[Ҁ]RҌ[GN^?18*̚io 0y<~c^;[ٽh/ޯWD,}/E^9#y^ЗdsI6Y80bH K¡L:(!\yyUR*cFwݝYd !/nI&DU>+Pd.PypA,jʑY> HPgL?SѤC,cc6](+kUNgUƭ)P{p|KڻK}&{ Y>ex]<[ז Hn[ϸc<<9v^ǑmH;*s!([@CUÜ1TCTX}&DWL*ʔIzBȫ *45VI[IϽ*L, (JrP8Ԏ nȍ&D;EC0mJSżHiWLʔ`h$`D xNMTZ}sd7U[BcB&r=E-JItn30*ghCO3=βLK*u=+`n۞uLVيP*Ʋv+ BY`Nil̎/DoWǅU=&6?H9?54jGEya* 7vqήx4(BKX9FFJmYXP!c['юnJ[ʱ;=oV9* -赠h33Ϙa~eФbp@˲v+q3~J[.!mP 4˃{M) ͫ H.G_I&F6L'JNyѵ׏ej;Lt_H|O] bay12⑟+iuElJ8;_}Bǎ)hd,9nKj$^ZL0kOK~>&w^aY{OCh#8VzS48đ]$9eBKboHŏv7vТp; l cPM/2ǰ:yLi[_^ Q9F$cJyV ʏ{$CGbK2LzNЉ6NW(ÛK,+^+=GZ Xn"bƀ9]Iim@>3%>n-ԷBI8^6T^9RӘ xA֗{||յ '\ @}5/`XQ~dMG*Y*^+Oϰy=K1 mnϪ)kx HssxLp=^Jr '&2ܰ;|9ÉOT:Dhup~bRҠ[޾i-nIBJ2܋ڃz*bxj= ^Q9)uMڦ T(s^yMhӅƎl$:[vV OD&XNzm%=7c-˪#JpKu/Y4ӳN+zR.Y^[?i/xÕIG$k^]VQ Ҍdb|2 p8sKĩ]PH:ʗoge:CHI5<+?hmI"]GR8!*a]Rlk\./X]_*W _Oӗ-Z@BPD6x!+]`<:JR)Xx; Bː)V)]D>Q ^.-$hTlM}wƏ.n"/%_IV.tsvФE@3ۂt243o,Ǉȱ uVކ.YZHG8Sp/QݎX¹P&gE5 Ƣ1yBl@6`-] wÙ[ebٻ2\G7M\ץXOmx${ЗU,!yzJb2[ש!jPI|A(Q1Ls& ]6zh9y\̏$C8n--8}{: X^]koLk\m8=:$Ӱ;~;;B-PL%:T|1h8D)%b^X-<ЬXV[vPv4lU:]aG[mh|Be͌XPWf[oU0#ŰmVMOK*\DH!ciؐ<-@~#;!Kֱmm2 cЧZJAƞ\nLŪ٬1~ZxA)vc|)4ц }vʲuiEl K-ܖFr=+E mQrqL˘%{ JdFXrAoӢ_ćkf~(rHi5?ͯS{S{IU>8ǡBt h*YB[z;n#Őix []XIFɠ)O(W}<0n m!+0 +JQ2P 'bdQىB"=WMF;=J]MNP:}cP>ǖhrZº4[F3DKݥyAmײ8_vS^\LZ2)ǪSn|Ѧh|EaT.Xs%7J*qgտKVy־'p:`xOV,zJ|XM3[3$nK!ǜUW-Fc :fb禰ɇ=WOvMyhYZ ӵε4wMgvA"=m L޼`?ZÔ_̾ASZSAp֥[s~e$Q^nk7Sn~h{J*Q1ǡNM EXwyIhS̍9MK<@_jyIQHÇ~*ԩnU]WZ@PR*xIjԌU-:3aIg!%l%uމ\Ű~NQ`ۿfYF؍Mx˵w`EH&gxZn z^/Om(6!fy|х~G![Jrh܂-_ v6omlR]B̞Ơnj[kOߡziQRwJ) ƍ.bDFϽ9m"9 }uwS0P$Jj@Cds{ƏޞvLpVDMddVwCm6;fEng@/= (lӋFd,X^N@Np^$w_O:|Wvh+_ަo6\G+i:ßA)=dhS˅>teycC%!3ycg+~Ep!'_bUR_3s!\xT{j`XY\׫~K_eѺBnɉJkx:y)焫sKUG~N#EU̠{e7z4`Lt;R>8ϔ sYQJ~1=hff,J9|<"ALj䱌 *{~ZYP'Bp1ʠ)ڋSB :4M+wdmgttM=kR؇pyttyb߯(T8}M"wMfRUR1Fy@kdh==K|ԉ{[.{npjJ9lw֝TYIZQ6x?#i@^AE;L|Ձۼ\5\Qc}zbO5L[ L d}`>>)LY~j1Y)s+owM܆&x7Y[[ Ibw/eE y"y g@DZj $ nqܞ׉lր-iDZ?}m1.ϙx<Q`DZ,^nZ?ҐUnac(.['8w'k.;f!^[ Ui- LěFe-5=\z^6?άKEhP30{ S>krJ׻G\wDWӥY QƨJƔl{L0zF^):ע6}ȻygU 0'^Azy=+n-,Tl޵WOL㱸.n.ؑ\s vUqYHuנ@MѕTLfƤ*9_σxpk)}_C5֡SgQŹsfCl7 J,Kn ,M5K M~vߘ$,po N: pzUFȠfGAv.(nS˩=\'F S~;l:@אi BII`l?'npAk$=}Y:ЊLY+lĺ&\M8S@ĥ^R*HVE~5iY,5񰢐pKԙF@$58ąMi+Y=W@ݤ %hJt}_E_YY존OIA}).e=#/4';Pt/sc/lsz =lHnvA>XPٷz)ޠ+#"y[ac0_[ÌĽA*imbra8L룩+{HX)KL*8# ԹnI'ڍr2"b!97ݢĪH-(:1[w|vg~ To.hLO70H9M)അv4(pp?d(\A۰k¤! ,wxeŷq G᧴g.C8!X'(" ő^xЋ5q=U4ܳ)IKǇV9 j~Emc9W룤 |iM&x?. ƀ^^J(Ԙn{=l=.j۲H8ƭ3]2Xn~Iণ'`L\= H>-E !Ҡab2*|v=:~>Hʶiö('bc א*8N(Kd=J9:/+9 LovuxNF8>\ÀĲ];0kolwq%B(wHE1Wc8 $>̎ѼYK"og>j9<+ɻŵZ$"®!EO"sи&#!(Z(%6"凴O}:5u5Q387KJ̐"5Z>~jj|aA>Ly㲰LkFUF9=y 3=3ݨ[k?w83r:[ EET +"R<`ܚzxGꯩA>YGUR:Š"Բw\06Ld12z3Hžj.,`@l)ӐV5 p M*O1\3Y)) 20ou"ܜ5f5D!pNivʧc)Ʋy9 o`8Y޶ė0So8]~ܢRNтv.e/ W_zxUY܋%8gj03T:L権N%--2J(q#x'1Ӑnm=:*lv<;iCh5>z/QH9`cCjѣGI`Ks4~Ԍ! Y9~Nu˧ NMˠud '{2Gr[ ]6qgXU{̋8u8pnY_5J<}+ܶ-z\{.&3՞)x;Ʉ6J; [U)Vi@86פt3+l =p/gD)<˶v|L!@7zH:ҀZa3PO(rPڶ]EE׆*N̔;Fr#<-[P'pX =6dqoa8^뫧/kJK.Kt1I0)=Ɩ۽DN(݈`5?b45#үؽG#'Ǫ;X{TfrA@7ePV<5N'hɵ~]6*Ld9c ,SAepɭ /,uPob!K.&O0-S)1>'ɊOu(#[גT#A4,YI~̺S6 ԭ?okrff;W!pKM/P`099ҿBX>f1?c55"ӵͼ@"!Ǫ0}sArfo =TZL82;OзKy5jkd4?e.]QԿt(( %nXc֜c4I c)*.N3|1%#Oz>s?8ܷ>R]ֵV->ybz-LxeUkAL<9;ړҨUO3ۅw^"h>>2ӵݬJ(!Ϫ4Aul}Q⮹G'h@V<$@;Hձx~0_lx1 @: H հ|2+lv=;b+ZSٶz/å($pXg ׂc @: X հ%|2+lv<;cZSeٶz/å($pX/ ׂ;|O9)b/s9~[r9g FֲO}t[2b\<_ĽS;(nlOoa8^ꢣ(yIE)Yi| 8;NʾK'/s U:j<.۲H*F3y)\nȰzIXL/aH WN@] ! m|]+6lw ;RՇZcעzô(LKX <:)/5J\[N9T UO}:un\|<\[:SRzloǫ 8^(IL*i[ P;hѾKK/rT:O<^̴H*A3t]r\Gn{஄O/H7QN@: { /՞|+ywt;NZ!巶ԢzN(gX <<򵇒)/ PD[9] onO};rA\P<\["SKg\loǫ86ʢ(YI"@5i ;*ɥԖK'/o]:O< ̩H*Z3|sr\Cn{쮏O/4H:[M@[ ѷ# rհ|U+l$(;cYZ:徶ܢzC(cAX @: H հ|2+lv=;b+ZSٶz/å($pXg ׂc @: H հ_|>+2lv=;b+ZSٶz/å($pXg ׂc @: H հ|2+lv=;b+ZSٶz/å($pXg ׂc @: H հ|2+lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADPU"F;HQ*;FS GK '@EqualsHI9@tHHGetValueOrDefaultizAWG&A_ӴK&IN:+ڽget_HasValuexjVp $ν|*ƇGF0FؘiD[\"kqCy!Ib%@@QZ^&Ƕ]/SD!7Ç ZEogL*B9q"am8D꾤K`Kp~('09|eVD")*C#9Y[e}]O~o CN~S5:*ӆToStringget_ValuebѾp:Rfhn M"v33m M")avX0 0*H UEx}tJ@]GetHashCode&RSDS XEyU`Pedfoliaz.pdb. _CorDllMainmscoree.dll% @0HX||4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0CommentsCrop family rotation rules soil nutrient tracking via user-input data tables seasonal task scheduling via calendar integration.4 CompanyNamePedifalin< FileDescriptionPedfoliaz0FileVersion1.6.4.1LegalTrademarksPedifalin"!DOriginalFilenamePedfoliaz.dll0ProductNamePedfule4ProductVersion1.6.4.18Assembly Version2.8.7.2@>.|s`GQfZrK2[vJMoאtp(V(}ogObɲPd6l;a00DQ'a<2/zcApHr`p+h!Ձi2#[eVӄY5uzʇ ޛ,ŗo5// $Q1~.v8WWn`p:FȪxI`2DwNm}%fèqd핇gU&z%JS\i%E!W}qf#TRIA+Ą!d,f"*4%/Xi)Hõc(G~VyB%"$"l :au>T/Mg@ q"qW%0}5\Ν;]%[[`0-9F:Z}*=OتG3=4{i͙Zk$ SODZJ`H˴@:_"¢r]G2oe͍ɞ49!T)Β(]oռ~ՙPkm(iP cia/Zɴ蟬ї:kt6=S8/"N" A!/NTB ? #D{HqRмySJ%S|0Fyrg-k+Gm]0PLJ.$ gy*׶+Oe1JF "0KC#²;lHKFE /Ԉ4e~|F!l9ANVe#}={]}` 'hj=1AOɆlQU`VLOJJL#1[=lZg'|L"=WT/u}_Ѕ'ݸ&p6Vo}>yD-qg#O+[+X&%Duכdaڎ}H|>dJ>5fyhR3󦢂e)$ sQ&ZM!X%9Jء[Ǚ/m-GB)(Kl=N#'ccZWcׅЙurb.+aK9^VQ`W-J?Ot¨M}Wj8*,5Q=y G+ݷIn"R^ArN8K(N4㑏?D$B}.6e5FýIN̥Nby?[Grri!#6R" նTYK-Wk߆gq^f^m1M^} e<.;8oV' QbZy-_>S:n'םn'q"+0LFf2I ҖFWc<,( M! ߈ݎe!؝u.էOa)[Qnbǥ1^3pooKz8Ի //e^kb214*M9L9ަ}ŵDzJg<]GM0܌FnxOj+G|L}K4[w'2-5Л 0iΙ^]dPjNm]H&F`ۑ=p8;H`M`&\{h?= ~yZVY5 KslWiе5{0p|tҕfN+e/ŧ&$لdɘj(L]jˬpn$"W8m69JÄ1.Pv..H%xyLaKZuX&SQzGjlʜCF+P)p!KB:b31dȌ }Vյ~#pbiÚvu9~rz%ȃeG^|bEYi{깣T}8}$!< L?CG_)M@I uqa%dѫ`w1%eoM=nƶ_Bst~A荬cN70j"5-H$\R4ľt߸9LZ :aV45q/omjf.LOHp ~1Օ/]xĬ_A⅟ekկW7~eGk0TrE"fAM6ڎ2: -~pt}|tZay!Q/K+TRR jf-{+la^&LLZe x&į*o?ȹq,LVUҺB8O7H.Ie\bO\ Tٱ[D18{<#إ& UuZԵ`S Sa1{n٨T40'Ċ>^:SEl wt'0燍@y,l.EnxB'nX"W-h"O_޲ / I}-L?!mL)$QH7C^#_JPsLRԼE4iF)ε(_Z48rfKB%{] @!K]kc$ma$q@9Je1'/iQXrV++kV΍$ x45xOuy;K=uovNcSb$$=>Lﯽ>E>H򭁰yqФ&d`IJy)֞tdJU?l:YT1Jxm @?E@| :ke2D[sXؿzX o'՛FtߥႿzPg_r)n;K ]6ךW< cq|"b2!]2 ׻ ukXcO)qe$>Uĭ2f{z0<[(ۨ`K$Y;ݐ{58>iNn [fOPTp^uX'oΫ9ڵ[Biv@?/_͝l؎3-ۤyѿV4Q1_'&~'~;tG"֪Y7~f}x)+.(FD]H[A~bK?+~o¢~ lB%*i Ej1ɟȸ1@!}u1TY軤k~=#$C)򓳹Vstn4$j>h8I60U꼶zɒx1g+k;+>vX-$rM~Pght~UA96z^{ݐu9@ӊ{󪲤 Îb %M^ɳ_ss*r2 e>ASwTcNZsTVت%cth/Ohy*z&׬p(vń>mVd8*5_Vi7xm=:IыB`V;EZo(ӱ^#+CZ%;~pcA=]ce )wה8ߙ a[bNWg"aPXQ\w+[r7-2 -X_PL|e?vzu%8JvGHC;`S0?\H[+j4Wx<$szqc^wuSd$>zݒO¬hc9lOW"NhH2Ml`Os&n4*<ڠdW*^MAC.8%A um=gye "e/\m++\*|ul,:/mCS5CsܛwMy?d0^--EivH?x$UXD1=VCM60\)G2[=Uބafoͼ4%UMG5d"m͛Q*o4ǄGhmc_WWGhWTKCA402q&93Ƙ*1Z.m3 1PgNe&eaAAmһIVc2dJxyp5pT|<`@F >UƋ%]/Mz5eZA[y؛X;#騬r"ݔ%U_(7˗Z򸠏7w֔i?LZ 1:qzc%lVXZa^lyS5gKɃӝeN-`+EYĿ;Y[`;,@ؕ1][Fz)!.SqpFXՂ(9p2{@-BǛXoKQs0 -zCVw8,@[pټ#koFny!XAMYhXCldYFp~Jb`\u +V?)iS.Xթ!".xU&!J>""ԏMFрݵmC*2ړ=7qPR}lԟh0MDek`VϦd4T+ 9p1E&yJ"{` ~:UΆuhP.WG|̄9.Gb{0nTc$flyMyCŵ8{}}n!<'s@ C.?qXOrrJGE2{+#G >=/t{0@$h;ʌkBNX!mѯNs[ሥ)9N65/ڣT+6r]dL an<'>Qfo&D0J%A/Jjwe'}g 00E[xL=YW?~[ x>̈́Hp$S뙥>I$dlSf 2<;nOZ4?D@>K"jS 6 ]jo9 w61)Y* rz~U#*/77J:!ȰH2boSݝpmFtH:γ_5{ھAY,Sht]M~l3t l;S!3%tg 4.0:#D\*D__!|+1??esv';P9VFR__MPuKfO_6nW(OI,XlL*`HRbU3C"3z2Z ޵p ۍ _d}l&&`wwУ i!PZ-Qtȟ;+ 灙NZ2nx>ncKhngnf:9f> BzSq_l"R DwdRoJ_N : %.t10xF}ªcl?l ;)jkJ>æ6e1"\ mz5EnR!*"Q{bbqvU.ѥEVw>ZryTX3U|tҬ^B,΃OC 3V Tqr?Z:+H},hܮ*R=SђXעuuZpw[9Hw;@^{ws7Gxd5~ڳ-x5Df.3(7l¶}:<۽0 pyi,+}woTi58LF.'ht~-\YEYs3ޙ\VhDSڜw?u(Jb̆N=O-\A#FzpPMGXm}u#k_xaVzUV^)GD| 352ucߜ$b z*#w6ߌ#-Fu!;ʔ4|+97E]rUYT_{7 TaЮ#Jrc 5IrGQ@V%q"{sk633^,vE@gMj̏ÍuIڣ-I4!h1y ]wf`VuO."ktu2ZSI 5dI_9J.:(\\n"+y|\AUT?k]_3Zezi^罚@u~:L80{ ߚ<9@kev/D_[ O24c]5at%<&j2-İXZ1~mX x5(ƭ\tQ`{|ƟGن%'0df%Ayj,wWKq_z$C`yywCSdzQKT>KFea`q _}X7z+mp/ϠJfU=Gt:9nK&J4&`CZوv;`|W*}!' Gjxdco#Hvg71Y%$wŔ0NiS|xC(2͢dлoG"drX6V0[@`t80EgEV190Kc@ᕔVr8LZ)Tbz?#'שGGFk`JA+}G3-~O%&,k1zidSt/̒6QaTL7cVc9ѾȤbI "N{ģ֕4R/ u;y5tӔ֏x0t=;hZ{o/ 0(zcN/L`0můI$XvT^^L)*T%WG҆i1Qt){wR7U,|AqgNgն?g_ltqWӤ#b.yѠ7S\CHW9 U2;y^Yl39 vBj{# =i:4{DwnR5Awost}@r8n7<_%(gؖkž%_.{:Uwi>huǥ!h?Jh!]z铵5!'Wequuy^nZ&\ )b (B?}c'RAჄ錒eO}۲Λ4W.dgI6>0Wkss.r]-{+gd4N{u-dI_It#Sў"qUP4?ыA3(UZ1~f[}|gfp`C2vؖ\.Q'+b{<ڧ&msx478p-?De5`:=Эrr}yܞrctdZ=bKU\oՔyNLbctChwuŧ4nkfS u4{A_(j-!LZj,C+)1g0=hvd^GxrP:zbL@NƑngw}]K]eBOzlRR!#eB l׼/z6̪};"ZOVYV"xOϮt>Ed0TR9Vܬ4"bFIzÄWlo4SJ0`l*2q"@TlϢdN׈dX)H=P˂`;JH*(]Lds"伌cC_Tt(mhJX@*q}%+ƗaoNcNԮ&OFtFA{e~9)%gHA;0~RQ 6R*DR7-J\9Mp_>{I`g`3OAaFuh' VIg8 ()i7s'*o]Ɣ2g?#t]Ksz{M6tMĿU۲'v{!!{SĞ3!OLSء ܰR (Jzt$ CYLԋ6xE"2WR%)D٥kHi^9c} yAabqU/MJ.GƃWdg\k?LRz?)qd)B>ی/~U, (Zl03(P33b5ީZ]B 7Dt4 /Ks3f"IKqp*_J'/JNK䳠3Q_:mpH f"8qDFwz'0%Tu:=G8(3+{*~ A!n.}e1l !W\go: W=Ni*Y ,|VWPuw'DwߐփM,aQFS'n733Sold4cn?J攢&Bؑ7 ^<\JfjNs6b@Q󬻞I/_Qfg : uQCjҀ[ߨ%&[719q#}[;vHJ%Zte_e0`]?l)lR3q:K!1[uOYUJ{r!J){11uB^ *^1$<:J؉jEcxڌKnIA>[9:r|/c[)3rlBe˯iRS}ݼwq,cY<+BՅr$0zXT?#\qrWkKw]JqLyњo_G#"ΔT:qǖV$('-BxT})])El]ګL:CJK =0[:4mrR80r= 6h]5# U8JOxePnTFܧ0*KV(ب%ڰZpiZ>OhI*rpYH~yAk=uh/f?ۗhw_~ՁWO*{mp|!kYDqgZ#1!mGێ\E}$`߶g1}ץm$ܒ=.Xqޮ*cռO?3W]'O43XRvE7NMM}[9;JR;fMQ#%ĕPULn׼O]X+w$ݦb_!`$:,.un;b'(4^;U\ -5l2&}C]Tb8i W|75gG)T.Or`K@=V/Z[l!(4$h# N`B:Cs?A]TiʫE8xŕQdOAyENN_;zN˪f\ё _v']vGZdw5xWJ{+S{6Kal*2@l,.:[X$`v.NL~.W a]O;]:>nX߻.0Jd&=\ZOچo~U/ G\h ){66Tߛ$ܶsf,P/)3w%8s*^4*֮OToq}s9P&P5;V"{ ߱+\oW=e)o5cmHˊ®15Y\ |qQ6FS]J`FZԳNQ.@ZchP x/V13*lWh#]u zn\W&zşwMkAw@5LbB]B%|u@؛%:dWs6ť-sۋGgyrNFۯGrS݈{'Q=}w%Ob;&&33Ѡ45/ c&)?*óJCS _A>d 7|p 6/`d6=AF2Ʋ(ZBяFLճȹN@Wҡ*~>{P|i ٳ9FM}I cgl@޻m15QЅ^sbӦzg&6<+ed{$]K7;ȥv%N%ޱU`E*[<}1J__8r>Vա 7٘C.$ݢ}`KsEŖ~r_SFӅEWQ1!j`?JI&ₙ[7Y:=3ʨn`CE*#0CŮ9N&zrS~>9 I`rǉHҾs{ns`@`dBypÑ?d4!7>.r4Z0ǀs<0>US{+0-lf©48>䎦Ӯxk][D6BDTmSit[+B`?ӺP?;RRL#B2@t?VT)!#9,b-[)dF=}.BDhOFm܇i䊎1/yՌ}\\o)&X[x%Y7% bIhv.a5 GOf8E6OJΕ@x#y`Wt&2Bf0p;[p-Wj1Wv@+y廀$LݯILWp'REs&u"VGa))cwoͩia5RJ/ݎDaSRnǌ*z=o^C8Yڵdx&7Uԙ_3ƂЁ'fLO GtyRѵI|[E}HMyT@JM/EbQu`WEz 8+y9/NTxd3o*zLnL I1+ ʞq[1suQjw"8}3 4\a]Mڷ'R!#RN!#2fsj5dJb]Zwхgǩt_/?whزH y1YHv.#$Ht*RUɸ} Ndѽ^ukVȯzaĄ[Cg(3xaJ܂+5O[>tm5'+U;sB;F os?D7qխQo~ bV̪,dNyZhldدD]_AȈp Z<`G-|2UN{6FHjxga*) ~$zV{hj;SY;R3hTo+P\|75:/6cyC>(@M3O?x*9ewz^9W(ӻ8x<>3`$j">s!ڣ2$q$:R`ƆthBx0I_;F6P nb;2bpX*S\P=#VP۵i3oG'L! hu=Wn{sk\b#=)\`w2fhsVjy8Hn@:>~qwWg4 BzL,/~.5T3 Ӎ0naQ{:ź83k"+ ܲ3-PSW&-Q[Dy?d',0V$ET~,Qd:R'6Zw^cp%$oM|ƚ{EtAt #4BLlD}Ϡ#4Pj3ȵdb՗ȥ-IXEhAqb5/%QI:s;tooNZrպSVP..5.c5B&kڑͿc]I~!UwSĉ(6&7%TP^'H_ Xj~1@sytMJh Wt'zj.hBtGOy"t| NU! 屷,$37{\2PW"@Ys8|#[-92Ɗq5|S3:q}+tc>*%a)o'"T#!Q$Wbof<4٣҇|TG)U}w7Fy^ Iȧ9׿vȊbk;@}͍s{Rc@󠱹W)kPL.NEv2m؈d,XP(ÊQlWxk84q?8^0@@N:mJAnOA)tdY+& ^=c"tZ0^-YCC(}6%lS<;xctGI6 f҇iZL.Jх<2;9y3gQfk8a@yti3DpȎD'twz#wxUkOPY<0"4vpì$r\uM4wo"v$輺_@۽ q.(K |Ql{%tyvƒ\7Tժ@k3ǻ3RýPҠZٱ&PC@ԆŮd>Pv: ڥట Ndm~e;-@{0 &Z||t~Eu7szdPRWM((1G@_Ntњx/%&ʅhFqL&Jl& ʄ|G̊)iכk6u-_Us$yQ@S"(Zк~>fe[VӷR:1)7G2j*:0;xz_U(d.|Kw! fPOHse1 k"Cauv8*4E0V6Dh9gOymky NoG0ī`D@PVJÄJhjNhzy14E*˶ƼUnZ\P8Gی/o@Yk }$NG%]TfP9W=׫l ]~\sA>- z2#[P5]xp܀wUKQ+|[pZ$;\5q+.L'̪z%> $׃4#+n7 #5:gCQOk0;vwl؏JCy7.ssycj1!RZƣm1j!kfi3ımɒYWW9iGC[Vɳ;O7Jf:+OЬGπUsK7W /=|Is &;Kyxx^=oN[h']S/U1U)=o#qW XnôE~jDF]sBf92_݀BQ:2!1,۩@t1m/EaV"AW-Th35?K#l H;5vN6LgwTWu8~ >qƤIaL.Gb+Vʐ/3:b wbo dO6^>VrX}>X܍_DBEgVn-4 %g(|5ɒJ0oOYwz}a=NLs)Nm pFjOzq!^^9uUNa QM#ӳ;i!L74&waO1!XY_ŀ*|C}G&YjIV_im_ۤ0ńvf8 c~2˕/DʤߜpDIdYrcb6'Sn8aLݟcIL[՝+]"@é"\8+ƋpsXLxkX}nC !;Cf+mWB)^*=lϞɖPj7`n~L*ODpkX^:psaND׳qh߶zpVք&KPQS} .=;*Q^VRۯ*KӘQ3&3)uqv-{Uv]}Mdߝ9CQP~2]kvQէ ~vb7e)oʫ_vjׁL꾁?ɧm%r8R4ɖ-65󛓿[טl)j;dH;ľ/m% oNjz)JiҰ65E#HwgqݗpujyIQYcϿx^Tb_(s&88iUǯt@\w\@Gc`@% DPR0y$'CQf\#95ҊP奯2]{ Y{5 gAx>}ww9vXFGv'K'+@Qw]>L'{Swdr=_jFrnhgKYۗ9RskWLĉ3vˬRJw`oPx㱍tb`8-4~Lj(\ZG 7٫u7!{>r>3/]+xxCadv} ,*]2#hF"=+@cxt9h@7 Y}P'+G ;%RͤG {J~" )v#}bhG=ڬ&qvdꌗqVȑ7IZN ]:Qyw_y"yzc1&/訉(e$/\/O۱lH5|W!⻎%Jzʓ^J|GEwM5.KLV*-es)NHBC|EȭHrwJKΐivHG@ѫA{Pj ]綫PVbF S:EmvQ:$]&B$]DWz^M_eIix=Qe-8iofkY֣|M%^d!xLRj7YwXFFҙ;+ۓI>(JP`嶾vi$~J;1.uHKv[ ۳^IamWeU c4TzD4LͰJ*ѳ :7łuS2shiܝ@0A-`: |KX]JjK+Y|UmkV,X[><$sv "Ηsk+>\Qjwr"RG]8 NnoN(aQ%ЈbˍWHت#@Ak)HhQȢOa\oWOBBHb~~#DMR@IJ[jJ0@co9xO_62Z"O3䔢NVDO$a(4 qItz82/gJ&\]bFzA=ThW~kA"+JoȰW쓿$m-Nӑ`6Eby{υdam Zŷ.Gr'EF}W8AODt-.c(2Sw7qjAF'eK#iqS}TM jȢpVP/pK%ao>68tRA;w2M[p*(Z%1G3 %-M!2IUgu/ce9}+^n1{2<&E-Vʥr8sklψs2me3kA٭Ԣ :EV5cC\@>"+!F@9Mưy)~fEvjmK #P enZ xRQOk~0 (ץI`^L<:(Dl4sZuPRU9su*Xxq?A{ʛw#.Q/<7dmmij6FEpJ)В`">d15yǈ' (}@;1ٙc}8!2|v"w.ɺCz(;f=SQjxzjPwV9l__l:7M )WOf!^dPZ{Y[}^0ڤX>{r^ѽZ/HhFo R28STuJ$ |ޢ S8T^2$Uyt0(%a)/7 L_QUc_7\آ/O|J(@HP7l*AH5]of|[m$S܃pnM>~ }fJ,xmW*FZ\zًlSY2۹];ƭKMYCtbpn;t$2ӹE8D_3mcΫF3rֱ0v%;6%U4{!Mld_KhgXXp~ Jܘmhsl0RѿvC8 HJPQn>_smXޤ/Sq%0zk0b1J+G8VHHˤQIZ]vlFuFBoU Ed=5W{`s6l'c+:V`>|#YQŀHjBfo!1IK%aiUO裐|];PbRy?J HxVyT#k*?iGww4 >/*9Nek]j 6+˃Y}P;4õvWB>Ek\8BmyC|QsxX94uw*ӂ\xlHws-Ԑ?-xwKdVZXFG3UCP(ӹ`TM'^O; 1dD?<́OGu4S^".G">[*hqc`%,! Ox1rz{X2+|u89p7-iJgf#g03Ё,!܃DK\m"1nR`bp@T\i=lV&tYZlDpbKhs1+HSkz$6" w~l嬘|;-/0MT{!O(]`M]^ƬXAΚ?Fٶ)*K̓:'GՄ[4M ~5eVv(=mLTQWB²J,tp\FǇ-Dxmt*#H"aJ&R)(=mѾlY}9=AN#6:!ZWPK|mrDh=71d[E(6rP>U0)X԰Cʡr(t+Wa1~#osORu?ÆgH=PjٱV2=4ٔ8;"X"mv$Ϧ5" HUv?~c:O;taD.qS)QlEʬ?OdVlGyG-A*9<-N}<#%[cc14TFiF#z2L'3"8k_dN`~D?$bYҋ>2wfd )0@bXs$@R?3KIay$R8&b$]3!'FZ~ZR2bAйv)Ӆp0Ѳ4r9miր^l6E+fGmtzuQ:bp(HR&^NԦFZ"VIjT@ EŊ/*wlvOjrIm,4K[#k܂+10|$bS$vb,?$.BJDN#YG[ӛ*Fj:'~=<:]-乤BgZeE:ka'떎>:b`wBZײ^R 's0~ک!tw5! S]@1a?V_|l>d[yx~۔Q,k(M9oƱ$WPfh^ʌ{OlzZ0k{Z5о#2n/!ɭ88I2אVnEJJ&0S!-0 x,?Zś?kXY)>Β<˟L 5i|,Q( N]uܩs$ )evC;YO-|i2G֫#.Zn()أ]I GB,"|k>QRfzf T@n,?wq^^gq͢DN-Q-ძ &`}hşO糢ZCaBU+ JS'Xx`\)]W=cV%6=nTXýǘ^u+e$ȑg"W/ ;GsHRtuiH S.mm5<+Ӿ '"ʔuxIvn`K#K٘=XnI}uR¥s=0$NBe^Tc>\gY$ªt +VSSs_5*8\P/*?ù951C:=K՘8$^р9:B$qY)znɪUJɋVD]qt՟[VoZb'XئD<[\Rބ;ڻ0Z̎sIsJ2-Oȱ\['S!sX>J]va5! 2w3KwGycRk%++-R#{f HK `$ͥQ: Hi~e\M?uހy?Ej3ZF`ҳzέ6kPy[Aǜ?~ #q{cfޢ*cBҋq|U@_55m܊|zc21}DltRc_&~lӓa;JM;?x;ъ|+0`msVMN:]w*8d_\rD9}0'0@1p ET:2r o@/'AQ8Raޑ#&a9A)9\#Ev"ɛV̺?8txCV3)ev_<_z܆E٘ZYSn;)\#)U[cXkmH\>γt;j95݂Jo}q`q=\; OC#W!\ݦ)(o@QB6gc\.;ѹmzSeuo_V4 t= 쁒Sg.kVm|}0=git.؏3/@kMNECaIc3#媧0>&j}gЋA떂YQfp}TFxe"4~!Q"V[`e7_r1nbKψm,$'4vOn HSLHӈVM]x +`9@8=WhJf'%[a}S4nq֔E6vJV%FF҆ʸfbhQY`(b>mcDM4ݧ->xhvVuլLq x#V"-`_/EE}_w^q1W{[ M_T&(Z[G_g{JhN{EkjO\l]^XwmIP\Fk ^'!KjCXVK9mH1܍PߴyneUn5h?=M]h#7,tm[>4C)@Ѓ`zMq!:b wI1h3 +ҲiBf!Ŏݼ|yI9VqI=1abh Dp(kvJ@aW(,culkvVHoD[Ap@9ʗ`B>lB";f(5y23lPN4p3?O=z,;"tєtP =#}]8gK%_\1칿gqUO){7r=(,?!ͭCq<5mjcr j7~K͌)E!T=y5oƺમAf6sæWMTNMvH4b-PC" b& |Ux*Fllb!?&)lXu#$2rz&J՝B"XKj&etdڸ4Rӓ(y>;)}gK/os) nvBkW>]V$:Z*1AfҢy%mtP"Ku0-"](,|QieN:Q=fe/਺0nOngjɜ]LUrLoyi'gap/ޭyo" S[+גvZ@#yY^Xe<>q+I c?c?~4<$Vx0tUBɈ~7$UqK_ݏ{pn 7]n!{}3R䯄!|%?;=tO1N7iTcݠb\xTk 7/ >ӾO5VMX`DY0pG))oqc]61i7%g|WvF]2zeU,cԴ3;pd}I$"}4h9zhd*yVIү>Ȓݥn2YW~]3џegs*ZvǗ͛9&Vz`7w>,<)ޗhKJrnЖ$q (6Ĺif[T*-C1ڥa,L,H|kqDJtq("yB&QrΏY89Luo֐ HE>t\PŎ8b4SK7G90n-PøJRhل~ +]5>[q2?sgF9SiFjᅰpBHoDJ+lű2 r&%d!-Wsi@1͛qW`Γ!I58 ovj[u&( tƠ̈ÙgDg獄cI_=)&iMVDȘ@;ll&:^nDZݡ5Z4s4I ]ݾ5- /)ɹ")k/"niQ>pJѡ#]`gf\\HSAoIzD2vЮN[C/}=jWD$G`x$µ5|p8VRy>SJʫgxGpeWPnMxcvi%mdf2:ZnĄ'E lQ`@n[ʢmi?E|щdr JXzHf!Bj0xqZfBbO4[Fbv(|Z掶6ͳ->z4gc+^F-bb~G~&9||=/?Qu RbK P3$l~HN=csHp,*-exS7ocy?ڧI|GoVY)Tۇ2lsq<&f=$˼cP N[8T[N{urhJa-P6Ga:@Mๆ'p1 Bw@jNf-NaN*)u=E@ϗi;[4Z7jyu@<3n&t.z"1f'ӂ7ZVC,́}fS tG7S6 Qra这Q96ؠzFau6ӟOj:d? -e'# ꗺ]zԋl١(.6jከmu_YndR{xZժl>Z)ak9n|k'KI҅6/efP& "vԴAh+M?M; _AV?qx>\2PNTKD"@i_7k'7/$ Dԫ.=ġEv4ݣp.)u%'L +EPL+0e>:]xQzWi{"FΧy('[FQʽ5 (N/Zt._X]7Cz;wnj:L*G,oDȾxN2߳zGjfZﭒT;}p=>w-wk-9]aFxfDߪ',lweg耼ѶҔ F;saƽM\Q`=C ߉Ahx_"nY&s759qJNB=}p S Dd˥lB`ek7`Nb@4KwT#)NxN AlDduSb+=Q6i(V7NGʾ@uC#B?LՏ: mzskNr^3VV9>V~:5 =H7mWSP9@$;j1E<}z'ڧӷ%Ҵ ˣ'Ag8a gJO,߅Vf11Hc \8U޼*q0ťrњ|XFb6jR)]Qb9l/DBڥeB!Fy ں 2B/[ 7yhaN/I|X׿e%fʈxV.&WESlZ#0W=CM23 W}pmݾ\"Χثx[eev__PmæNBIW &g|TiDP2*jǔ:"YŧmĄ.؛R#Ô- !]ѥ#m%<؄55ڣ3"s׽e[4910Rw̴ne>Wbĳ|VP6`[>q!W{GE/Ah0qZV:!m{Z(on>mDHHĤ6t_sX20aIVlIO6T*l8]IAB$ƴP{7&>. t`'5Pk~B%f 퉡JxZ$oKP"p91/G&azS6([RTeleiXt:G SyvkG2 CtX^ݟjOaĠ\UwfuJ\HDsV_PuZ>mPCM5IwVtP,h'rZ *Qv~HU Z!h=VJ8{FDIG槲4[Ak1WuuBD٢:1PlYpp^lK;;9Yqhj.3?O6Wbo5 _$B'EnTh"އMNCNuPLB2LE2-W턎?繝֡[d~TͦgacyJǭdL]Eb5BRt>3mw< *)~vuoa۟[gҳd*I#%^t4мaI;O ty1$&!,n)K_3=3é "F~TOn68sl-nRML*IbM>g-hòBb)˖$Ea=|M5aMc/ 6nP5#ܶAfQUV\Oif (`BG?qXrDgLEHԮ!ssP{Nߢp2~iJOS3_[<;jbEN!vqg&aq$) gC鎭@apmz_=Ġwm!X\B|[+Qmq6P$ 7?fM'ω|7{jy4/5FcڍEdڏַ XY1 ՖŴ f kB膤\+gKDs)FX)c+oDShVB`fI¥^6zG?oE|[GlcKЎ-я!IAe$#ޤ-C/6U1JGlj%kWWEHmYҏBEDY'<1{ wQRp1kCR 01znxRk'`|͓,/7JYoY/ҌGټ1}#!J8FȍsYJv"1AZ>]䙱V`-(#9zX`%xq0窿b8=Tudek賍 LM?BzFjJޛ;| T=ͅݣ|P:[D¦&$I:FL иxth1y3$ZpxUz]bAQFY|F'/m>Q0zo^h9K(IoP%_w֭q`l /dAi#U1,"?Q IΥ$fj1BЉ@Xbw8IobBrM&Z<5M7γ]Pd>턵:G>hpӒ;Um;=7) ~Jy26<&Ekv0xq<>^3/5rwdpϲKE3gknUBh#<=$ioY)9ZMv ]3ș4 {b!|o/?_Q|-ڴ#yUF؇PM ԻM| ʝO^SE j}G}dtF+nwsD{u=Qg4=S-ul 9$'6UV:#Ywp?9B:92t󱩖|m}qq'(xptxgJ&ך{Mi.eG73ܘN[0$&1}6[U=feѫm>E+p }6UbhB3HtK%0-5xNՋ'2&úU9Cq;\J%ym"1sR"eә/5 /FlLZC @{՛9H>yߥTz]jDE>ޣ?'N=j&/wJ Gw1k~ųS{l@>HeѢxYy/`/$mIA>֯`ȧ0C49ΨDaAcJ/Rfd*o)ndqkx] n ȮfW}!Dʤ*%)mz pdQ(<6&D%n;_ 1N۷e՟N:6h6qm]G!HC%ϋP0|vh:rq\Ԏw]`}Nh9eܠ# "Cx+.8bȃYЪGT#X03CjPh/b8>43V6xz je]y$Cys4Z]e:L8 a90sK^eq ʁ(+aMXv?Fx%Z5 S׆~e7r(?uN|W<,_*P׀6>5E+m#V]~iǾ\Ȼ*5y)<&(BVjwп<:3cs'R|i4ɤqr d_)}$C1FrpdiӪ>Ыm z2h#ҁ_wnL Z)) $u) ptWjJ%m7Z%zZvm\SUHZ?GݚTZ[N{ I.Ke[T-o B'4Ŧ-&[#H-S9񊶃HrІl,kX2hðUFRp0*b40a%؛LڜַH~kO~A?8޻Kq>kuZtvaRTUt[Y@[ZK$g,FDFj_+" ^e*'jQx>lÑ d45!q]2NhN rtc6A0Ņi^ TS9*'/#ern1O9W0ck\ik;;҂7*9~ xMiw2Jf8QNFeQGH[$̸nW7:NO@3 y`Ao{d Ooal}u$t+CpIʏm/H|F\8UӔ>5,w\='?)=N_8f6PWSTAb^ y=`?%ضF?53A+S5dӢ??+;M#)zRx4oCKr) /fM(XL3v'Т4X#9㡆mP+OMӍ]ÒLUr7-Gnɦ)A~"-U\ʃեL5Am+%SALb6:dmRB֍\?STHMoo6wBW~S`!@)Z/wFWIf|Kg*61b?^XdxT4ȺJ*|2n2̟t\C[4?QkԶMuǦ|7N^F+Í!SABv9&fZA6VrC'ryf+]vxL%6J-ՋO8@gujtp"42:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A////////////////////////////////////////////////////////////////////////////////////////93AAAAAAAAAAAAeP/////4d3d3d3d3d3d3d3f/////+Hf///////////h3//////h3///////////4d//////4d///////////+Hf/////+Hf///////////h3/////4cHd3d3d3d3d3d3d4////gAAAAAAAAAAAAAAAAH///4AHdwB3cIiId3iIcAB///+AB4h3iAf/iId4iIcAf///gAB4iIcH+AAAAAeIAH///4AACP9wB/cAAAB4+AB///+AAAf4cAf3AAB4/3AAf///gAB4+HAH9wAAj3cAAH///4AAeHeHB/cAAIhwAAB///+AB4h3iAf4AAB4/4cAf///gABwAHcAcAAAAHdwAH////hwB3d3d3d3d3d3cAeP////h3///////////4d//////4d///////////+Hf/////+Hf///////+Hd3AH//////h3////////cAAAeP/////4d////////3AAB4//////+Hf///////9wAHj///////h3////////cAeP///////4d////////3AI////////+HB3d3d3d3cAj/////////+Id3d3d3d3eP//////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==43:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A////////////////////////////////////////////////////////////////////////////////////////93AAAAAAAAAAAAeP/////4d3d3d3d3d3d3d3f/////+Hf///////////h3//////h3///////////4d//////4d///////////+Hf/////+Hf///////////h3/////4cHd3d3d3d3d3d3d4////gAAAAAAAAAAAAAAAAH///4AHdwB3cIiId3iIcAB///+AB4h3iAf/iId4iIcAf///gAB4iIcH+AAAAAeIAH///4AACP9wB/cAAAB4+AB///+AAAf4cAf3AAB4/3AAf///gAB4+HAH9wAAj3cAAH///4AAeHeHB/cAAIhwAAB///+AB4h3iAf4AAB4/4cAf///gABwAHcAcAAAAHdwAH////hwB3d3d3d3d3d3cAeP////h3///////////4d//////4d///////////+Hf/////+Hf///////+Hd3AH//////h3////////cAAAeP/////4d////////3AAB4//////+Hf///////9wAHj///////h3////////cAeP///////4d////////3AI////////+HB3d3d3d3cAj/////////+Id3d3d3d3eP//////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"a3f191beb1c2fd9542d8ea5fa25e5d375d55c9ace02640a9d95e2a694db3113b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791205655505,"unified_at":"2026-10-05T13:07:35.505Z","metadata":{"hashes":{"sha256":"a3f191beb1c2fd9542d8ea5fa25e5d375d55c9ace02640a9d95e2a694db3113b","sha1":"02c08e2ac2ab50f23de3eafc7533cd9129bef8b1","md5":"1a70db59944419fbdbd1e22bc1cdd4e0","sha512":"cf4efaae2860a45c2b3a62a5771c6f48c07d3df62f93100d24258425590614221290992fc661335b804880730edaecc3dc365500a8684177df5af30e271846fb","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"a3f191beb1c2fd9542d8ea5fa25e5d375d55c9ace02640a9d95e2a694db3113b.bin","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":726528,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1776140801000,"last_seen":1776670830000,"last_multi_scan":1776670830000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":60},"sandbox_signatures":{"informative_count":152,"suspicious_count":5,"malicious_count":4,"total":161},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.InjectorNetT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Basic.8.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Basic.8.Gen (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Downloader.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Injector.nj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 006daaef1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.IPEC-4994","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.MSIL.Basic.8","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"suspicious","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Contains ability to load module (Dotnet string)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve user privileges"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000812.00000000.102639.02940000.00000004.mdmp, 00000000-00000812.00000001.102881.02940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00000812.00000000.102639.02940000.00000004.mdmp\n 00000000-00000812.00000001.102881.02940000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000812.00000000.102639.05BC0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00006904]\n Process \"WerFault.exe\" [UID: 00000000-00007240]\n Process \"WerFault.exe\" [UID: 00000000-00004268]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000812.00000001.102881.04BC0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000812.00000001.102881.04BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00000812.00000000.102639.05BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00000812.00000001.102881.6F391000.00000020.mdmp, 00000000-00000812.00000001.102881.6F421000.00000002.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00000812.00000001.102881.6F391000.00000020.mdmp, 00000000-00000812.00000001.102881.6F421000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00000812.00000000.102639.05BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000812.00000001.102881.04BC0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000812.00000001.102881.04BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00000812.00000000.102639.05BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00000812.00000001.102881.04BC0000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00000812.00000001.102881.04BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm\n Matched sigs: Able to perform cryptographic operations\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: YARA signature match – Encryption algorithm","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 457225; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 457969; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 476372; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 490534; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 495517; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 528161; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 529527; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 549584; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000812-00000C2C-596989649\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_OSVersion\" (Source: \"00000000-00000812.00000000.102639.00392000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000812-00000C2C-596989649\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00000812-00000C2C-597350977\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00000812-00000C2C-595877944\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00000812-00000C2C-595878465\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000812-00000C2C-596676046\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000812-00000C2C-596676076\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp, 00000000-00000812.00000001.102881.6F485000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00000812.00000000.102639.02940000.00000004.mdmp, 00000000-00000812.00000001.102881.02940000.00000004.mdmp\")\n Found reference to API \"sendMessageChannelCache\" (Indicator: \"sendmessage\"; Source: \"00000000-00000812.00000001.102881.04BC0000.00000004.mdmp\")\n Found reference to API \"System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" (Indicator: \"sendmessage\"; Source: \"00000000-00000812.00000001.102881.04BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\", Potential IP \"4.0.0.0\" found in string \"=4.0.0.0\", \"1.6.4.1\", \"2.8.7.2\", Potential IP \"17.11.0.0\" found in string \"KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator\t17.11.0.0\", \"2.5.29.10\", \"2.5.29.19\", \"2.5.29.14\", \"2.5.29.15\", \"2.5.29.37\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$39","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3a","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00000812\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \"System.Runtime.Remoting\" (Source: \"00000000-00000812.00000000.102639.05BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000812.00000001.102881.6F391000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp, 00000000-00000812.00000001.102881.6F485000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00000812.00000001.102881.04BC0000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00000812.00000001.102881.04BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\"\n Found registry query API: \"RegNotifyChangeKeyValue\" in \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00000812.00000000.102639.05BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"\" (Indicator: \"password\"; Source: \"00000000-00000812.00000001.102881.04BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000812.00000000.102639.02940000.00000004.mdmp, 00000000-00000812.00000001.102881.02940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000812.00000000.102639.05BC0000.00000004.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00000812.00000000.102639.6F471000.00000020.mdmp, 00000000-00000812.00000001.102881.6F391000.00000020.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00000812.00000000.102639.6F471000.00000020.mdmp, 00000000-00000812.00000001.102881.6F391000.00000020.mdmp\")\n Found string \"DisableBehaviorMonitoring\" (Indicator: \"disablebehaviormonitoring\"; Source: \"00000000-00000812.00000001.102881.6F391000.00000020.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00000812.00000001.102881.6F391000.00000020.mdmp\")\n Found string \"DisableBlockAtFirstSeen\" (Indicator: \"disableblockatfirstseen\"; Source: \"00000000-00000812.00000001.102881.6F391000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown complete\" (Indicator: \"shutdown \") in Source: 6000253-Mr7pkSm2H3jb~Q_x3pn8S7Xej","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp, 00000000-00000812.00000001.102881.6F485000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000812.00000001.102881.6F421000.00000002.mdmp, 00000000-00000812.00000001.102881.6F485000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69e5d86d33a5cf3b09074e49"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"