25:I[10321,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/3k0jjn7m8jtc5.js","/_next/static/chunks/3xfwong8gg51p.js","/_next/static/chunks/1kn_tf3p-ubex.js"],"ReportDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 24:T4ca,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 64fd2327cb60… — Score 100/100 — Sample a99222b871ad…","description":"Malicious verdict for sandbox report 64fd2327cb60…. Threat score 100/100. 2 malicious and 3 suspicious behavioral indicators across 32 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/a99222b871adee0178a92831be5917cd131451971b36bf8191a2d7d0429f3997/64fd2327cb60c83dfc0bfc10","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","a99222b871adee0178a92831be5917cd131451971b36bf8191a2d7d0429f3997"],"about":{"@type":"SoftwareApplication","name":"output.exe","applicationCategory":"PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows","identifier":"a99222b871adee0178a92831be5917cd131451971b36bf8191a2d7d0429f3997","additionalType":"Malicious sample"},"threatScore":100,"sandboxEnvironment":"Windows 10 64 bit","behavioralIndicators":{"malicious":2,"suspicious":3,"totalSignatures":32},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}26:T69b,"\REGISTRY\MACHINE\SOFTWARE\Micro" in Source: 00000000-00007708.00000000.69136.000C8000.00000004.mdmp "\REGISTRY\MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock" in Source: 00000000-00007708.00000000.69136.00150000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp27:T6c2,".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")28:Tad5,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "OUTPUT.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "")29:T54b,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007708.00000000.69136.02750000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007708.00000000.69136.02750000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007708.00000000.69136.02750000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007708.00000000.69136.02750000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007708.00000000.69136.02750000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007708.00000000.69136.02750000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007708.00000000.69136.02750000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007708.00000000.69136.02750000.00000004.mdmp")2a:Ta2d,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")2b:T7e28,iVBORw0KGgoAAAANSUhEUgAABLAAAAJYCAIAAAD9hIhNAABeZUlEQVR4Xuy9a8xtV3mevWQOcil8pJQmLaHJLgpgwsknzgdvzKHmfAwlnLIhEAgYcDgHAtgYY4whDXEoMQ7ZJYlDXZrSNI2qT1G6QchyLRdFCKEIpdEWqpBlWdEnK8qPKKreD/banvt57mfOe82xDnO977uuS9ePucZ45hhjjrWW33HbYWU2m92Q/dPoQx4yiyr3zjZxdraFPYtWZ9797uSEXJEFuJu3vAVxR/2lX0q++c1Of6/0vvWtyV/+ZePXAWCr6J9FAJgcAuE0EAhhgHpKRtwRCYQAQCAE2AcQCKeBQAgD1FMy4o5IIAQAAiHAPoBAOA0EQhignpIRd0QCIQAQCAH2AQTCaSAQwgD1lIy4IxIIAYBACLB1zjor2caDs09Pvv/9SS3OvO1tydkDkjfckJzNLo5qxjsrO7s+6oeazW7Kfjv7neztyaOz5Oz72R9kT2b/IivF38z+VVLnvSUr9/61VVZ1R1Inujl7W1KL5YnuzOZl6L2y7b74muzx7FeSem/eWN2NW7P5eWevTT5o5nxg9tJLk+98Z/Jd73JK8WWXJeW7Ib7vfUn5xn7wg8kPf3h5ZagmZaiPfKTBj340efnlyY9/3PmJTyQ/+cnkpz6V/PSnnZ/5TIO//uvL+xu/4fzN30z+1m8l/92/S37hC8nf/u3kF7/olH/Ieuvt473++qSs+fOfT153nVEPpy3MAAAADjoEQgJhUFZ1KgcSCAmENZg1WWPeeGWomvqMBEICIYEQAABgIQRCAmFQVnUqBxIICYQ1mDVZY954Zaia+owEQgIhgRAAAGAhBEICYVBWdSoHEggJhDWYNVlj3nhlqJr6jARCAiGBEAAAYCEEQgJhUFZ1KgcSCAmENZg1WWPeeGWomvqMBEICIYEQAABgBJdkJ+PL2WuznpTxZmflBHjPbOb225Oz2bOi//APs2jJAJkfyy7gndkGvvGNpHLfrPz0649nF+zVy7IZLW5hlXtX4Ui2iSMr3NuEHE8/97mkHOtrDIh+9rPJa69NXnNN8uqrk1ddlbzyyuQVVyQ/9rGk9EoSq1EtKpHvV381KfnwAx9ISoh973ud73lPUuKxZGkfvCXDy7/QEuXnLuW3Md/0puQv/mLyDW9Ivv71yde+NvnqVztf9arkz/1c8uUvT77sZcmXvCT5ohc5X/zi5AtekHze85LPfa7z+c9PylBeWYZf1QHkchjN3v+c4T53/7Div+WJ/55ozFBD/15pqB1gcxAIz0ggJBCe4cgK9zZBICQQEgh7JRAOo6EHhqnxA/ebC5kHpA7tDvjejqEBF97uC5YeqhbXFoCNQiA8I4GQQHiGIyvc2wSBkEBIIOyVQDiMhh4YpsYP3G8uRNKRCUumKzI04MLbfUHs9ZWzRcW1BWCjEAjPSCAkEJ7hyAr3NkEgJBASCHslEA6joQeGqfED95sLkXQ0f1kbI73tsbG7ji+lpmOoJSKN8WW9MbZEulvmNfElwEYhEJ6RQEggPMORFe5tgkBIICQQ9kogHEZDDwxT4wfuNxfSm5RGNnYtcn26Ir8cKq4FFekaur13KLl3Tm8jwFa4Ims5ssIBuikwnJ1tQhJRE6vMu06OZVtoeQQ5MslP+i3g3lklf66a3pSjWc+RFT6TwpGWoY60FMup1ysn5ksuafDZz04+61nJiy9OXnSR82lPa/ApT1neJz3J+YQnJB/3uOT55yfPOy/52McmH/3otXnuucnHPGY71oWN95GP3Bf+7M82eM45S1uPp4g4pQuZ56iO2D504V+eHuhuegu6RtMeGXlLb3vvsL2NAFvh1HmdQDhnlXnXyTECIYGQQEggXGBd2HhrNtuKNfUZS8wbbz2eIuKULmRhpqoX3Uuht6xjqGCoPWJuEaRArjt6GwG2wqnzOoFwzirzrpNjBEICIYGQQLjAurDx1my2FWvqM5aYN956PEXEKV2IRKMapXpTVn3ZsbB9aJyhG2ela+Etsb23prcRYCucOq8TCOesMu86OUYgJBASCAmEC6wLG2/NZluxpj5jiXnjrcdTRJzShQxlrfm1SVZDvVLWEQuGrucXvcTe3tulvTaaFoAtcuq8TiCcs8q86+QYgZBASCAkEC6wLmy8NZttxZr6jCXmjbceTxFxShcyz1QdtTdeS03XIo3ddWTMjdISkcp4XW/sLejtBdjfHGk59e5Pjraki3OyAGvhYQ9r8Gd+Znkf8pDlPXJkX/hTP7W8P/mTDf6Lf5H88R9v8IEPdP6Tf5K8//0bvN/9GvzH/3ht3uc+DZ599kTe617rsh5PEXFKV2T/ZCcJdUuzrnEAJuFI9iBylEAI26amPmONeeOtMW+8NZttxRrzxltTn5FAGK2pz1iT24YsuW5p6/EUEad0FQhOANvmSPYgcpRACNumpj5jjXnjrTFvvDWbbcUa88ZbU5+RQBitqc9Yk9uGLLluaevxFBGndDn4z2gA+4Mj2YPIUQIhbJua+ow15o23xrzx1my2FWvMG29NfUYCYbSmPmNNbhuy5LqlrcdTRJxSADjIHMkeRI4SCGHb1NRnrDFvvDXmjbdms61YY954a+ozEgijNfUZa3LbkCXXLW09niLilAIAAOw25Xg6kfe4R4O7hjy+bJ0kE0lE973v8koClPTYZM2i460pd7ySpQ+C9XiKiFMKAACw29SoNo019Rl3DXl82ToCobHErf1vPZ4i4pQuZP4/F5z/Lwa53u41AABsgBrVprGmPuOuIY8vW0cgNJa4tf+tx1NEnFIAAIDdpka1aaypz7hryOPL1hEIjSVu7X/r8RQRpxQAAGC3qVFtGmvqM+4a8viydQRCY4lb+996PEXEKQUAmJjXZu/I3pa9KyvFTfwgedYs2cSRbBP3zDZxdvbwcbTlJ2dn38jK5+o72Vuz30yW46mz/h6mUX5mU36xU35H9KEPTT784clHPCL5yEc2+OhHr83HPnZ5zztveS+44JD7+Mc3+MQnHjLr8fSQ+7WvIe4r9Q9sZs+i1QAAIyAQEggHOEogJBAOWBPUIbOmPmMJVAddzUuH3nIcR9yu+gc2oxEwo9V9jKyPZV1lbyMAHHQIhATCAY4SCAmEA9YEdcisqc9YAtVBV/PSobccxxG3q/6BzUgkE7S6j67M1/f29jYCwEGHQEggHOAogZBAOGBNUIfMmvqMJVAddDUvHXrLcRxxu+of2EwOgIpWF6Rm/nJM45zeRgA46BAICYQDHCUQEggHrAnqkFlTn7EEqoOu5qVDbzmOI25X/QObifGvotUFqelemotIbyPA4UNCTj6qes7JrsLRprN4ZpWQc9/sIeSKrOOKK5IwEeV4uimf8ITk4x6XPP/85LnnJh/zmOV91KOSki2blJjapCTeJiU8Hz7lXxZ45V80yL+GkH+FIb9BKj9n+oAHJOVHVr33u9+6rMdTxLn6j2vYBjH+VbS6IDXdy96LiGkEOHwQCAmEpyEQboea3DYkgXBpa4I6ZNbUZyQQ4s6o/7iGbSCRTNDqgtTElzJC72i9jQCHDwIhgfA0BMLtUJPbhiQQLm1NUIfMmvqMBELcGfUf17ANzoS/PrS6IDXdS3MR6W0EOHwQCAmEpyEQboea3DYkgXBpa4I6ZNbUZyQQ4s6o/7iGbRDjX0Wr++jKYn1t7B2ttxHg8EEgJBCehkC4HWpy25AEwqWtCeqQWVOfkUCIO6P+4xq2QYx/Fa3uo9bLjfOXvaP1NgIAAKyV+9xnec8+e3nvda9D7j3u0SAAAAAAAMAWqDFvvDXmjbcmqENmTX1GAAAAAACALVBj3nhrzBtvTVCHzJr6jAAAAAAAAFugxrzx1pg33pqgDpk19RkBAAAAAAC2QI15460xb7w1QR0ya+ozAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwP5hL6B9maHKoXYAAAAAAADY13QpbmGcG6ocagcAAAAAAID9S2+0G99o2gEAAAAAAGBfMxTnzMXIdgAAAAAAANjXDMU5czGyHQAAAAAAAPY1Js7tnaK3K74cagcAAAAAAIB9zVCcMxcj2wEAAAAAAGC/0xvtxjeadgAAAAAAANjX7AW6FinoLqTStwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADsHHvWTbG31z/4UDsAAAAAAACsnRoCVwqEPtF1vUNlQ+2GvVP0Nvqu2CIXAAAAAAAAu0ANgdFNMRS9htoNNfWZl73X9QIAAAAAAGAXqCEw6ujNXZK4JK3F6BWpBVLTNQpd19AgkYXtQwUAAAAAAACHknnwG9Ih8Wn+sjdc1cYY8+S6t7G7FuqNch1Z2D5UAAAAAAAAcCjZsy6gRql6ERnqre1DBYKp74iNoeQMQ4MAAAAAAAAcbvasC6hRSgLYUCST6FXbu3s7zlTfjTT21sz6BhcWFgAAAAAAABxK9qwLqFGqN1PV3qEsVy8MewWtOEXXvnQBAAAAAADAoWQe/IZcjCSx3nBVG+Ndcl0bY3tEGusg9WXvdb0AAAAAAADYBfasizHJbd7V29t1DRVITdcYe7VpYPxcsmBVXSMAAMAB4R73SN7rXsmzz17e+9wneb/7Je9//+QDHpB84AOTP/ETyQc9KPngByd/+qeTR44kH/KQ5EMfmnzYw5LnnJN85COTj3pU8rGPTZ53XvLCC5OPf3zySU9KPvnJyac9LXnRRclnPCP5zGcmn/3s5CWXJJ/3vOQLX5h88YuTL31p8hWvSL7ylcmf//nka16TfN3rkseOJd/4xiQAAAAAAGwKAiGBkEAIAAAAALCjEAgJhARCAAAAAIAdhUBIICQQAgAAAADsKARCAiGBEAAA4FDy93+f/Pa3k3JGauQb2TdGb7xxFpVz3W23JWezW6P//J/PorPZjdlj0QXFP2wJLig+Z5bMT9T9nNTpH5X6qVn0ssuSs9nnsy+IlmX8IPuSbFrGFVfMoq9+dXI2+2D2m9m/T95zlpy9Knl0Fr3yyuTx48nZg7JnJf/tv03OZtdl74yePDmL6ns0+1q07GQuPjKLluKrsnnr8iPM3vSm5FveknzrW5Nve1vy7W9PXnpp8l3vSson6d3vTr73vcn3vS/5gQ8kP/jB5Ic+lPzIR5If+1jy8suT8vZfdVXyk59MXn118lOfSn7608nPfCb52c8m5aMjfu5zyeuuS37+88kvfCF5/fXJL34xecMNyd/5neSXvpT83d9Nynfjy192/t7vJX//95N/8AdJ+afqH/5h8itfSf6H/5C86Sbnf/yPya9+Nfmf/lPyj/4o+Z//c/JrX1ub/+W/JFfgfwPAyuj3CgAOEARCAiGBkEBIICQQOncgEO6F37/Xcy4AjEC/VwBwgCAQEggJhARCAiGB0EkgBIBF6PcKAA4QBEICIYGQQEggJBA6CYQAsAj9XgHAAYJASCAkEBIICYQEQieBEAAWod8rAJgYOUKUc+0V2bui973vLCpxYja7I3t9Mp+JFy3jj5NHf5QizpiHkqNLGepzyXNnydmXo/KAciYsD5gP/T7y5dxSFvnWqPbm55UTlM94TdFLA2GetySxy6Lf+MYsKsHsjjtm0dm9s7N/iN511yw6m70/m4pns0uyad6yqvS50n2WT52MnHdDPnWz2beiOrIoR1V/CJb3W5TjddPhu6nY98ojSLEo84oSJySKyL7XNBKVe5tSjSir8tbbo6ssQ5R5/U76RdYCY31PjfJREf13YY3mifRwCgDTMvPEf+lS3R6njnM9DLUD7F8WJTECIYGQQDiXQDg8kfTKI0ixKPOKkj0kPhEIozKv30m/yFpgrO+pUT4qov8urNE8kR5OAWBaZp4aAlsC4RLxzN/S9Q6VDbUb7j4c9jT6rtgiFwANLEpiBEICIYFwLoFweCLplUeQYlHmFSV7SHwiEEZlXr+TfpG1wFjfU6N8VET/XVijeSI9nALAtMw8Mf5Vt8dQ9BpqN9x9OEwtQy97r+sFQAOLkhiBkEBIIJxLIByeSHrlEaRYlHlFyR4SnwiEUZnX76RfZC0w1vfUKB8V0X8X1mieSA+nADAtM48kQHERkpTCSSz1Sk1sifWxt+saKpCarlHouoYGiSxsHyoAcCxKYgRCAiGBcC6BcHgi6ZVHkGJR5hUle0h8IhBGZV6/k36RtcBY31OjfFRE/11Yo3kiPZwCwLTMPHvWRcSk1F137bGlNtZ6uRi67m3sroV6o1xHFrYPFQB4vhDVk6uciZ84S9ozsQ51dlJ781CSD+V3RGeza7KSAcT/bpWfyvyT7J9mfz86/253+LAxm53IppF1N34m+Z3vJM86KynL8Mxmf5b9dvaXsm/KemSo/y97e1ZGls25KSsj53+zoBOl31yd/T+zqHyQ5HdxZa/kQyg/yfmQhyTlA7yIlyXlBw//+I+T//W/JqXXF/+3/5aU3qaRRVlzk3Lobxq5rsTo512jPg9LcQ0nRhlZwpVEPt/blA/9yDXImUU2WUdb2rqZw+rhFACmRf9ICnvWRZw6/KSLoXZzERnqre1DBYKp74iNoeQMQ4MAjIRASCDsJBCegUDorFFtvBKQmkauKzH6edeojyJSXNKIU0aW+ORjWw2B0RoCCYQAsCX0j6SwZ13EqcNPuhhqrxfz6zmxRS6G2rt7O85U34009tbM+gYXFhYAeAiEBMJOAuEZCITOGtXGKwGpaeS6EqOfd436KCLFJY04ZWSJTz621RAYrSGQQAgAW0L/SAp71kWcOvyki6H2ehGpveMHNMyPHBGtOEXXvnQBgIdASCDsJBCegUDorFFtvBKQmkauKzH6edeojyJSXNKIU0aW+ORjWw2B0RoCCYQAsCX0j6SwZ13EqcNPuqgv53/3a5dvjHfJdW2M7RFprIPUl73X9QKgCQIhgbCTQHgGAqGzRrXxSkBqGrmuxOjnXaM+ikhxSSNOGVnik49tNQRGawgkEALAltA/ksKedRGnDj/por6c/903Xb29XddQgdR0jbFXmwbGzyULVtU1AozlmmuS5SyefnWzHM3TuVaCymz2l9lE91GeI8eP2ey7yR+GwKgsI/825mz2vKTvlaHuOUsK901+/vNJCRvf+lay7GSTV2SbetMDfve7s+jsp5InTiQl4vq37Nxzk/oOHpklZ3+U/Vo2rfnCC2fRF7wgWX7rNSV8v+a2n8nNH0IZeTb7UvLHZsn8Y6ff+94sqgfZFc61em89cK/r8F2njspEsu+SPeT3LevvfxrrL22Ot2lVPi/J5tStXlo/sl+z7JX8G7s//MOk7/2DP0j+/u87pViGEm+8MSn3Sq+/V5bxe7+XrOsM6uEUAKbl9CkLALYFgTBJICQQEgjHWKeOykSy700xxiv3Ntm0KumVe2Vz6lYvrR/Zr1n2ykc+30sgBIBNcvqUBQDbgkCYJBASCAmEY6xTR2Ui2femGOOVe5tsWpX0yr2yOXWrl9aP7Ncse+Ujn+8lEALAJjl9ygKAbUEgTBIICYQEwjHWqaMykex7U4zxyr1NNq1KeuVe2Zy61UvrR/Zrlr3ykc/3EggBYJOcPmUBwLYgECYJhARCAuEY69RRmUj2vSnGeOXeJptWJb1yr2xO3eql9SP7Ncte+cjnewmEALBJTp+yAGBbyA8tzmZ/kW0iZwAl9+YfHW1KCBLb/uRPkp/7XFJ+wVLO8XKuO/vs5F13JQv/N3tpVH84NPfqbmioy88rHJFw5ZGN9e+RzPvH0ec9bxadzb4Sve22WdTv8znnJGWoRYuUJ5J7D8Qn5x+S5XjqlBOzV87ETdapjV/OP8n67/99g8ePJ3/3dxv80peS0isje/3I3t/5nWRdp1lVLRivLEN6ZaK680Y/UZOyOV/8YvL665033JBs2md5IvmIZvVwCgDTon8kAWBiCIQrHOsJhATC5T45BMLgKgFJsof0ysheP7K3Kaj4eZuUZUivTFR33ugnapJACACL0D+SADAxBMIVjvUEQgLhcp8cAmFwlYAk2UN6ZWSvH9nbFFT8vE3KMqRXJqo7b/QTNUkgBIBF6B9JAJgYAuEKx3oCIYFwuU8OgTC4SkCS7CG9MrLXj+xtCip+3iZlGdIrE9WdN/qJmiQQAsAi9I8kAEwMgXCFYz2BkEC43CeHQBhcJSBJ9pBeGdnrR/Y2BRU/b5OyDOmVierOG/1ETRIIAWAR+kcSACbnJdmUAfQ8rUiM8fhT/pfNb2POfnyWnL0+mX8qczY7FvXn+AX5If845Gz219kbsg2/bzmb/blR7p39ME9GZ5ck8+PLL2fOZt+Pysie73xnFn3iE5NabZmdNYtefXVSfq72s5+dReVduPLKWVSG+uAHk9//fvLSS5PPeU6yRE3/iU1BVJ5X3m7pFfR4KsFMMl4NY9Ga68Yry5DztI8xkgHkHO8zwG//dvILX3DKb/s2+Vu/5bzuuuRv/mbyN37D+eu/7pQP9LXXJj/96aT87rP4qU8lP/nJ5FVXJT/xieTHP568/PLkRz+a/LVfS374w8kPfSgp37r3v9/53vcm3/3u5GWXJd/5Tqd8n71vf7tRD6cAMC36Bzbzw7+TRgBYCwRCAmE/BEL7iSUQEggJhARCAFgD+gc2U0PgPgmEp/+I9zX6rtgiFwDbgkBIIOyHQGg/sQRCAiGBkEAIAGtA/8BmagiMbpHTf8Rzy9DL3ut6AbAtCIQEwn4IhPYTSyAkEBIICYQAsAb0D2ymhsDoQn70d7bvv87Fxtg+v67tQtdV760sbB8qAJgMAiGBsB8Cof3EEggJhARCAiEArAH9A5uZB78hF3L6T214WduHrucvu+tIrK+NwsL2oQKAiZh/7ofQ6hZ0rBZ0LIBDzFvfmnzLW5JvfnPyjW9MvuENyde/3vm61yVf/erkq16VfOUrk694RfJlL0u++MXOF74w+fznJ5/73OQllyQltT/rWclnPCN50UXJpz0t+dSnJp/ylOSTn5yUf//xuMc5L7wwecEFyXPPTT7mMclHPSr5iEckH/7w5EMfmnzIQ5JHjiT/5b9M/uRPJuV3kP/ZP0v+03/q/LEfS97//sn73S8p/47qPvdJ/qN/lJSf613Fe987ea97Je9xj6geTgFgWvTPYmYe/IZciJwqu5et7YKp74iNoeQMQ4MATE384Fa0ugUdqwUdC+AQQyAkEBIICYQAO4z+WczMg9+QC5FTZfdyifbujDpUIwyN2bGwAGAius93L1rdgo7Vgo4FcIghEBIICYQEQoAdRv8sZvZKCIwuRE6V3cvWdmkUtOIUXfvSBQATkT/Pila3oGO1oGMBHGIIhARCAiGBEGCH0T+LmS779boQOVV2L+OBU67nF70vexvH3Nt7XS8AtsP8OzCEVregY7WgYwEcYgiEBEICIYEQYIfRP4uZvRICowuRU2V82XvyNPVDLbGxd0zpii1yAQAAAABTo4dTAJgW/U4CAAAAAEyGHk4BYFr0OwkAAAAAMBl6OAWAadHvJAAAAADAZOjhFACmRb+TAAAAAACToYdTAJgW/U4CAAAAAEyGHk4B7uZ/wCTodxIAAAAAYDI0BADcjQYX2Az6nQQAAAAAmAwNAQB3o8EFNoN+JwEAAAAAJkNDAMDdaHCBzaDfSQAAAACAydAQAHA3GlxgM+h3EgAAAABgMvRwCgDTot/Jg8bXT6GtjQyN0LUPFXSsZRkAAAAAO4ceTgFgWvQ7WZhHnYhWZBYWrJem6YaKF7YPFUTG1AAAAABAQg+nADAt+p0stOac1voVWct0Q4MQCAEAAAA2ix5OAWBa9DtZGMo58/av303XWFu69qEaaezaY0F9WVvCAD9qj9ddQbyO+Pahgq6x65IWAAAAAHDo4RQApkW/k4WhkCOJqLuW+loWK/1119K1x5e1Jb7svY4Xrde9jd111xJfAgAAAMAC9HAKANOi38nCPPZEunYp8+3+5cJ2KZgzdNfQdb1obR8q6H0JAAAAAAvQwykATIt+JwtDIWcoCw21+5cL26VgztBdQ9f1orX964XTpbkMAAAAAEahh1MAmBb9ThaGQs5QFhpq9y+H2rtrKZiz8C65rhet7VIg+F4AAAAAUPRwCgDTot/JwlDIWZidhl7GyoXX9aUglf46XrRe18bYLtcAAAAAMAo9nALAtOh3sjCPQJGuXcq6C1M2b5EaaYztXa+0dMSuhdfSGPHtQwVd47w9vgQAAACAxejhFACmRb+TW8KnKdNbg9lW2CfLAAAAADhg6OEUAKZFv5NbwqQp0wUAAAAABxs9nALAtOh3ckv0pj7+sxsAAADAIUcPpwAwLfqdBAAAAACYDD2cAsC06HcSAAAAAGAy9HAKANOi30kAAAAAgMnQwykATIt+Jwvz/yHf/H/Lx/V2rwEAAAAOG3o4BYBp0e8kAAAAAMBk6OEUAKZFv5MAAAAAAJOhh1MAmBb9TgIAAAAATIYeTgFgWvQ7KVxwgXNC9k6hrQeKQ/AIAAAAAGtGD6cAMC36nRRqCGwMhPMU5LPQyBptWjcyRfdyqH0JVrkXAAAA4BCih1MAmBb9Tgo1BLYHQrkQYrvJhEPta2RoiqH2JVjjUAAAAACHAT2cAsC06HdSqCGwJRAu8d/Wemt6x4npcX4dW6QxtkuXaTHtQ3d1BbU99gIAAADAj9DDKQBMi34nhRoC90cgjC3x5YrX8wt5adoXXs9fdtf1JQAAAMBOo4dTAJgW/U4KNQRuMhAOFfhxhl7ut/belwAAAAA7jR5OAWBa9Dsp1BC4sUBoev04e4Whsu5CkAJ5ua723pcAAAAAO40eTgFgWvQ7KdQQuJlAaLpmpde/7BgqW7F+6fbelwAAAAA7jR5OAWBa9Dsp1BDYEghnAzFpiYzkb+/tje1D1/OXcjG+feh6flFfShcAAADArqOHUwCYFv1OCjUEtgfCjtjYWzCn64rE9lrTe3tsjO3SVRu7l749dkljdy0vpQsAAABg19HDKQBMi34n9ysSusbQWr9plngEAAAAgEOOHk4BYFr0O3mIIH0BAAAA7Hf0cAoA06LfyUMEgRAAAABgv6OHUwCYFv1OAgAAAABMhh5OAWBa9DsJAAAAcJp73CN5r3slzz47eZ/7JO93v+W9//2X9wEPSD7wgQ3+xE8kH/Sg5IMfnPzpn07+q3+V/JmfST70ocmHPzz5iEckH/Wo5GMekzzvvH3h+ecnL7ww+fjHJ5/4xOSTnxzVwykATIv+kx8AAADgNARCAuGQBEKAw4L+kx8AAADgNARCAuGQBEKAw4L+kx8AAADgNARCAuGQBEKAw4L+kx8AAADgNARCAuGQBEKAw4L+kx8AdobXZr+V/U72e9nbsi3cN9vC//2/yb2MVit/kTxrlpydzN6ZvSP7/awvln3+Zvb27F9lt4WsWZ5I3v27slI8FfqGtpDPphv0KU9Z3qc/PXnRRcmLL04+85k77bOelXzOc5KXXJJ83vOSL3hB8oUvTL74xcmXvGRtvuxlyZe/vMGf+znnv/k3yZ//+eSrX5187WuTr3td8vWvTx47lnzjG5O/+IvOXKyH06mYzfYQ8ZSWyy93Tsi4895iFg6yrokA9j8EQgLhEATCzVhj3ngJhOMlEBIIx1HOxIg7q6WGwMZAuPC0FguGamanyrRpKcaMM6YG4BBAICQQDkEg3Iw15o2XQDheAiGBcBzlTIy4s1pqCGwPhHIhDLULI8sWMmacMTUAhwACIYFwCALhZqwxb7wEwvESCAmE4yhnYsSd1VJDYEsglBNa74Gtt1GoNb0nwK7RtMeu3sauS1oADh8EQgLhEATCzVhj3ngJhOMlEBIIx1HOxIg7q6WGwA0EwoUnujpO1xIv1nLdtcSXAJvk3lk9196c1N5dw4ervFeatU5mJeL6ULc883++DKHVgnw2lCuyEukltsleyQPKxh5zrvAh1OfPaLWwYDdW4Nix5C/8glOOyGKtj8ppexVf85oGfQZ41auSkh9ECRuSTHyqeelLk5KIJHp5a6BaWr8qSYAvelFS0qNkSx8112jdn/HKE/kHfP7zk3Ul45WJ9GyKiBNrqSFw3YEwMnQkGDPOUE1re+9LgE1CIGyAQBghEK6JYwRCAuHAqgiEUQIh4qHVUkPgJgPhbKBmzDhDNaZd6C0D2DwEwgYIhBEC4Zo4RiAkEA6sikAYJRAiHlotNQQeokAY2wXfC7BWCIQNEAgjBMI1cYxASCAcWBWBMEogRDy0WmoIbAmEP6T7Ex//1pvroSPBUFm8WPp6/rL3GmDzEAgbIBBGCIRr4hiBkEA4sCoCYZRAiHhotdQQ2B4I6996+bvfWyMM3dLbaNpjV2/jvD2+BNgwZ2dX4UjWs8KxfnbP7Dp5TnYFjhyC3XhTtonvJpsesKlY2OBuXJldH/UcvLQ1b6xLmUiO9XJSf+5zk//6XyflRzjlJzqf8Yy1ucrI8jOq4tOelpRfc33Sk5JPeELywguT55+fPO+85GMfm3zMY9bmox61vI9+dIPyCP4BxXPPbbA+o1Em0rMpIk7swaDGtg0x2UQAd0MgTBAII28iEAYIhEECIYFwpPII/gHFmvqM9RmNMpGeTRFxYgFguxAIEwTCyJsIhAECYZBASCAcqTyCf0Cxpj5jfUajTKRnU0ScWADYLgTCBIEw8iYCYYBAGCQQEghHKo/gH1Csqc9Yn9EoE+nZFBEnFgC2C4EwQSCMvIlAGCAQBgmEBMKRyiP4BxRr6jPWZzTKRHo2RcSJBYD9zD49mn85OxX7dDduzTZxRbLlAbsfxepFq4UN7sbfZ1fgSEOk1+fPaLVQz8FGOdfWY7FRsscFFyTlpC7Kvd46tbHONd46WrQuLCrB7HGPS8rmiHKv2LRIsT7jeOszjtc/YK03967RurfjraMZ9WyKiBMLAPuZloSgbPDQTyCMEAgjBMJh/Tm+Boylw0ad2ljnGm8dLVoXFpX8QCA0D1jrzb1rtO7teOtoRj2bIuLEAsB+piUhKBs89BMIIwTCCIFwWH+OrwFj6bBRpzbWucZbR4vWhUUlPxAIzQPWenPvGq17O946mlHPpog4sQCwn2lJCMoGD/0EwgiBMEIgHNaf42vAWDps1KmNda7x1tGidWFRyQ8EQvOAtd7cu0br3o63jmbUsykiTiwA7GdaEoKywUM/gTBCIIwQCIf15/gaMJYOG3VqY51rvHW0aF1YVPIDgdA8YK03967RurfjraMZ9WyKiBMLANtlY0dz+V26dXI0m9HDeEarhY3txrFjyTZW+CVYff6MVgsb240vfCE5HS2JV9nYbujZtB5to/U4fsiO5mIdLVp3YPxuSJqq2du4yr0S6ZusATJaf+HT/Nqnt/6y6Hgf+cgGf/Znl7eOFn3EI5wylJ5NEXFiLf/rfzknZNTZqYVVRuvuXfuqYCfZ2DFXDgnr5CiBcCz6/BmtFja2GwTCxGQRaBXrSsZbRxtvHS1ad2D8bqwS6la5t8a88dYQSCAcsoZAAiHi/tVSQ2BjIBxz8hlZo02rscqA8d5VxgE4xcaOuXJIWCdHCYRj0efPaLWwsd0gECYmi0CrWFcy3jraeOto0boD43djlVC3yr015o23hkAC4ZA1BBIIEfevlhoC2wOhXAjSPrJsdVYZMN67yjgAp9jYMVcOCevkKIFwLPr8Ga0WNrYbBMLEZBFoFetKxltHG28dLVp3YPxurBLqVrm3xrzx1hBIIByyhkACIeL+1VJDYEsglNNO7+FnuZrIUFdve2wZuq7F0l674kuARjZ2zJVDwjo5SiAciz5/RquFje0GgTAxWQRaxbqS8dbRxltHi9YdGL8bq4S6Ve6tMW+8NQQSCIesIZBAiLh/tdQQuG8CYe/1maLwsremXsyvh+7qve5a4kuANv7sz5LTsS+P5idPJqdjX+7G/B83Hdq9OfblbswelF1lkUey9aRrfPjDnXLqPeecBmWoOrWxHsejda5oHS1an3G8/gG9D3tYsi7b6DenhhMTVNaoLKMmRmN9T8dbE2O0rtOseY3KA+rZFBEn1lJD4LoD4exUuz/w+HEW3tVbMG/0Qw2N4F8CtEEgjBAII/N/LHZo9+bYl7tBIHTWA3e0zhWto0XrM47XP6CXQBit7+l4awgkECKiaqkhcN2BcPWa+DIcnX5ELeiIBdIY6dqlzLwEaINAGCEQRnr/eTQF+3I3CITOeuCO1rmidbRofcbx+gf0Egij9T0dbw2BBEJEVC01BO7jQDiyPTYO3SL4sqG7AEZBIIwQCCN7Ge3eHPtyNwiEznrgjta5onW0aH3G8foH9BIIo/U9HW8NgQRCRFQtNQS2BMIf0p1h4mFm6Lq+7JBb4rBDU/iaejG/lpe1fagGYEkIhBECYWT+j5sO7d4c+3I3CITOeuCO1rmidbRofcbx+gf0Egij9T0dbw2BBEJEVC01BLYHwnqYkYNNb40gtw/dEhtjVy0217VY2mOXlAGsm1VOvZs7ms+OJVdZ5JGsRb6HglYLG9yNzyVX2Y0mVplog7vxp8lVFjkZ9cckjfVIvS7rcXwrR/P6yMb6FOOtsSda68ffKz/+KT9JKj+U+vjHJ5/whOSTnpR88pOdUtykDPXUpyal+IlPTNbRjHKvV+6tj2ysUxv1bIqIE3swiOe9xQe/qRh1CgVYiVXO0xs89B8jEAYIhBEC4bLWEEggHLLWRwmExpr6jHJvfWRjndqoZ1NEnNiDx+KDH8DhYZXz9AYP/ccIhAECYYRAuKw1BBIIh6z1UQKhsaY+o9xbH9lYpzbq2RQRJ/bgsfjgB3B4WOU8vcFD/zECYYBAGCEQLmsNgQTCIWt9lEBorKnPKPfWRzbWqY16NkXEiQWA/cwq5+kNHvqPEQgDBMIIgXBZawgkEA5Z66MEQmNNfUa5tz6ysU5t1LMpIk4sAGyXDR7Nv5uc7Gi+ykQLduOE9dbs96z19uja0Nia0WphwW6swt8lV3nLWtDnz2i1sLndkLOpnGuf8pSkFPsDtFeyh7ce1scrmUesC4tOthtN+lV55d6nPa3Bpz89edFFSUlxMq/0rlFZxtGjDT7jGct78cVOmcgvUs+miDixALBdNnfMJRA66+3RtaGhJ6PVwoLdWAUCYaApbEjxKhGopj5jjXnjrSGQQNhZU5+RQBi9uITAqEzkF6lnU0ScWADYLps75hIInfX26NrQ0JPRamHBbqwCgTDQFDakeJUIVFOfsca88dYQSCDsrKnPSCCMXlxCYFQm8ovUsykiTiwAbJfNHXMJhM56e3RtaOjJaLWwYDdWgUAYaAobUrxKBKqpz1hj3nhrCCQQdtbUZyQQRi8uITAqE/lF6tkUEScWALbL5o65BEJnvT26NjT0ZLRaWLAbq0AgDDSFDSleJQLV1GesMW+8NQQSCDtr6jMSCKMXlxAYlYn8IvVsiogTCwBb5ciR5OysNR7Nr8gm9DCekWJlY0dzOW6ttBtHDvzvl77tbcm23Tgn28QqT7TKvZYrrki27YZwJHv06NpsOjGLcu8zn5mUYplXTtsSYySZSLiqAXJd1iA33lWGksgnyshrDN7eus7xyiPUlGusATIqI/t5m6w7YHZDz6aIOLEwyNdPoa3jGHnjKlPAIeEIgTBAIIwQCCMEwqTMSyCM1nBiggqBMOrnbbLugNkNPZsi4sQuYJ5YOobavz6QanoLhoqXYI1DVczgpmvOUEFtry2wWxwhEAYIhBECYYRAmJR5CYTRGk5MUCEQRv28TdYdMLuhZ1NEnNgFSFzpXo6JMavcO5I1DlVZZfChe2t7bYHd4giBMEAgjBAIIwTCpMxLIIzWcGKCCoEw6udtsu6A2Q09myLixC5glVDXW/P1QNfStXcvO+LLeU3X0r2MLadL88v5hVR2zFsEaZ+/7Opj77yxo2uMXbVy3tK1x5ewWxwhEAYIhBECYYRAmJR5CYTRGk5MUCEQRv28TdYdMLuhZ1NEnNgFDEWXMRlmqKaOGVtqb3cRr+XCv4z3ykvp6pBGKeu9feh6/lIuIr2NAKc4a4VT78aO5n/+58mVFnmkIbatNNHGduMv/zLZuMibk033NhULG9uNv/3b5EqLbGKViepp1Sj5ock6WvRxj0teeGGy/jqoUe71yrwXXNDg+ecvbx0tet55yXPPTUqvV0aWvZJ3QVJNzVfGGorGW0eLSnySNUuvt34sjXJvXbaxTm3UsykiTuwC5sGmY6j96wORprdAike+lPY5Q8Xycqi99+UcX7Nw5JHtc3obAU6xyjF3Y4d+AmGEQBghEDrraFECYVRCHYEwKmuu+cpYP5ZGubcu21inNurZFBEndgFDWWWo3TAUika+7J1xqFhe1nYh9s6RxqGXK7bP6W0EOMUqx9yNHfoJhBECYYRA6KyjRQmEUQl1BMKorLnmK2P9WBrl3rpsY53aqGdTRJzYBQxllaF2w1AoGvmyd8ahYnk51G7wtywceWT7nN5GgFOscszd2KGfQBghEEYIhM46WpRAGJVQRyCMypprvjLWj6VR7q3LNtapjXo2RcSJXcBQVhlqj4wMRebl10/Rey0X9WVvfe2av+yuI6Ymjjx0Pb+Ql9Le2wIQWOWYu7FDP4EwQiCMEAiddbQogTAqoY5AGJU113xlrB9Lo9xbl22sUxv1bIqIE7uAobgyDz8RrThFb4G0xK6upSuIvbF9TEvXHgu6lljZS+ySMumK1IL4UspiF+wqGzuaz+6T3dxEwipH8wWLPJG9PXtH9pvZH2SleGNscDdW4Gezm5tI2J+7IWfTerSNyolZ0kU9UhsliXlXmWiV/FB3wOyGn1eUJ6qPbFxlN+TeJv3myAPKvHUH1qVflXeVeyW1ym/b1nqjnk0RcWJhEEluY1iivvUWOHRs7phLICQQDkEgjDSdiX26qPHDWHOOcZWJfH7w1h0wu+HnFeWJ6iMbV9kNubdJvznygDJv3YF16VflXeVeAiHi4RFWpUt0pDtYis0dcwmEBMIhCISRpjOxTxc1fhhrzjGuMpHPD966A2Y3/LyiPFF9ZOMquyH3Nuk3Rx5Q5q07sC79qryr3EsgRDw8whqYR0HSICzF5o65BEIC4RAEwkjTmdinixo/jDXnGFeZyOcHb90Bsxt+XlGeqD6ycZXdkHub9JsjDyjz1h1Yl35V3lXuJRAiHh4BYLts7phLICQQDkEgjDSdiX26qPHDWHOOcZWJfH7w1h0wu+HnFeWJ6iMbV9kNubdJvznygDJv3YF16VflXeVeAiHi4REAtsyLkm2n3psP2W9UzmaXJjc4UWLPotXCBhd5XXKViVru1efPaLXQMlEj/2+yaaKzs0I9ni7tU5+6vE9/ulOK5RwvShSRNFV/0nND+p8z9dYgN94amaIyUdMifRLzb+hFFyWf8YzkxRc7pbjJZz7TefRoUhYpvaL/iHolPerZFBEnFgC2DIEwQiCMEAgjBMJgDYEEws4aAgmEQ0rGIxAi7qgLiP/rOK63ew2HFQJhhEAYIRBGCITBGgIJhJ01BBIIh5SMRyBE3FEBYMsQCCMEwgiBMEIgDNYQSCDsrCGQQDikZDwCIeKOCgBbhkAYIRBGCIQRAmGwhkACYWcNgQTCISXjEQgRd1QA2MfoYTyj1ULTibmN/5NsmuicbBNNEwkL7j1hvS3719lbs/X26Po4a19G+r1s20TfTTY9YFOxUNOX0R/rvfU4vq6j+SpevEL2qKNF6zNGn/Ws5LOfnZRiWWQdzSj3euvt462jjbeOFvXbXt+XaP0Mj1c+hE3W0aLyCPoPDkScWEf3P2DrRat3mMUnc4Dl0AiY0Wqh7SzeBIGQQDjAXrZtIgJhUCaS3jV6cU4mddnGOlq0PmOUQBito0X9ttf3JVo/w+OtMW+8dbSoPIL+gwMRJ9ahETCj1YXe82ps7D3ZxsbYXguG2mvXnNpeW5ZjXeMAKPFjXdFqoe0s3gSBkEA4wF62bSICYVAmkt41enFOJnXZxjpatD5jlEAYraNF/bbX9yVaP8PjrTFvvHW0qDyC/oMDESfWoREwo9WFemSNLbXLt9eXQ9f15VBjbVmOdY0DoMy/M0NotdB2Fm+CQEggHGAv2zYRgTAoE0nvGr04J5O6bGMdLVqfMUogjNbRon7b6/sSrZ/h8daYN946WlQeQf/BgYgT69AImNHqQj2yxpah02xtN7eYrkqtiS3ztc0JJaPaY9dQY9fVNQIsJn6eKlottJ3FmyAQEggH2Mu2TUQgDMpE0rtGL87JpC7bWEeL1meMEgijdbSo3/b6vkTrZ3i8NeaNt44WlUfQf3Ag4sQ6NAJmtLowP692p9bel5Xabm4xXZVaE28fup5fyEtTv/AaINN2Ym7gwQ9OrnOiI9nM/OM+hFYLa1xk5kUvSm5uIuWsFYLKxhb57ncn1zrRFdmEfhoyUqysc5EZOZtebE/q2zqaN00kyhOJUiwTyTLkxyGf8pSk/7HTNep/7dNbf3d0vPV3ZaN1neP1v33aZP1xVOPjH7+88giyV1Ls59WzKSJOrEMjYEarC/O/791feXk5v64ngXoqkBEiC0eLxIKOrksq48uOhfUj2wECGzvmEggjBMIIgTAhEWgekzoJhFECobGuc7ySl2rMG29NfcYa88YrjyB7JcV+Xj2bIuLEOjQCZrS60P19j3/rh/7om4IxXUJve22UFUZiTW2PBfGlFMf2M9UAiY0dcwmEEQJhhECYkAg0j0mdBMIogdBY1zleyUs15o23pj5jjXnjlUeQvZJiP6+eTRFxYh0aATNaXej+vse/9UN/9E3BmC6ht702mpHnSPtQ/VB7x1A7wAaPuQTCCIEwQiBMSASax6ROAmGUQGis6xyv5KUa88ZbU5+xxrzxyiPIXkmxn1fPpog4sQ6NgBmtLvT+fe8apXdhe305dF1fDjXGSXtHk8be+qHr+Uu5AChs7JhLIIwQCCMEwoREoHlM6iQQRgmExrrO8UpeqjFvvDX1GWvMG688guyVFPt59WyKiBPr0AiY0epC79/32Nh7EoiNsb0WDLXXrjm1PbYM3R4bY9eZ6rt7a3ts7K4BEtdem2w79d4720L8pFa0WmhaZAtf+UpycxMpZ+3H2PaNbyTbJlrhifTTkNFqoWmRLdx1V3KdE9WTrvGCC5xy6q2H9Q3pT9uyyPPPT9anWJeyyLqZRnmiJmvcisqq/JqblI31+1xvN9a9Ha8MJXslizzvvGR9ClPcpAylZ1NEnFgA2CoEwgiBMEIgjBAInTKvX7OcxetTrEtZZN1MozxRkzUEEgg7Za9kkT62+eImZSg9myLixALAViEQRgiEEQJhhEDolHn9muUsXp9iXcoi62Ya5YmarCGQQNgpeyWL9LHNFzcpQ+nZFBEnFgC2CoEwQiCMEAgjBEKnzOvXLGfx+hTrUhZZN9MoT9RkDYEEwk7ZK1mkj22+uEkZSs+miDixALBVCIQRAmGEQBghEDplXr9mOYvXp1iXssi6mUZ5oiZrCCQQdspeySJ9bPPFTcpQejZFxIkFgH2MHsYzWi2s8cQsPCC7Qi5tY4WQs8HdeHx2qt3QT0NGq4XN7cbsnckDsRv1DG2sx+LxylByUpcT87nnJuuRel3KImsaMcoT1WxmrFFtXbFNipuso423jjbeuj9ReY/8OyjKUDV7G+VNkd8RlZ9vfepTk/KDtBddlLw4/9Stnk0RcWIBYB+jB9uMVgubO/QTCCMEwgSBcFgZSuKEnPIJhGaiuhJT3GQdbbx1tPHW/YnKe+TfQVGGqqnPSCBE3BUBYB+jB9uMVgubO/QTCCMEwgSBcFgZSuKEnPIJhGaiuhJT3GQdbbx1tPHW/YnKe+TfQVGGqqnPSCBE3BUBYB+jB9uMVgubO/QTCCMEwgSBcFgZSuKEnPIJhGaiuhJT3GQdbbx1tPHW/YnKe+TfQVGGqqnPSCBE3BUBYB+jB9uMVgubO/QTCCMEwgSBcFgZSuKEnPIJhGaiuhJT3GQdbbx1tPHW/YnKe+TfQVGGqqnPSCBE3BUBYLts8Gh+PLnK0fxI1rM/Y9vs/yRX2Y0mNrYb97xnsvGJTrR4Y/ar2S9lb8pel70he21W5v1y9itZuVdWdU32eDZP9KxnJZ/znORzn5u85JKk9D7/+ckXvjD54hcnX/rS5MtfnnzFK5yvfGXyVa9KvvrVyde8Jvna1yZf97rkL/xC8g1vSL7xjUnp9cq94pvfnHzLW5K//MsNvv3tyXe8w/mudyUvuyz5K7/SoNwrI4ty77vfnXzPe5Lve1+D731vUnrf//5kvd0o9zb5gQ8kP/jBpJ5NEXFiHZdbtHq/svjfDk/CPlkG7D/soX81jhMIAwTCyIkWCYQEwoFQV1OfsYZAAmEngRARt6kjxr+KVg8w9H+z09veNcau3sZIb0G9GEMtri3Lsa5x4NBhD/2rcZxAGCAQRk60SCAkEA6Eupr6jDUEEgg7CYSIuE0dMf5VtLqPmIJar31jxBf4XqEW15blWNc4cOiwh/7VOE4gDBAIIydaJBASCAdCXU19xhoCCYSdBEJE3KaOGP8qWl0YikC1vWupXUONkd6C3jH3Al1jpLaPuX1Me+waauy6ukbYAeyhfzWOEwgDBMLIiRYJhATCgVBXU5+xhkACYSeBEBG3qSPGv4pWF4aCTW3vWmrXUGOkt6COGbPWUO6qjb23yPX8Ql6a+oXXsFPIaVuOuddnj2evzp7Iyr1yNJfjtZzjZShRqAXRW7PfzN6RlV4Z6vasv/cHWSmu64w2PaB4Tfam7PGsvPsy1D55B8U7st/Lynsk9+7Ld1DOpr/6q0nf+6EPrU2ZqGle6f3wh5N1rqgU/9qvJT/60eQP//aPV+792McalHtFWWR9qPEPKH7kI0mZV3rr7ca6MLNIr9wr775YP0tRyWmS4iQQSkz1IdYr9+rZFBEn1nG5RasLQ/Gmtkso6jCNkd4Cc9H7smusdF1SGV92LKwf2Q67g0QCAmFUhtqXcUK9hkBIIFzGelgfP6/0+vwgSrHEGElENfUZ5d6a+oxyr7hK1qpRLUogJBAi7qKOyy1aXRhKOLXdh6LexkhvQR1zr3Cm+m5qY9eiN4fK3vZYEF9KcWw/Uw27hEQCAmFUhtqXcUK9hkBIIFzGelgfP6/0+vwgSrHEGElENfUZ5d6a+oxyr7hK1qpRLUogJBAi7qKOyy1aXRhKOLXdh6LexkhvQR2zt0yoNQtvl/ah+qH2jqF2OPRIJCAQRmWofRkn1GsIhATCZayH9fHzSq/PD6IUS4yRRFRTn1HuranPKPeKq2StGtWiBEICIeIu6rjcotV9xJDTeu0bI70FNYDtnaIWRGrjwtulsbd+6Hr+Ui5g15BIQCCMylD7Mk6o1xAICYTLWA/r4+eVXp8fRCmWGCOJqKY+o9xbU59R7hVXyVo1qkUJhARCxF3UcblFqweY55+adnrba9lQY6S3oGuMvd2kvbfM+oYac3tsjF1nqu/ure2xsbuGnaLp1Pv9rByvZajbsnJwP5m9JSsjyzKkd5VjvSATibdm5YlEuVce8NtZv2bplaHkiWTbZajvZP1OSrHMK/fW7Yo27bOMLMv4u6w8rwx1MvutrJ9XdsO/C3+ZlZGlOK9KzqbyI41NygFaev1pW5STus+H3hoDzFC1wBQ3JROfPaTX76S8ZfUHP6M+itSsEq1vsVHWLA/Y9O6LTRP5T06TNbgaa3A1IVbUsykiTiwAbBmfl05kCYTRGgIJhEM27bOMTCAcrT/HN0UCf6yvcctYD/pmqFpgiuVYX6eOyhP5GON3kkAY9TtZ38Tx1uRmrCGQQIh4YASALePz0oksgTBaQyCBcMimfZaRCYSj9ef4pkjgj/U1bhnrQd8MVQtMsRzr69RReSIfY/xOEgijfifrmzjemtyMNQQSCBEPjACwZXxeOpElEEZrCCQQDtm0zzIygXC0/hzfFAn8sb7GLWM96JuhaoEplmN9nToqT+RjjN9JAmHU72R9E8dbk5uxhkACIeKBEQC2jM9LJ7IEwmgNgQTCIZv2WUYmEI7Wn+ObIoE/1te4ZawHfTNULTDFcqyvU0fliXyM8TtJIIz6naxv4nhrcjPWEEggRDwwAsCW+SurnMXliHzCKtSCqJzFD0EGkCQma5Z5pVfu/Zusf3yx6V2Qd18e/7vZk1lZs4wsz3tn9uasFP9tVnrlLZPNkSeSVfmNlSeSeeUjKrvx11mZN1uPp9F6tF2X9YcojXKvLLIe5Y0SGMRV0kUdbfy9fii/Ku8a720aqtYb6+1mKB8XRZ+HvTVdR6XYT+STtp5NEXFiAWDL1BAYlVMvgTBKIIzKmmVked47CYRnrCGQQDgUVOpo40eu9Ua516/Ku8Z7m4aq9cZ6uxmKQIiIaxYAtkwNgVE59RIIowTCqKxZRpbnvZNAeMYaAgmEQ0GljjZ+5FpvlHv9qrxrvLdpqFpvrLeboQiEiLhmAWDL1BAYlVMvgTBKIIzKmmVked47CYRnrCGQQDgUVOpo40eu9Ua516/Ku8Z7m4aq9cZ6uxmKQIiIaxYAtkwNgVE59RIIowTCqKxZRpbnvZNAeMYaAgmEQ0GljjZ+5FpvlHv9qrxrvLdpqFpvrLeboQiEiLhmAWB/caLFW7JygPbp8a6s/4lOnwEktzQtQ9wnuyFhQ4rZjaikOElit2brOqNNz3uzDbGi3Jt7/WlbDrJef56WXl982WXOd70rWQtM8Tvf6XzHO5KXXpp8+9uTUuxXJc8r+yzKmyL5wRfXeGmUn0KtBcb6rw/GW3+FNSrF8q8DmtZcpzbLqAVGf6+s+SMfSUqvnk0RcWIde//TeRDZ21vwyOtl4ungcHCixflZv3OVQz+BcHwEYjeiBEICIYGwXZm3KVw1rblObZZRC4z+XgIh4kHSUUPgEoFw7260ow8pG3nXeHoHrI21ZTnWNQ7sFCdanJ/1O1c59BMIx0cgdiNKICQQEgjblXmbwlXTmuvUZhm1wOjvJRAiHiQdNQS2BsKYiMakozE1q9A7fm2sLcuxrnFgpzjR4vys37nKoZ9AOD4CsRtRAiGBkEDYrszbFK6a1lynNsuoBUZ/L4EQ8SDpqCGwKRDWONS17GVqo9T39nYFtT02xnapGWqUW+o4I9tj11Bj19U1wo5zosX5Wb9zlUM/gXB8BGI3ogRCAiGBsF2ZtylcNa25Tm2WUQuM/l4CIeJB0lFD4HoDYe/1/EJemvp4y5hxYvtQY+/4cj2/kJemfuE17CxyNN8nceLG7FezX8relL0ue0P22qzM++XsV7Jyr6zqmuzxrH9AGfn6rAx1dVZGlntlN+SJZOtkKFmVbLs8r9wrNn0YTsWkM0og3NxPzn47KyPLV+P7WRnqlqwsI//2qT+5ih/9aIOXX+684grnlVcmr7oq+clPJqX3E59wSrFM9PGPN+jvlSfy93r9I8huNG2O7/XFXn9vXWf06quTn/pUUnp98TXXOP3ITavyQ8m8n/50Us+miDixjhoC1xgIN9ouDNV3jZWuSyrjy46F9SPbYTe5g0AYJBBGZVUEQgLhQJzwUUSUYpmopj6jv1eeyN/r9Y9QA9X4zfG9vtjr763rjProJb2+uIZAAiEiqo4aAg9QINzL1IKO2hjrhVhT22NBfCnFsf1MNewqdxAIgwTCqKyKQEggHIgTPoqIUiwT1dRn9PfKE/l7vf4RaqAavzm+1xd7/b11nVEfvaTXF9cQSCBERNVRQ+BBCYQj24caff2stA/VD7V3DLXDTnEHgTBIIIzKqgiEBMKBOOGjiCjFMlFNfUZ/rzyRv9frH6EGqvGb43t9sdffW9cZ9dFLen1xDYEEQkRUHTUENgXCHxIDj1zHsDQUnIZqxtTHxt72jtrYO5e0x8be+qHr+Uu5gF3mDgJhkEAYlVURCAmEA3HCRxFRimWimvqM/l55In+v1z9CDVTjN8f3+mKvv7euM+qjl/T64hoCCYSIqDpqCGwNhD9knoUk+XSN0iUtvV3S2F3Ly1jctUv9UGPvOFIWG2PXmeq7e2t7bOyuYWfJZ1M9fN8xVQKUA3RTEL0r60/qEjZk5MnysGy7zCvvwl9nr85Ktrwp+5XsKs97Z1b22T+v95ap3n3JeLKxt27sJ0ntt0zOpk2ucrwWa6IwStiQ+NQUvXxsk16faaX3Yx9LSlquYTv6a7+WlF+wlB/SlJ+79L9+KSOL/t8OSG+93SjL8E/0gQ8km3pXUUYW/cbK5vi9ko3VsykiTux2IAgBdNij6oKzuCjUAuNkkeB2AuGyz0sgjDY9r/2W1Zg3XgKh6SUQRmUZ/ol85PO9q1hDYNRvbA2BZq9kY/VsiogTux0IhAAd9qi64CwuCrXAOFkkuJ1AuOzzEgijTc9rv2U15o2XQGh6CYRRWYZ/Ih/5fO8q1hAY9RtbQ6DZK9lYPZsi4sRuBwIhQIc9qi44i4tCLTBOFgluJxAu+7wEwmjT89pvWY154yUQml4CYVSW4Z/IRz7fu4o1BEb9xtYQaPZKNlbPpog4sQCwZexRdcFZXBRqgXGySHA7gXDZ5yUQRpue137LaswbL4HQ9BIIo7IM/0Q+8vneVawhMOo3toZAs1eysXo2RcSJBYAtI2fik1k5mp/ISvHtWSn+m6wczWUiGUoCkswrjyDzikItiMq8PsX9RVYeUEa+OStDyeP7ocSmB/QT3ZKVYLbKmyLP+72sjCwbKyPLmyKPIMU+W4pNO3ld9srsTdl8r48iXjn11oO+OTHLvE3LkGLJWt6mibx12WZkWYaPi9LbpMTUmoHHK8G7xvioFNcYH623b0X/7yz8mn2vKJsj6tkUEScWALaMnJhPZgmEUQIhgXDI6wiEY22ayFuXbUaWZUiK871NEgjHSyBExB8JAFtGTswnswTCKIGQQDjkdQTCsTZN5K3LNiPLMiTF+d4mCYTjJRAi4o8EgC0jJ+aTWQJhlEBIIBzyOgLhWJsm8tZlm5FlGZLifG+TBMLxEggR8UcCwJaRE/PJLIEwSiAkEA55HYFwrE0TeeuyzciyDElxvrdJAuF4CYSI+CMBYMv4A/StG/vdxRuzX81+KSvnaTl835C9Nivzfjn7lazcK6u6Jns86x9QRr4+K0NdnZWR5V7ZDXki2ToZSmx6B2/NSsa7Iyu9MtRtW/oQyj7flD2elTdUhlrhTZHf1Wz6IU3plaG8PnuIUixDyTLWqH9esT6j0U/kQ6z0NinpUXolxEqG9/lffoSz/obneP3viNZ/1xCto0VXWaRMVDdkafVsiogT69j72teMWn1IGfp/mTjUDtDKts7iBEICYedtW/oQyj7flD1OICQQnpZAGK0hMFpHi66ySJmobsjS6tkUESfWUUNgayDcC2jfOOTGpcfpiEvq0KLAUO9QO0Ar2zqLEwgJhJ23belDKPt8U/Y4gZBAeFoCYbSGwGgdLbrKImWiuiFLq2dTRJxYRw2BTYFQItNyCWq5u8YwcuShsqF2gFa2dRYnEBIIO2/b0odQ9vmm7HECIYHwtATCaA2B0TpadJVFykR1Q5ZWz6aIOLGOGgJXCYSR7j/N1dAYG0PVmZZaLI2xq2uv1N7urtgVG6W9t6ZrBBjJts7iBEICYedtW/oQyj7flD1OICQQnpZAGK0hMFpHi66ySJmobsjS6tkUESfWUUPgWgJhDE7mWi5q+8Lr+cvuWhgaWV4ODT7U2F0DjOSEtan45uztVrl3W5FAvCX7g+wdWbn3rqwMJcW79ry3Z2VkiYtNyxBX2Y2rt5MP5YgsZ/H3v9/5vvc5pfi9723wPe9Jvvvdycsua/Cd70y+4x3OSy911vrxvutdyV/5Fac8r1f2qm6m0e+z9Pr31yvhykc+rwQz+QD7yCfz+mXUgqifSHprcI3q2RQRJ9ZRQ2BTIPwh84AkMUkiU0xTsb23cah4YXvFdM1GDFgvel8CLOSEtan4ZgLh6IC0a897O4GQQEgg7NHvs/T699frs5b0egmEiLhmHTUEtgbCSExQghREpHGoeGF7pXadWdApukapqRfCmWqAEZywNhXfTCAcHZB27XlvJxASCAmEPfp9ll7//np91pJeL4EQEdeso4bAdQXC3HOa3nZpHBpkYXvFVy4csF4ALMcJa1PxzQTC0QFp1573dgIhgZBA2KPfZ+n176/XZy3p9RIIEXHNOmoIbAqEJkrFrt72elHbh67nF70vI6bSDF4nio2xHWAkJ6xNxTcTCEcHpF173tsJhARCAmGPfp+l17+/Xp+1pNdLIETENeuoIbApEP6QeViSyDSmfailt0sau+v6MlK74mhdb9fYdXXt8boWAIxETr0nrEItiDYd67+flfwgQ0ma+l72ZPaWrIwsy5De72T/LivLaNqcb2VlInkimUiGkjQl98rIf5GVIPpXWZlXiv0bKjZtjixDHvC72ZNZ+ajIyFLsPwx/k5XdkIn8J0fmzTtZj6fResKO1t9LjMpPVq7yU5lyr1fm9dbbl1bWLL/nKb8j6n/t0+sfodZHm+b1j+B/KNUXizLRKouU3vo2RWUn/chifQqj3w09myLixALAliEQRqVXjvUEQgJhp0zkPzkyL4FweFWrKGuW/CCRQHrrIxv9I9T6aNO8/hF85vHFoky0yiKlt75NUdlJP7JYn8Lod0PPpog4sQCwZQiEUemVYz2BkEDYKRP5T47MSyAcXtUqypolP0gkkN76yEb/CLU+2jSvfwSfeXyxKBOtskjprW9TVHbSjyzWpzD63dCzKSJOLABsGQJhVHrlWE8gJBB2ykT+kyPzEgiHV7WKsmbJDxIJpLc+stE/Qq2PNs3rH8FnHl8sykSrLFJ669sUlZ30I4v1KYx+N/RsiogTCwBbhkAYlV451hMICYSdMpH/5Mi8BMLhVa2irFnyg0QC6a2PbPSPUOujTfP6R/CZxxeLMtEqi5Te+jZFZSf9yGJ9CqPfDT2bIuLEAsCWOWFtKr4ue2XWJ085T0vYkEggZ/HNJZNrsjdlj2/qZyd1orqwaNMT+dziE68MdTIrEVeKv52VkeX9lX87IEPJuy9DyQNKr9zrI5/MKzZtu3hLsp7dzcnVH3PXeDSvBcamY730Ni2y1kdlGRKPJUv7H7Ssv9Jp9L9+6TO8rNk/gv+XBU0/s+mXUXd+aWUivyr/gP5eP5HfHD2bIuLEAsCWOWFtKiYQRmUoAiGBsPMWAuGgdfBorY/KMpoSAoEwWnd+aWUivyr/gP5eP5HfHD2bIuLEAsCWOWFtKiYQRmUoAiGBsPMWAuGgdfBorY/KMpoSAoEwWnd+aWUivyr/gP5eP5HfHD2bIuLEAsCWOWFtKiYQRmUoAiGBsPMWAuGgdfBorY/KMpoSAoEwWnd+aWUivyr/gP5eP5HfHD2bIuLEAsCWOWFtKiYQRmUoAiGBsPMWAuGgdfBorY/KMpoSAoEwWnd+aWUivyr/gP5eP5HfHD2bIuLEAsCWkSPyHTZc3ZX1xXI0l+JtZTxRgpn/fUv5iU7JD1dl5V4fVJoeQYa6M3tzVor/Niu9su2ySNmcurBo0xOJsozvZWXNcq+sWX4Z9dZsnTra9Aj+k/Nd98uocq5tigSrKCPLOb6Gk6gM5U/q0ivKSf1970tK1vL6Q3/dgajc60eWXllzTYzj9UP53roh460rMSPXAlMsWyePUFdirHOZef3HTNSzKSJOrON/W7QaAJaiKYkRCAmEBMJe/SeHQDjsGgODDOVXJcq9fmTp9TmtST+U760bMt66EjNyLTDFsnXyCHUlxjqXmdd/zEQ9myLixDo0Ama02rK3t2CuIZa+EeCg0JTECIQEQgJhr/6TQyAcdo2BQYbyqxLlXj+y9Pqc1qQfyvfWDRlvXYkZuRaYYtk6eYS6EmOdy8zrP2aink0RcWIdGgEzWm1ZOtctfSPAQaEpiREICYQEwl79J4dAOOwaA4MM5Vclyr1+ZOn1Oa1JP5TvrRsy3roSM3ItMMWydfIIdSXGOpeZ13/MRD2bIuLEOjQCZrR6mL2AaYy9UiBdAIeJpiRGICQQEgh79Z8cAuGwawwMMpRflSj3+pGl1+e0Jv1QvrduyHjrSszItcAUy9bJI9SVGOtcZl7/MRP1bIqIE+vQCJjRaktv2Ou9HroAOKxIEjuR/U7Wn3p9XpKR/Q88yqokA8iqTmYlA8i8olALopJMTmZlNyR7+AeUieQXO2Vev+0+L4lNjy9rltgmxfJLobIqGUo2x+/zLVn/vDKyz4dNuyHfBflMykQns/nx5SArR9WaoMYrmWeVbFkHj9YTtrHeHq1TR+UR6u0HzvqM0Vpv7q0FRrlXNtZb/wVBVIrrQxn9vfUpovWTFq1zRfVsiogT69AImNFqSw2EvS/NBcBhRY7mJ7IEwqgPKgTCKIGQQDhgvT1ap47KI9TbD5z1GaO13txbC4xyr2yst4ZAAiEirqRDI2BGqy01AQrSFV921wCHEjman8gSCKM+qBAIowRCAuGA9fZonToqj1BvP3DWZ4zWenNvLTDKvbKx3hoCCYSIuJIOjYAZrbZIrhuKeV17vQA4rMjR/ESWQBj1QYVAGCUQEggHrLdH69RReYR6+4GzPmO01pt7a4FR7pWN9dYQSCBExJV0aATMaHXB/Ie+of8MaC4ADityND+RJRBGfVAhEEYJhATCAevt0Tp1VB6h3n7grM8YrfXm3lpglHtlY701BBIIEXElHRoBM1pdkMhXQ6A0xt7updQAHD5OZOV4fef++AXLg5ge1xcYdGQZSibycVG2TkY+iPt8Y/ar2S9lb8pel70he21W5v1y9itZuVdWdU1SztPya58f+1jy8suTV1yRlN6Pfzz5iU8kr7oq+clPJj/1qeQ11ySl1/vpTzs/85lkLRjvtdc6ZSLxs59tsN4elXnrOs2apVe2vd6+LmWiyeatb1NUllE/WtGrr07K59mrZ1NEnFgA2DInsnLKv5NAGPRbJ8oTyTJk3pMEwmDTPt9IICQQnrYmimhNbtGa+oz19qjMW9dp1iy9kwUzmWiyeevbFJVl1I9WlECIeIAFgC1zIiun/DsJhEG/daI8kSxD5j1JIAw27fONBEIC4WlroojW5Batqc9Yb4/KvHWdZs3SO1kwk4kmm7e+TVFZRv1oRQmEiAdYANgyJ7Jyyr+TQBj0WyfKE8kyZN6TBMJg0z7fSCAkEJ62JopoTW7RmvqM9faozFvXadYsvZMFM5losnnr2xSVZdSPVpRAiHiABYAtcyIrp/w7CYRBv3WiPJEsQ+Y9SSAMNu3zjQRCAuFpa6KI1uQWranPWG+Pyrx1nWbN0jtZMJOJJpu3vk1RWUb9aEUJhIgHWADYMsezJ+xpW46512dlqKuzMrLcK0dzOV7LOV6GklVJBsiHb71XFGqB8ZasxKc7snLvXVlffFtWstat2brOKOwD6vF0vBLqvBIIm/KhKIfvejo3J3Wvn0j0Dyh5WLzyyqSP1uJHP5qUSO9/G1N65V75mU2YiD3EuwUA2EWOEwiDQi0wEghhKWrcGm9NfUbJS6IU17miEsxqCCQQEggPEnuIdwsAsIscJxAGhVpgJBDCUtS4Nd6a+oySl0QprnNFJZjVEEggJBAeJPYQ7xYAYBc5TiAMCrXASCCEpahxa7w19RklL4lSXOeKSjCrIZBASCA8SOwh3i0AwC5ynEAYFGqBkUAIS1Hj1nhr6jNKXhKluM4VlWBWQyCBkEB4kNhDvFsAAAAAAAAA2B/8D4tWL8XeHv8uAAAAAAAAYP+hETCj1Zah4DfU3rGwAAAAAAAAANaPRsCMVi/Fwry3sAAAAAAAAADWj0bAjFZbYq7by/S2D7UMNQIAAAAAAMA60QiY0WpLF95ikJPr+YW8HGrvfQkAAAAAAADrQSNgRqstIwNex1C94HsBAAAAAABgSTQCZrTaMhTw4ssf/efCQC3oWmoZAAAAAAAArBONgBmttgwFvKXbe18CAAAAAADAetAImNHqQkxrMeANXc8vTLu8jGUAAAAAAACwTjQCZrS6IOEtXkdqe6wfWQYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABw2Nmb7Rm1GgAAAAAAAA4NJvWZro69vcU1a2GyiQAAAAAAAHaFeerr/W+DBEIAAAAAAIDDzLoC4V4gvoyVka5dumKjdM2pd3UtAAAAAAAA0MAaA2FtjNcxvLVez1921/JSugAAAAAAAGAUUwbCrnGV9t6XAAAAAAAA0MwBDYTzljnSDgAAAAAAAKM4uIGww3QBAAAAAADAICb1ma6O3vzWe713iqbr+cXCl9IFAAAAAAAAo6j/bVD+O6GnN7/1Xs/DXkdXIF2xMZScqTEtAAAAAAAAsB8huQEAAAAAAOwoBEIAAAAAAIAdhUAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsDJ7VgAAAAAAADi0mNRnujr2ClqRWVhgaJpoNmKuhQUAAAAAAACHmXkk6v1vg2PSUmumaq2PyL2rDDVn9REAAAAAAAAOMBsKhPN2+a953cvYUstil2mJL7sRpDFeSEH3smsBAAAAAADYLbrsJ3ZdnqE0JUErxrCucf7SdMWXtSXeOHRdG6W9awQAAAAAANg55pFor9h1eeZZK9K1S5lvl5fS3jVGYnuo6hlkYQEAAAAAAMAu0mU/sevyDGWqkRls6GXvsL2Ns9JeB1lYAAAAAAAAsIt02U/sujxDmWpkBqu3z1tq+1DjrLTXuRYWAAAAAAAA7CImEpmujqFMNTKD1dv3TiGNc0x7HL/ONTTp0IAAAAAAAAA7wZ51IfMAFunapay7MGWmcTbcPsvLiI1yUdvlFgAAAAAAANgmJDQAAAAAAIBdhDQIAAAAAACwc/B/vQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwmD3rFuD/GyEAAAAAAMA01BDYHAjn/z/l1xXk1jUOAAAAAAAAeGoIbAuEMb+tJcutZRAAAAAAAABYSA2BDYGwhrd5i7R3L7v/llhjZNcoXVIfe+tLAAAAAAAAGI8kQHEBNY/VUBcbY67rve6K40V82dsIAAAAAAAASxDjX3UBNY/VOFcvRrYLtX6oEgAAAAAAAMbw/7drxygMAzEQAP//6xQGI3Zjn43Lm0GFTpHcLyQSYNRCR7JOa7MJsdDP+/04BAAA4JUOgbMWOpJ1WusmxPxqfz6P/uqDAAAAPBEJMGqtc9p8xq9/l/uq530bVwAAALzVIXDWI0c864TWw3Nzzntn9ufyzRoAAAAbEQgBAAB2JA0CAABs5/wHKQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBnP+BI3aaaavgXAAAAAElFTkSuQmCC1c:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$24"}}],["$","$L25",null,{"initialData":{"job_id":"64fd2327cb60c83dfc0bfc10","environment_id":160,"environment_description":"Windows 10 64 bit","size":3935,"type":"PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows","type_short":["peexe","executable"],"type_short_id":"exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"output.exe","md5":"1108a29bc361a3b8854cd0aa251b7884","sha1":"af286327f32760ef5bfa80ac852e8ede66677817","sha256":"a99222b871adee0178a92831be5917cd131451971b36bf8191a2d7d0429f3997","sha512":"d6a100b6b0eeb5148d950785ea0749cee6ec9c6af1cc4b76fdfa904f1675a46971f273b553d26aba3e8e027c1d13547d775a06017cad7ad304c7be38318d49dd","ssdeep":"48:6kAeQCAbxJUxAvy/JQxhkRjZ8qyWnaIqUXO9qK0AW0Xe:BOTJtsJAajZ3nfH9","imphash":null,"entrypoint":"0x401000","entrypoint_section":".text","image_base":"0x400000","subsystem":"Windows Cui","image_file_characteristics":["32BIT_MACHINE","EXECUTABLE_IMAGE","DEBUG_STRIPPED","LINE_NUMS_STRIPPED"],"dll_characteristics":["DYNAMIC_BASE","NX_COMPAT"],"major_os_version":"4","minor_os_version":"0","av_detect":null,"vx_family":null,"url_analysis":false,"analysis_start_time":"2023-09-10T02:00:07+00:00","threat_score":100,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[],"is_certificates_valid":false,"certificates_validation_message":"No signature was present in the subject. (0x800b0100)","domains":[],"compromised_hosts":[],"hosts":["13.37.13.37"],"total_network_connections":1,"total_processes":1,"total_signatures":32,"extracted_files":[],"file_metadata":{"file_compositions":[],"imported_objects":[],"file_analysis":[],"total_file_compositions_imports":null},"processes":[{"uid":"00000000-00007708","parentuid":null,"name":"output.exe","normalized_path":"C:\\output.exe","command_line":null,"sha256":"a99222b871adee0178a92831be5917cd131451971b36bf8191a2d7d0429f3997","av_label":null,"av_matched":null,"av_total":null,"pid":"7708","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","process_flags":[{"name":"Network Activity","data":null}]}],"mitre_attcks":[{"tactic":"Execution","technique":"Shared Modules","attck_id":"T1129","attck_id_wiki":"https://attack.mitre.org/techniques/T1129","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Loads the RPC (Remote Procedure Call) module DLL"],"parent":null},{"tactic":"Execution","technique":"Native API","attck_id":"T1106","attck_id_wiki":"https://attack.mitre.org/techniques/T1106","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to execute Windows APIs"],"parent":null},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found PE header in memory"],"parent":null},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Found a string that may be used as part of an injection method"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Loads the Bcrypt module DLL"],"parent":null},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found PE header in memory"],"parent":null},{"tactic":"Defense Evasion","technique":"Hidden Window","attck_id":"T1564.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to pass information to a window procedure (API string)"],"parent":{"technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564"}},{"tactic":"Defense Evasion","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Found a string that may be used as part of an injection method"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Credential Access","technique":"Credential API Hooking","attck_id":"T1056.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/techniques/T1083","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Tries to access non-existent files (executable)","Touches files"],"parent":null},{"tactic":"Discovery","technique":"System Information Discovery","attck_id":"T1082","attck_id_wiki":"https://attack.mitre.org/techniques/T1082","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Calls an API typically used to get system version information","Calls an API typically used to get product type","Contains ability to read software policies","Reads information about supported languages"],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/techniques/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Calls an API typically used for taking snapshot of the specified processes"],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/techniques/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Opens registry keys","Queries registry keys","Contains registry location strings"],"parent":null},{"tactic":"Discovery","technique":"System Service Discovery","attck_id":"T1007","attck_id_wiki":"https://attack.mitre.org/techniques/T1007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries services related registry keys"],"parent":null},{"tactic":"Discovery","technique":"System Language Discovery","attck_id":"T1614.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Reads the windows installation language"],"parent":{"technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614"}},{"tactic":"Collection","technique":"Credential API Hooking","attck_id":"T1056.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Collection","technique":"Screen Capture","attck_id":"T1113","attck_id_wiki":"https://attack.mitre.org/techniques/T1113","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to capture screen (API string)"],"parent":null},{"tactic":"Command and Control","technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Spawned process connects to a network"],"informative_identifiers_count":2,"informative_identifiers":["Contacts server","Found potential URL in binary/memory"],"parent":null},{"tactic":"Command and Control","technique":"Non-Standard Port","attck_id":"T1571","attck_id_wiki":"https://attack.mitre.org/techniques/T1571","malicious_identifiers_count":1,"malicious_identifiers":["Uses network protocols on unusual ports"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Command and Control","technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Making HTTPS connections using secure TLS/SSL version"],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-320","type":2,"relevance":1,"name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")","description_v2":["Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"memorydump-8","type":20,"relevance":1,"name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007708.00000000.69136.000D0000.00000002.mdmp\")","description_v2":["Found PE header \"MZ\" - Source: \"00000000-00007708.00000000.69136.000D0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found PE header \"MZ\" - Source: \"00000000-00007708.00000000.69136.000D0000.00000002.mdmp\")"}],"origin":"Memory Dumps","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-124","type":6,"relevance":3,"name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007708)","description_v2":["\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007708)"],"description_v3":[{"type":"text","value":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007708)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-125","type":6,"relevance":3,"name":"Calls an API typically used to get system version information","description":"\".exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000008e31786c2325aa7388235f00687dfe7628f25f003054aa73cac08b1ffeffffff44f15f00b240a973e8f05f000000b474e0f15f00cb40a973e0df407508000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000070f15f0000000000080000000000000000000000000000000000000000000000000000009631786c00000000b0f15f006992e776ffffffff3400000070f15f0008000000000000000000b474e0f15f002794e77678f15f000b00000000000000c8f15f00 (UID: 00000000-00007708)","description_v2":["\".exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000008e31786c2325aa7388235f00687dfe7628f25f003054aa73cac08b1ffeffffff44f15f00b240a973e8f05f000000b474e0f15f00cb40a973e0df407508000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000070f15f0000000000080000000000000000000000000000000000000000000000000000009631786c00000000b0f15f006992e776ffffffff3400000070f15f0008000000000000000000b474e0f15f002794e77678f15f000b00000000000000c8f15f00 (UID: 00000000-00007708)"],"description_v3":[{"type":"text","value":"\".exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000008e31786c2325aa7388235f00687dfe7628f25f003054aa73cac08b1ffeffffff44f15f00b240a973e8f05f000000b474e0f15f00cb40a973e0df407508000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000070f15f0000000000080000000000000000000000000000000000000000000000000000009631786c00000000b0f15f006992e776ffffffff3400000070f15f0008000000000000000000b474e0f15f002794e77678f15f000b00000000000000c8f15f00 (UID: 00000000-00007708)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-78","type":3,"relevance":1,"name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","description_v2":["\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"],"description_v3":[{"type":"text","value":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"External Systems","identifier":"suricata-0","type":18,"relevance":10,"name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Microsoft Connection Test\" (SID: 2031071, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 4, Severity: 3) categorized as \"Misc activity\"","description_v2":["Detected alert \"ET INFO Microsoft Connection Test\" (SID: 2031071, Rev: 4, Severity: 3) categorized as \"Misc activity\"","Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 4, Severity: 3) categorized as \"Misc activity\"","Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 4, Severity: 3) categorized as \"Misc activity\""],"description_v3":[{"type":"text","value":"Detected alert \"ET INFO Microsoft Connection Test\" (SID: 2031071, Rev: 4, Severity: 3) categorized as \"Misc activity\""},{"type":"linebreak"},{"type":"text","value":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 4, Severity: 3) categorized as \"Misc activity\""},{"type":"linebreak"},{"type":"text","value":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 4, Severity: 3) categorized as \"Misc activity\""}],"origin":"Suricata Alerts","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-1","type":7,"relevance":1,"name":"Contacts server","description":"\"13.37.13.37:1738\"","description_v2":["\"13.37.13.37:1738\""],"description_v3":[{"type":"text","value":"\"13.37.13.37:1738\""}],"origin":"Network Traffic","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-101","type":2,"relevance":1,"name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"Beep\"; Source: \"00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp\")","description_v2":["Found reference to API (Indicator: \"Beep\"; Source: \"00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API (Indicator: \"Beep\"; Source: \"00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-120","type":2,"relevance":1,"name":"Contains registry location strings","description":"$26","description_v2":["\"\\REGISTRY\\MACHINE\\SOFTWARE\\Micro\" in Source: 00000000-00007708.00000000.69136.000C8000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Winsock\" in Source: 00000000-00007708.00000000.69136.00150000.00000004.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp","\"Software\\Microsoft\\RegEdt32\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp","\"SOFTWARE\\\\MICROSOFT\\\\CLOCK\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Devices\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp","\"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\EXTENSIONS\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp","\"SOFTWARE\\\\MICROSOFT\\\\CHARMAP\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp","\"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\NETWORK\\\\PERSISTENT CONNECTIONS\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\PrinterPorts\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp","\"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\TRUETYPE\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp","\"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\TWAIN\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp","\"SOFTWARE\\\\MICROSOFT\\\\WINDOWS HELP\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp"],"description_v3":[{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Micro\" in Source: 00000000-00007708.00000000.69136.000C8000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Winsock\" in Source: 00000000-00007708.00000000.69136.00150000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\RegEdt32\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\\\MICROSOFT\\\\CLOCK\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Devices\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\EXTENSIONS\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\\\MICROSOFT\\\\CHARMAP\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\NETWORK\\\\PERSISTENT CONNECTIONS\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\PrinterPorts\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\TRUETYPE\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\TWAIN\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\\\MICROSOFT\\\\WINDOWS HELP\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00007708.00000000.69136.7FBE0000.00000002.mdmp"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-154","type":0,"relevance":0,"name":"File contains dynamic base/NX flags","description":"\"output.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","description_v2":["\"output.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT"],"description_v3":[{"type":"text","value":"\"output.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-9","type":10,"relevance":0,"name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74270000","description_v2":["\".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74270000"],"description_v3":[{"type":"text","value":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74270000"}],"origin":"Loaded Module","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-10","type":10,"relevance":0,"name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75500000","description_v2":["\".exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75500000"],"description_v3":[{"type":"text","value":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75500000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-80","type":0,"relevance":1,"name":"PE file contains executable sections","description":"\"output.bin\" has an executable section named \".text\"","description_v2":["\"output.bin\" has an executable section named \".text\""],"description_v3":[{"type":"text","value":"\"output.bin\" has an executable section named \".text\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-95","type":0,"relevance":0,"name":"PE file contains writable sections","description":"\"output.bin\" has an writable section named \".idata\"","description_v2":["\"output.bin\" has an writable section named \".idata\""],"description_v3":[{"type":"text","value":"\"output.bin\" has an writable section named \".idata\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-96","type":0,"relevance":0,"name":"PE file entrypoint instructions","description":"\"output.bin\" file has an entrypoint instructions - \"cld\t,call\t0x401095,pushal\t,xor\tedx, edx,mov\tebp, esp,mov\tedx, dword ptr fs:[edx + 0x30],mov\tedx, dword ptr [edx + 0xc],mov\tedx, dword ptr [edx + 0x14],xor\tedi, edi,movzx\tecx, word ptr [edx + 0x26],mov\tesi, dword ptr [edx + 0x28],xor\teax, eax,lodsb\tal, byte ptr [esi],cmp\tal, 0x61,jl\t0x401027,sub\tal, 0x20,ror\tedi, 0xd,add\tedi, eax,dec\tecx,jne\t0x40101e,push\tedx,push\tedi,mov\tedx, dword ptr [edx + 0x10],mov\teax, dword ptr [edx + 0x3c],add\teax, edx,mov\teax, dword ptr [eax + 0x78],test\teax, eax,je\t0x40108c,add\teax, edx,mov\tebx, dword ptr [eax + 0x20],add\tebx, edx,mov\tecx, dword ptr [eax + 0x18],push\teax,test\tecx, ecx,je\t0x40108b,xor\tedi, edi,dec\tecx,mov\tesi, dword ptr [ebx + ecx*4],add\tesi, edx,xor\teax, eax,ror\tedi, 0xd,lodsb\tal, byte ptr [esi],add\tedi, eax,cmp\tal, ah,jne\t0x401057,\"","description_v2":["\"output.bin\" file has an entrypoint instructions - \"cld\t,call\t0x401095,pushal\t,xor\tedx, edx,mov\tebp, esp,mov\tedx, dword ptr fs:[edx + 0x30],mov\tedx, dword ptr [edx + 0xc],mov\tedx, dword ptr [edx + 0x14],xor\tedi, edi,movzx\tecx, word ptr [edx + 0x26],mov\tesi, dword ptr [edx + 0x28],xor\teax, eax,lodsb\tal, byte ptr [esi],cmp\tal, 0x61,jl\t0x401027,sub\tal, 0x20,ror\tedi, 0xd,add\tedi, eax,dec\tecx,jne\t0x40101e,push\tedx,push\tedi,mov\tedx, dword ptr [edx + 0x10],mov\teax, dword ptr [edx + 0x3c],add\teax, edx,mov\teax, dword ptr [eax + 0x78],test\teax, eax,je\t0x40108c,add\teax, edx,mov\tebx, dword ptr [eax + 0x20],add\tebx, edx,mov\tecx, dword ptr [eax + 0x18],push\teax,test\tecx, ecx,je\t0x40108b,xor\tedi, edi,dec\tecx,mov\tesi, dword ptr [ebx + ecx*4],add\tesi, edx,xor\teax, eax,ror\tedi, 0xd,lodsb\tal, byte ptr [esi],add\tedi, eax,cmp\tal, ah,jne\t0x401057,\""],"description_v3":[{"type":"text","value":"\"output.bin\" file has an entrypoint instructions - \"cld\t,call\t0x401095,pushal\t,xor\tedx, edx,mov\tebp, esp,mov\tedx, dword ptr fs:[edx + 0x30],mov\tedx, dword ptr [edx + 0xc],mov\tedx, dword ptr [edx + 0x14],xor\tedi, edi,movzx\tecx, word ptr [edx + 0x26],mov\tesi, dword ptr [edx + 0x28],xor\teax, eax,lodsb\tal, byte ptr [esi],cmp\tal, 0x61,jl\t0x401027,sub\tal, 0x20,ror\tedi, 0xd,add\tedi, eax,dec\tecx,jne\t0x40101e,push\tedx,push\tedi,mov\tedx, dword ptr [edx + 0x10],mov\teax, dword ptr [edx + 0x3c],add\teax, edx,mov\teax, dword ptr [eax + 0x78],test\teax, eax,je\t0x40108c,add\teax, edx,mov\tebx, dword ptr [eax + 0x20],add\tebx, edx,mov\tecx, dword ptr [eax + 0x18],push\teax,test\tecx, ecx,je\t0x40108b,xor\tedi, edi,dec\tecx,mov\tesi, dword ptr [ebx + ecx*4],add\tesi, edx,xor\teax, eax,ror\tedi, 0xd,lodsb\tal, byte ptr [esi],add\tedi, eax,cmp\tal, ah,jne\t0x401057,\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","description_v2":["\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")"],"description_v3":[{"type":"text","value":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-153","type":0,"relevance":0,"name":"Uses 32 bit executable PE","description":"\"output.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","description_v2":["\"output.bin\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE"],"description_v3":[{"type":"text","value":"\"output.bin\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-177","type":3,"relevance":1,"name":"Opens registry keys","description":"$27","description_v2":["\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")","\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")","\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")","\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\CONHOST.EXE\"; Key: \"\"; Value: \"\")","\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\"; Value: \"\")","\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\BAM\"; Key: \"\"; Value: \"\")","\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"\"; Value: \"\")","\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")","\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")","\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","\".exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"\"; Value: \"\")","\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\CONHOST.EXE\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\BAM\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-172","type":3,"relevance":1,"name":"Queries registry keys","description":"$28","description_v2":["\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RESOURCEPOLICIES\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"OUTPUT.EXE\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"LONGPATHSENABLED\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"LOGFLAGS\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"SHOWDEBUGINFO\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SHELL FOLDERS\"; Key: \"CACHE\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"TYPE\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"ALTERNATECODEPAGE\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"PREFERREDUILANGUAGES\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\"; Key: \"MACHINEPREFERREDUILANGUAGES\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"SAFEDLLSEARCHMODE\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"ENABLED\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RESOURCEPOLICIES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"OUTPUT.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"LONGPATHSENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"LOGFLAGS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"SHOWDEBUGINFO\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SHELL FOLDERS\"; Key: \"CACHE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"TYPE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"ALTERNATECODEPAGE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"PREFERREDUILANGUAGES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\"; Key: \"MACHINEPREFERREDUILANGUAGES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"SAFEDLLSEARCHMODE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"ENABLED\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-263","type":6,"relevance":1,"name":"Touches files","description":"\".exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \".exe\" trying to touch file \"C:\\output.exe\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \".exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","description_v2":["\".exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"","\".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"","\".exe\" trying to touch file \"C:\\output.exe\"","\".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"","\".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"","\".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"","\".exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"","\".exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\""],"description_v3":[{"type":"text","value":"\".exe\" trying to touch file \"%WINDIR%\\System32\\WOW64LOG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" trying to touch file \"C:\\output.exe\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-126","type":6,"relevance":3,"name":"Tries to access non-existent files (executable)","description":"\".exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"\n \".exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\FLTLIB.DLL\"","description_v2":["\".exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"","\".exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\FLTLIB.DLL\""],"description_v3":[{"type":"text","value":"\".exe\" trying to access non-existent file \"%WINDIR%\\System32\\WOW64LOG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\".exe\" trying to access non-existent file \"Z:\\FLTLIB.DLL\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":3,"name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\"","description_v2":["Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\""],"description_v3":[{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-54","type":7,"relevance":1,"name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","description_v2":["Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]"],"description_v3":[{"type":"text","value":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]"}],"origin":"Network Traffic","attck_id":"T1573","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-103","type":6,"relevance":3,"name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","description_v2":["\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}"],"description_v3":[{"type":"text","value":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-78","type":2,"relevance":1,"name":"Contains ability to capture screen (API string)","description":"$29","description_v2":["Found reference to API \"\" (Indicator: \"GetDC\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"GetDC\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateDC\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateDC\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"BitBlt\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"\" (Indicator: \"GetDC\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"GetDC\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateDC\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateDC\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"BitBlt\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00007708.00000000.69136.02750000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1113","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1113","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-173","type":3,"relevance":1,"name":"Queries services related registry keys","description":"$2a","description_v2":["\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"WINSOCK_REGISTRY_VERSION\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"NAMESPACE_CALLOUT\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"SERIAL_ACCESS_NUM\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NEXT_CATALOG_ENTRY_ID\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NUM_CATALOG_ENTRIES\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000001\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000002\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000003\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000004\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000005\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000006\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000007\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000008\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"WINSOCK_REGISTRY_VERSION\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"NAMESPACE_CALLOUT\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"SERIAL_ACCESS_NUM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NEXT_CATALOG_ENTRY_ID\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NUM_CATALOG_ENTRIES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000001\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000002\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000003\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000004\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000005\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000006\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000007\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES\\000000000008\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"registry-26","type":3,"relevance":2,"name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","description_v2":["\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")"],"description_v3":[{"type":"text","value":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")"}],"origin":"Registry Access","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistence","identifier":"string-4","type":2,"relevance":4,"name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00007708.00000000.69136.031F0000.00000002.mdmp\n \"!Progman\" (Program manager) in Source: 00000000-00007708.00000000.69136.031F0000.00000002.mdmp","description_v2":["\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00007708.00000000.69136.031F0000.00000002.mdmp","\"!Progman\" (Program manager) in Source: 00000000-00007708.00000000.69136.031F0000.00000002.mdmp"],"description_v3":[{"type":"text","value":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00007708.00000000.69136.031F0000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"!Progman\" (Program manager) in Source: 00000000-00007708.00000000.69136.031F0000.00000002.mdmp"}],"origin":"File/Memory","attck_id":"T1055.011","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"target-412","type":9,"relevance":5,"name":"Spawned process connects to a network","description":"Process \"C:\\output.exe\" connects to 13.37.13.37 on port 1738 (TCP)","description_v2":["Process \"C:\\output.exe\" connects to 13.37.13.37 on port 1738 (TCP)"],"description_v3":[{"type":"text","value":"Process \"C:\\output.exe\" connects to 13.37.13.37 on port 1738 (TCP)"}],"origin":"Monitored Target","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"hooks-8","type":11,"relevance":10,"name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"1032167780ec1a77208a177700000000\" to virtual address \"0x74263000\" (part of module \"WIN32U.DLL\")\n \".exe\" wrote bytes \"a0925602b0925602b017010080f00600c0020100b0f0060060b20600e0915602f0915602\" to virtual address \"0x74CDAC94\" (part of module \"USER32.DLL\")\n \".exe\" wrote bytes \"309f0977f0660c77702a087720a4097770230877003b097710600977b05b097700b00977805b0977d0810977d00d0777\" to virtual address \"0x74B5E018\" (part of module \"GDI32.DLL\")","description_v2":["\".exe\" wrote bytes \"1032167780ec1a77208a177700000000\" to virtual address \"0x74263000\" (part of module \"WIN32U.DLL\")","\".exe\" wrote bytes \"a0925602b0925602b017010080f00600c0020100b0f0060060b20600e0915602f0915602\" to virtual address \"0x74CDAC94\" (part of module \"USER32.DLL\")","\".exe\" wrote bytes \"309f0977f0660c77702a087720a4097770230877003b097710600977b05b097700b00977805b0977d0810977d00d0777\" to virtual address \"0x74B5E018\" (part of module \"GDI32.DLL\")"],"description_v3":[{"type":"text","value":"\".exe\" wrote bytes \"1032167780ec1a77208a177700000000\" to virtual address \"0x74263000\" (part of module \"WIN32U.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote bytes \"a0925602b0925602b017010080f00600c0020100b0f0060060b20600e0915602f0915602\" to virtual address \"0x74CDAC94\" (part of module \"USER32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\".exe\" wrote bytes \"309f0977f0660c77702a087720a4097770230877003b097710600977b05b097700b00977805b0977d0810977d00d0777\" to virtual address \"0x74B5E018\" (part of module \"GDI32.DLL\")"}],"origin":"Hook Detection","attck_id":"T1056.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/004","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"External Systems","identifier":"avtest-8","type":12,"relevance":10,"name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","description_v2":["CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)"],"description_v3":[{"type":"text","value":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Network Related","identifier":"network-7","type":7,"relevance":7,"name":"Uses network protocols on unusual ports","description":"TCP traffic to 13.37.13.37 on port 1738","description_v2":["TCP traffic to 13.37.13.37 on port 1738"],"description_v3":[{"type":"text","value":"TCP traffic to 13.37.13.37 on port 1738"}],"origin":"Network Traffic","attck_id":"T1571","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1571","stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":true,"allow_sample_tampering":true,"network_mode":"default","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":180,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":"Windows 10","windows_version_edition":"Professional","windows_version_service_pack":null,"windows_version_version":"10.0 (build 16299)","windows_version_bitness":"64","custom_date_time":null,"sandbox_version":"10.2.0","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[{"name":"Spyware","details":["Found a string that may be used as part of an injection method"]},{"name":"Persistence","details":["Installs hooks/patches the running process"]}],"icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","visualization":"$2b","classification":["41.7% (.EXE) Win64 Executable (generic)","17.8% (.EXE) Win32 Executable (generic)","8.2% (.EXE) Win16/32 Executable Delphi generic","8.1% (.ICL) Windows Icons Library (generic)","8.0% (.EXE) OS/2 Executable (generic)"],"dns_requests":[],"contacted_hosts":[{"compromised":false,"address":"13.37.13.37","port":1738,"protocol":"TCP","associated_runtime":[{"name":"output.exe","pid":"7708"}],"country":"United States","associated_sha256s":[]}],"contacted_countries":{"countries":["USA"],"coordinates":[{"origin":{"latitude":"37.3394","longitude":"-121.895"},"destination":{"latitude":"48.8534","longitude":"2.3488"}}]},"port_infos":[],"extracted_strings":{"all":[{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcY29uaG9zdC5leGU=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"LmFic29sdXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"MWE5OW4zX19sNDZMMTdDWWlfX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"P19jPjlfXzBfP19fX3QzX19fX19fX21lOWVfTGxfPz9f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"XyIiIl8/IiIi","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3hjX2VuZF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3hjX3N0YXJ0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3hpX2VuZF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3hpX3N0YXJ0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3hsX3N0YXJ0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3hwX2VuZF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3hwX3N0YXJ0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3h0X2VuZF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3h0X3N0YXJ0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fQ1RPUl9MSVNUX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fRFRPUl9MSVNUX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fSW1hZ2VCYXNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fUlVOVElNRV9QU0VVRE9fUkVMT0NfTElTVF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fUlVOVElNRV9QU0VVRE9fUkVMT0NfTElTVF9FTkRfXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fdGxzX2VuZF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fdGxzX3N0YXJ0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19ic3NfZW5kX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19ic3Nfc3RhcnRfXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19DVE9SX0xJU1RfXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19kYXRhX2VuZF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19kYXRhX3N0YXJ0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19kbGxfY2hhcmFjdGVyaXN0aWNzX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19EVE9SX0xJU1RfXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19maWxlX2FsaWdubWVudF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19JQVRfZW5kX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19JQVRfc3RhcnRfXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19pbWFnZV9iYXNlX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19sb2FkZXJfZmxhZ3NfXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19tYWpvcl9pbWFnZV92ZXJzaW9uX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19tYWpvcl9vc192ZXJzaW9uX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19tYWpvcl9zdWJzeXN0ZW1fdmVyc2lvbl9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19taW5vcl9pbWFnZV92ZXJzaW9uX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19taW5vcl9vc192ZXJzaW9uX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19taW5vcl9zdWJzeXN0ZW1fdmVyc2lvbl9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19ydF9wc3JlbG9jc19lbmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19ydF9wc3JlbG9jc19zaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19ydF9wc3JlbG9jc19zdGFydA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19SVU5USU1FX1BTRVVET19SRUxPQ19MSVNUX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19SVU5USU1FX1BTRVVET19SRUxPQ19MSVNUX0VORF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19zZWN0aW9uX2FsaWdubWVudF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19zaXplX29mX2hlYXBfY29tbWl0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19zaXplX29mX2hlYXBfcmVzZXJ2ZV9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19zaXplX29mX3N0YWNrX2NvbW1pdF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19zaXplX29mX3N0YWNrX3Jlc2VydmVfXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19zdWJzeXN0ZW1fXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X21haW5DUlRTdGFydHVw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X1MiJyIiIiJfJyJfJyI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWdncmVzc2l2ZU1UQVRlc3Rpbmc=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJuYXRlQ29kZVBhZ2U=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RCQkW1thWVpR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVN0cmluZw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aHdzMl9UaEx3Jg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExhbmd1YWdlRmFsbGJhY2s=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGlicmFyeVBhdGg=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ1BhdGhzRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U29ja2FkZHJMZW5ndGg=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TURNRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWluU29ja2FkZHJMZW5ndGg=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmFtZVNwYWNlX0NhbGxvdXQ=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV4dF9DYXRhbG9nX0VudHJ5X0lE","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnVtX0NhdGFsb2dfRW50cmllcw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b3V0cHV0LmFzbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"b3V0cHV0LmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFja2VkQ2F0YWxvZ0l0ZW0=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UFBQUEBQQFBo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJZA==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2VQb2xpY2llcw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VyaWFsX0FjY2Vzc19OdW0=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0RlYnVnSW5mbw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwb3J0cw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNBcHBDb21wYXQ=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNVc2VyRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRGVsYXllZEFjY2VwdGFuY2U=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29jayAyLjAgUHJvdmlkZXIgSUQ=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyTnVtSGFuZGxlQnVja2V0cw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyU3BpbkNvdW50","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3xuZGF3c2wwUHJv","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null}],"interesting":[{"value":"JVdJTkRJUiVcU3lzdGVtMzJcY29uaG9zdC5leGU=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X19tYWpvcl9pbWFnZV92ZXJzaW9uX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19tYWpvcl9vc192ZXJzaW9uX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19tYWpvcl9zdWJzeXN0ZW1fdmVyc2lvbl9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19taW5vcl9pbWFnZV92ZXJzaW9uX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19taW5vcl9vc192ZXJzaW9uX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19taW5vcl9zdWJzeXN0ZW1fdmVyc2lvbl9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19zaXplX29mX2hlYXBfY29tbWl0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19zaXplX29mX3N0YWNrX2NvbW1pdF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExhbmd1YWdlRmFsbGJhY2s=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWluU29ja2FkZHJMZW5ndGg=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b3V0cHV0LmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0RlYnVnSW5mbw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwb3J0cw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNBcHBDb21wYXQ=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29jayAyLjAgUHJvdmlkZXIgSUQ=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null}],"targets":[{"name":"output.bin","strings":[{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"LmFic29sdXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3hjX2VuZF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3hjX3N0YXJ0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3hpX2VuZF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3hpX3N0YXJ0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3hsX3N0YXJ0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3hwX2VuZF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3hwX3N0YXJ0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3h0X2VuZF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fY3J0X3h0X3N0YXJ0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fQ1RPUl9MSVNUX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fRFRPUl9MSVNUX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fSW1hZ2VCYXNl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fUlVOVElNRV9QU0VVRE9fUkVMT0NfTElTVF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fUlVOVElNRV9QU0VVRE9fUkVMT0NfTElTVF9FTkRfXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fdGxzX2VuZF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fdGxzX3N0YXJ0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19ic3NfZW5kX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19ic3Nfc3RhcnRfXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19DVE9SX0xJU1RfXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19kYXRhX2VuZF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19kYXRhX3N0YXJ0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19kbGxfY2hhcmFjdGVyaXN0aWNzX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19EVE9SX0xJU1RfXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19maWxlX2FsaWdubWVudF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19JQVRfZW5kX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19JQVRfc3RhcnRfXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19pbWFnZV9iYXNlX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19sb2FkZXJfZmxhZ3NfXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19tYWpvcl9pbWFnZV92ZXJzaW9uX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19tYWpvcl9vc192ZXJzaW9uX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19tYWpvcl9zdWJzeXN0ZW1fdmVyc2lvbl9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19taW5vcl9pbWFnZV92ZXJzaW9uX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19taW5vcl9vc192ZXJzaW9uX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19taW5vcl9zdWJzeXN0ZW1fdmVyc2lvbl9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19ydF9wc3JlbG9jc19lbmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19ydF9wc3JlbG9jc19zaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19ydF9wc3JlbG9jc19zdGFydA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19SVU5USU1FX1BTRVVET19SRUxPQ19MSVNUX18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19SVU5USU1FX1BTRVVET19SRUxPQ19MSVNUX0VORF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19zZWN0aW9uX2FsaWdubWVudF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19zaXplX29mX2hlYXBfY29tbWl0X18=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19zaXplX29mX2hlYXBfcmVzZXJ2ZV9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19zaXplX29mX3N0YWNrX2NvbW1pdF9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19zaXplX29mX3N0YWNrX3Jlc2VydmVfXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19zdWJzeXN0ZW1fXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"X21haW5DUlRTdGFydHVw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"RCQkW1thWVpR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"aHdzMl9UaEx3Jg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"b3V0cHV0LmFzbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null},{"value":"UFBQUEBQQFBo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"output.bin","compromised":null,"detection_total":null,"total":null}]},{"name":"output.exe:7708","strings":[{"value":"JVdJTkRJUiVcU3lzdGVtMzJcY29uaG9zdC5leGU=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWdncmVzc2l2ZU1UQVRlc3Rpbmc=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJuYXRlQ29kZVBhZ2U=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVN0cmluZw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExhbmd1YWdlRmFsbGJhY2s=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGlicmFyeVBhdGg=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ1BhdGhzRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U29ja2FkZHJMZW5ndGg=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TURNRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWluU29ja2FkZHJMZW5ndGg=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmFtZVNwYWNlX0NhbGxvdXQ=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV4dF9DYXRhbG9nX0VudHJ5X0lE","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnVtX0NhdGFsb2dfRW50cmllcw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b3V0cHV0LmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFja2VkQ2F0YWxvZ0l0ZW0=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJZA==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2VQb2xpY2llcw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VyaWFsX0FjY2Vzc19OdW0=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0RlYnVnSW5mbw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwb3J0cw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNBcHBDb21wYXQ=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNVc2VyRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRGVsYXllZEFjY2VwdGFuY2U=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29jayAyLjAgUHJvdmlkZXIgSUQ=","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyTnVtSGFuZGxlQnVja2V0cw==","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyU3BpbkNvdW50","type":"Ansi","source":"Runtime Data","process":"output.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"screen_2.png","strings":[{"value":"MWE5OW4zX19sNDZMMTdDWWlfX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"V3xuZGF3c2wwUHJv","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null}]},{"name":"screen_0.png","strings":[{"value":"P19jPjlfXzBfP19fX3QzX19fX19fX21lOWVfTGxfPz9f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"XyIiIl8/IiIi","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X1MiJyIiIiJfJyJfJyI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null}]}],"image":[]},"http_requests":[],"ftp_requests":[],"irc_requests":[],"strings_resources":[],"tags_details":[],"sample_flags":["Network Traffic"],"suricata_alerts":[{"destination_ip":"23.199.47.135","destination_port":80,"protocol":"TCP","category":"Misc activity","description":"ET INFO Microsoft Connection Test","sid":"2031071"},{"destination_ip":"52.142.223.178","destination_port":80,"protocol":"TCP","category":"Misc activity","description":"ET INFO Windows OS Submitting USB Metadata to Microsoft","sid":"2025275"},{"destination_ip":"104.124.157.216","destination_port":80,"protocol":"TCP","category":"Misc activity","description":"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent","sid":"2027390"},{"destination_ip":"52.142.223.178","destination_port":80,"protocol":"TCP","category":"Misc activity","description":"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent","sid":"2027390"},{"destination_ip":"104.124.157.216","destination_port":80,"protocol":"TCP","category":"Misc activity","description":"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent","sid":"2027390"},{"destination_ip":"52.142.223.178","destination_port":80,"protocol":"TCP","category":"Misc activity","description":"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent","sid":"2027390"},{"destination_ip":"104.124.157.216","destination_port":80,"protocol":"TCP","category":"Misc activity","description":"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent","sid":"2027390"},{"destination_ip":"52.142.223.178","destination_port":80,"protocol":"TCP","category":"Misc activity","description":"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent","sid":"2027390"},{"destination_ip":"52.142.223.178","destination_port":80,"protocol":"TCP","category":"Misc activity","description":"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent","sid":"2027390"},{"destination_ip":"104.124.157.216","destination_port":80,"protocol":"TCP","category":"Misc activity","description":"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent","sid":"2027390"},{"destination_ip":"52.142.223.178","destination_port":80,"protocol":"TCP","category":"Misc activity","description":"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent","sid":"2027390"},{"destination_ip":"104.124.157.216","destination_port":80,"protocol":"TCP","category":"Misc activity","description":"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent","sid":"2027390"},{"destination_ip":"23.55.103.43","destination_port":80,"protocol":"TCP","category":"Misc activity","description":"ET INFO Microsoft Connection Test","sid":"2031071"}],"version_info":[],"apk_info":null,"apps_info":[{"name":"Access","product":"Microsoft Office 2010","version":"14.0.6024.1000"},{"name":"Acrobat Reader","product":"Adobe Reader","version":"11.0.20.17"},{"name":"Chrome","product":null,"version":null},{"name":"Excel","product":"Microsoft Office 2010","version":"14.0.6024.1000"},{"name":"Firefox","product":null,"version":null},{"name":"Flash","product":"Shockwave Flash","version":"32,0,0,114"},{"name":"Hancom Office Hancell","product":null,"version":null},{"name":"Internet Explorer","product":"Internet Explorer","version":"11.00.16299.15"},{"name":"Java","product":"Java(TM) Platform SE 8","version":"8.0.1610.12"},{"name":"OneNote","product":"Microsoft OneNote","version":"14.0.6022.1000"},{"name":"PowerPoint","product":"Microsoft Office 2010","version":"14.0.6009.1000"},{"name":"Word","product":"Microsoft Office 2010","version":"14.0.6024.1000"}],"architecture":"32 Bit","document":{"author":null,"creator":null,"producer":null,"title":null,"subject":null,"pages":0},"packer":null,"file_imports":[],"osint_tags":[],"osint_references":[],"memory_forensics":[],"language":null,"authentihash":"63efd16b458897405a30e06a083932332a130044a4308fa48d50ca664e6758e0","entrypoint_bytes":null,"pdb_timestamp":null,"pdb_pathway":null,"pdb_guid":null,"file_sections":[{"name":".text","entropy":5.06078365977,"virtual_address":"0x1000","virtual_size":"0x172","raw_size":"0x200","md5":"1acbd0a5c17459edfc58f81275b0972f","characteristics":["IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_READ"]},{"name":".idata","entropy":0,"virtual_address":"0x2000","virtual_size":"0x14","raw_size":"0x200","md5":"bf619eac0cdf3f68d496ea9344137e8b","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_WRITE","IMAGE_SCN_MEM_READ"]}],"file_exports":[],"error":null,"yara_hits":[],"intelligence_mitre_mappings":[],"entrypoint_preview_count":45,"entrypoint_preview_instructions":["cld ","call 0x401095","pushal ","xor edx, edx","mov ebp, esp","mov edx, dword ptr fs:[edx + 0x30]","mov edx, dword ptr [edx + 0xc]","mov edx, dword ptr [edx + 0x14]","xor edi, edi","movzx ecx, word ptr [edx + 0x26]","mov esi, dword ptr [edx + 0x28]","xor eax, eax","lodsb al, byte ptr [esi]","cmp al, 0x61","jl 0x401027","sub al, 0x20","ror edi, 0xd","add edi, eax","dec ecx","jne 0x40101e","push edx","push edi","mov edx, dword ptr [edx + 0x10]","mov eax, dword ptr [edx + 0x3c]","add eax, edx","mov eax, dword ptr [eax + 0x78]","test eax, eax","je 0x40108c","add eax, edx","mov ebx, dword ptr [eax + 0x20]","add ebx, edx","mov ecx, dword ptr [eax + 0x18]","push eax","test ecx, ecx","je 0x40108b","xor edi, edi","dec ecx","mov esi, dword ptr [ebx + ecx*4]","add esi, edx","xor eax, eax","ror edi, 0xd","lodsb al, byte ptr [esi]","add edi, eax","cmp al, ah","jne 0x401057"],"file_resources":[],"file_permissions":[],"file_activities":[],"file_receivers":[],"file_data_directories":[{"name":"IMAGE_DIRECTORY_ENTRY_EXPORT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_IMPORT","virtual_address":"0x2000","virtual_size":"0x14","is_in_section":".idata"},{"name":"IMAGE_DIRECTORY_ENTRY_RESOURCE","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_EXCEPTION","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_SECURITY","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_BASERELOC","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_DEBUG","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_COPYRIGHT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_GLOBALPTR","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_TLS","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_IAT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_RESERVED","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null}],"elf_headers":[],"elf_static_symbols":null,"vba_macros":[],"verdict_source":null,"user_comments":[],"email_headers":null,"classification_tags":[],"tags":[],"submissions":[{"submission_id":"64fd2327cb60c83dfc0bfc11","filename":"output.exe","url":null,"created_at":"2023-09-10T02:00:07+00:00"}],"crowdstrike_ai":{"executable_process_memory_analysis":[],"analysis_related_urls":[]},"warnings":["Not all sources for indicator ID \"api-263\" are available in the report","Not all sources for indicator ID \"registry-177\" are available in the report","Not all sources for indicator ID \"registry-172\" are available in the report","Not all sources for indicator ID \"registry-173\" are available in the report","Enforcing malicious verdict, as a reliable source indicates high confidence"],"report_related_files":{"report_json":{"file_name":"report.json","download_url":"/bff/report/64fd2327cb60c83dfc0bfc10/download/files/report_json","file_size":133542},"memory_strings":{"file_name":"mstrings.zip","download_url":"/bff/report/64fd2327cb60c83dfc0bfc10/download/files/memory_strings","file_size":687},"certificate":null,"network_pcap":{"file_name":"network.pcap","download_url":"/bff/report/64fd2327cb60c83dfc0bfc10/download/files/network_pcap","file_size":156070},"memory_dumps":{"file_name":"memory_dumps_all.zip","download_url":"/bff/report/64fd2327cb60c83dfc0bfc10/download/files/memory_dumps","file_size":168618}},"system_resource_monitor":{"cpu_usage":[{"x":0,"y":17.8848},{"x":1,"y":10.1563},{"x":2,"y":11.2857}],"memory_usage":[{"x":0,"y":28.5889},{"x":1,"y":28.3318},{"x":2,"y":27.9824}],"disk_read":[{"x":0,"y":629515},{"x":1,"y":3276.77},{"x":2,"y":59974.9}],"disk_write":[{"x":0,"y":1880230},{"x":1,"y":302538},{"x":2,"y":263736}],"network_packets":[{"x":0,"y":292.444},{"x":1,"y":141.599},{"x":2,"y":224.707}],"page_file":[{"x":0,"y":719651000},{"x":1,"y":712253000},{"x":2,"y":696492000}]},"external_reports":null,"available_buttons":{"report_false_positive":true},"hashes_to_context_check":["a99222b871adee0178a92831be5917cd131451971b36bf8191a2d7d0429f3997"]}}]]}] 1f:null 23:[["$","title","0",{"children":"Malicious — Falcon Sandbox Report 64fd2327cb60… — Score 100/100 — Sample a99222b871ad… | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sandbox report 64fd2327cb60…. Threat score 100/100. 2 malicious and 3 suspicious behavioral indicators across 32 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a99222b871adee0178a92831be5917cd131451971b36bf8191a2d7d0429f3997/64fd2327cb60c83dfc0bfc10"}],["$","meta","4",{"property":"og:title","content":"Malicious — Falcon Sandbox Report 64fd2327cb60… — Score 100/100 — Sample a99222b871ad… | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sandbox report 64fd2327cb60…. Threat score 100/100. 2 malicious and 3 suspicious behavioral indicators across 32 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a99222b871adee0178a92831be5917cd131451971b36bf8191a2d7d0429f3997/64fd2327cb60c83dfc0bfc10"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious — Falcon Sandbox Report 64fd2327cb60… — Score 100/100 — Sample a99222b871ad… | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sandbox report 64fd2327cb60…. Threat score 100/100. 2 malicious and 3 suspicious behavioral indicators across 32 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]