24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T489,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ser.Zusy.Generic Sample ab958828c486… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ab958828c486…. Malware family: Ser.Zusy.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 12 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","keywords":["Malicious","Ser.Zusy.Generic","malware analysis","sandbox report","threat intelligence","ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ser.Zusy.Generic","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T171a,Found reference to API (Indicator: "LCMapStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenFileMappingW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "SetHandleCount"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "FreeConsole"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapCreate"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin")26:T101e,"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000008dc2c0000000000d8276a000203627700020000880162770000000064de2c00a40162770000000000000000000000015500530045005200330032002e0064006c006c00000000000000000000005b7700005b7700000000cedc2c00d0005b77f0db2c00ccdc2c0018dd2c0095e15c778f3d1900fefffffff5f6607716f86077e81e6600cedc2c00c4dc2c00c4dc2c000100000028dd2c009ef86077626f607764f860774fe855777412d17188dd2c000000000000005b773ff000007412d1710000000000000000e81e6600ccdc2c004199607700000000000052746c44656c (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000064e42d0170e42d0138e62d0192e0906bdd75e360feffffffb8e52d0116bc8f6b1f9bdb8404000000ece42d01b8e52d0120bc8f6b0600000000007a6a010000002fbc8f6b2a000000060000001f9bdb8404000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4e52d01000000008e00000044e62d01feffffffcce52d01cf006177d6006177abd054768e0000004700000044e62d0100000000a0e52d010000000008e62d0195e15c777f331900feffffffd60061772f7b5b75010000005c00b800167b5b75e4e26a0a (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004332)27:T148d,"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\MUI\0409\\mscoreeis.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreeis.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004332)28:T3958,"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00004332) "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004332)29:T8b6,Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_f40_IESQMMUTEX_0_519" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3904" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_f40_IE_EarlyTabStart_0xf20_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_f40_ConnHashTable<3904>_HashTable_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_f40_IESQMMUTEX_0_303" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_f40_IESQMMUTEX_0_331" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\MSIMGSIZECacheMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\https://learn.microsoft.com/" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\InternetExplorerDOMStoreQuota" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_f40_IESQMMUTEX_0_274" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\_!SHMSFTHISTORY!_"2a:T1257,"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "MSCOREE.DLL" at base 6bb30000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "ADVAPI32.DLL" at base 75940000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70a00000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "KERNEL32" at base 77100000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6baa0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "SHLWAPI.DLL" at base 766a0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEIS.DLL" at base 71fb0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "USER32.DLL" at base 767f0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "IMM32.DLL" at base 767b0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "COMCTL32.DLL" at base 71d10000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "USER32" at base 767f0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 742f0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "DWMAPI.DLL" at base 742a0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 768c0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "CRYPTBASE.DLL" at base 753b0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "KERNEL32.DLL" at base 77100000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "CLBCATQ.DLL" at base 77070000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 773c0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "OLEAUT32.DLL" at base 76710000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "SHELL32.DLL" at base 75a50000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "OLE32.DLL" at base 768c0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "PROPSYS.DLL" at base 73fc0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "COMCTL32.DLL" at base 74350000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "APPHELP.DLL" at base 75360000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a7a0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 757b0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 754f0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "URLMON.DLL" at base 757f0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 71fc0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73fc0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 71320000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "IERTUTIL.DLL" at base 76ad0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75a50000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77100000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "SETUPAPI.DLL" at base 77220000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "RPCRT4.DLL" at base 76fc0000 "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 753600002b:T12ec,"logo_net_1_.svg" has type "Unknown"- [targetUID: 00000000-00004332] "index-docs_1_.js" has type "Unknown"- [targetUID: 00000000-00004332] "site_1_.css" has type "Unknown"- [targetUID: 00000000-00004332] "ms.jsll-4.min_1_.js" has type "Unknown"- [targetUID: 00000000-00004332] "7DPJDVUY.htm" has type "HTML document ASCII text with very long lines (56220) with CRLF line terminators"- [targetUID: 00000000-00004332] "application-not-started_1_.htm" has type "Unknown"- [targetUID: 00000000-00004332] "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_ab95882" has type "JavaScript source ASCII text with very long lines (427)"- [targetUID: 00000000-00004332] "wcp-consent_1_.js" has type "Unknown"- [targetUID: 00000000-00004332] "docons.29a7210.c559c2a5_1_.eot" has type "Unknown"- [targetUID: 00000000-00004332] "app-could-not-be-started_1_.png" has type "Unknown"- [targetUID: 00000000-00004332] "app-could-not-be-started-details_1_.png" has type "Unknown"- [targetUID: 00000000-00004332] "imagestore.dat" has type "data"- [targetUID: 00000000-00004332] "repair-tool-no-resolution_1_.png" has type "Unknown"- [targetUID: 00000000-00004332] "en-US.4" has type "data"- [targetUID: 00000000-00004332] "favicon_2_.ico" has type "Unknown"- [targetUID: 00000000-00004332] "~DF270B012EC176C401.TMP" has type "data"- [targetUID: 00000000-00004332] "~DF138B28A738A505FD.TMP" has type "data"- [targetUID: 00000000-00004332] "~DF10CB442571DEFA75.TMP" has type "data"- [targetUID: 00000000-00004332] "repair-tool-recommended-changes_1_.png" has type "Unknown"- [targetUID: 00000000-00004332] "repair-tool-changes-complete_1_.png" has type "Unknown"- [targetUID: 00000000-00004332] "RecoveryStore._03316FB8-AA73-11F1-9178-005056915D79_.dat" has type "Unknown"- [targetUID: 00000000-00004332] "_03316FBA-AA73-11F1-9178-005056915D79_.dat" has type "Unknown"- [targetUID: 00000000-00004332] "_03316FBB-AA73-11F1-9178-005056915D79_.dat" has type "Unknown"- [targetUID: 00000000-00004332] "B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D" has type "data"- [targetUID: 00000000-00004332] "B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92" has type "data"- [targetUID: 00000000-00004332] "B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF" has type "data"- [targetUID: 00000000-00004332] "PU7H520E.txt" has type "ASCII text with very long lines (592)"- [targetUID: 00000000-00004332] "VNEAIGKR.txt" has type "ASCII text with very long lines (580)"- [targetUID: 00000000-00004332] "RQ5BT6P0.txt" has type "ASCII text with very long lines (476)"- [targetUID: 00000000-00004332] "PDEVV2M0.txt" has type "ASCII text with very long lines (431)"- [targetUID: 00000000-00004332] "VJ9WWLND.txt" has type "ASCII text with very long lines (476)"- [targetUID: 00000000-00004332] "892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6" has type "data"- [targetUID: 00000000-00004332] "J4TYF5NW.txt" has type "ASCII text with very long lines (476)"- [targetUID: 00000000-00004332] "VG964DGY.txt" has type "ASCII text with very long lines (476)"- [targetUID: 00000000-00004332] "095LWXZD.txt" has type "ASCII text with very long lines (480)"- [targetUID: 00000000-00004332] "12RW769E.txt" has type "ASCII text with very long lines (476)"- [targetUID: 00000000-00004332] "LZ125SVT.txt" has type "ASCII text with very long lines (480)"- [targetUID: 00000000-00004332] "ODXRJHBZ.txt" has type "ASCII text with very long lines (476)"- [targetUID: 00000000-00004332] "YK3T3OZF.txt" has type "ASCII text with very long lines (480)"- [targetUID: 00000000-00004332] "V82SKCXK.txt" has type "ASCII text with very long lines (476)"- [targetUID: 00000000-00004332] "J3XY0WYI.txt" has type "ASCII text with very long lines (480)"- [targetUID: 00000000-00004332] "RB1OPCJW.txt" has type "ASCII text"- [targetUID: 00000000-00004332] "5MRFPP7Z.txt" has type "ASCII text with very long lines (428)"- [targetUID: 00000000-00004332] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959" has type "data"- [targetUID: 00000000-00004332] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F" has type "data"- [targetUID: 00000000-00004332] "26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD" has type "data"- [targetUID: 00000000-00004332] "7JZ6P7KH.txt" has type "ASCII text"- [targetUID: 00000000-00004332] "BHWPZLGZ.txt" has type "ASCII text"- [targetUID: 00000000-00004332] "SLVA7KNQ.txt" has type "ASCII text"- [targetUID: 00000000-00004332] "OKAV03YS.txt" has type "ASCII text"- [targetUID: 00000000-00004332] "learn.microsoft_1_.xml" has type "Unknown"- [targetUID: 00000000-00004332] "15GGFZY2.txt" has type "ASCII text"- [targetUID: 00000000-00004332]2c:Tb41,"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: ""; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: ""; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: ""; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: ""; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: ""; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\FONTLINK\SYSTEMLINK"; Key: ""; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0"; Key: ""; Value: "")2d:Tf87,"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ERRORDIALOG"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "FOD"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "AB958828C4863D416659A6009DBD9E7BF7A87DE51DF206689178EF70BD6B6424"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0"; Key: "DISABLE"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0"; Key: "DATAFILEPATH"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE1"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE2"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE3"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE4"; Value: "") "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE5"; Value: "")2e:Tcfe,"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\FLTLIB.DLL" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\MSVCP140.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\VCRUNTIME140.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\ucrtbase.DLL" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to touch file "C:\api-ms-win-crt-heap-l1-1-0.dll"2f:Tcf7,"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\FLTLIB.DLL" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\MSVCP140.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\ucrtbase.DLL" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"30:T621,Found requests in header "GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: js.monitor.azure.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /fwlink/?linkid=859328&locale=en-us&market=us HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: go.microsoft.comDNT: 1Connection: Keep-AliveCookie: ak_bmsc=E0E8D4B82185FE9D58C25C502CE6423C~000000000000000000000000000000~YAAQhlHDF/p5DEugAQAAWM0VegE03XNNBzfebsTFcGrUzdQTryAkstPb4e/PZeCWJ+CC3Dz83WsehOiK2z9tREB2wv/adZtGjHsddJfUyq7l3s4qGVi18lILJdMS+Pbn/DzWbbLwYJYOvLdwJJNPLQWZA3V2qdloFaKDdbmYUhho3el2XBVgO5te/kosa9aZhat714oSKtf7ZkvdTp3tY8tY8hRFSWI6MLeSfUarDZnuy7xh3HO6Pm5MWXSDCqXgLBxn+x/iWxvDcXButgP97xBYFPfjJCkJXBA3eDZ4wx+L2PnrTf6Fn7DegHhOt5pChkFF698WudiRQss0lBA6J0YGYJTcCA5k3YhA47maiRd8oiYbTWvBzCGt0FwXM5ZFKJ3rvi7DSqXKG1ZK6JZj2UuUhCUq; MUID=16D2234D6CFD627103FB34806DC26386; _EDGE_S=F=1&SID=3A97A5C24B8C68931956B20F4AB36980; _EDGE_V=1; SRCHD=AF=NOFORM; SRCHUID=V=2&GUID=A4BF8A5F3EFB43709FE05FA4B302B0F8&dmnchg=1; SRCHUSR=DOB=20260907; SRCHHPGUSR=SRCHLANG=en; _SS=SID=3A97A5C24B8C68931956B20F4AB36980"; in File: "SSL")31:T21d65,"GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: js.monitor.azure.comDNT: 1Connection: Keep-Alive" "K�\��r3�#N�A~��mH�WV�u��ji��v7��۞v��Zш��5�Ѡ?��"<��ghӿ��n�C\�� P��Be0ṉ+�xkl��y�r�^�G�c��zaN�oޜ��n��[��1�Y"i��*�{�r��U��U��~��c-|�n��_F^E�j;�-�,S�P�`O�3CZ��c�5�|-��zZk6v^ճX�ml�J�6��A��`��6�5ؚţ��4d��V^D��2��^��@;��P5�Զ��]L+ X�\��!3j��(�H!0��kuAޮ�7�-*�lɈm�B�|#�_�gA��i�,k�푎wb�z�Hmؗ_�E{��זO+��:˷�b��Q�:��p�e��#u8Bx��2.��~9�F�E62W�#��Ϻ]%'��7�D��8a,.i6nNK�Λ򡣶<�t4p��;~}�E\��s�,"WØC��b� Wr�Z�+�Bט>�+LWFGC��9��r�#F�P}�{�:�0��X��l5�H�G��\P�Q��8JR�G�?O{N��e��'@Ux�5�*�8N�S_��`u~�K�$�2��}��zVY��+��ͱi�Nu�v!<䜕�۶�q=��z��f�;0º�4�g��<�-+~��;��E�ʛQ�N܃��<��l˽��.Օ�U[�x�Gs��e�qμ�Q�.�K��u�W+�Ob��r�/��d��{�]�]u�cR�r䷭�6��Q`��a|q�rw�S8�爐l.�ة�.>8߲��]oc\u�*�o��Ⱥ�w��7Qo�r#�C�ǡv�#k�EP�"J��<��#�SU��Q�|��Ep1��zwD�{��a�!�4�p�Jɀ�j�Y@��=�K�rZۊb&�#Q��JX��~�[�0�4-r�E3z��g�,�)��0�$X��4��vu�.�|��;��b�m��l��J��O�Ćfo�Պ�pW�A�9��Dty��a\#>��/MA�8Xں^��W�~,��D�g�σ'��m��d7��K��.��$��:K��Ї��_��s�B�#��jyY� ��Z�Lb6dJ0�.��'��on�*��s�+;w��C�8lglr��j0��#ɝ�mCDG�z��z%��e��H��l�7�N��E&"�4�.E�٘��]��P��N��/��Fsŷb~��^D�F3�[`G¾��?��Y�ў��w��+��"�_ӫ��"Ѥ�C��k|�1�V�*��Ok��O�@��Z��n\ntA��^3lqxq;c#g?�1��v��\r-r��]Z5��z@�M�K��Ǝ��v�YYY��N��ؕ,gǴ��>`�_�%�)��}��Ųi@�2z5�f�͡a�UIv@`p<\��{��,��m��f�|�U��;��uzsJ<��8��fugU��@�9�wS��[��x��q#�0��2#�6�L��g��¼��pð�U�h�R��_/��z{n�,t��a��>�x��o�c�r�z��kt��x�2B_y��ᐝ��` ��5bJ��H#�Ʋ��Sa�{��{��b�7�1�{ng�$�{/��*��qZIP&��uD��e�Vy^��c��WL]�?��0B�n��.lm#��_��,i�82�LƠ�C$$�If<�x�-��Ȳ��~��[j�"��9�d��7��=��q��f��GӦ��^`��v��`��0"��D}�="�ak��K�ЇU�`7+h��ӚΦ�집�sL��Q,��+�]"��j�9�q��>Ÿ��k��2j&:݇<��2>�'T��HR��ͯ__��m�0��g��?�t�|�;��*��Fh�@�VF�L��M�"MB�j��DmnX�n��n��FG3�S��{2�N��S��V��K80d��^�Ν��mc�I��ߣf�q�h }<��t��:��dt�C�S��!��dT��>y��{b�4�<ȳY�Ú�j�DqX��٦C:�e*�+��lZq*��%0ؕc�%�7��Z$'-��bCV�:`��v��RP�C�H;wc�H�e��![@��U��L#x&5��r<��*�V�d��~T��O��<6�Lhf�ᨇ_��=;�f�{�-j�"Z��*n"4A7�z�7��0�3.��~�e:>J"��@A�M*�!�t(3��)tW��9��e��i�ԇDqP��Ýa�S��g�b�l¯�'�@~�ۯmqx��70��e��K��O�ջq��x;��W��Y�H�i|UTYA��HI��+��gh�0�Mp�Mp)��5�$��~ � ��7��&��^��Uzl��m�[��fl/h�1��z��]z-q��e��-�%��z�ܞ�Yp�]w��1�i*��;��6mmhF�M�^.�f��2p�v�|�#�b\��O��H��`.(�pz�xG�Ŷ�-(#��7B��J+�5��'O��`9#��{x��aG°#4�v�;z�h��6��^HI醎P��3L:�O�$j��hkkT�+6[=6� H)�=(�{�w��@H$D%i0��kP�I�mnt��O��Iv��:ыz��C�ŷ&hʫɅ_Y-|��6�#�+�owA1�l�{6,��ès�>�� =��Ò��__?�_F@Fa�1ޜ#��j@Xh~��k1c>�#��[[c��ѱ�v��N��*��XZ��l'+��N�4j��5�&��m��i��P�9\.��%��r��d��1�9r��h�?�1�8%��݂"��`�ca��i3!T�^�̏!Pu6��̓��r��餚.��@\Ĺ#8�x��Ҙ��i�@1Q�u]�B�Zi��@��(-�&>ͰxB��n�Y�.��^0��OU^�0�e+� �`��SI7�l͸]ޚh�q��h��S�Q٠�K�̵��L��F��R�SU��d,̂YPUp�̰�c��=��3�6Ý�E��9�:[0^�u`��J|&D�}2r��8\�tKY�e��Lܕx_$d�c�\�7i][6uQ+��C��p�Vn_zE��#�^�c��x��v��@6��N��Y��GYŰm7:��l�p�ѐi��:��^�&�~pR�V�z�n�کyhw1�W��k�whh ��l=W��7�$2�5��RV��Zqy/�c��J��#LYTQ��J�n�4��;��.��>�)[�5��w��X��>Z��N��Ҩ�U۟��qZ9b.��P�R��c��#�k�E��w�Ի"u*O��mB.רQ9ڇN�l"��Jw�Nۏ��H�XȄ!G3��l7�<�2$5m{��g�$��Ean�Y��2�s��E�"��L9r`��`�U��C�5/��~rБ\��׊�z7p��GY�v�4��?�̏��(��#�<��Ş��S}p~��|0oT��5X��Sp''��U�{>f��?��c}��l�+ӓ]��sQ��ο��cm��k)�,݁�`��u��l~��ϥ�0]��Wiqঝ��v�9��)ߙaA3bN��U&��C|�'�E��ӛ��Ɇ��h[��y��y&0 ��(��kU�J��ܳ�_�>�;�U�0F��SU�9��O��Q�p*'�(��f��晭i��o��e�U��%�f�[��jHO�ќ{�c)��hw�_��"vmb�(�M�Ք�sEޕ��F��T�ܐ[nc�K-ɛ �6�y�Սm+�o��{g�=��\��L}a&3��T��O��^�&�L��rZF��Z�Ӕ9"]�Y��㩎b�(gBX�Bݰww��ʻ�n�>�H�T|G+E^6�O��\ڈ�n��05�3`��xc/-ԧ�u?{NK�6z��c��tv�O�9��"��s�mЪr'vk�;��G��Q�8Զ�B��e}9=y��%xs��$�l)��t�R�-ﶵ߅f"N��y��ݍ��z��ҪX��,�� @��)�8�7\�bD4+�K>�;;�BuF�d��u��KƜ�J��LTӛ��`L�t=�'a�ջ��a��}��~{�z��#�un��ϒ�V�Q�>�Jюj��e�7��A�_W"�=f�CG�/~�iV#�Y�D�ر*F��cڕ��{�[z� {��$x�Y~��h�c��ݥ)�h�{��cw�i�;~��^�� n��B�|-SA�p��O�ڍ��hY��1��4�ݟ?0�+]�e�<>h�F��'|�|lC��6��s_I��@��IV�'�`�Y��/|�sC��\4��ڿ��.��Ra��Q�3d̍�F?4F��^ma��hD��L3B)Ւ_��x��E��rv��r�%0sv�3-%!Kh*��g��f��J��ױbV��&�~�֥�g�IR"@�Á��L�1��X��'��_�W�?�qH��f��p��xB�۳Xq��p��m>��)��w��Kgol��vW��IRR�a�"��.��4O��Bal��R;��#��8�B�9(6��q;ee��+��̥��*�$��4��(��:�Ci�?�Zb�/L!ֹ zM��-��=>x��3⽡G��P'/��2K��,q��7,qM�^B�/�'��Zώ�%��D&�;Sr\K|��e�y�kL�g��Lmޢs��^4��R|�e�`o[�{�v%��A0��sj��zb��-�Q��n�W��ł�P�g�j��8E��w1��cyo�x|��Y�U��9M�'ʠC��R�5X�-��B��z�%�E��,��!_`�l�o�y�h�{z�N�y3_)��2��E=��=��U��(��R�IԖ%��,��wrA��K��Jb�Ių�+Vr�?�O�c��9��,��{e�g>�١&�'x�,,��;�OQ:r7��`��K�!�}C��h4��tꇬ��h�K��u�::�!�p��̔��0��#�-��FC��h�w��зR��|�qZ��,Z��E�G6L��c�h/h_��K=|�u�,]M�Jc�l͠<��1J��Fo�M�� (/ѡ�C/h�;��;��S�żSA�$�q�)@QE�� >�l!��T��ڏ~n��Fۗ�w�8}��G��7~h6n�C��㞰.?mb��PJI��Vڌ ��ʶl%�sDr��K1z��S1z/��F��aN��"�zQIbbS�|��:N-��MRYh�whM�m��N�B�x��f�;��P��S)e�Epw�{��T��y��^\��F��6��Y�T�jg�Dڲ�/�8^�v�� `.��$��d�_�J��pkq3�i��E�3� ��Z�H�M�^HckSEB�3��SveV��x im�<�M|��2�"��_��$��xt�k!�(�?T2u��s��M=�c��b��-�_�~�p7`��oy��IE��aԓ��u��Q'�[f/��^��k<].9�OTlNL~kvl3�0��y)�Yq�$0ɮ�\��֜)��8znu\[D��Ia�8�KW^��v�F��U�� |V��Ԛ�Y�s��S�UT��I�d8p�M]�C�>!m�7)WT�iI��A�Di39�u3��ШN3'k�"Gj��j%�J�~m4�H��v�6}��+K�B�W͸N�\�vʊ''bg6�M��K��MFF�["�A�@@�%�1��Y;�֏"j��X��E�t�X�F��]@Pu\X;9��&��d��C�3�m�`�&�b�>�uQn՗�pA׫q=E�,نg��4��M��Ȓz�Z��l�t�,�p�X��p�P@�_;:vVK��nS�:Z�*駻2A�O-B�\�lY�ټ}L�S�<��i��k�nt�PLG�몧<��/]�Y�K��B=;��;�s��<[��Cv�@+��o�lak��)d�l�0�>�hV+E��gv��O�H׬��]_��1�f_z9��:�ox@�XV!�bkl��V[�p�Νs�e�ЅHQ�ԟ�M�0��y��/@��fɄ��gɈ.�-��L��KM/ݹ��i:��0�}ܳ8�7=�9��|��E_>]�G�4*��މ��8�Ĉh�@��r+��wq&>�q*��'�V�G⛸_�g�^�_�;��S�"�M��9�F�l ��e��4�>�b<��5`��{��PŨj��=��؉��!��%l�1��E�]��a)�J�8��B϶��G��c#��_s�kh�jUk�^�Z�t�!��8�Õ�E%�h�n��/�A�nܥ�{��ݕ!��M�/�w$�J슪��mڷ�R&�焙��|�H&��X��oi:>)}��sķ+��#��/��O�,-��2��xｯ��WTrĦM{x��{�w�z'r�V�H�(s�l��,�´�q4Uȏ�HQ�Va��՘�n��=��(��)3q74KL�"g�GPg͞��G�� E��y��)�'�)��O�A@sӧ�� v�ːI��]�>�f7(��S#"�ᕟPd��#�2��ӕ�FT��-�0��.�w-`�S��b�aǔ?X��b�+��i�ͻ�U�G�Yu��¸�h/��#g!d��SV1z)��}g��a��9�U��~Y��em�ҡWqo��մ,'ۄJ�Iayӂ��O��$��d��$��wt��a�+}�D-�X�|��Վa58�eJ��럙dS�!r_��p_$��!tp&��|�D�&j�*��H��Y��uBTfW��e�RP�DK�x�ܷg��۟i8p��L*��[P�-��"�� 6�LLF�^�3�A}8�޿�|kAs��N��/�?7��.��4�<0!�ęGL��(��[Da%�7��vm�W��X~:ah�!_C��;�o�K� ��j��Eݸ\}1}�zF�k{��{^��=��jpn1�B��#�M��(��A��f�R��GJfTi�zy�~J��Fl��pPL@z�zh=�[�0�f��s;��Y��ȜQ�|��3��Y�LSۚ[Q��H��FqZ�e�p�5ņ�Qm�Z[��*pK!P��ϐAmi��踮�DQ��n�J�V�#X��φ��`��;�io��r��>�z�-f�JЎx�FCN�� ;M��T3a�ݜ��)�o��0Q"�0Q%�e�ʻ�@��%��K4�nh#�㩼�Q9��{^9OC�Uِ�e��Z��6}v� };ee�r�y"9�£0�4�px�ڬ@Tb�5�� l��2�~d;�<�uZ��>s�uУR�x�x��E�Tw�wBm_��2�S�˅�FWkk�5�H�nÂ��0犍��tW�yR��;�ע�d:�j��^ʼd�l�J�k�-��b��du|��K��A*܇X�Pڭ�f��1�l�~{&��>2k�X �H��/ܟ��p� ��?9�5��}WԔ�CFVgg��벗�m�C7۩g��yan��z��tGS��)Gq?�$B]J)��>�8��u��VR+ �ɵ�!-C��m$��np�u]猆=D~*�&��A-��X�I�4uF��#-�C+�� (og�xN��4��w��pJ��ɪ��ۏ�t��i�c��S��t�G��[/��'ᠬ�z�J�� z��K��/��y��)�!C��=�C+l~J_��=l��t$�X_��67��-H�SЅ۹��E|��wCmO"D�O�_��?�~��|�1?��k��p��r��<�{�vʼ�<8"��)�U�@b�3(s�8F��ǁ+�O~�]��*��D ��?�ꀼ��ڟ�5��=[��1��ܴX��.��舝0��z��>�}��Y�"L��I�!5)�?�9��K��8�SB��:��O��]��R�I$;J'��#Xv��II�C��)�3��$��&?�y��P&�PVO5��e2@�5=��gl�ri~�f�o�-�c�g�So��՛��p�\��Z�=G��}"�d�N|��bN�K%��PZ�B_t̀�3�P-M��.��d�\��I�3uv%��q��U�6PZ߾�`�$��*��Χ�q�!0>�ﷶ$�݅��׀6��,>��W�t��R�}J�i�*�~��cfG^�C�Ժh0�Q$�Js:2^��n�P��|�.~F��X��A�%8�S�b�3sHoh!V=Sa��A13��>�9G��Y��33�=�"�g��rq.�� Aw�v�L��r�`5TB:�^+�<(5�Ėx_i@�R8%C�/kg��(��Ä��y;��߈��ҞS�y9�8w�\8�t�hqL��w�t9|�?ߤ�Ӹ��t��{��=�\?�2c$��)��p��j��0{��}�{;�K�k��AP��d,�r�OV2A�6-L�wO~��ٸ�Ӑ�A�/��a�y��2P.RD�{��uD��6D0�>T��8V�Cm��:�vi�੄��z��G��~��!��D8��Q�LF��.��ưP��(�Tx��,I(�n�r�f%/�澬��p�yX��M�LI@~��RUw2[nV�Dq�v�SW��bո��/5Te�K�xk��ּ&^I�E��#%��xsݛ��w�ܗ��o$��#|�3>��y%��2T�O�0)ة��`�y��%wh7�6��"�n�ͻ�qR��=�WC�i7��Z��{e(j�*��?��O�uaP�Jk�`@��ŏ�hT��"\[b�A��م��JD��B�Y�¦=2��=2��$��jdA��_ͻu��z?��M��fl��K�]��V,Z�a�9�L#y�cq�Q.%��Ь@��ճ��ji��S��=�q��ƵRP��G��y#�Y?�K� $f�m�s��Y�0��`�G��**Q|�.��y@A��B�q��#y]��s�R�^��۞%�~�g�J�B.�^��=��r��|*�!�F�o5��di��Y鞈�i5��+�j�E$^ʥ��̓�7C�X��^��T�2a�C�wV�%4@Nњ��$/d�Z�p̙Dװ��P#8�@(�d��Ty��3�_'�t��]��P�a��Β�#�:�e��f[��𝕚+5"t�ŕ+@��17�5��KD�-�7i��cl˻�uO��W��[�}eUXÞ��q��A{t�|D�N��a<��Ҿ�L��催Q1Ne�Fgw�D��IZ�[�i��b�'�A�O��͆l�S�&>��Ƹ&pv�p��G��&�Yܴ_��7��f�{o�!؟��o��;WjM��B$��N�J@K_��!��2/��>��&�<(G1��D�x�x�i��5n~q:l��^��u��7��We>�Q�Ώ2�gޚ1F��'WJ��ƫ�k#x�o�+��]��M�J��j]�("PM;�>�K�n��H��5*j�*5��y��J?&�߷�2ꍋ��i�:��q�j��@[mJ��bM+~(nFbT��&c�>�!ȡ'�Ĺ{G[[G��e@��A��}��͉�;�>0��$~n1�m��c8"�b��y��3h��n@G(�T �tqۛ��mk+��o��x��1Z�kCD�]{޳]*�l�| y�1��(|�+DaME4mE5�}�L�G��g�Nh̨�e��lnB��z�V��aj�2��@��|V+�IM>:k�>��ȋv�QFr�z�0�h��*T��mFoC]��6&��L�T�D�r|G�׍.�͟A��9�7*úh{{��&Iq��VB��+��f@�ի�(�4�Qy`�;SHt"��=�3�IJ�LB�J-R�+�3�I�:s��dΫ��?^�/�S$�:��><::�x�l7^��)��a��/�7�k8j��Ց�ebFW��г�d�)�KZ6�U��>��@��nF��Ȍ�x�#��X��Y%0W��J�b%�ċ�`��פ�~��(7t�2ظ��7�|�zL��{sLS��1@Gn,�L��T���?Y�C�Z;�,��T��vm��)8�j�\an�\��nSJ�+��NQ��6ڡ8�lϼz�s|��@�̿�R~�R��}��(�Ζ)Y�k�+��g_W��?P L��7ۤ��W��pV�#��^�[qށ*JA֛��N�:�1�n�ފ��@��B6��|��"��k��ŴJ��ɴq�c!y�{��S�?*��e�?Ζd\>��I��Q�ydw�p{��7��n�E�hK��b%ϻ��V-�x�-3��Y�z2|"��y8��lz[�p�x(ñN^.A]-t��*��ʞy1��+�+r+&��S�Tl��Rڟ�7bPǹSm�o��#�UR��LZU�bL�]��;su�S�<��r�tN!�N�MGr��+ۿ�-y�6{򬯻��Wŋ�ٲ$Q�� ?i��-5��V��A"�OhF+�k�6��bU�V��cX��"�0ݧ�z>a��H@Q$�S*T�A�h�)_��Y-�["�۵,��I��A��ˤ$��e��'_g��}��̹��@r9�"\�5N��Iݽ�=/�a��T��qX�`��P�FG�v.[�xxx�T��&a��=^OV��G�©!�KK�vY��Ǟ)�jw4��F�k۬��i1�A�so��ǐLQ�-7^��1E�+XQ�2.މ�8��X�P�\YK�'��%P��<'2��F�ل��Vu�Ć榔�3�B(0�h�Y��1�P�a�;�n�;nk�}ɋD��ө�.��+pa��ͥ�p��Ӝ,��?^�L�;��zC��F�Vp��@@X<3��[��x&��؎+bF�]��3�f��Q�W��s-��_(��f�T8GC1y��,�m�E��b6ۮ�Θ;Bzt�Ć�z�Fɗ�VpꎰXtA��Nz*,�Q��Ʉ�qJ8��axrѻ��n)�8Ju#�K��Q�U�崗ԭ�K'�L�]X��x֓��w�Χ2=O��x�!�2�C��p��1�)aJ#�<"�HE��q��OH��<&��|��F�!�H%o��<�2v��O�7�7 �kʝ��(�81`�7�;�v�r��+&qO?sO�(]c��q6T"��#'�j��TΘ�3V�N*��p��'y|�2�6�f��B��:��y%�(݇��!*�#�VՋi��;ngO.|�Yn+{÷�F�`ʭ�\��s��䴩T�<�;�ގ�\��ϴ��gU��?��)w��!��q�hW�?q�q�I��*��c$��a3A��M��T��T��6x�aO�j��kn&}�^��%u�j�5Tɦ<��Gn8��t��]�n��a�gH��ݒE��G(͠��2��;J%>�Yt�y:�3�:�h��ڄ��D4��C�#�:P�R��8�'8��D�^*w��(�Rn� S4v�\�(��h��_��f��cV��]5�$�R<��I/G��{c*�Y/�c�d@��9�.e�?cC&k�x��"Mzq��S�8�.�� ڻO�1�(�)9��0NM��Y��Q�S�S��g��V��9�#��" {�$q��'��k�!�Vl��h�qб��DyZ��ᤈ0��㬶*��N7�G�[E�*2�l=l��3�X�;C��Y�ۅM\0G��b��mo��z7#`�d��rg�u`��|s!R��3�^�X�z�B�^ϛ�_Bxr�%o3a0��]ay�-�pw�X�WZ�d܌��«Fso��tˇ�(��Η|��Y�,.�qt4�9��1��b�3ҿ8m(�P7bk�Nf�e��m6�ڪ`LF��,x��xa]E*3�48�nC�POx��꽸�b7�Y�ɹ��~4|ы[qKД!��i&�AϞ�R5�B��a��5�Y�q�}�� Aa7�@g?܍��tzK_(�Ə+�S�'��¥��[��8تԇd�3vN��܇1��"�+㰰�s��+��/oku��+��V%�6�Q��h��zo��d�漏#�C�J�ݳ�1�(��u�'��em��Yt�p��f�]�o�8UO�'��۲\�5#�:��5;йA30sWm>h>��"rI�Ow�'��䏗�'~2ޕ��o�>6��O'C��ӿ{��]|��~7��x:\��F<ݸC{�g�N��2��Y��n�5��(�f7�(�-{�M�G�6�v~�Φ�r@G*��~�.�n��I��=�|�'Q/��R��M�S�~��"��o��?��n>A:#�t��?H�.��+q�z�덦��̋�K��)�©�$��ߝ��O�ޠr�6\k%�6��Nͱ�q�~�R�)Ei�X��*�xڴ>˅�8�lR��B��K#��ɴ2��]�$5��/gAg��p�fP'c�8��?6d[�~נ�#�*�T��&H��z��W�.Lc��̽P/2+"��ˌ��:@{�Oi�]l|�Vft�0#�p��V��ӚEd顛G;M[�n"?�u��4�]C��77Fp��i�i�H��$��hr|��'�m��E�R@6�ډ�7�'3(:�E�C4�XL�`|�c��ް�p\�Du��sNƋe1�'�vC�O��>�b��Q��T��p��x�B�<�:�urm�%�T��tk˘^z/��5,�8G�+#��!0��6�·K�$;kES��m9.��?7ZV��1��$�5�=��.O��v��*�H!�w��"��'0�oFƘ��M��F�]�n��(��;��;��u�f��+�ԓk�C1z);�g�c\�1\_��P��J�d�ٓ��O�v�XmB&|V�yM�4�&�4��y�\�GJ&��ߺ�}�a�Mf�M#�#�1�K�y��w|#�ǯ��ɻ�A��t5�K��=G��:R�%��*&gl�q�,J��dt�%2�F��<6�ҟѲ��M 8�P��,�3aa5��%��w��<��6˪��=i�G�`�K��>�%��~ŕ]�)�P��.G9=Q".qF+�Q3.��ͧ�yDnJ��K�x��2��j*�c��r�#Ȫ+�,��w�#��Ic�|tm_`��rN7z˛Gs�D`��K��s�\v��)$�I+6"��N^��6ٙ�t��gwT��hM�b�;k��52�\<�D]Z��8��a��DF��N��G8r΄__f�1x�uBݙ/��)w3�G��3��ʟ�;P-�.�_�â.G��/qo�}�f\{�g2��>_��UV�D6��6�lkk��1*6�?(�n=Y�(K�N+:5��:��#��Ρ=bGض�;}J`U��t�*��Fe�n��Y�rE��K�a�S޹��F��^,�DVw-��r��w֪M��xr��*��?{�>+V��l,EBss��>I�G�#S0��n�N��4��&%��迥��ހn�'�x��7��zC@��"�|�)3~w�Y��ʦf��<�I9�V<�2��EeJ��ԣʸLظ�sN/�u:�7�R�h��g�u��$��3ni�_��Hf毫�8�l�$��N�X�d��(ب��m��\3j��M3l� ��k�&15h~|�\�%s��}5�._�;�t�Q�'dt?s�؉8+5A�z'&s�ks1��A��]�� J�h0�3��E\E?� ~��K駋��9:��/bFy��/�2�2��#�X��AͰ�3��e�J�i��ӝb��,;\�F�a��s�򩐱�A�G�,��D��{*��*Y�!�r��`�k�o�"��@wa̮�dW}��Y}J&e1�?��R��ïkF|�m��)"馔�J=��N��=[MJ|�V&X�o�'k��vE�Oy@U�y�'/�~B0V��'D��i~r��Tf�d.8�q��B2o�ŵ*��{��Û�c@'��3��y1��=��T$K�#2nf*�y�܌%Q��Ӕ#Jg��x�I��ԂQ7�$Fk5Y�a�t�wxڡV��d6�Г/�a�M��:�{�#4�6�g��k��F5$��f^��RJ��3�J� �S�>��l��3��A�辱�-)�>uZQ��!�8u+d�.[�q�g�Cpce��ٙHt7��uy��N��V).f�T�G��SU��|�2��<}�L&��Z��j��!�-Y��ϸ�`��t:b�6a��T�H�EGI��r��-cH^�n��N�&��H�EB��p��MA.ձ�"v|�6Q-�"?m��'�y�ޕ^Q*�c~q�;B�h^�u�u��S��࿿�ߗ��w��;�Y�4\��?\v*V�G��X��0�Վy�7�� o�懅�7��ٖ��rLE�H˛SYAO��~�t��m�cY��x�Y��þ�U65V�'�(%�L�z��b8�b&�ҁq�8�7��GXc!aumN��cc�i"��q��A<�0m�L��;/0��C$2|��ػ#��'��η��P�}c�ژΈ�+�}�,��3��|@��~�Ey~��"��=�W,�a�~��Fk�]z�v,��S ��4r��w0p��֦��е��jN�#u�a_�yO?,�]v�j��]x�}<��rW�"/m��F>('_��s0��2�m�p�؋��P�c�a�(��3q?@ŔC�)��|hʑ�LK��>�7��b��3��=��)<79Ⓔ��QH�O:��yG��CY��Iiٷw��;O��'�L��'?��~┧Hɐ|9�I5��]~��دFϦ?��s��Þ��yQ�/z�?o�x�7I��(r��?E2�h��c?��o�KasC�F~t�+��鞛,�=�v��ǲ�a�m��~��_Q�W�6(w��x//��h��||��?��ȃ�O��Ǭ!)��y;t��Yԕ�F��&��vN?�밨�P�/��?��+�*|yT��l]>k�(��%̫�^��Rzz��M��E�kvK9�ԛ>�O��k��/WP�=�Q�u��o޼g��Yޓȋ��}+�޵��D��p/ր�!�K1�C��_`��b#�~+�G鷈YJ��%b�p&ߴ!ZϢA�)�@�5��](��%R��i7�~(ᛳ�&��ib��B�\��,�+�qq\��FGy}�Wֹ)׹�:�򯬲(WYp�#T��k��P��r�1�k��$��E��q��\~�x.��ۏ<��t��cO�˞ޓ��~��!\��i�k/�KC� U�:~T�6ЕBz~��ʅ��Y�ɯ�b;�;��U�d��Oa��-V��T��p��-�ʐQ�hI3s��R�q6]+ϻH�M�K�VH��:�*ᅷ�"ߒ�W�cCa��X�\��eM��n�U��R�꽶bmJ��)0�.�qUH��P43��&��ңfb��N��/׳�p�"{�$��\x_%#KD�.��<=�7q�aCzѶ�§ec,b�!��L��[�K�]��ҋ&x-1⬄��)��w�8I�wW��D��<�L�mG��҆�� FVi>f��f�%��{��ڀ�D\�lg��D�˖X�|�\g�J�G��2�oq��߱��v�SpY�>�~^��2]�R�0�n�cT��W��x�\��b4�k*�]vQCy�XO��Z��5M��wyv[�W�7��h�F�AN��g9��l�N��%��E��>�i:�c�A:��҄��j4��A��~w�y��^ɢ�F�Q�S*'�rE9�f�{;hK|R�j4*�F��K�q,�JM��D�Z�uZI�]�7��T�˘H��<��n*��ra��K�1C#��X��-�3k�,�5f;M��]�`u)'��&��?2tc�;�h��Z��a��x�Gs�C/��r4K��#iN��8�8��rz�z��F8N:f��6�T<��N�%�{�Q�N�B�q��wӺ%��9��_)�@�S�/�Кo��n��0pCn��#00U�G�'�ŕ��}��'�mH�Ҕ��)؈�I��YB�2��ۧ>��ؽ�I�.�Qz^Ӱ�>�^n�`��^��/��xn}{XMQ��o6t�}�I��!��<�-�F}AB��♰rTqê�5k��_V-�Y�C�.��)¡�BX^J��]�֯��Q|ô��O�vD��¨G݆��A�+ֻ�L�｀�g�A<�Q��dᵟ NԴ��O:��'�$��'��n��TwWK��=�D��u�^��}�P��'��ʹO,0��Cڗ��w��r��0WB)��\�%:�4��3RJL�'e�S��4��XK�.&��WH�q��19�=�}�p�.�C]a�9z��zO��yNŤ�a=9m��+��~��>X�\��m�!�9�A�{�M��!��!]��[�9\�j�?��:�^h�>��Mm�Oa��)U7�ט��鲐Ƚ�!.��R�cq-.��}�A��:U��*�z�&T/t�qjǅ؜f�V9<��ӱ��OB�v�y��%;n��-Ѓӿ��,��k��y(z�s�^yo�O޹��]k+�3!#��=�y�3��yG��w$�x��t��x_��ׯ��_�,��Wy�]��e�q��'�ro��=�K5C�]+B��=�lpF8u��qY멕6�T�3�9�,6�qd��QW?�{��]��zJE�8�IZO�L°B�[�=�Jd�n�PX-��X=��I�m��}o��\�;�N��V��U�Ђ��iq�Cv�j��΢��f�гۊvЅ^��rB��I3"��l<�x��҈6Ct��ٓ>!FЁ�'N넕�l�I�į$\Ї9>SZ��s�e��sSNٖമ�ۄ{��M�m��m��i��Jh�a�Y�F�`d�w/Is��t��s�}��Tښ��>w�Uͺdãe�o��^=��d�g�O��\g��<ˡO˶8F��q`X��J��mA�C��V��prc��^�d�ir�#��S��Sj�P�d{��rT�N��k��[�;5I�!_^��qv��*<��zl��1~'�xۯ߫k��ڇ4^�TG��x�=AܘqǘA+݇��y�ŘllUr��.{��>��H�6�C��c�Bۂ�Z&�0�@�=:Qވ,�0�Z7Ҥˈٽ��3�x��H;]��Np�%∰ ��>\Q`iN�_1��\4z�ˣ��@lf@X��,�u��[Dd�Ec�tּ&R>D�e6�)�u�}qf��o�|�}�g��hg=z�u��u[FjmQ��w`��Ĥ:��s��'��N� ��m�nnXL�d�2�'G"k�>��%B�K��򷶚�\G�P�p�N�g�@4�g⯱��!��{�*��N��)]e2�i�Ȗ��P�3B�.�"�Q��e�#]��Z��fpY�1�rݙ��ɬ��|��]w�i��B��W��k�9��=��?ƙ��(�xp�l-?@@@��ɔT�J��2r4rS�f_G��~>��fer^��3��ʁ��/��bN�l��dL�a_zL-��?�?Øf٥��)"*�S榙]*M�[[ߙ�p"/�9ի�邗��Ԭ��j�Z�2&�u�j��L��Ղ�}v�2u�� }��*�\vh��YY�q�Bk?��n��sN�<�ښ:�Zm77 U đ�K��Mѵ��.�F�ۙGeh9HGLXt��Y�e��(n0_�$ʌ��o*֘�k�H-��I!��'��na*K�Cƃ¨*k=Ġ.�@9VE�@��M��#��ZmN�h��r��¥�m��kF3��9��y��KL�j��y��r�_#{Nhq.�삫��50PN�OKy&��R#�%њ�5�0]�L��h$˃Ŀ�X�c��V�Y~e"�R$�d4��26a��_Fu�T4�m%��0ՠ$`H"{��4��m�m��M�e,֍�`p.o�#��r�J��&�l�f�]M�OԝCвk��v�ǯ�8�vb�r�&� 6_��Fs�!��gąm�H��]��Q�'Y�o�c�cxT=@�v��D�LZ��R�O��zo��U��ե��;P��vb��\�,��C�LżI[E�%�|��Ci{�֐Y�ӡ��Hf�1��jbTWJ��Rc��B�U*&�g�2q�NB'�h�WC�+�&wE>4٧߫��E��; v�'*�P��'�=Ǌ� �a4�Tu��K_߼\.�6�K��!�\�>�8�rW�y%��2S'��tU��#�QM]�"�&kTuYI;��M�c�1��WaAp+5_��xFȍ��V��K�m��Z]��ބ(�6ib�h�A�.��[>��̕�ȗ�%��'��Kn�iƨ�1��9��3AݑP(��@d��n�F$�@Ŵ��\��]��U`��B�S��O޿\�oa�B�=0s$b2&�*(p�t�G�V7�IW`p��&f*��Z��4{'X1��m16ju��b9�5FH�A�� l�F�P?�>�%�!��⏔ì^j(2(��7pQz��dM#��'�CY_��RCb>�>L4�x+:yPmYDx�͹v*e��OU��O�"G��L�sW�.|�]��y��,KYN�["��c1𾉹�1$�nL�da(y�{Š�yÌ�Nc�c�ϙCG��]��S7�F?��|��ھL�5O֑`�M�~UU_U5B(>R=��z~��2��;�-K��eй��kD��tp��n��tkJ�<��&��#��JȘf�Q��.�kq&��Y~-��I3i��7Ù�z_�K��a�]2�u=�#�l�tj�be�*�tG|��ƧD��Ve��ڧ]��$dw .�M?�Q��g�*��V��scg��{2�M��޾��>�9��/�(�k��F�<�w�wBX��a��i��C�;�!��L�"^�4��%-,%%/s�f��D��F۪!J��J��R��n~��d[��G��gu�ݳ�馭ڮ�c�)W?ّ��r�fV��0��l�L��Z��=o��TxC�I�&73�${��}�*�a��C��<��gH�g�55ȑ�G��Ӿ�p�I^�|��L�5�5��sBN��pBF`yh��{!4��r�+�iFs��[��V�1��n9?�nڜ�P��I�r��G�Q��(r�8�N~#CƷ]�ץ�n��0W��[i/�iYX��-�D��b��k�k~�ֆ��xwĊl��Es��f2��WPsa-��T��59�B'˼��c\槝p{ؙo�%��ĐS<��K8�g��T��a�qOT��YK�n�:k�e(&Ӝ$-X��/SS"�yl��z�Mfh�+�З$ǿ��0��S�|��d�%S�Qy��4��a��#�d�٠G\EJr�h�+Z��@��6I��B�9��@��s�_�M�~��\��|D|b��j,d�/�?��wg;`�ɯ�;�!M�t4E��r�'=J��04�}�T%n�:��6dU��(1*ā2^��}�W:�" �I��Ź])�@��_��A�Ս��r�ѝk��d|�OAy��k��n�-�#�5��8(�*PT��8�!��pc��v��ڍ�|�j+��d��&��hvH��i6�h�l�h��8$�L��;�;!��:�;n�|��҉ϓ�+`"��¢$>DC��Ľkڗ!�!S��r4#��oߠ;��Rh|��E.n� ެ��QA�[mq/�( b�i��.(��1N��P�kQZ�_߾�(7�^N��SȔ�1��>hT��wjA#�΄�$18Rb&�p[�nn�߰��`�ⲾP�h#d��=�]bn��d�Z��$��@�I��RС��-,7��{P�ho�u�@b��_?>��=@H֞�*��S!1��E��]�3꽂pf��=��z��q;��!Y�Ĩ�fa.��Ni��G҆OBe�PV�;f�؎pj8��g��͔X_b�{��^��)�=0�{��V-��7>x�\$rS�߹�+v�џ;c_H��flg.��j�v�%��c��T�Y��ȏ8�l7��U-q):3��/1 ^�S�.9�K9L��+�u�|:��b��S0� ��&+K6�\�2b��b�{q�6� ��m�w��f��@X�su�]��#Spѿ5�k�`��À��w��N��X��hv�I.x��{��;�Â�/��9�ƈ��s3��O/"�9ln�qW`��onB�̊��.�M%=��>H��O�r,��>y�^��hu�?�:ek�0�.�>�ǈB4�.��u8Ma *~�'�)��nAȼ��KiSJl��;��"��q�SS��3�*�w�i��t�j��>*?��Xw��3��6xj��>�(?�x�YT�v�77)��U3��_K�S4ldo>��36usCyh&��b_��C<��8�a[{(Y�%�DU��}��A�_��b��e�qz�z�{��u��X�^�Q0��JBB��9�2�v��"X��~�z��[�a�x|�#�+�n��7�Ě�ݔ�:��L��&��/t�L`JVWZ/�]�Ȓ�Jݟ��|�CܯVS0��T��.c�m>��\([D�砡׽`��d��ަ3��o��YN:�`_��k� =��=�nlt��!L}A�k��Z�ix��J��K�c��!{Q8ʼ�`�s=y� 8i�ԗv�j�ƦOT4'#U�ZO��J�Wf�٠_�ߩ�%D;��xR�K+?́��+�)R�IQ20G�B�lU��$z��1t�K��:�2ف�Y��*��@6㺚LHJt ��Ɓ�Dp&k�Q�Q�.%|e��a�W�Є�~�%�𺪮'��Z��ҍ��{��rS��ӄR��8�/̓�ܽ�pu��V�D�-��bu��uaB�a9�,S�Ō�s3<��=x;6�!�g1��l#�E��Z��rX��Y( ��X�o�~]�8"�=�夆�C!��.q�\8X��<�)�K�bc7�윤�π%(�� ,oR�se�0rvY��78�gj~�)��pj��@lڜU�9�Z;�CM�q5��2��}�57<�N� ށF��)Ӱv��&��b��eU��꒐"��{��Rⳉc��*�h��L��X}@_f�,��4Vg��Or�:�ǓJ�\��K}��aN��mx��p˷%�P;�x��E�;��J�x�>2Ո�:Ş�-sn�Τr_]�s��a-��e�p��ɋ-A0�[b�L4YVLf��nn�û�_yس�h�z�~퇇��`QW�g#<��פ��ߓ��*��C�߀��}2��j��k*��d˫�IHM��p��A�2�� bπv��6"��9yOkb��0p{ի�:D��]l�*�N�^�w�9��/&��>�e�/j�[�g��)N�Ȍq��V��_��Q;��5��}WE��O��sp�;��G�C��P>N)�c��G��W��lӌ@)�,��WU=m<[1��p;�n��=�m(*?<1�(��-j��qm��$F��M��c�-ٛаC9T�<��,�y/��a��Fk��(ad?�C�GJ��r�1g��[��ȹ)BӅR*CYM'7j肛K5.O#f]�.�M6/��'˟Z�X�H�O��}�=�4�(l~�E��[u𯕄ڶo^�V4P\�FL^�x��åXXG�;ɐJ��H��bwX��[uK*`�g|�a�[k��v�f��D�j�zu��:[�z��\��iO�Y:��'�F|r�a��H��ONt��a��> ��چ:C/$~t>�jD�𤤈�9ʍ�R��ڗ�cJ��.�6�=��{�g.l�2N8�wm3%$��R�sA.y�}��(��Ts�?��L�(s�:�TU�`�MW�qk!k'iH%.��5C�7591l}5��N�^�H|��WOA��aX"bA�9FH�.`Ϊ}�e�XFp�+��CB~�b��@��D݀.�dR��(F��:�]2A��9�W�e4 ?F��.��B��W�_��Y��|��ƣv��r:�x�0ɘP�57�z��}��v��!~��&9�S�x�>Ţ\%��Y#B��Z�p� .�yKt�i��lm��p��)�d��8D߫��k��4ʱz�|=)�5��<��0�65�E�U�>7�9=��.�KE��d��P;��U�=��Ν�{�*��Ci��`ڇڔ�!�R�"�kub��⌢3%��4s�6Y�ޖ�xG�:w~uk:|_p�YW�=tYx:��E|"�@s�GT��wˌsl�m�k�%$�ژ��S_l�/��_|�I��'2��6�'�<~��ϸ�v�Iрӛ�c�-��'��g�C��,D��y��6��vA~�{�,��i��y�*�HM�!��o{��G��_��ֽ��@��l�ȃs٭pї�J��fp��^�AX8�M�"�[�}N�^�Yh��Ou5��m�Ė��x��\��jG�j!�O��gap��ʇ.}ml(��ץ�/��^�PɯN�@��W��_��]�s�V�ܥ��w��U(�\,x:�?�3��dűH�Q&��!�K�H� 稧"V�b�x��klbb�ݺ�a��\��7��.z�a�>��"�#��at��f��k��|~VY��Y�/r��zS�;�5;��Vu7�0�0l�*D$�B��9��"��!9�ѥO�I��U�m��qU��m��+ͥl��%K�g��m#h�6�Pn[m(sW'�[e��w[HQ��f+;��s3��}��2=�S�{R��ل�/H"��X��{.��U9��(��3��Q��%Ayϻ7��%��YR/ߣ �d�*s+�d�y�n��1�J�e��E4]��r1 ��L-ŧ�|��[�N�h��>_�3|e�N��LjPx��1��;��F<��_�.u� ��l]4��{g9��4̱��RlW-k��'z�@r_��`��v꿗�ޯ~�l��"�4t�bLU~��Ϛ��b��8ј�G�uFqLX�~��3�.�AI�g��_�$��2�z3�lr�Zf��qv�]�9�fy!8��aa�'y��G��У�5_�d�&�AN 6򊑫v_�ތ�b{R��?.��!5��RH��?��k��7v�A��ȹ=\n!��Ju�u�GtS��@��]��S�q�{�lA6O�~��9��k�dv<(�XA^�FR�P �k�H�֌��k��KfcT�w*�&�W㫢nZz�006G`g��=C <*z�t(8�v�,�$�;��ʷC)pK��7�g��k��k��O��jB�o��A,�؊��~��)l��vܦ�=��Z��_�{h��ej~x��.�M�J"�6��э��'B��=L�g�ꗝN��;+��v��ԋ�f��_[o�M��n��(L' D|��g3�}]|L�k'�))\�&��^\k��P��B��t��Ԧ.j>��(r��c�O�4q��^�O�(�)'��YV�r,kN�<�mI�Cc��"c��"�6��nS�ԖI_�v稱��z�[�ւ!L)h��]�", "x�.�2,��$��x��_��i��q8-J�9�f��N0", "HTTP/1.1 200 OKDate: Mon, 07 Sep 2026 04:17:23 GMTContent-Type: text/javascript; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingCache-Control: no-transform, public, max-age=1800, immutableLast-Modified: Wed, 08 Jul 2026 19:34:46 GMTETag: W/"0x8DEDD27F7DB6F34"x-ms-request-id: 73f177e3-d01e-0047-26c3-3dab84000000x-ms-version: 2025-05-05x-ms-version-id: 2026-07-08T19:34:46.5015364Zx-ms-is-current-version: truex-ms-meta-jssdkver: 4.4.2x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.4.2.min.jsx-ms-or-policy-id: 6437dba7-5170-44ca-b9b7-c3a660a5c205x-ms-creation-time: Wed, 08 Jul 2026 19:34:46 GMTx-ms-blob-content-md5: +eEumdRvFky1unHu2UN6HA==x-ms-lease-state: availablex-ms-server-encrypted: truex-ms-access-tier: Hotx-ms-access-tier-inferred: trueAccess-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-version-id,x-ms-is-current-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,x-ms-or-policy-id,Content-Type,Cache-Control,ETag,Last-Modified,x-ms-creation-time,x-ms-blob-content-md5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,x-ms-server-encrypted,x-ms-access-tier,x-ms-access-tier-inferred,Accept-Ranges,Content-Length,Date,Transfer-EncodingAccess-Control-Allow-Origin: *x-azure-ref: 20260907T041723Z-15b44db96d562b7whC1IAD6fw4000000087g000000005taqx-fd-int-roxy-purgeid: 0X-Cache: TCP_HITContent-Encoding: gzip8000��i{�8�&�}~��&[�b9KUQA�ql'qV'vV��MA2c�T�8v,�o�s�$()�=�{�tW,Ď��?7�G럭��I��ɫW��D�A�Ag��6�&y��(L�,� ��$��ȓ4��Z��Tz�F��օ��\�q0m��}��?6�E�Q�J��u��b��H��X��^4v��sG��v��qK�̒4϶��U2*�jC�^�o^OM3�B鲅��|kK�v��݁c�;C��}JE$TY|2M΃��E�Q��W�y��cȻ�H�svv�mR��Q -�EGe)��[6��=��C&�rGL��#��K��C9�?�9eIw�i&�3��lɐ��L��5��!U<��Q�u"��u��I�F�(v��$z�Y�]��'r7�D�ҹ�n��菘�)��&ĥl�#�Q��r'��|<��v<ᆃt(��j5�7�Y�ޝSТfu��CKi�IU^��6��[��醔��.��C�z]`�G"Tuq+Q�V�q�ZP�,��)��3K�<��J��;�bC�ؗ�H��R;'�W��ҙ�x�_8�&2��rE��)}��N��G�N��8Mf*�oT�ь�<]��q(��3��'��%� 1��A~ቈ��4��}��5��'�F��u|C��}S\��C�Nxj��.9� ��{59��q�Nx�$S�o9�0M]�{��Y2�G��W��nwi�x��2��魁��k�6�l6��A^�q$wʏ��^�5��تJ*q�$�b��,��\: -��w��lp1�`��A)�XU;S뛞��S��9��v>��u��9��:�s�s��}��׮�iP�ĵ�WB�U�'uI�np�m��W��Aʉ21��:�z�D;1C�}�۹�z}��Mc��f'�P��5��5ϖ��n ��j��T�N�&Q\'Ѩ��y��s�y=^n�u��ۋ��N�ZW��P[�SUC�ph��̐v*�f��!��N��wY��6�ʲ`�t�y�0�N��z�5�ti&^��}��K�o��[��5��՜&��*��N�f� T�=��G�s��D8�]��x��G �@�7a�Q�Nk��0��4��*Ѷ&w�9�H�z~��S��j�΅}��E%�� 5��V��[I�gG+OZ�[�\r-��|�Z��W^��G+�Z�1h�;�.v�8�h{mm�u.��zA1X��k�3��.D�ὲv��c�Qڐ?�cݡW�(c�¾��s^qQ��QX�'<�k��h)��E��&y�<��H(�O�V�B��y�.-��\|#��S�P�:7��^�Έ��'b��uu��.�}�jp=��?w��E�ӭ�&��8�uW��h�G��[D�g��ri@�6��ct��:�o�t�L4�H�x>�ʑ�2H'ŕ��L��S"�g�;��J��m�R��àW�0��C�_��3䛕�e�B36%�x��+(Z��Z��J�G4#��hQ��o}�6��7΄��%��6�� |��ct��΂*�ة��F�h�� G�a��g��|=��O|#d�|GY�Bd�8�&��w��iAO?|�G�:y�V$��w2�]��g^OdL�J��C��#�Q�cޙ.�1�r��l��B�$}�Z;S�\;Lt�Q.��倾QB��C��@�2g��_��3�ԗ��[G�W��(��̦">�$D��]��hR�E��7�Lh�Eʏ�$��.A�x�+�cf��^4�z�׎�f��J��'�=wO5�a^˼��!�3�c�@�8��i��ƿ�h��ik~�E�oT;��i��T�7�c .��O�>m}�mVG\�=M��W��,�8U꧲M�6^��@;]��[n(�u�A�E4��Ku��Ȯ��WR�S.�w>�#�ΔM~�pFN�M�8�h^��I�J��Y�xU�b�+��2��9ЫE5j�J�� 9��"I�r>i��18ϭQ�(:v��C�\d��?�=ך�3+jd��ӈ��dy�*�G��A}��Y,b>��F"��E�Q'p�#4`�?Z2C�ԥ=p�'��X��s�I�2��Մ��ۍ�iꘖ�B�E4|��v��s��FW�˚>�*s|�re5�7�U6�"�k�Z!�N��3[r��l�|�{��ל��h��us�k��1��􌕤��'�sFI� �3�Ε�v�QY��x��QU�9��-��N|�Ӊ��[��U��Fc+i4��y�Pe OkQ��:�*�(k��#��6ۻ��~S��-�%�V�tt<~J�K�>cJ��,Su=?_��Y��̴u�lZ��5��dU�#��?Zg�K�Zf��n��5�Ȑ��x>�Z�>Q��A.r��\S��?��P��!�CD�o$�uo�!��{�[3��@�h��>��W��n*��=U�P'O�fN`4f��s>MĂ]cܐ�Ax�nl�_j+"�H�4��1��\;S�j��˜{�џa_^�*��o��,%4DE�DDX�\��t��>��uFI�⸍q\�a(�@�z^�n�M��X��'b�;C�l$o�7��tz�j��0Od��lz:P�z�r�,CS�zZ̜v-[��v8�rJY�B��;�\��D^�>OqSb��AL�LD$c�"�NO��#�S��͙YK�B��;f��]-��z�Mc1��s�^{bk�k]�*JTPr`�XNc"p��@<�"�q��G��1��:��W�^4��+��Ci��+�<É��F0l��+��cq��X҃b��+f�b�޿��s�/��B��=;�n@,�*�ʺ�W*�4�#�ۖ>��<�Y�cl>�_ڕ��ǲT�+C�u[��Vi$�0uD��j��Vp7�Cb��Ѻ��w��MM1x��T��tL�紥��i�.�۷�.�*6vxZ�b9X'�6�{�9��Ŧ��N��b�Kh�N��:t�ݞ&��PD�]�b�r��E�G�+��n�tɶ��6�ܰ^�7�=,�!��bu��y��P[�N�i��Y��-�}J9"#@S�jaX�L�߷�B�l��dp�ݑ��R,J��4�b"*��9�&�)�w��^�רc0��y�}�Ce��S�f)�OT�x��/��J�Y/�T�~��vh�1R?�Gq��U�S?D�NޟW3��rU�G��K��w�g_��t��'ф��4��V�7[��)�Մ؜� �<�E��<��Wc�X��9�3�o"#��x�%��mV֩�ޖ:��~��Xa��>:��,T��b�Dm¸)g�2+F.XFw��8�UǠJ�[T�L'ڎ-h=nP�ZMn��8/��#D3@|~<.X�SW��>'��7\�/*Yx�{-��|��L��I��Z+�x˷�㭑`0X�TJ�p�b��׆~M�"��AT�x�C��G٧�y7�M�~��"6��9�jrH�6X�?�(��?��x;��<�ؚ�z�%�7ͫf��>�w��<��fC"n��lw��&��"Ȱ�-�G�LiK��(DH��w44��D�w@3d��v�~6;�D��(9�J>�$�F�y�'fA��O�@�R��T�T�O��hJ��޿��m�IW�R��Ri��9-=^�ӅF*�y��!዁:"i�Jsж��15�z�0�Ȝ^��DLOWzs�Q�J£k�_h�"�@N��D�4u��rN��F�4��T�7�rGL#ۧbU�M@��O@|�^�@1�J;%�ɡ�K[%*�1#��x��*��^E%�8��m#�5מU4�}n(MՔ1�.IwZ��q�c{P=�:�~«|��FB�Ons��#{��O��J��v��ڗWψ(��f�%H35:�I��d@�&��Y��΁X�mMM��F��+��`��2Ҥ��l��Q�W�>j8ϼ�~6�#��1ćH��I�}��ցia��R�̙��Ӵ�&��y$��bH-��WW��ki�?N{q�]��e;��އh�12~��$NP9<�*�B<��X^#��u��tK�blY8��լJu��D�ۃ�ײ��s�WL4aP�٠m�k��idJW�&v�Qֱ<��Z�NČ��ҞX��̴q��j��r�y۩��Jk|Z�'�u��O��_�$ m�^�GK��;��%��6K�C�ђC׷&�~j��(�6��!)�n�7�s>�<<3�u��j��;��z_"�.�&�,�$��/�3`�0ESxg�w��Z�r4��°��윰A��q2a�)��TB�cmk\IPn�"�I�i��L�� pEFK��*��ؽSx�G�%��F�cP�bu��o�Ӡ��dC�$|�"�y��]�k�y+�e��W%�V��ѹ��E�0m��t��)>��@�3��-ﱓF�a)�7-5H�a�E��/��4\��V��V"�X��9v�]r�(e��WO��u\zocԔm1b��F}�DQٵb��1h��$X2IR�Վa��S��|n\V<-��Ͳ��E"�\E!��l%�E��-��<�q/��f+~�;8ޙ�u-0h(�k�"��h�hU�Q��V�Xa�_��Ny^�L�5;�ĵ(��w�BN�0BGCd1��T��H�D"Ԉ�w�s��@��y�"P��܌��:�㢱m��-t��1$��ic��3d�M�uA�zo[��{��5�+�C(�f��3m�(�`��ΙC��-:��̜[�8U��jb"760��ë��d��ppM-�9A;'j�A7��nmM6}��XD��X��hH� A�OU�s�i�g��GI4xQ��}r��K��I�mJ�1ϋ*e~-hX��'A��J0,6-��%bH}Ux5x-X��f�P�"&̳V)��J�y9�\Xa>��{�s=�D�@1P��/��U�%��4��Dd�S��P�cY&��P>�)E�9��K��T��h��O�Ap�#��K �s�3*E4]� �ko��4GTӘ�ϝaƐ$��a?��Q;cc&J��FH��s� ��x�t!�LU�$l[��@��i��~�y0��ab��Ԡe8��4��(�M(�M�f��=<�1@�/"o��$��)tK�_��[P~��Q!��y i�J��wZx��<��?X��F�W��ձXE��g9�)kQ��4ґ�-�hI٩�s�g��+9��BΜ��XY��䍍�X�dL��ʆ e�4��4� �ч��/�2m�v�xsBt��G0�)!*�#�0G��n iC�Te��~�t��Ne3M�; #��QVV/�D��o��s(�v�6��]��^ �� 7b-��?U�l��zk~Ͽh�?��qA�*�Yl��ǎ�)ma�H��%|\[�13��u��L��b��hiV��.\��бÆ��7"��ލb%�T��Uw?�#��s��qS[[3�J�&aT�G� �X�Y�~�c��R��«&�#ֻ��]��_"+`�MJ1v�E7��?$��Z<�wWt��r��6��C�U�빠��ؽ](�-�k��A��<��|��ܽA�Yj{9�Os"�"E�VM��R�!��X&��PP��&��M`�}�ƾ�N��)��P/bmR��<��`�}pb:_?Z��V?Z:1�|8��k�o�5i!i#l�xXw58��/P�.�I Hz��R�W��v�1��ig�L^">�l�R��L��0;��M�:>BrT(��\:/K�Mz5jЦx�>�6�m�V_=�h/Zj7�2h�b��e��sID��v��t��C�U%�Z�,��ѱM��f})��8JB�[�F��U�𛒱�[r!��vL�-��-�E�K��;��O��fkW��@��~|�0^d��+�ϐ��)%v��&B�Tơ��i�`��j��-��PTi�NÈh�i�1c��/��^�(�Ci/�`1�a�72��y�B�V��[��0��`n�o��ų"��&��׬L�"1�pv׳h��xŘ��gF�a�kz�$�x~MDQ*7��Fe�b��h��L+�Ej�W5�a�^ ��(U�{�D级�6ә�Z�� /��=0�d!t�k>U��|l.��6E}zV�:��i��&�h�?��'�p�upy�'�C��1:pUh�'�$�<��V(�K�Nt[H�d�~�g�-��ԛ�t��O��4��T��ϴoT��D��s��s�N��eppe'��R�DY�#��ig"��{� ��F��$�1�X�:3�?��'o�R��z�&3��-/��(��tDBOoE5R��{��3̊sMb��Wg��^�y�n�]v>o?K��v�g(2��x�Y�4i�famÑ��O��B9"}��3��<��*��ݺ&.�"+��`ߣ(��s��&�qcî��n/�>S��Ѣ��V΋՜�Q�p.��]%�6��A��s�ݛ�}zu��_��MN9��ڃ*Q�&Fѱ��<ҭ�u44��EbI�ub�ӡ{��k! �0�i�l9g�OXP�_�חe7U怫n�5�]�C��=�x�s)\��R��j��-�-L��ag~��I:��<{Ip��=��O��D��5�L�h1J mߛ��Xp��2��:�XZh�+�Sb&��'��'2��VMT*�O`#W��p�I��S�f�-ge��I��+�r~��7(�L1��l�_K�O+�)M�To��4��qm-��܅9��Iy�[��0�uڗdvfM:6{��ׯ��̠`a�Ϝ�l�ö#J3J��E��o"�o��&�r��΃Y��y��M��ھ"4YE�=ۛ�6�1��A�۳'�� 7G��|��;�ا�aοIm$c[��PT�i'�fl�Ki�V�S��s��ƀ�zZ��9��Hvk��)�*!��0/�؊�d��[�F��m#bm>$P��r�`l��i�1B֤�;)��<�9�$�w{T�f��.'mg��w3��#5̓�+�e�isb�X+҅\D�>��Ɩ�X�A��;a�{��ҿ�a��&b��(UD�h��k��D0��v�.��>�b� w!6�s^l�v觾'H5/O엧I3h·��_;4�\��'�� QIʊ�Z)�gh�sR�c��7��M��e��8g��a��c��M�5%�h�f��M��C_��4)��tnFE�w�ݯt��j��*��8��G07)S��U)��>J��P�ȥ�H�:;;t��V�!��x�Sb�X��J��t��y��:��vD\�1��X�S"^&�Y">'��:V��3}��824;�K"+яؤ� ��$��U�o�r~�`X�ʏ�k��LoM�E�3��uX�ω��{kB��JK�A�R�sv,��(�:��4`��]%��rd�$�cuU��ڊ��Z��(��~��S��.�Pׁ�2��iZB"Tt�.ZEQM_��q��I��Q�"$T�WA��`˴~��gZ׃Y/��PET�e�ܗ�,��)A@MeB�O1�I�ɞ�qa9�?K䳤&��,�Dߡ��o'#�M�7�qT��&�x�^6��c�"�,�J��z9�)��Xj��(��L81��34d��t�s�[�m*�:R�q�&�K+W�v�R�Y0�Jx��^3Z�G��*fQp�b�P��vH}�GK��A�q��r�kk�پR�J��3LuS�q��=�=Q��Lҽ��u��haT�0�uC�,$�?_r9�(\k�8��o"0qg�ʞ�" ��J�[k�M�nBv/t��2%��Œc �m+�Ro�G�L5�ꪨ��s�X��V�N=¼��;�]�!�f��ut5��+�x��`*�Z��aP��5F��ӯ.��xdޘ֬v��5-��*��:4�;��;��G��û��!v�^��v;��6�!^t)��ˇ��| �Q�m��]3��ji^@��0a��z��U��8ǚO~H��41�@�Q/��At0��%H��5��|��@?19�Fwz�c>�{E��1^K$=N^�@��6v��c��K!4"#*>@ŕ��XL�:[N��H��e��<ԓz�g^�?��Ҙ��;b��ی&�j�DٟkP�ԏ3:`�l��b��M�u=�뾮f��it��.jk�i?mg�f�D9�M]��B�D�L��x��ľ��P��{��G��8-��]q�gG��ǣ?��>z��í��kS�vyT�{��K�vW��G�|Tg��˹cS��'0G�Iȏb�w��/�em��Y�l�<ܪY�[3Ѭz^ږ�ޓ��çϞ�x��ޟ�~��yH�dr}��^��{��۟;��9��[��Ջ.>�m�m�\��Vfs�^u�i��y|_�"��V�!>��Aa��H�V�I;�ù7��Ѯ�,�P�3�> ��Fd=�ڴ?��^��ě¶�� ?�w�ȧ:�3��H��K2��_�X�K�cjt�QmOُԷ��.%wٳ��ť��/ck\,�ٿ�r�;�x�ǋukb E�M7��ʅHb)��*X܈v*�|hū[T[�Z4erOX��.��@6>��9�>Bl��W�~��7��2e�t��qg4�Z��|1�^Ig��E��r�$t�c>UzIyht�$Cę1g|h��}l?z!��b:#q+BH0��nF��x��.W�-�߫�s��J�u��J�ک�'��Y��w��N:UbL��K|�%I4�b�-�]��b�@J٠�V��mN!N@p�1�N�>+0��\��1f5��3��D��;3��D�-��d��5@2��P�2��-��N�vYQ}�*r��VC>�Х!w��3�tEK��X�d�t�]�<�fVj�ʐ\��8��.ߥZ3��S!b�U��u"53]j��ب$i�i��%ψ��=�7^R�R`�.d��`Dlq>��u��N�`}��;��}��V#��-��@,"r��"��bȌb�O1�1��k<)Jw㐭�}>�;p,��|��̠ot��h��o�O��y(�r�2�zGL�}��]8NV��(S��A4U#�'=��araW�a��^�e�̒E�٘%q{ �`�� .=�Y��1v��2ӯ�Dԡb�h��4m�P�m�@�(�5ƕ+]�4�Iٴ!`��Q�S\�BK;fS\@�F1x]5��R�X�}}�_��-�*u�m��#��e9� ��e6�w�Eܰ�R��r��m��Q��)��;ԕ&ClX�Ftll�[`g�Nh7�l��|QK�`��}X��Os��Iϖٻ� ��h�jy]��=��k�X�.��Y��Y'��>UN4_D��v��#x�h��֖��l-� <�뛯�/a�M��dk�>KDKe>��A6P�c}�C��K�J��%5d��9YU��/�}��]M��ki8:��uL��{LU��h�ʄ��0ȓi^��M�MR5-�d*��ۚ��7U��-=I0)ޑ�5aϠԼd�Ct��9�K�Ԓ?�j�)5��u�+;��{�`]M�,:O6��y+P�J��Ȫ��7H��"��]x�}L�&uS�Bk˝?+��s��׹ŋE%k,��K�ob�U�T��L��xA�C��w8D&��\��v�)�Q��,��N��䱝��zy�O��(o�ϴj�d�}��a��Y�ˏ�-�#��nq��h�d�G��@,��L�%e�9��X��T��@��)L� ��%5.��g"�bO��)��1��8�Aū�2.#�Y)�Vr��2�U*�@_�.~h��OR�"i��CG�E,��g�18�q��r��"SM}�&�*|v��a��t��>��r��!��s�ˏ��7��JK��"�5q��rX��hx�6�Τ��7�X�±�j(�b{��9��v��3ؤ�' ��+�2�o9bI��W�X�d��VM]��ذ��Be�`4/21��K�7Ss��+X��Y�P��O\�؏�F-��AOj�~�1�Rtw3�7 H�d>o��}��u�R Sc��Q�X<6Q�p��f�0B'b��Ȕ�D0�� xFC��}+�C��M�K⋦t*�h��c��^��L(0��D��04_OY؋xEg��~��Ǹ�M�b�1eT��\3SeFX��<>c��ݸ�\Uɹ�˱�s�)ǚZ5:��)��ܥ��__L��r�::��Q�$�":�A�b��e�DKJ�{� 12H��A��Bp<�u��bЀǱO@(ҫmCxY�q,s��;+p5�*T��&�N�E�B��31�@�y��W#�2&��l��r�\\w��l�b/�Eyp�gE��f��gEwE��A��˒04��!�7��c5��Z9��.q�N��UԷ��}9|�]X��i�>W��IdW��*��kM�Y²M��B��;��[�J�I"A��j�<�Qj�P�,e�h>�}�%��O.��ZNmE/RJ��b$4Q�ˢ�h|bh)��mn|��yb\��N��=ߩt�]��3�r��v�_P6�`�e��4��w��@|�"�(� �?k�!�VHt�!��F!�T�V�T��:k�B%<8��se�� L|�+�Pޭ�j��;�2��*�y��q$@��б��y1�9+B"��D��)&��$��u��E�-��}�l�|�/��D@u@i��iش�06�0�@�}�7/��0o��G1X{�FCb�>/Ga�Ԡ'!��C9�ޏBKPꟴ��^�g^��e��}g(�i�Znt��V=ؖ�p%�)_n��y�i��>;m��c��9�N�9�W6ږ��O��@b�8��.�M�� Y�nc��ښ��G��'J� &q��Q��^�,�J�),� ��w.�r�8��E�T��!g�q�m��|t��om�i#Z�>�>��=m�{b%1n�E��V��a7��XT�I��.��r�Z�ݤ�$ϧ�5�j͈p>��B�qH��W�bx�`6�8l`��0��E�in+�j��3��BF��q��-!�%�t¯��O��Z��)�";�S", "�(q��x�t�o��b�.�*��Y�[/�\/4�Q}�q�$��~(��P>��P⮗�n�׎F��uox�#v>\xs��髟�q�ڢ��p1���k{��r`%y�`��l�wwv�AF�:R7Ĕ�t��N�p��o�5G��U��N�~��1\WN�=ΏF�<��6��=.�K@rq�n)iw(��i�r�ō�+5�X�SrTWbɠ�es�[�� *x�r��]��S6ڥ��-��A��+{�V?��Lpt@uv𱒗ݶ��شF�ZC\1�t�Ѱ$A�S��/"�d�Y�\9��ޠ�8o�M>oЯ��w�Yh��&v��-�N�ǵ(Si��6�W��u�h��|mi�|ר��0�;L�c��k�m\��Y��R7b�<��2h?]��$V��\�+�j(�6��8��0�u��]@��9.{��C�e�W��"�؊lbI��n�[[p^��fa#;:�`�2Rӆ(!q�V��[�p��Y�3��N��W_]Y�J"<�C8-��!6/mLC��F��;��v�h�Y�x��N�v��vNl��2��s�1-\N��4iKB#"�M,�r�q��cYԸ�"P��= C(�5�L��a��@V�\t0�ny`G#��EE%R{��^�Ge5��wJxX�Q1��BN=�\c�&�q�(�l�H'eW��wL�[��<�+_#jl=f*�Kr�Ռƻi��B �j��1��_q6�[�ߨO�pd^l{��kcrc��v��6��.��+�0m��}׾?U׺=�遳Cե��>�{@�ҿG��7��;��V��;Cv6��A/%��ې�?�V�ސHT��cw�z~T?��X�V�].�CQR3��[��|�:��`;�s�O�4�ֽ/��H�<~��4�;�kl��w�o�z��x�>��蓻= b6� ��H\��S�~�cG��#ޮ�e�5߇KaMو"g6�T��$��e�H4XdG�X�EW˗]Z�2,�qi7��>�O�.7�\O��?��&�5��P_��L0+�[| И�bA��ǒhH:��v�Chy.x-��a/+nƻ��4��D��Ƃ]j�]��o�1��܂Pl�8��Uj5��R=�A8j�8�Qǰ#��>߆�j&�K`Q�/�S颜��L��JV蹴��U�K~YmV��c%m��v�'�z��}��d�B��e��"J�F1��.u��k_��Kv2��YC0��lg��P�YB3A�W��A�FFol;<�/C�:ֵ4m�&+ �C�L��[��ɜ7�y^C`��l��Ġ�!O�*��W<{}Z�"��>��B�@&�pj|"�� J��Y��2��:�b�|�H(�k�A��>��7�*�/�w��~�֯�L�_u��c:��%C��s&��Q|��c��9��i@/�$NҲ�:�u!j�Hk�@��6y��Oy�Vلl�9�[gt�~��p��g��:άX�I"B�(�`&Q�;@qh�� P�6�4�e��9=�ښ��<�'�c�l�fN��yZ��g�[�@�¡vU��p�AL.-m�'�1)��B.�N��#A��}��A�]u -Y��~��;�BXK��s�YhU�W� ��$��O�0�%��H9*�:<�H$b&�k�/hP�{1�/�^��n�E��_�E��1�UG��c�q��m��!0�'F�K��jDATƺ�F�3�W�<��l�;�vK�1��$U�>�SYn��N@�*k�FA�M��c�+[As�S-�×�a��Ҿ6��U3D�j�X�� aVC�|>�ĈR�:e��G�@�T� �PD��2��iۡYct��r�p��-K�#\jN�מ�[pIk��E��wՖ_��pW�42�Y�$�k��S4B�f�&]��:�a[":%-o.l@Ffj�q�R�b;+��֘��w_�5"��DR%��؋�g�6{PN3��d�{�h%��xF=��D�� Q�6��5��+��p��W�ޗ�Ô)��o�%]z��2B��_m(Q�v��}�� Z�"ϡ�G��-�Vغ|�B��5æ�p͑Ie��Ç]l��ࣞg��C+:�Hb�z{��:�g��D��0��$�� 垶(y>��;g� iuƏ�ȼW�� y�ͯ��_F��G;;�N�a�}��+њF��L��WW��<�S>ĩ��7�@�cg��?I��J��`�v1��T�^��J�D��u�$q�4��!HD4�[��KB�a�vٵ�wGƓ*�HUhk��W"�w8��C?�%ױRXT(�T"�� 6�ҭ��h`��Έ�Yj�p�)i��q��&�/D�?݈��/FT�e��M��j"{I�V�}kt�g��άH':��/�!��hbO�x!�пi��bʩB�eq}#[��Jy3�L�ʚ��䶂4d�9�~|zw��9�vV��!b4�-z��D�)l\�P�ϱ^gW<��6�94#�ȴ�@%�0�0�7��B�h�7P-�;Kc4�*+3;L�a�ˠ@J�^��3�e�9�ta!��l�D\ �<��@�j�r$ 匪��q�¼61��.��T��Uj�p�J�e��m�X�� PYWY��X?F��vu�q�� '��H_�Bse751X��j��x!�Q�wܣ��Z֋LM�LGCQJ�=�1*��G.\��@u�t2l0WY-�Y��?A$�a?u�7�8�S��gD��t.�p�"�a�#B�|�45��-�W�fr?�ǳ��aۉ��]2+�'��wƎ�ׇ�X\g�~�!�ō*�;K��`{��-�^(��j�ۈ#^�%�oT*�p��ҷ�n&&)��[��U��>��*OC��wt� �5�|�Q�K��^H.�e�ܗ��M�ͥ��f �~��q��ſ.uwa14=?at?�sm_�Rd�{�m��ƕ��!�B��f�@��qc*Y4��J��JK��j��*7JW��=��vW�V'��q]+��˚0�l2��^�\��86��S��P]@��1��&�f!��nn8�'��ݸ��]��9flv�I��#5W��)��N?̤{�u��W�:�>��C�^}Yh��([v��E��qx ��IXs�W-x��1�e�ς[=��Ӕ��S�W�!0a��KuD|Xfn��l؏��7Z��ul��eڴ)*-��J�p(��ׯƵ�(��i�Y�q��r��6�q�)ͭ��J�xKc��fyeV`܂�ES�[��E��6KY��5�߶�ݗ�p�8Y>t�2yb:'o��F�(�'�g� ��~�K0[�i8�ҦU��w.�1.�ִZ<�@�T�+��:� @�rY˽x��=l�$U�h�uF�:[��7��ѳ��@�@mK�Зyے14&&�/��gP`�(�ZS��F�Ru��5�Waa=�d}�>�z\� oB{UXc��~7&zE�zq�NV?�t��4�T�;��G&�3��c[g�[x~Ӝ:��~GV�#d^r�5�D6n}�'�V3I-eL��2��ᚕc�Y��ǽqj�"n��w}mn��@*��.��f�-��d�}��V��}9�k��oW��T�-U3Hw�~��N$��>T��$e�~�j>��z��Rp�t��Y��C`D�{u��0�bӤ��D-��u�ɒ�&6�=3G��v��kI¿��jd57�h�ޕ��Z��[��|��5k��oW��:��X�`c�.��~*h��˕�t7�iک|�#szj#�A�] �g��b_��S��}�L~&�z�S��^�2*��g��(��Q��V��e*J��d.!��^��dB/�`�7��*��TM��S�P��u�NY�@ Bp��[�LH�w��`��ZA��S�B�w�G^ZlĶ�F�U��Z��؎��q͏act�k��Q��x�A��Jآ��/�*��Ѣ^�� v��RU�+`fw��p�A��"W#�/�޴��w��i�^y�B��#w��L��ĭ��d�U"��Q}A�ɷj��q@x\×��#�D8�<��&�Xh��U)�Z�D�)$��P�HjG�[�]��X`?��v��,e६��>!��$��}Q�6@�mr&=gj��>;Uy3��v)��<�p��r5O3;��w0]Bʔ,p-�Ip��f��,�b��.j#�Fp�e��^O��皑e��15U25/3�8oZ�g)_��%H�;�i��!Q��Օj�!;��ȳ�p��7mu�2�/.��X��:�bAA��]��}��͌� k�L\kT��4�]�mŁ<�R��QL^%� j�yv�լ)��$d��7�,��jq?tu��݇D{c�v]^��G�;��F�t�k�d��/�ߩ��Z��wȄo�z�=��gO�YБ��M�4��j�%��ZW0)�9Q��kR�O��j{�?i�i��Y�1S�Fʝ]��&<�*2E��F.��[މ�$��BԠ��$�B,��ؚy�n��!��!d��Q�P�>B�L��U7t��9~��v�hxB��z�X� �#(,)��%P1ްq�q��TB��!2�BB�Yz^ԕ��tJ��z�X�p�E��p[��V��%YVn�\�z_0F5%�ؠ�ޮ��Lf�6�u�\�w!��ɽ�I4hn>O4��~+�_fp��87�1�\�_��\��Ek��={��%�M�iu~��Qe�^uS�B��V��xl��]��R" ��V��3��X&��-��la.�[�BՄ�u!��ZȭA��X�� S�N;�T��f�OG&�|�;&�X�}Ӥ�:J��n��{ 6f&��y~��CJF۳в�e��"�6�T�5�[��r�l��O��x"܌�C�1o�ܸ�z��ʀ�n�|�İ��!��R�[$ x��-/�؎�g��EJ� �]'r)��*]�[�5$.��$��Y̍�Hb�&-��)��O��j�mX��p*҃��ڍ�˃��n?_��5w�{M�F��g�HN�k�R�f8�U�R��թGi�2f��3l�Bƃ癱s�X�6�޼g3��&s��r~Z�>-�Oŀc8V�AJf��W�<�A$��)^%72b��y�p�5�YL`t�e�Xo�V/�ĺ54��jr��VZ�1G�S�o��ӫ�79w�X�3��(�L��rx1��M5�[h�8E_��FMj_n��g��v��4��n��^��U��^�}�ʮ��^��k�Ф<�F��p�:�X��F�fl��w��xU��FhO��̵��f�jH��Slڊ��r�01��օWY��0��[��݌�`ʋ-�.��7x�!�[�M|�B�V�׸��;�6=_21�n�MI5�[��kVDf��5�V�ʁDkh?��&��-��@�^3iȁ��AH_PV��73a]Lzw!�kbQ끤8�7vE��M��6��%X��K�Y4�a��x"�y6��و��;s��0�^6|��G��Q�scǇ=ql3��ʐ3�N��I� ��ı��C��s�2a��Q�c̘��'3�`��(��E9�:ݶf��8i8�\�Q�t��%J��&!��9��Z�5��8��y�\��;��Ɗ�j��2Fs��H��Jawf�> xM:%ʵ�nԨX*�t��L'_��2�?W�7��ęa��0i9�|��u�k�4� '��^�]��=z�x��J:��됯�Ѓ0��c�l��ⵢj6Rs��X��^�t�4rc�N�o�d��"��Rz�S+ҝ��1�� ;�U\�F<�j�z��q��kĆ�Z�. �c_W�Z ��(*D��lz��Fto1�M��DҁR�F�{mm'��؂��7Y�� 1�+6`ϡ?�ʰPT�cs�l�fniM�ҐOY��r��Er�-Qޓ��G��tj(:�;��#��r�X�1ށSz�s�yD�.5�W�Þ5|�ۯ|�Wi|��C�&<�e��z�EX��|�"@��_&PW%�\fS��1q�Sz��Ur�_��%]:�^m��u�\`��"��.�B��R^'+f��YW��=g��A��,�βF�bjŮ��*��5@��ڋ��ۿ��=�e!#\�]�Gb꧋�t9��i�Nš8��L��'ވq)��:Kߊ��7^��PJ|��T|?�7�I��g�B�_Ħ��g��n#+��/0�>��K� ��?=�H�P�1��p�KuKx��u�Z�n��;�*�T��i�S~�6<��C:�GDAO�xV��E��}mb�5��i��W��#\.�qk6��&�q�k�^��~� b�EW=�;�z_��[_��-\�֜�?c�y@��Ҩ\��u��SOpu�Y�+��}i�.8гor��u�^j��Y[�j��h�I\WN�ķ2V�Rf��'.��&O��s��=�Z}E�;b��"��)D��@�ki�S�NijvGFrB��ʴ͔q[�~�{i��ʿ�AKK��o��'�S��/��V5NM|ȵ�Q%G҄��ٌi�G�8Z��đ��4�m��ԁ�y��Y�S(9�TG,�{��:.K�?�1�O��Qҧ�F|��D��"��'�L�{܉r�=`%�+��w�67Nc�cy)��=m��f��zIM��+U�+y'?�g��&?ɧ��(��U)�;M��Q�kp�r#�ۼֺ!��һ�5��MQ��U��!Ȋ=��l6�0��a��k��ݿB��GҪT5Y�"�V��VI��΍�%!�qڸUӅgE��N?��P�(�td�\j�f$ ��4��5>Ѭ�J�W�KC;���s ��+(��?f�9��8@Wv�K\�O\�O��ki:Yp�蓂�s�x�um��m��f��+�8&��[�/��_�G#ZU�%�T��JC$aE�i�Nc?��'�[�"B8-7��7g�4�F��P�ět�O�@"Β��VL�-��b�иv�2�wM#��-O�b9�KI�T��7��GU��`�2s��ڤ�h��oX�j�G4�o��$~Y�yk/�$󋬒��Qy�.�=~;�2�%�!��R�r��r��樼��NNN=�P~��gc�e��j��1�ͳ�n�qZS?rgU\��]:;�ϝ�`�G��*��P��S�G��$q+�xqN��q7�3ڿ+�5+�%>m4�iQ�M�]��7m@A1�ۘ�2�)[�kG'��n��e-M��Ţ��/l�CHȠ��*IC(�0=+�� 8/K�8 !b(��p�OdӇ�t��G��ebc��Z��?�#l�F��u�4�I��o5Ҙۡ0��ݯ��kv��,�V��b�и��kp�+�9�~��èk�R��trJD�ʳU�x�S��I�^"uH�p�Ot��gŚZ/��c��^��R�G�e�?��tv�K�s��)�C��ġr8P��?%.$2y�*sWD�+��2_�b`��vU��}H[Ĕ`�87�ca�&}��jAn]ǂ�\"�}�pD,Elfe"-7s��#\0��.ub��c��D�`:�gY��\�w��$�܍s�-d��i5B�:v�cW^�tˇr��,�V�(~MG��t>��0L�JLO�B� �:h�$�q�:��x�4{��S��ls�8\K��h�uɎ��=��01�3-�t�<�7l#��H��_��K\~��g� 6�4��nU�㙁�ۂ��W��z@��&�o�7qo��6��+�3�+]:�MH&�� v�G�$3CX��d��<�a0�o��Z��w7c�V�ԟ�U�UO��q�B�a�ش��;M�ߵh�;��f��ɂ�4��#�l�\�O>�#B�r�@Қ�O8ꞩ��g��s8(��(�r�z�h��c��x=��\&��Lןv3��)��I�د�%W��m��s��q�#޾��&Eo%��ݗT�k`�C��\=��G�C��ͨDp�˯�1�t��\��!/��;��õI�X�0$�ܗ�r�H4Kp�!��p��EmʞS�` /'nb��I�l��H*e�>-��^�H:��i��{�͞s�B��;��3ޮ��J��RY�L6xǥ=pʮ��8>M�o�H�ؕ��I�H��c��1�F3nV>85a��]y�0��c��Pi��q)68n�<_�%=�_��R��l�)�q'�p�xHyfV(�J��B�7��:'��7��j"��l��b��̈́i��:J�E��l�e6[fk�ʗ�t#��.y�@r�EZ'�a�Z�(j�c��섓��d��A8�8��g�{R�]�XM�sb0g3p�q��$Ç�a2F�8�2��1��:'q�EK�!��`(:"X��ʽ��M�<��i��;v��nѧ�΍z&|;��~�q�0P��E��+b��%� ��t��*�Y�>l�Z.b��I�tq�p#�3�?(~��͗�F{�ø�67��Ke}�W�W�>�G��Y�ub]��5��^��%�^�!?ŝ�z�%l��u��=}܇��OP]lF�c|��+c]��f�c1aC�R��80��|�Y�w[�!q�N�i�S��S�xa�g�>Ǐc\E&'1��r��rΔ4�f��c\P��`s6�ji�1��7k��$7]�lQۅ��US��;�q�u8�V3\�Q6al��>Θ�"�؁l�kB� �`��M�_��{s��S�6>�kj��y.��R��%ER��Pe��m��?��-l�l5��4��b�|r;#һм��y�4��2;s��y ��qՇ�h�%�}�D:��r�imC�;��9?�bB>�Yk��f�:�4Ry�Sۊ��l#s�ꆥ�4��x��i��0�H�o_0�eT�@�&��c| ��\��g��=�ʥ��#u�>��4z�6��7!�9pe*��g��ErZ�@�n�k��bK8ҭJo��(nQ�ˇ�Xf��C��c��]��{-;�^�TU��g�M�Ҷ��$�B�q=�|�&|�_"��Y�Y]�ͩ�Ӗ6��f�0��`B��4�A ձ�mskaa/X�n�J׋��B�q+��r��Dϵo�$�Ly=�h�n��$��[r�PH�K��5�$rN�NE��X��9�!��2/��Ic}�2&��e�a0JL��F_�(�Kӽv��v6�j+�b��ٌ!X�:du��±��P;MT5#�}�i&�e/ �o�0�ia\��/��`��kb&B4:��(��*��eޔ�w��hެ��0��G�`��6�3ɾ��sk~��+��?5��r��^U��.l'��ꌿ��Z:�y��>�x�#�ݾ��G$h��?�M��[��a�O��۩��@��+�2��\@��s+��?�̩�9�2��=��2+J?��F7ɯ�?S9�-/Ǭ�]Od�w_IG�t��`%�*`�y��dT�$��n�a�F�g-&P5+cJh��LFl�5˽�l2�d)Q@�%�x�v�$�hwK٭}��xdt�Θ��Mw7P�]�֡-?��wو.��!ĵ�@�޵c��a�g��ծ��*�x��?�$��x��Ղn��ŉ%�K�~��X?l�6��~vDD.K��U�e��8p'��-��9�PӰU�.Ց��ӣI��if�Ddb+�ϔ�Z��l��SK��P�U�BI�6z��i>��խ&e�t��C��E�p��Uw��?�2)�)�v4ˑ��RJ�:K;_��>�y�^5�Ё0.�`�y~z�O�?\��\0�`癩zS2�;�F��e~L\�pr=��L��(�p�`�0��͎��+�/z��x�e.Q�z0|_.��gyC#�y�R\8��&u�9@i��q�q$��dB�5��q�C2� ��&)B:�q��I<)b�b� �M��*&>�< ��YyV-Z�F~6s��l��9+k��>�NDoi:��AAy�W��p��xJ�3}� �p��8Ϧ��~��a/��tS��F��5��0��e3ӊъ�E+��{��S��P�`��S�C�D�Ԟ�;�ļ��킶��Kyk0��6��$@>j|U*��W7�D1��le��`׿ZY9�H#�I��xA��q��i��s��w�W3��ĉ�I geUى'�;)�x�LӲ��f��;�Q띴�1��Q��4��q{��T2��A>hjN\]�e_��#J~g�0"��83��Q�J+Έ3$扣�ԩ��JHي�1~M=�ڨ�\�C�=^ n|1Yy$vӢlM#�Ƣ�B@��b�&��ݐ�jM&v�+�3�f��~g��h��0��':m(��ȟn��à�'Snou��I�O��O�yR��lݩ{9�6��`�h�k�i4Ӛ-��ZH��2b�$�c��^͈ߛ֝=��y3��fl��$l��W3��8?5[� �0�x*s6��ULMwd��lW�s�}>��I�GYp��򇶈�8C�:�M�I|r�g��%O]g�w2!��v$� 1��K܂��gQ��Ȝ�a[oC�e�Ix\��L[�e��U��߈<�x�|Ob��+�C��I�\$㤼6�Q�c@��K��u��Q�tg�)��EL�딚o�W��ј��\&;��!��H{��o��R��=V��O��O��#uHw|��cu3z��q�-/\��Gc��{n��q;��̳�ٿ[�V��@4�_�Z�3�ȥGU�T�R#�ۭm~O�ǉ��Z�/�P��/�:D��s�t��4fC^?E�R��5��)gM�"Rb��[�8kGc�k*��D�R��Zi�M�(�9��L�~ǩ��3dg��'��q^��u�c�1�O� ��EJ�])�8�Z��Z;$.�i�X��E�.�q&?>�3kL��~dE��i�Bs��G� 3�$g��l�v��ͱ�򾷜��A��VOUx%1'�D�bU%�v��jzV�}�JΗ/�� N'�S�v��G%h��=_Wmb[o��c)9��m0��3no �`@BJB��֊$�Ï�{��[�x��r:vB%��͟^�٦1:�~��0��A��:i�pf�u�C�)�[�xc�J�<�E��ߧ97E��$`߽"��^SY^��˖\��Ҵ�Z��KÍh6��H�ML��W��UYn%K�LMe�7��2��֑��g�I3:��2�I�s �cf��<��@|��w ��$ZW�Z�A��v�ʊU�g3�+�֟c��P��ސ#^T1Q𡧏��d�M�pm׌O��׈��"��>�P�]��i��f��0L񖩓��^��+&�}�@|�n��ϱg��<��)A8w��+[gF��x'y'/�$苑/�P��M�&�n�r��'��J��G^h��iy��B�C��O��ߡ{�'�ذ�aZ�TοF��#*��?h4��.�*�m��Χ|�zg�Z�)D~�I�-�I�kSƸ�$�� io��h.��#=v��C�1ȡ�/,~:|hk�y�a�z�D)��U܀�ȆK@��YKS ��4�3�v��f3�"�[/��x5:�� (�˵y��*��]�hE�#�~��YE��Fsy`��_韮�\� �]��:�nd��.��4$b�ɲ��g�߀��T�g��>��L9��g�m�,\s]��(��f7q��\9:ǣ�y��[�8[d�E0��1�WVzO�/]��9�I��U��Of_�)Տ��b�̲�q��:KK��eX ]�1M��j�r�Je�p��8/p؞�G�b��j�S7�G!��R�4��m��͘�ޔ��P��ի��:�SqUz�� 2��{Κݲa�?j!��][g�-�j�[5�I��@-��Ҫ��G��YU��D�U��[⼧��ҵ�~X��%65��Zd57t_�I�J]��2�%ۂ�^#�l�s��L�R�X&q^��Y��wl$�TP�h#Z��b"}ȵd�<��`�f�L�-�C��08�#W7,�f8�1�!�1|0J�B�,:�ve;�<�/%x��ڏ]'t8��XA͙�D��[�r$Ml͑TJB�c��St�UO�?u��{��O��Z{��s}zF��{��X�� {b��ޱ�&y팕ۆ��*=~"��랝�;�y<$�|u5�G`\�b�Q��l�m��. 5�8mҤO7TgZ��_o�{���-�uKĚN�h��O{�29G`�i+��x�7��?�:�H �Ы��'�@NAvNhF��G8=gܨ�4�4J2�sVOT��"��N�\ei�:O��H'��$-��35�ٓ�|]�$ƋH�:2�LY��c��>��-��k��F��;_��0 ��zaV<3��N�Gٞ�FIB+�^B�E"�k�{s�{��$g�l+e�8�YN��e�պ��N�J{Ӧg�k�vv�Hp}��;��G�h��č;eV�n�|��r>��;�#��F�#��D 6�[�+a$��\XU��]�l6�^��K��2��=D�!��-�f��e��z{94P)��8K��E��`m��s��՚[��H�@��`{�=HN�g6�ZB��1D~�at�e4��X��V4�m�V�;iv�?erE3s�Hr�U��I��d�#w��,�$�U� -�6��!h�v��!ن�o�G��m�c��m6��e��ͱ�$�b��5�d�h�U5v��34��J��]��Ƹ��aǮN�[w��ОW!úlJ�[�WD�2�փS�lw�WN�r%��\�Pٵ⯝�u�ZI�lvS;$��:��Ѡ_��///~�Ű~�qc�DE�=��ƂҴ��N�.�@J3�$��")��@�pfH��ԥB��мʁ�vї&;ۮi�%|3>e-�'�J��U�&O�Xl$�2iג]��m~�eR<�o��UF�炮c_̯��}ځ�H?�q�6%�o�v3�8��zu}�攳��Ȇeg�f�?i�{�s/��0��Ύ��*Z��$i��?�{�+^'��m��R�@��v��{�b6m��>`P��.0?��(�A�+�^�^�f��T��y�~FL��ŧ>1�}��c��>��=��c��C��k��iv.��p�_��Ɨ��.I�|vԟ�r;.i��h��G�Jwں�Q�q"]�D��CT��p��&$J]u��>�", "J�Td�}��?a��jƧ��!��'�Oǩ�T]�=ܮ�q�?Q�l�߫��E��8b��ޫI/ʨ{�On�f��U6->y4��M�۹�l��Ow��߮?��e4��$��_��駛O��9ͥW�ΐć��Dl��ӧ(M�~��k�X�|�O�٠}u��w.��ce�xb�x��=�ev��84�8�`��w��q�3ܟ��l��7uD�o=��o�&��WO��V-��_��![ �<�k��:0�jG4&T��q��$��a-(qL'%��i�LΥ �i�L��p.`�c��H�hу�rI�2�qG�V�>l�Ht�|��*.p`��.��6\XL�O��h��:�2�ݿ�<.�GFE��O��~�轾��ch�@^i��i��|b��l@��kվ�lq�Ȧo=�{>o|u�'*��.|��O1�M��Tp+��6X�ʼIX��Y�vq5ph�ȽB6Uj��E�24�k�l1�Z�o=��4��cj[��q�(��vK�q!��F��i�J��M᤼��f3�.��e�:��jm��h�d��N��$�n��n�U-�{��X��5`D "��/L�~?%��TW��R"�Q%�Uư*e)�X)�n��e�H�^�>��Jƀo�S��J��o��l�n^��`�j�8p��Qg�v��2�x�9�q�bZ�Pm��2{��S��9�eTizu!��xz��\㕕��`ԁ{�1��͍��S�O�i6myM��`sf��N|��5Wj��_9��_.~I0�9��&gA��3�;MJ�K��|Q�\PJX��j�O�-��s��t�Ћt�o��x7}u[�4��-b�=;Ǣj%�7�K��tAj�"��я@��F"lQ'5�U�q�5�:�-�1B�2[��U���)Z��8��+�?�<��\��1@�2v>��tыq|�K�M'8{�#D0��{a:��^��y�O��ʨ.Q�}��j�A��4��f�̷[Ds߮��$�%��3{�'0��Z��1�L�q��L�9(��/� �+��x��AM�hp3D��Ę0��YO�0��HJ��gI�՗]�/�;�J�6��0I��Y[�`��er�Q��&��h��4"(�˘̃��/]_��9�7�;�n';H%Q�k��6�c]��[Մ��wP��ڌ�4^�V��\��i��35�9n��3��X��vT[>mb{w��洩�bT�5熁T@�kpY�0��8-=@W8000e�)�k�`�5��B��B�1 µ�8��**�X��-X�wL�}C��c]E�)��B�!��זW�!�B��7uc�V;��fN�oV��J�W��آB��3�~�8��2�kcV�i��ڈlI{�=�A�Ty�v��%�kj��"p�l�6�U��=�`nf�b6��p�A|��٬�&��\`/(0�VV��˱>��x��3e��ZJ:3��3c3hcs��\�9lA�҃�S�GE"�"��`�@��^r��sf92'ֹ�ahN�|6D6(��.��yK�Ts��G��PY�u�U��N��h�X�̮%2�3ς��+d��ЋE�n�/S*/E��j�!�v5�$] �[Qъz4X홪�w��G��j��`Y��X��_�T�촅�F$S/[\�o�N�K�fH�c��k�Ղ$|,��ȍ>��}��Z�p�pV+�f�W�+~��kmw�W}P��>��m6o��YT�7��-�=]�͡N�ر�nǖ�1�q!��ѕ�S��0�ͷ��*y��@�YWB��s;��R�Րi��X<��*�a��UǦ�X�rK��J��Ř��b��#7�\)vV�ɅI)�IΠgx�^�tkF�+L@��DƖ&��s[��ʫ��j\�Tܯ�շ\T�]�$�g[��F��g��Lx�mǰ��/��?��6v��_��M|��Ʉo��Q�|��9D�{�R�ۿ�M�ٱ�ܢ��R*{�k��Tmqv�ɴ\��@�*�ޅ�k��Qui��p�6�B�qI��W��ӆq��T!W�2�\ژ��c'��:�B\��#��1�Y�b�386ٲ��DsJIc&�|��j�7Zͦ=��Qb��:��p]($�� Q �]KX'�wp�j�3uU�k��P�к�)�=��,��w_<�t��Y��~��(�(WQ�7�v�C��v��q�4��Y�(�A�&2[��K(��l��e�{"��/_>��%[+�^�]V^�qo�}��\G��W{0��1��Ŷu$|�D��Ŵ0+D{��F�A��`�w.�l��NxB+H��E��/��♪�ڧ� a�I�$�"]��Wt�x��%�sVB�ӻ�`=�ؿ&�~6�S��m-T�f�?`��M��j�C��G�pm�R��k>��1��Z�h��p�ζcB7m\�ԜWb~V��`�w|�Js9ͣ�}G��H��f��ȍ��mCP�*G��I}�,�G4�c�J�p鈉�� *J�ZoA��]� c�e��a�hA�B��,�J#��ѫ}�8�|ce1��Ct��h^G��<��M��f9��M��Y"85|u:4i�j��;�m�sYj6Z\��:� �߲d��-X3չ��4�R7T��{��cǨ�n�9��u��I�:F��=�h�D.�'Z��ʀ��Kd�K��Q�a��^'�f��DAA��f�1�%R'��G۬�_��г*�K��C�>��7 B�"�ủ�P}m��N��D``=u�һ�#E��Da?�^m�,��zg��S��T��1�/��,��2�(�4�:"<��p��ad��AV�>�=�0��s�m6rt��-��g�n ��nx:]��J�i��3l��0��q��m�:��X(�s}��%qV��*��"y13X�>��ܚ��ywɸQ]�'՟)��LD]��0��W�3�"�(rS|=`�r�1 �)?$7��e�L��U8�1!:sQ�,��\��mMPq��9�c�ݥ_ɒ�~�)��6"�c'�\_��x��Q��pH�V=b��x�I6y�e�P��{��{��]�E{�E��'i_�h��l)>ǩ �s�x)b��#��s�D��8� �j�q��\r�7�č)�1��˺��[0fh�{�\_�?99�G ��7;[��:��G�ۻ|�s�s��vqe�%��v��U|�>|o�qY8��i�u%��Qx��Ink�4W۪��}�==�/L�_�',H��*{d��,�U��cg�f!��rH��U��V��^@�}�eX^"{�v��X�X�q~+�Mp��)d9��P�Iؼd�K��9��u�D@)��Jr�?�-*��,lb3{�'�h� C-�U�;��4��N��ԣ]+��_�]��ǡ��A�?�aE��۸-�=��%m��R<�>q�M��u&��]��3��C�b2��9�"|�a�un3�z��,r첖2#�f��JZ��\r*sjL�hL�R7�0B5B�I�\,.��LIVa�8��*�7�7��!��[�<�0�s��7�@�6'�c}�b�z��;O�`�n��{��8��%��3�8w�;m��'��wc)��,�.�,7�F0�s{��<�$�g�>F�Wh��w^��l�^��Q��v�<�=��S=��ivM��g��>nm�O�;�Nv��u��;|��;��?UO}G�u|pt�?S�|W��ps��Y��;r�r��v��9��Q[�';��_��c%8�d�߃1��%r��R�i(M��Nv��{�z�J��:�9��Hѣ��Qov�w��Sգ��Q{��A��T�Zg��~��Q+ͽ��z��=W=jm�⨃Ý}�H��B��js�ytrxt��s|�u�5�NC��g��zhO�zj��N�B�k�F2}u�>�{��_{�֨��>��`s��c�^�u�]3��z�~N_��<�z��T��U��¹'&��L�J�|��k�ٚyjRi��!Vcw��=��'��N��?[W�֫��O��|��=�s5kz��4��9��Ӫ�ަ�4z��zNͨ�aw�Qϟp9��(Z��'G��u��*_%8�eP��?Uϩ��ެ��G{��g��3�rMjݖ��V��T��~��%�\��J�[*�^��/��9��]��+��Q��ix�4o��3�)I��8�Q�-Cq�k��ч�߫Uף��n��|��Sc��L�z�P�h�F��)�:5n�&d��}��iAA��MFI��\��:5�i��U�a��|�ZaG�ݺ�D�z�A��6��-'��eZ��J2��t��3��3|c�c+;u�3��#Ѐ��_vZ٩7�1=h?k��g�잵�`��J�z��_��N�<;��@uQ��Vy�1��f:��#�$Zm�}�7�aYZ�:G��.��{:�57�+��X�镍ү�vv�g�I�h�FT��k�٤��2�x끣��@[��y��O(c3]�{��˛*#}�IOg�0orx��1�H��5�S��t�uʴ^�_r| >��*M??�|O��5��:M?�:��,T��5��$�\gB�z��@��=�tZ�kX�UR�5��h)�a)7�u�W�_S�S_P�g��V��|4FG��g��i��{��sz�\?F�~�~_?A�_�璨s�~��-��b��R?5\?��^�ƹ��6�|��OM�K�5��9b�k�)��S��F�-��RV��덬�D��p��耦�S��f�t��ۻD$�~��<��.3�܌�ۃ��C��(�S3L��,*}|��[��4�O�/*��~=�V4?J��E�ŭ�(wt�~��ZQ��i��o�6��g�fV��w��C��~B��{�c�u��,��]�ӈ�� ?n<��,�o�v�w7�Edwdw��Pkq#�&��6��"Ft��N�Ml�]#��8�p�u��u��1�k�<��'$ʁ[#Ns�f�D��ɛ�#��O�?�s�~a8�K�´�%b�H��ei�},�,H;��:��BVP��rd<��^�p]q�#��7u��4��c};��=�*�rd��@`XZ��d��8P��Qh�6�{\�32�1�U|�ا�b(M��U�'��7~��B_v7��١L�}�� Ľ8�gP�Y!�G�H��C)��}��z��b�JY��&T��P��Rne ��[�y��g�?�S��d�H��;^ow^�`q��rD[/��6Qgk"2р��:ꏃ�=��1D��ͣm��#�[o��7�(ӯ�f�:43��q�ψ�t�;��x�`?��uO��?9�'�Q�f��f�U�S?E��}o@NDՏ�q�7G�p<[Gœ��p�c3UҍP��\��U>A!�:*��1��lER:*�g��K��9Ge��牣�vL�Y3��Zn�@��y(~��+-��C�"�Lq� �Y�(��5�/��s�W�&�/�5]֎o��^�}�uE)��u;˫��ο˞�� b�.��z�s��N&d��6I?s&�;��T��h?@��`�j�;��[��sU��1�G�*Z��+��lʦ|c'E��FX�s�3��,Pn[��eq�gz҂�!��y�MǑV�oW��f�p4��DyfJ,��#N�s��㿓R��b��^�HJ��A�G�ޖ�Lܱ��3'#�X%��L��Y��Ita��؆i��С��z� ��L��:p��D�t=��G�v�>=��I}��39�/��^Itk�؁æ?L�FA�;�N5L'M;��<�v¼��+؈.�dne��GC𰐳�*?��N��X�w��`��5٢�d��t��q~~�i4�v��tM��x��j�Bd��&J�ך�̀H<��`�z�'�$��lT�=�Ts��O��S��Q��\�w�Om�Q��.X�rQz��=*Q{6\��O�1m|NC�Ÿ(V��n쎀��>�M�_��$R�4-t��A8L�5X*K�� ^rI��zl�w\�/��@��w��ټ3D,C�H�3D?�`�T]��t�>�<9��,ؙ�v�j��8��N�CO�<�MK=v�K�:A�{��#�!U��aKBs�s��t�P�o��<&:��;��*!�nP��[r 1��*��~vO5N@��`�6��Y{�Uoxv��Q��f�_��Y=��Y��qlrIժ?G�E�#�SO��&�A:�6��ÞH�@�m��Ԃ�*a��0��žUls�`��ѐƴM�L� _M�'��$8uFY6�Y��QA�$��<&E}w[F�p��@b�-��&}"��Lq�t��}��Z��/�8|o�Q�N��gP0\��#s��\왋��/�n�6Nj�2��:��4ѻ>NB�)lIyYY�0A%ISW]��gbB��rB�u�J�9��@p�� h{=��-�)��o7m��p�&��g ��P�W/a��e��?�W��Z��wP�}��b[�[�5_��o��T&��C��iW��0��է`�Yă)@�Ʒ%&y!�9l�Mj֟}�h笑u`Q"!��PqBǆ�g�d��}q��%,�s��&��@��WYe��~5�4��`ƀp��NM@h�Oa�ؑ�,��qM:��MwUp͈Z��Ҙ�b$Íd1��\��Qڙo��ԥ-�X*N2��l]�ml�y��9��4��1%�v��E��Wj�qj�zq�hSjW2��v�t��C��f��co�u��A_υ�*�4�`#C��x/��bVL\cmpH໐�s1Ԝjv�+6�N��@�[S"k.݄�]�>�H�%v"$ƃ(��^M��W�ݞ�8w�>Ƿ~�~�_7�v�{��6?2o�Ɵx}S�'�M�v��åBĈ�Ԍ��lJb�)�NXW#�xƫU��[��f'�Z�8&��N0a�e��V�k"qL`��I��(�z��d�=��z�0�h��0��g�Ƞ!~+1��a�=��5�K�t��a��WYO��%1{��W0��><5�Z{�t,�!��)�m�IƹW�>�IN��O��_ݭ��;̩ۿ��"R�v|1�L&%d��m{/�樟Qۜ�K;��/��(f�B�3�_�Å��m6�kl��%>p��dnt�kH�lt+d�ޗ�Ml;�Uv��K��"�Nܟ&��I@�O��ֻ��9��*��O��?>�B��+��զ�W��:T7�@��jO�W��J�&f��Ƀ^�I�X��*7�p|[&��˓�&>�Nh4*��qx J�I��Y�򕺕Jo��D�TffW�$9.�e�M�]g��K�[)�"5j��Ct".Q`� �+ͯ=��w GO�Nc�kbtbV��6�88v9��0�o��&8>��~�|��zZ�@�5��}`W#U+i>~�h�B�eR�l��7��_+}��ƣ�C{Wp�W�P��|�i��Kĳ_��v@D��ڵv�*�>�%�)/��2{ӊ��jl��r��zO��5�䅖x�U�0;�>�?��J��*K�/$G��/Q��Z{��ѺlU�m>\��]��O6YX1�5U�@Uj�d!��R�']�H��=�]u�cp5��߆�_'��߬02I}��t}��ws�_�qS�תi̦�s"5�7��^G"�`��Yj��IB��z��9jz_*�2T��X��:���P�?8T||�M�+srր�Ή��s�z��8xA��k��s�2�?��C�&�-�� Ț]��UO0��C��+��:!�o��k¼�4�5�b=�0�v��J+��/��TM��<��h�+�G|�-�[�}�&�==��sZq��;��ĸ�#��$*|�-�iKb�e.w)��Pb��?1ۋT��g��֬M��ڐg��<@BZ��5�"��z�W�B0{E"�1��Wa��1��\q��5'Wz��*n�7�-�Fp�^F�D&R�MlB�쭬�u,�B�o�Nh�4��#�$\G��I;��$�w��"��W" Y��"�S��Xf(x�X�b!�I�w��Tԑ�:�RCV'I�'qX��=��&��:psr�?Ñ�r��/��ñ�*j}ȯ��}=��D��[�bЄ�f'��En�67�Hc��WL��<4�m��b��3�$ '&��Ex_�.a��<��T��w)��E��8U��*�ߣ��Y��SQ�hx��了�g�ˆ�X@L`I�KsA�c��~��.�-�ҥk�?�j��O�y76�ৗr��]��ˈ��k�5�{M�V��{U��WYr�U�H^�Iq_�f��\H؎��%�G2/�hl%rZߵ�l��=�\k��{5��4:��-��26��U,Dv�X��-;��oM��RT��,-�(Ω��_)��ʁ��LU�Pu<�X��j�4E��k��T61�/Ya�1��A��Ҫ�hZ'f�f3;X)=��iJ3�+ h�V�%��%�j��2%��x��34 �L��n'M��d(Ҷ��e�L86��8*^eT@ӠF�X�B�,��qMD+�n$�8�6W/C�[�¼l��G^i'�+KA�W��0Dk�c7<�UO{�q+�4��1�0<5b5췫k��P��;�;i�D�2�.�GMԵ�q�7�/��p��?'�:g��H��*S��x��?�$o'�4�V��aC�w�A�CmD��qC�$��2�S�CW5~��PE�7WV��q�X�4'�4=v��z��1=�3�mͬ/��a��c��8�k+�s�v��U��n�ǫN��;j�&ǀ��0�\fWL��5P��R��E:m{)�x8�ڴ$A�$u��{��k��Uc�v��^*��e��?�ȇ��/q��R��V�-6�tl3)zt�G?�5��!Eg��(��As�Mq��RNS��R*m~*�>�הb>�6>%��kh�^W��_m=@��'�X��2+C ��qy��ğ��_�ߢ=7ʮ��?NXBn�/��U��7��3�y�S�?KRWyi6��k�rر��-4#�d�D��/��5$#�h�9:�.Ҁ�O�:��8:��Ã談��^Dji٘`q��ĴU�K�Ge��i�%�U^��M4A��A[I�Zt�O��.��!]|�� R;��{��f@滰W*��u`~*��(��zd��g��:Q��P�m�9��̀�ĵ�_��?�t��P��Y-B��'��o��g��^��Ү��0(h��H�G8̔��$��v�jO�QnnwjCe@��t�MVV��>d��V��{��#�;X�tz��A$�.��\�ܦ��tI&�;��V�Ԑ}�M��7��>5l{e�ҕ]��R��yi‚4�M�5A=s�0C�!��S��]n%�C��;߻��|�>!�z��NͶ�i%��`u�]@16��}�j��1�*�M$��j~�k/�W��.ȍ7|��So��7�罱�y�7~n|j�Qp�4@0��E��<�T7�[V�W7�~%d�:ǂd�[�u}��.��ɠ~�u{��Qণ[�eI��ɭȝ�H�)g��60�n\[I�#@s 8-�A�.��C?�+��?�:�8��%��F��̚mݺ�U��n��6 ��iыsd��Qcd}i�OM��W�M�0��^�q��b�wJ�Y�aƠ��I�M"1뎋��'lRK��a��|v�j�� 7�|kES��{�U�U��\*\��4��C c\��j��D��:�d��ֻO�+��R��$Ȁݽ�Q���9L��X'�9�1ĝ�$�� c��I�HR�3��M9o��c6��w��X_7J��`�r_��קǫ3��'��Mل&�cG��4?֝�ɮ�[\�N��V�� M�6��Oci�΍�Vvu��[=)�To�8K�+y��;Gu:2��Cz�\��1�)��T�)�^b�Wa��w��R�B{DiS��'&ڨ�Ww��曉س<,�`A��F{��$s��ܪEЎ��vDXΏ��ԈG<�5E&6�1�ǖ?ճ*9X��=th��/(�f�]5%�~�96��bٶ�:��i�w+e��5s�U��o��]�Sj�y�7_S��-ê��Ѩ�uBU�� jl�wu��YnF��0j-D��^�HI2}�Օ�A97}�Y��ԹD�6�&�U�xH��l��3\��pJT�9��7x��8Z�p$<��ŀ��f��q�Y{x6jƍ5�M|QYF�Ur+��T��q�H��{�\_�ge�(HT��PgdI��d��D'`S^��t{��{��O��Dv�Z��ݳ�Lڡ�EQ�Wt>R��[�:Ԍ�x �j�P�6��l�k��?��6nc��7H��+��%k�"��"¸��O��m�.QQ;y��<;lD]26��e�'U��C<�ꘑ�͚�/��(�ՁSI��q;@F��1Ti暩�zh�1M�Q�es�ᄖA��pk{?Y#1��v�"�/}��dd��͊C�>*b�#Y��>h��!�]��oy��w�PI��.[i(UO��YÜ֫`�?|�j��&HuIĄ�(�"�J��1lJ�}[��SܗI��]mi4^�fB��ෟ/��䀃n�T��`,F�t*Q��H�ӳ��;�& F�H��Es�<��Y�wP��!JT��&Cu��Ҡ� �k��(q�U�k�DB��!�<`'j��p��C��U��o��g#�p'Q㥋;�B��֧��Z�5�a?�L/��4,��Fv=ɫ��i}cg��5m;��F�SY��Z4uC� ��#5��)�]�5J�E�&�hPihP�5�wmܼoe|s�OF(0��[4_XOZ��N�#-@�a�D��6��m�3`|"O��Fvl o��)!S}o�v�K��D��0�b�ZO��2�E��(nv�1��Tg��]"�j��*p��B#�7bȳ>I�}nۑ��G��@=�kS\%l��E>h<�{��q�]�Q��x��9��>:�S��t��3��/�8�fiC��7o+�=F,7冐��࡝O��F6(�%��h9O��u."YC�Q� rr��qjpi\�3/\CM(�d�&'�ؔ��Pr�H�o�ms�˻�h��V��b��|��^kvۏ��s�Mi�f��_n��a�25��k��N��O��`A�Xe8��w�ó�<�`e`<�P=�4٭�o}�tf��\�q�I46Q�*�t�!_��*ܯ�`߀�Z��kn��P� �f�j��5WFC��3��X�)/s|��K�03y3��i.#�4Q��k��ã\�ȡ�Z��ȉ��OnG�1?U�>�7��:��>N��O�Y��CSՅ�]�B�z��Gj8"�S��9�1q��or��#5aN�z!��=��v�oqʒ�ҺJ縉w�#�[y�L_;�\"��I�Ç^?��.�(�%�]��nT,j�"M�"��1VOP�ex5i̹N��aXCl;��w�j��"�{�ڊ&�J�jn%Ы*�T��6�q�~�� )�s�I;�0u|�If��M��h�=��A�ܒ�'#5�]�5��g2�a!?g5��"��X��⯭��9��}�� TH��H]2�}`n�|��K3��Y�z!��5��/�C>�=䋸��g��K��z��p�f��H]��[kF��t��]~s�;�-擯��<��5�ߠT��k��XS��TQ<��҆9me�Ӧ��d�(�+AdeS}�\x;�Ծ}xϿ��F�j&l��(8�f��Lآ��G�N�D�;�u:��s�Z�|D��ˈ�nY��ILo�7��]*S��M|��&��0K�v�J�/N��#dr��.4Ip'��hKx��~�~�;�E��e2�t��M��O޼�i�CvI��i�H�t�z��(s|#�ej}��7Dwa>��ng��|�0��r��9�8�<:"�͖TV됀��iX��L~��Y��a��g��]�?x�W��_<�ZŖ'��x�MU��*;s�h�"��3��s�*7ؽ��$�l$��ۄv�4��.ۧ��83K��j�~�xw��M��8�6�X�Ӊ�x>�~²+�<|�T�U��YNp��QxE�Z�&Dh��y��z��%��)5�q�9�D"1�Y�:�,��A�k�\�yI"�)�$��(�{�kϱ�BM�_ڣL��o�(h�^��F�%I�zhꔥm!��8��^�'�U$-��uM6{`}�s��_�~O�u�Ep��*2�{��/ݦ�,��ù�_Ǯ��]~��?�S�rL|�8K��>��2˅"O0��*�9�l�l�X�"�Q�8+5.A�i��:�f!��Џ��i>�|�(`݁l��Ԗh:(w��굢2OK��(�)h��4��*�i�S�{�)}��h�>�C4\�;e��oP��[�+��:��x��j��6�v[Y�)�>1�۶T5�E|y^I�b�]y�@��vGA��j�`�u��qX��D�xҹ*��_��/@e�Np$��{�nR�Zb�n�J��A@k�v�EFܕ�q< )%g�VҹA�k͌��G�ڰ��8�C�o��AԴ�x5�.^'�8��1��[u��t��VsT��0��efP�&�IP��J�f��&=2{`ζ��1��3G�b/n�,�p>�[~�k6h��s)��}?��H�?�&��R�}?�w�^E�\Y'�b��?R��|�A��HQ%ZlK*j�cX�2��f��Q/�5��o��S��Z��(��o�� i�zڳv�ۗ.��y��qT��Kn��p�1&�Z*�c�xji��{z��@6I�Y,�v�e��Z�E`�u��QKa�P��h�-��#2/��%�R�qS�M;�%ۦ�J�6��T��|�3�~��0�u��Y�Kۺ�H"I"�5�3�:��q�wd4��V��X��,c�w�F�Ǫ%Hj��=~(��D�.6�m�o��1" (Indicator: "GetDC"; Source: "00000000-00006584.00000000.66509.02AD0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006584.00000000.66509.02AD0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006584.00000000.66509.02AD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006584.00000000.66509.02AD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006584.00000000.66509.02AD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006584.00000000.66509.02AD0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006584.00000000.66509.02AD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006584.00000000.66509.02AD0000.00000004.mdmp")3d:T6fb,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "")3e:T59e,"file.exe" queried SystemProcessInformation at 00000000-00006584-00000C13-32925168 [PID: 6584] "file.exe" queried SystemProcessInformation at 00000000-00006584-00000C13-32926562 [PID: 6584] "file.exe" queried SystemProcessInformation at 00000000-00006584-00000C13-34749872 [PID: 6584] "file.exe" queried SystemProcessInformation at 00000000-00006584-00000C13-34751266 [PID: 6584] "file.exe" queried SystemProcessInformation at 00000000-00006584-00000C13-34968479 [PID: 6584] "file.exe" queried SystemProcessInformation at 00000000-00006584-00000C13-34969844 [PID: 6584] "file.exe" queried SystemProcessInformation at 00000000-00006584-00000C13-38195788 [PID: 6584] "file.exe" queried SystemProcessInformation at 00000000-00006584-00000C13-38196726 [PID: 6584] "file.exe" queried SystemProcessInformation at 00000000-00006584-00000C13-39421482 [PID: 6584] "file.exe" queried SystemProcessInformation at 00000000-00006584-00000C13-39422763 [PID: 6584] "file.exe" queried SystemProcessInformation at 00000000-00006584-00000C13-40259412 [PID: 6584] "file.exe" queried SystemProcessInformation at 00000000-00006584-00000C13-40260911 [PID: 6584] "file.exe" queried SystemProcessInformation at 00000000-00006584-00000C13-40426289 [PID: 6584] "file.exe" queried SystemProcessInformation at 00000000-00006584-00000C13-40428305 [PID: 6584] "file.exe" queried SystemProcessInformation at 00000000-00006584-00000C13-40888929 [PID: 6584]3f:T1079,"file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\ELEMENTS BROWSER\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\UCOZMEDIA\URAN\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\FENRIR INC\SLEIPNIR5\SETTING\MODULES\CHROMIUMVIEWER" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COOWON\COOWON\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\LIEBAO\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\QIP SURF\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\AMIGO\USER\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\TORCH\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\MAXTHON3\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\K-MELON\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\SPUTNIK\SPUTNIK\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\URAN\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CHROMODO\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\MAIL.RU\ATOM\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\COOKIES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\EXTENSION COOKIES" "file.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\LOCKFILE" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data"40:T1c1a,file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB related to Yoroi file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\JBDAOCNEIIINMJBJLGALHCELGBEJMNID related to Nifty Wallet file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD related to Coinbase Wallet file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN related to Guarda file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC related to EQUA Wallet file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE related to Jaxx Liberty file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI related to BitApp Wallet file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ related to iWallet file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH related to Wombat file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NLBMNNIJCNLEGKJJPCFJCLMCFGGFEFDM related to MEW CX file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NANJMDKNHKINIFNKGDCGGCFNHDAAMMMJ related to GuildWallet file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKDDGNCDJGJFCDDAMFGCMFNLHCCNIMIG related to Saturn Wallet file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FNJHMKHHMKBJKKABNDCNNOGAGOGBNEEC related to Ronin Wallet file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AIIFBNBFOBPMEEKIPHEEIJIMDPNLPGPP related to Terra Station file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet file.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\KPFOPKELMAPCOIPEMFENDMDCGHNEGIMN related to Liquality Wallet file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB related to Yoroi file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\JBDAOCNEIIINMJBJLGALHCELGBEJMNID related to Nifty Wallet file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD related to Coinbase Wallet file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN related to Guarda file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC related to EQUA Wallet file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE related to Jaxx Liberty file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI related to BitApp Wallet file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ related to iWallet file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH related to Wombat file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\NLBMNNIJCNLEGKJJPCFJCLMCFGGFEFDM related to MEW CX file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\NANJMDKNHKINIFNKGDCGGCFNHDAAMMMJ related to GuildWallet file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\NKDDGNCDJGJFCDDAMFGCMFNLHCCNIMIG related to Saturn Wallet file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\FNJHMKHHMKBJKKABNDCNNOGAGOGBNEEC related to Ronin Wallet file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AIIFBNBFOBPMEEKIPHEEIJIMDPNLPGPP related to Terra Station file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet file.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\KPFOPKELMAPCOIPEMFENDMDCGHNEGIMN related to Liquality Wallet41:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791618357549,"unified_at":"2026-10-10T07:45:57.549Z","metadata":{"hashes":{"sha256":"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","sha1":"ce72e7ae953c13f000d3c8b0bbce3e1ef9a6d6d3","md5":"126a235cd7d2577559d6a3a2381c834e","sha512":"cef05996875922f8bab00568cf85015978d0b629d67aa779e28455cc4929c3cc78106c322e7d56634fd5998b58f18143784c7fb97c271448c90b1bc1bd4e7627","ssdeep":"6144:LgiMaXliaXF7A9bipAoTWryiYx2OU54ik1QNZGGq1cpF2l+O3C:JXHF7A9KS0IIGNMGq1i2l+b","ssdeep_chunks":["6144:LgiMaXl","6144:giMaXli","6144:iMaXlia","6144:MaXliaX","6144:aXliaXF","6144:XliaXF7","6144:liaXF7A","6144:iaXF7A9","6144:aXF7A9b","6144:XF7A9bi","6144:F7A9bip","6144:7A9bipA","6144:A9bipAo","6144:9bipAoT","6144:bipAoTW","6144:ipAoTWr","6144:pAoTWry","6144:AoTWryi","6144:oTWryiY","6144:TWryiYx","6144:WryiYx2","6144:ryiYx2O","6144:yiYx2OU","6144:iYx2OU5","6144:Yx2OU54","6144:x2OU54i","6144:2OU54ik","6144:OU54ik1","6144:U54ik1Q","6144:54ik1QN","6144:4ik1QNZ","6144:ik1QNZG","6144:k1QNZGG","6144:1QNZGGq","6144:QNZGGq1","6144:NZGGq1c","6144:ZGGq1cp","6144:GGq1cpF","6144:Gq1cpF2","6144:q1cpF2l","6144:1cpF2l+","6144:cpF2l+O","6144:pF2l+O3","6144:F2l+O3C","12288:LgiMaXl","12288:giMaXli","12288:iMaXlia","12288:MaXliaX","12288:aXliaXF","12288:XliaXF7","12288:liaXF7A","12288:iaXF7A9","12288:aXF7A9b","12288:XF7A9bi","12288:F7A9bip","12288:7A9bipA","12288:A9bipAo","12288:9bipAoT","12288:bipAoTW","12288:ipAoTWr","12288:pAoTWry","12288:AoTWryi","12288:oTWryiY","12288:TWryiYx","12288:WryiYx2","12288:ryiYx2O","12288:yiYx2OU","12288:iYx2OU5","12288:Yx2OU54","12288:x2OU54i","12288:2OU54ik","12288:OU54ik1","12288:U54ik1Q","12288:54ik1QN","12288:4ik1QNZ","12288:ik1QNZG","12288:k1QNZGG","12288:1QNZGGq","12288:QNZGGq1","12288:NZGGq1c","12288:ZGGq1cp","12288:GGq1cpF","12288:Gq1cpF2","12288:q1cpF2l","12288:1cpF2l+","12288:cpF2l+O","12288:pF2l+O3","12288:F2l+O3C","6144:JXHF7A9","6144:XHF7A9K","6144:HF7A9KS","6144:F7A9KS0","6144:7A9KS0I","6144:A9KS0II","6144:9KS0IIG","6144:KS0IIGN","6144:S0IIGNM","6144:0IIGNMG","6144:IIGNMGq","6144:IGNMGq1","6144:GNMGq1i","6144:NMGq1i2","6144:MGq1i2l","6144:Gq1i2l+","6144:q1i2l+b"],"imphash":"90219210ac67d72f58379b44b35f53db"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":400996,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1699178620000,"last_seen":1788754610000,"last_multi_scan":1788754610000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["backdoor","commodity","informationstealer","redlinestealer","evasive"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":82},"sandbox_signatures":{"informative_count":183,"suspicious_count":15,"malicious_count":12,"total":210},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.RedLine","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Kryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ser.Zusy.4719","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Zusy-10033256-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ser.Zusy.4719 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HVEE trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:TrojanSpy/Stealer.h","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005ad9e61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_get_geographical_location","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-ACN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Kryptik.KVJ.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.UBC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.4362400","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ser.Zusy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Creates new processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"References URL in command line"},{"type":"suspicious","value":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Dotnet file packed with confuser protection"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"suspicious","value":"Calls an API that may be used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Communicates with HTTPS web server (GET/POST requests)"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Decrypted SSL network traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Found WMI keywords in script (string)"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"malicious","value":"Tries to steal desktop applications information (file access)"},{"type":"informative","value":"Queries list of installed browsers"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal crypto wallet extension (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetUserObjectInformationA\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStrings\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStrings\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\"), Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"GZipStream\" (Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"LoadResource with parameter {'hModule': '1988034560', 'hResInfo': '4851216'}\" (UID: 00000000-00004332)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")\n Found reference to \"CryptographicException\" (Indicator: \"CryptographicException\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")\n Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")\n Found reference to \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")\n Found reference to \"CspParameters\" (Indicator: \"CspParameters\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file packed with confuser protection","description":"Observed string: \"ConfusedByAttribute\" (Indicator: \"ConfusedByAttribute\") in Source: 00000000-00004332.00000000.74701.00152000.00000020.mdmp\n 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\n Observed string: \"Confuser.Core 1.6.0+447341964f\" (Indicator: \"Confuser.Core \") in Source: 00000000-00004332.00000000.74701.00152000.00000020.mdmp\n 00000000-00004332.00000000.74701.0040D000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1027.002","relevance":1,"id":"string-232","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 30276-84-00404DF1\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 30276-84-00404DF1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"DecodeBase64\" (Indicator: \"decodebase64\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"b__754_0\" (Indicator: \"DecryptRSA\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")\n Found string \"DecryptRSA\" (Indicator: \"DecryptRSA\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")\n Found string \"EncryptRSA\" (Indicator: \"EncryptRSA\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")\n Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004332.00000000.74701.00660000.00000004.mdmp, 00000000-00004332.00000001.75074.00660000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Decrypted SSL network traffic\n Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_UserName\" (Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")\n Found string \"get_Is64BitOperatingSystem\" (Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00004332-00000C2C-172807113\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004332.00000001.75074.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004332-00000C2C-179283248\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004332-00000C2C-179283445\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004332-00000C2C-179283770\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004332.00000001.75074.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"00000000-00004332-00000C2C-180854595\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004332)\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004332)\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00004332)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004332)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004332)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"IsWow64Process\" with parameter \"4332\" - (UID: 00000000-00004332)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"GetActiveWindow\" (UID: 00000000-00004332)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004332)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00004332)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f66077a7e85577f42ed871d8276a00a035d871f7e85577e8dd2c00980e6a00b2f46077c7e85577f8dd2c000000d1710000d1710000000054dd2c00f0000000f000d1710000000064dd2c0053000000f8de2c000000000001000000c8dd2c0040f560770000000000000000b4dd2c00 (UID: 00000000-00004332)\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"GetVersionExA\" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004332)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004332)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"USESHORTNAME\")\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"APPENDPATH\")\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00004332.00000001.75074.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1\" - (UID: 00000000-00004332)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$27","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"150.171.109.74:443\"\n \"23.54.41.214:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"1606049,4448,3191,,ShellExecuteW,Shell32.dll,\"252:05:05.130\",RX=0,PX=0\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004332.00000001.75074.00660000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Registry\\Machine\\Software\\Classes\" in Source: 00000000-00004332.00000001.75074.00660000.00000004.mdmp\n \"Software\\Policies\\Microsoft\\Internet Explorer\\TabbedBrowsing\" in Source: 00000000-00004332.00000001.75074.00660000.00000004.mdmp\n \"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00004332.00000001.75074.00660000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$29","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"logo_net_1_.svg\" as clean (type is \"Unknown\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-2.dll\" - [base:0; Status:c0000135]\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-0.dll\" - [base:0; Status:c0000135]\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\\\mscoreeis.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Registry\\Machine\\Software\\Classes\" in Source: 00000000-00004332.00000001.75074.00660000.00000004.mdmp\n \"Software\\Policies\\Microsoft\\Internet Explorer\\TabbedBrowsing\" in Source: 00000000-00004332.00000001.75074.00660000.00000004.mdmp\n \"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00004332.00000001.75074.00660000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00000000-00003904)\n Launches browser \"iexplore.exe\" (UID: 00000000-00000288)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"iexplore.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 77490000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76FC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016002073916b@ADVAPI32.dll\"\n \"0e000f00e473916b@ADVAPI32.dll\"\n \"0e000f005074916b@ADVAPI32.dll\"\n \"11001200d47d916b@ADVAPI32.dll\"\n \"110012007c7e916b@ADVAPI32.dll\"\n \"12001300cc7e916b@ADVAPI32.dll\"\n \"12001300387f916b@ADVAPI32.dll\"\n \"14001500e4b7916b@ADVAPI32.dll\"\n \"1400150000b8916b@ADVAPI32.dll\"\n \"140015001cb8916b@ADVAPI32.dll\"\n \"1700180038b8916b@ADVAPI32.dll\"\n \"0d000e0054b8916b@ADVAPI32.dll\"\n \"1100120064b8916b@ADVAPI32.dll\"\n \"110012007cb8916b@ADVAPI32.dll\"\n \"0f001000ecb9916b@ADVAPI32.dll\"\n \"1400150038ba916b@ADVAPI32.dll\"\n \"1400150054ba916b@ADVAPI32.dll\"\n \"0c000d00a8ba916b@ADVAPI32.dll\"\n \"0c000d00b8ba916b@ADVAPI32.dll\"\n \"0e000f00c8ba916b@ADVAPI32.dll\"\n \"0e000f00dcba916b@ADVAPI32.dll\"\n \"0b000c00f0ba916b@ADVAPI32.dll\"\n \"180019008cbd916b@RPCRT4.dll\"\n \"13001400bcbd916b@RPCRT4.dll\"\n \"14001500d4bd916b@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" touched \"Network\" (Path: \"HKCU\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\SHELLFOLDER\")\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\\TREATAS\")\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" touched \"Application Registration\" (Path: \"HKCU\\CLSID\\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424\" has an executable section named \".text\"\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424\" has an executable section named \".bss\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424\" has an writable section named \".data\"\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424\" has an writable section named \".jkqvbz\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424\" file has an entrypoint instructions - \"call\t0x403c4c,jmp\t0x4016bc,mov\tedi, edi,push\tebp,mov\tebp, esp,mov\teax, dword ptr [ebp + 8],xor\tecx, ecx,cmp\teax, dword ptr [ecx*8 + 0x462c18],je\t0x40183e,inc\tecx,cmp\tecx, 0x2d,jb\t0x401822,lea\tecx, [eax - 0x13],cmp\tecx, 0x11,ja\t0x401847,push\t0xd,pop\teax,pop\tebp,ret\t,mov\teax, dword ptr [ecx*8 + 0x462c1c],pop\tebp,ret\t,add\teax, 0xffffff44,push\t0xe,pop\tecx,cmp\tecx, eax,sbb\teax, eax,and\teax, ecx,add\teax, 8,pop\tebp,ret\t,call\t0x4038fd,test\teax, eax,jne\t0x401869,mov\teax, 0x462d80,ret\t,add\teax, 8,ret\t,mov\tedi, edi,push\tebp,mov\tebp, esp,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00000000-00003904) was launched with new environment variables: \"sfxcmd=\"⥠f\", USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"iexplore.exe\" (UID: 00000000-00003904) was launched with modified environment variables: \"Path, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"js.monitor.azure.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00004332-00000C2B-171996659]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\\\mscoreeis.dll\" [Source: 00000000-00004332-00000C2B-172348051]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreeis.dll\" [Source: 00000000-00004332-00000C2B-172659186]\n Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00004332-00000C2B-173085559]\n Observed system executable string:\"%WINDIR%\\system32\\ole32.dll\" [Source: 00000000-00004332-00000C2B-173748415]\n Observed system executable string:\"%WINDIR%\\system32\\MSCTF.dll\" [Source: 00000000-00004332-00000C2B-173940631]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" searching for class \"IEFrame\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch ...\" (UID: 00000000-00003904)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3904 CREDAT:275457 /prefetch:2\" (UID: 00000000-00000288)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch ...\" (UID: 00000000-00003904)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3904 CREDAT:275457 /prefetch:2\" (UID: 00000000-00000288)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft TLS G2 RSA CA OCSP 10, O=Microsoft Corporation, C=US\" (SHA1: 76:46:2F:19:47:F2:77:4F:98:1D:63:C0:2F:DC:1A:A2:47:82:01:D0; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US\" (SHA1: B6:63:D8:41:3C:A3:5F:3F:22:64:3C:CB:C2:D3:25:07:00:91:6B:1A; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"SendAttachment\" (Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateService\" (Indicator: \"CreateService\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"iexplore.exe\" is creating a new process (Name: \"C:\\Program Files\\Internet Explorer\\iexplore.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"learn.microsoft_1_.xml\" has type \"Unknown\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"~DF270B012EC176C401.TMP\" has type \"data\"\n \"~DF138B28A738A505FD.TMP\" has type \"data\"\n \"~DF10CB442571DEFA75.TMP\" has type \"data\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" reads file \"c:\\program files\\internet explorer\\iexplore.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" trying to access non-existent file \"C:\\Windows\\system32\\mscoree.dll.local\"\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" trying to access non-existent file \"C:\\ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe.Local\\\"\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" trying to access non-existent file \"C:\\Windows\\System32\\MSCOREE.DLL.LOCAL\"\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" trying to access non-existent file \"C:\\AB958828C4863D416659A6009DBD9E7BF7A87DE51DF206689178EF70BD6B6424.EXE.CONFIG\"\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" trying to access non-existent file \"C:\\AB958828C4863D416659A6009DBD9E7BF7A87DE51DF206689178EF70BD6B6424.EXE.LOCAL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTPS web server (GET/POST requests)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-505","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00004332.00000000.74701.06940000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$31","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"41.11.2.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$32","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$33","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"file/memory contains long string with (Indicator: \"HTTP/1.1\"; File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"js.monitor.azure.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5182f54f9c6e99d117d9dde3fa2b4cff","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"js.monitor.azure.com\" (8 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"150.171.109.74\" on port \"443\"\n HTTPS traffic to \"23.54.41.214\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" tries to directly access volume data \"C:\"\n \"iexplore.exe\" tries to directly access volume data \"C:\"\n \"iexplore.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$35","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"ZIndicates if the text in the edit control should appear as the default password character.\" (Indicator: \"password\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$36","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"b__1284_0\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")\n Found reference to API \"b__1285_0\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")\n Found reference to API \"DeleteFilesWhere\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004332.00000000.74701.00152000.00000020.mdmp, 00000000-00004332.00000000.74701.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" opened \"\\Device\\KsecDD\"\n \"iexplore.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D has high entropy\"\n \"B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92 has high entropy\"\n \"B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF has high entropy\"\n \"E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959 has high entropy\"\n \"E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"app-could-not-be-started_1_.png\" has type \"Unknown\" and extension \"png\"\n \"app-could-not-be-started-details_1_.png\" has type \"Unknown\" and extension \"png\"\n \"repair-tool-no-resolution_1_.png\" has type \"Unknown\" and extension \"png\"\n \"repair-tool-recommended-changes_1_.png\" has type \"Unknown\" and extension \"png\"\n \"repair-tool-changes-complete_1_.png\" has type \"Unknown\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424\" was detected as \"Visual C++ 2008 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/26 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"suspicious","category":"General","name":"References URL in command line","description":"Process \"iexplore.exe\" with commandline \"http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0\" (UID: 00000000-00003904)","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":1,"id":"target-174","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 150.171.109.74 on port 443 is sent without HTTP header\n TCP traffic to 23.54.41.214 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 150.171.28.10 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 23.54.41.214 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 150.171.110.193 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 150.171.109.72 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 150.171.109.74 on port 443 (TCP); Domain: \"js.monitor.azure.com\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"Found string \"sfxcmd=?f??\" (Indicator: \"cmd=\"; Source: \"00000000-00004332.00000000.74701.001C0000.00000004.mdmp, 00000000-00004332.00000000.74701.004C0000.00000004.mdmp, 00000000-00004332.00000000.74701.00530000.00000004.mdmp, 00000000-00004332.00000000.74701.00660000.00000004.mdmp, 00000000-00004332.00000001.75074.001C0000.00000004.mdmp, 00000000-00004332.00000001.75074.004C0000.00000004.mdmp, 00000000-00004332.00000001.75074.00530000.00000004.mdmp, 00000000-00004332.00000001.75074.00660000.00000004.mdmp\")\n Found string \"sfxcmd=`\" (Indicator: \"cmd=\"; Source: \"00000000-00004332.00000000.74701.00660000.00000004.mdmp, 00000000-00004332.00000001.75074.00660000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":3,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"40010237\"\n \"cx\": \"487\"\n \"cy\": \"25\"}\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"360108c1\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"360108c1\"\n \"cx\": \"487\"\n \"cy\": \"25\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"7DPJDVUY.htm\" contains indicator \"ActiveXObject\" (Line: 36; Offset: 79466)\n \"7DPJDVUY.htm\" contains indicator \".Run\" (Line: 36; Offset: 37214)","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetTickCount\n IsDebuggerPresent\n Sleep\n GetModuleHandleW\n VirtualAlloc\n GetStartupInfoA\n CreateThread\n UnhandledExceptionFilter\n LoadLibraryA\n GetModuleFileNameA\n OpenFileMappingW\n GetCommandLineA\n TerminateProcess\n WriteFile\n GetProcAddress\n GetModuleHandleA\n VirtualProtect","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424\" has a section named \".jkqvbz\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/26 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe\" called \"ShellExecuteW\" with parameter http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=a (UID: 00000000-00004332)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"file\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"file\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"file\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006584.00000000.66509.0040B000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00006584.00000000.66509.0040B000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00006584.00000000.66509.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006584.00000000.66509.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00006584.00000000.66509.04BC0000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00006584.00000000.66509.04BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\root\\cimv2; Source: \"00000000-00006584.00000000.66509.02AD0000.00000004.mdmp\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00006584.00000000.66509.04BC0000.00000004.mdmp\")\n Found string - [-]?\\d+(\\.\\d+)?; Source: \"00000000-00006584.00000000.66509.04BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006584.00000000.66509.04BC0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006584.00000000.66509.04BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00006584.00000000.66509.04BC0000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00006584.00000000.66509.04BC0000.00000004.mdmp\")\n Found string \"http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00006584.00000000.66509.04BC0000.00000004.mdmp\")\n Found string \"http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1\" (Indicator: \"encryptedkey\"; Source: \"00000000-00006584.00000000.66509.04BC0000.00000004.mdmp\")\n Found string \"EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00006584.00000000.66509.04BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00006584.00000000.66509.04BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"file\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00006584.00000000.66509.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"file\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00006584.00000000.66509.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$38","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$39","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"file.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\ElevatedDiagnostics\\Reports (UID: 00000000-00006584)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00006584.00000000.66509.0040D000.00000004.mdmp, 00000000-00006584.00000000.66509.02D12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM\" (Source: 00000000-00006584.00000000.66509.04BC0000.00000004.mdmp, Indicator: \"select * from\")\n \"SELECT * FROM Win32_OperatingSystem\" (Source: 00000000-00006584.00000000.66509.04BC0000.00000004.mdmp, Indicator: \"select * from win32_operatingsystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"//./root/cimv2\" [Source: 00000000-00006584.00000000.66509.04BC0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"file.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70AD0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74150000\n \"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 728B0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 71FB0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"file.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"file.exe\" queries basic process information of the \"C:\\file.exe\" (UID: 6584)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"file.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006584)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"file.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\file.exe.log\"\n \"file.exe\" writes file \"%localappdata%\\microsoft\\clr_v4.0_32\\usagelogs\\file.exe.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"file.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\file.exe.log\"\n \"file.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\file.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00006584-00000C26-36336555\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE6A8DD9D22B61920721054A33F304]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006584.00000000.66509.02AD0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEF6227938E0C34737E53BD64B3866]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006584.00000000.66509.02AD0000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006584.00000000.66509.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"file.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"file.exe\" called \"GetUserNameW\" (UID: 00000000-00006584)\n \"file.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"file.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"a0f52d0\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006584.00000000.66509.0040D000.00000004.mdmp, 00000000-00006584.00000000.66509.02D12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"file\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"file\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00006584.00000000.66509.0040B000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00006584.00000000.66509.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00006584.00000000.66509.04BC0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%APPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00006584-00000C28-19697675582\")\n \"%APPDATA%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00006584-00000C28-19728181320\")\n \"%LOCALAPPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00006584-00000C28-19772855558\")\n \"%LOCALAPPDATA%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00006584-00000C28-19809517178\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: file]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00006584.00000000.66509.04BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"file.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006584)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"file.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\file.exe.log]- [targetUID: 00000000-00006584]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$3e","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"file.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 6584)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"00000000-00006584.00000000.66509.04BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"sales@zzzprojects.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"file.exe\" called \"OpenSCManagerW\" requesting access rights \"0X0\"","origin":"API Call","mitre_attack_id":"T1569.002","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00006584.00000000.66509.02AD0000.00000004.mdmp\")\n Found string \"\\\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00006584.00000000.66509.04BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"https://api.ip.sb/ip\" (Indicator: \"api.ip.sb\"; File: \"00000000-00006584.00000000.66509.04BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 171.22.28.239 on port 42359","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"file.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\COINOMI\\COINOMI\\WALLETS\"\n \"file.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\ELECTRUM\\WALLETS\"\n \"file.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\ETHEREUM\\WALLETS\"\n \"file.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\EXODUS\\EXODUS.WALLET\"\n \"file.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\Documents\\MONERO\\WALLETS\"\n \"file.exe\" trying to touch file \"%LOCALAPPDATA%\\COINOMI\\COINOMI\\WALLETS\"\n \"file.exe\" trying to touch file \"%APPDATA%\\ELECTRUM\\WALLETS\"\n \"file.exe\" trying to touch file \"%APPDATA%\\ETHEREUM\\WALLETS\"\n \"file.exe\" trying to touch file \"%APPDATA%\\EXODUS\\EXODUS.WALLET\"\n \"file.exe\" trying to touch file \"%USERPROFILE%\\Documents\\MONERO\\WALLETS\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$3f","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$40","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal desktop applications information (file access)","description":"\"file.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\DISCORD\\LOCAL STORAGE\\LEVELDB\"\n \"file.exe\" trying to touch file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-97","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"},{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]}],"intel_graph":{"map":{"Domain:js.monitor.azure.com":{"type":"Domain","value":"js.monitor.azure.com"},"File:00c8e029429e0935efcefa928916d0179ae96c23ea6bb5f8c6af39dfb80dbbc6":{"type":"File","value":"00c8e029429e0935efcefa928916d0179ae96c23ea6bb5f8c6af39dfb80dbbc6"},"File:030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07":{"type":"File","value":"030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07"},"File:0b7bd32d4b36936a4fd329093482a9b242e629ee15c0cd63d2bc78b5a5c5b0da":{"type":"File","value":"0b7bd32d4b36936a4fd329093482a9b242e629ee15c0cd63d2bc78b5a5c5b0da"},"File:0c7fe6a089ddd7370f3bf589e50ab0e479145b25512ecef88df7b0e27f219fb4":{"type":"File","value":"0c7fe6a089ddd7370f3bf589e50ab0e479145b25512ecef88df7b0e27f219fb4"},"File:1d4dcee8511d5371fec911660d6049782e12901c662b409a5c675772e9b87369":{"type":"File","value":"1d4dcee8511d5371fec911660d6049782e12901c662b409a5c675772e9b87369"},"File:248e4527419f83d1ad1be21a739dfbec5f2718c681fef567d0f16473042559a3":{"type":"File","value":"248e4527419f83d1ad1be21a739dfbec5f2718c681fef567d0f16473042559a3"},"File:26373f8fccd9af96ab72be3644bd1bab9f0ae164a75b6dfdaff7adb10583a5c5":{"type":"File","value":"26373f8fccd9af96ab72be3644bd1bab9f0ae164a75b6dfdaff7adb10583a5c5"},"File:45b8a577d995132574d682b70d844551ed1372243b09aae63482d32edddf34cb":{"type":"File","value":"45b8a577d995132574d682b70d844551ed1372243b09aae63482d32edddf34cb"},"File:49621eba2303112e1b0c8e1f9bb6204ad4f65e63b46c455f88aa6bb4bd8fc913":{"type":"File","value":"49621eba2303112e1b0c8e1f9bb6204ad4f65e63b46c455f88aa6bb4bd8fc913"},"File:76985163aa7bc728edc0180d4a578e66011747dc5e8eddf1f1dc944d438233fd":{"type":"File","value":"76985163aa7bc728edc0180d4a578e66011747dc5e8eddf1f1dc944d438233fd"},"File:8e34f3807b4bf495d8954e7229681da8d0dd101dd6ddc2ad7f90cd2983802b44":{"type":"File","value":"8e34f3807b4bf495d8954e7229681da8d0dd101dd6ddc2ad7f90cd2983802b44"},"File:90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21":{"type":"File","value":"90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21"},"File:983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7":{"type":"File","value":"983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7"},"File:a312546b2fd130cd3102454efdc7c97793ac1dc934d8364576489667f6339f05":{"type":"File","value":"a312546b2fd130cd3102454efdc7c97793ac1dc934d8364576489667f6339f05"},"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424":{"type":"File","value":"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424"},"File:bd1758ef7ec18f466c8674797f6ad36a3747ce397bae2d721adada889bf8e0b9":{"type":"File","value":"bd1758ef7ec18f466c8674797f6ad36a3747ce397bae2d721adada889bf8e0b9"},"File:c47a383de6dd60149b37dd24825d42d83cb48be0ed094e3fc3b228d0a7bb9332":{"type":"File","value":"c47a383de6dd60149b37dd24825d42d83cb48be0ed094e3fc3b228d0a7bb9332"},"File:c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad":{"type":"File","value":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad"},"File:ce405f40f5ebb91ac380b098974e8626360132a4814f3e707854e33eb6fd37a6":{"type":"File","value":"ce405f40f5ebb91ac380b098974e8626360132a4814f3e707854e33eb6fd37a6"},"File:dfe480ce6e9cb555bc9c43ef78e2f0c2a17705c1f03379545b0e0971ce3ebd1f":{"type":"File","value":"dfe480ce6e9cb555bc9c43ef78e2f0c2a17705c1f03379545b0e0971ce3ebd1f"},"File:ecf682c023e7aa1761b00a483dbfc3b0bd05f5c70fc2f7a1a6003839da59e1e4":{"type":"File","value":"ecf682c023e7aa1761b00a483dbfc3b0bd05f5c70fc2f7a1a6003839da59e1e4"},"File:fdde29c3088304098038531aa3cfc38deceda7d8e6af8a09439aa45109a80aaa":{"type":"File","value":"fdde29c3088304098038531aa3cfc38deceda7d8e6af8a09439aa45109a80aaa"},"Ip:150.171.109.74":{"type":"Ip","value":"150.171.109.74"},"Ip:171.22.28.239":{"type":"Ip","value":"171.22.28.239"},"Ip:23.54.41.214":{"type":"Ip","value":"23.54.41.214"}},"chains":[{"id":"sandbox_network","root":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","edges":[{"edge_kind":"contacted_ip","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"Ip:150.171.109.74"},{"edge_kind":"contacted_ip","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"Ip:23.54.41.214"},{"edge_kind":"contacted_ip","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"Ip:171.22.28.239"},{"edge_kind":"contacted_domain","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"Domain:js.monitor.azure.com"},{"edge_kind":"resolves_to","from_key":"Domain:js.monitor.azure.com","to_key":"Ip:150.171.109.74"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","edges":[{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:8e34f3807b4bf495d8954e7229681da8d0dd101dd6ddc2ad7f90cd2983802b44"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:248e4527419f83d1ad1be21a739dfbec5f2718c681fef567d0f16473042559a3"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:ce405f40f5ebb91ac380b098974e8626360132a4814f3e707854e33eb6fd37a6"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:a312546b2fd130cd3102454efdc7c97793ac1dc934d8364576489667f6339f05"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:0c7fe6a089ddd7370f3bf589e50ab0e479145b25512ecef88df7b0e27f219fb4"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:bd1758ef7ec18f466c8674797f6ad36a3747ce397bae2d721adada889bf8e0b9"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:26373f8fccd9af96ab72be3644bd1bab9f0ae164a75b6dfdaff7adb10583a5c5"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:dfe480ce6e9cb555bc9c43ef78e2f0c2a17705c1f03379545b0e0971ce3ebd1f"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:45b8a577d995132574d682b70d844551ed1372243b09aae63482d32edddf34cb"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:fdde29c3088304098038531aa3cfc38deceda7d8e6af8a09439aa45109a80aaa"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:ecf682c023e7aa1761b00a483dbfc3b0bd05f5c70fc2f7a1a6003839da59e1e4"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:00c8e029429e0935efcefa928916d0179ae96c23ea6bb5f8c6af39dfb80dbbc6"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:49621eba2303112e1b0c8e1f9bb6204ad4f65e63b46c455f88aa6bb4bd8fc913"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:0b7bd32d4b36936a4fd329093482a9b242e629ee15c0cd63d2bc78b5a5c5b0da"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:c47a383de6dd60149b37dd24825d42d83cb48be0ed094e3fc3b228d0a7bb9332"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:1d4dcee8511d5371fec911660d6049782e12901c662b409a5c675772e9b87369"},{"edge_kind":"extracted","from_key":"File:ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","to_key":"File:76985163aa7bc728edc0180d4a578e66011747dc5e8eddf1f1dc944d438233fd"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":25,"imported_dlls_count":198,"dropped_files_count":0,"extracted_files_count":21,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["backdoor","commodity","informationstealer","redlinestealer","evasive"],"sample_flags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6a9e3ab10785bdb5420b4f85","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ser.Zusy","contacted_countries":["USA"],"submit_name":"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","analysis_start_time":"2026-09-07T04:16:50+00:00","indicators_count":{"informative":139,"suspicious":12,"malicious":4},"tags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true},{"id":"6547687c088bfeae1108816f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["DEU"],"submit_name":"file","analysis_start_time":"2023-11-05T10:03:40+00:00","indicators_count":{"informative":119,"suspicious":31,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"150.171.109.74","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"address":"23.54.41.214","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"address":"171.22.28.239","port":42359,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]}],"dns_resolutions":[{"domain":"js.monitor.azure.com","address":"150.171.109.74","ttl":59,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}],"processes":[{"pid":4332,"ppid":0,"name":"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe","command_line":"","sha256":"ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424","normalized_path":"C:\\ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe","uid":"00000000-00004332","icon":"$41"},{"pid":3904,"ppid":4332,"name":"iexplore.exe","command_line":"http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00004332","uid":"00000000-00003904"},{"pid":288,"ppid":3904,"name":"iexplore.exe","command_line":"SCODEF:3904 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003904","uid":"00000000-00000288"}],"all_imported_dlls":["user32.dll","mscoreei.dll","propsys.dll","iertutil.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","ssv.dll","uxtheme.dll","ieframe.dll","devobj.dll","oleacc.dll","mlang.dll","cryptnet.dll","DWrite.dll","MSOHEV.DLL","api-ms-win-crt-stdio-l1-1-0.dll","sqmapi.dll","ExplorerFrame.dll","bcryptprimitives.dll","tzres.dll","ole32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","credssp.dll","vm3dum_10.dll","d3d10warp.dll","lpk.dll","rpcrt4.dll","api-ms-win-crt-string-l1-1-0.dll","shell32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","t2embed.dll","gdi32.dll","api-ms-win-crt-locale-l1-1-0.dll","nsi.dll","comctl32.dll","npmproxy.dll","Wldap32.dll","jscript9.dll","usp10.dll","msvcp140.dll","bcrypt.dll","imagehlp.dll","fltLib.dll","wshqos.dll","userenv.dll","wkscli.dll","msasn1.dll","msimg32.dll","jp2ssv.dll","urlmon.dll","rpcss.dll","WSHTCPIP.DLL","WindowsCodecs.dll","mscorwks.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","netprofm.dll","duser.dll","mshtml.dll","xmllite.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-math-l1-1-0.dll","wship6.dll","RpcRtRemote.dll","SensApi.dll","winmm.dll","wininet.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","ieui.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","setupapi.dll","crypt32.dll","oleaccrc.dll","dhcpcsvc.dll","ws2_32.dll","wintrust.dll","d3d11.dll","msimtf.dll","api-ms-win-crt-filesystem-l1-1-0.dll","clbcatq.dll","version.dll","cfgmgr32.dll","gpapi.dll","webio.dll","sxs.dll","d2d1.dll","ucrtbase.dll","dxgi.dll","msvcrt.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","normaliz.dll","deploy.dll","sechost.dll","api-ms-win-core-file-l2-1-0.dll","dwmapi.dll","cryptbase.dll","profapi.dll","KernelBase.dll","api-ms-win-core-synch-l1-2-0.dll","netapi32.dll","msvcr90.dll","kernel32.dll","ntdll.dll","oleaut32.dll","vcruntime140.dll","api-ms-win-core-localization-l1-2-0.dll","comdlg32.dll","netutils.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","winhttp.dll","SwDir_1231201.dll","api-ms-win-crt-utility-l1-1-0.dll","msctf.dll","VxSSL32.dll","srvcli.dll","schannel.dll","api-ms-win-downlevel-user32-l1-1-0.dll","secur32.dll","ntmarta.dll","vm3dum_loader.dll","vm3dum.dll","d3d10level9.dll","cryptsp.dll","api-ms-win-crt-heap-l1-1-0.dll","imm32.dll","dnsapi.dll","api-ms-win-core-file-l1-2-0.dll","mscoreeis.dll","apphelp.dll","ieproxy.dll","IPHLPAPI.DLL","winnsi.dll","mscoree.dll","rsaenh.dll","dui70.dll","advapi32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","IEShims.dll","mswsock.dll","rasadhlp.dll","FWPUCLNT.DLL","dhcpcsvc6.dll","URLREDIR.DLL","shlwapi.dll","sspicli.dll","nlaapi.dll","ncrypt.dll","msvcr100.dll","npctrl.dll","gdi32full.dll","clr.dll","psapi.dll","win32u.dll","System.Runtime.Serialization.ni.dll","WMINet_Utils.dll","System.Windows.Forms.dll","System.Xml.ni.dll","wbemsvc.dll","GdiPlus.dll","kernel.appcore.dll","wmiutils.dll","System.Web.Extensions.dll","RstrtMgr.dll","wow64win.dll","wow64cpu.dll","msvcp_win.dll","mscorlib.ni.dll","System.Core.ni.dll","fastprox.dll","wow64.dll","ucrtbase_clr0400.dll","System.Transactions.dll","System.Security.dll","Microsoft.CSharp.dll","System.Web.dll","dpapi.dll","System.ServiceModel.Internals.dll","System.ni.dll","System.Drawing.dll","System.ServiceModel.dll","clrjit.dll","SMDiagnostics.dll","ntasn1.dll","SHCore.dll","System.Dynamic.dll","combase.dll","System.Management.dll","wbemprox.dll","windows.storage.dll","powrprof.dll","webengine4.dll","vcruntime140_clr0400.dll","Accessibility.dll","System.Configuration.ni.dll","System.IdentityModel.dll","wbemcomn.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"logo_net_1_.svg","sha256":"8e34f3807b4bf495d8954e7229681da8d0dd101dd6ddc2ad7f90cd2983802b44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"index-docs_1_.js","sha256":"248e4527419f83d1ad1be21a739dfbec5f2718c681fef567d0f16473042559a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"site_1_.css","sha256":"ce405f40f5ebb91ac380b098974e8626360132a4814f3e707854e33eb6fd37a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"ms.jsll-4.min_1_.js","sha256":"a312546b2fd130cd3102454efdc7c97793ac1dc934d8364576489667f6339f05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"7DPJDVUY.htm","sha256":"0c7fe6a089ddd7370f3bf589e50ab0e479145b25512ecef88df7b0e27f219fb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"application-not-started_1_.htm","sha256":"bd1758ef7ec18f466c8674797f6ad36a3747ce397bae2d721adada889bf8e0b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_ab95882","sha256":"26373f8fccd9af96ab72be3644bd1bab9f0ae164a75b6dfdaff7adb10583a5c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"wcp-consent_1_.js","sha256":"dfe480ce6e9cb555bc9c43ef78e2f0c2a17705c1f03379545b0e0971ce3ebd1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"docons.29a7210.c559c2a5_1_.eot","sha256":"45b8a577d995132574d682b70d844551ed1372243b09aae63482d32edddf34cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"app-could-not-be-started_1_.png","sha256":"983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"app-could-not-be-started-details_1_.png","sha256":"fdde29c3088304098038531aa3cfc38deceda7d8e6af8a09439aa45109a80aaa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"imagestore.dat","sha256":"ecf682c023e7aa1761b00a483dbfc3b0bd05f5c70fc2f7a1a6003839da59e1e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"repair-tool-no-resolution_1_.png","sha256":"030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"en-US.4","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"favicon_2_.ico","sha256":"90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"~DF270B012EC176C401.TMP","sha256":"00c8e029429e0935efcefa928916d0179ae96c23ea6bb5f8c6af39dfb80dbbc6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"~DF138B28A738A505FD.TMP","sha256":"49621eba2303112e1b0c8e1f9bb6204ad4f65e63b46c455f88aa6bb4bd8fc913","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"~DF10CB442571DEFA75.TMP","sha256":"0b7bd32d4b36936a4fd329093482a9b242e629ee15c0cd63d2bc78b5a5c5b0da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"repair-tool-recommended-changes_1_.png","sha256":"c47a383de6dd60149b37dd24825d42d83cb48be0ed094e3fc3b228d0a7bb9332","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"repair-tool-changes-complete_1_.png","sha256":"1d4dcee8511d5371fec911660d6049782e12901c662b409a5c675772e9b87369","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"file.exe.log","sha256":"76985163aa7bc728edc0180d4a578e66011747dc5e8eddf1f1dc944d438233fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]}],"files_written":[{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\file.exe.log","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f40_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3904","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f40_IE_EarlyTabStart_0xf20_Mutex","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f40_ConnHashTable<3904>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f40_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f40_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://learn.microsoft.com/","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f40_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"6a9e3ab10785bdb5420b4f85"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"name":"Local\\SM0:6584:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"name":"SM0:6584:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]},{"name":"SM0:6584:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6547687c088bfeae1108816f"}]}]}},"report_ids":{"sandbox_job_ids":["6a9e3ab10785bdb5420b4f85","6547687c088bfeae1108816f"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Ser.Zusy.Generic Sample ab958828c486… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ab958828c486…. Malware family: Ser.Zusy.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 12 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424"}],["$","meta","4",{"property":"og:title","content":"Malicious Ser.Zusy.Generic Sample ab958828c486… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ab958828c486…. Malware family: Ser.Zusy.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 12 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ab958828c4863d416659a6009dbd9e7bf7a87de51df206689178ef70bd6b6424"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ser.Zusy.Generic Sample ab958828c486… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ab958828c486…. Malware family: Ser.Zusy.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 12 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L42","11",{}]]