25:I[10321,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/3k0jjn7m8jtc5.js","/_next/static/chunks/3xfwong8gg51p.js","/_next/static/chunks/1kn_tf3p-ubex.js"],"ReportDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 24:T4b9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious — Falcon Sandbox Report 67ef30fdee78… — Score 35/100 — Sample dc6267608ddf…","description":"Suspicious verdict for sandbox report 67ef30fdee78…. Threat score 35/100. 0 malicious and 2 suspicious behavioral indicators across 47 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/dc6267608ddfcc5c80571ccd46475a03fb667baf8620d0e91c93ccacacf97ef6/67ef30fdee7849ab710a663c","keywords":["Suspicious","sandbox report","malware analysis","MITRE ATT\u0026CK","dc6267608ddfcc5c80571ccd46475a03fb667baf8620d0e91c93ccacacf97ef6"],"about":{"@type":"SoftwareApplication","name":"argument_baby_1.exe","applicationCategory":"PE32 executable (console) Intel 80386, for MS Windows","identifier":"dc6267608ddfcc5c80571ccd46475a03fb667baf8620d0e91c93ccacacf97ef6","additionalType":"Suspicious sample"},"threatScore":35,"sandboxEnvironment":"Windows 10 64 bit","behavioralIndicators":{"malicious":0,"suspicious":2,"totalSignatures":47},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}26:T4fc,"argument_baby_1.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000001800000051bd754e338e4b73e8056f00687d367790f56f00d0bb4b73bdd9573dfeffffffacf46f0052734a7350f46f000000e47548f56f006b734a73e0df267708000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000d8f46f00000000000800000000000000000000000000000000000000000000000000e47539bd754e0000000018f56f006992d076ffffffff34000000d8f46f0008000000000000000000e47548f56f002794d076e0f46f000b0000000000000030f56f00 (UID: 00000000-00006072) "argument_baby_1.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006072)27:T1342,"argument_baby_1.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006072) "argument_baby_1.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006072)28:Ta32,Found reference to API (Indicator: "GetCurrentProcessId"; File: "argument_baby_1.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "argument_baby_1.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "argument_baby_1.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "argument_baby_1.exe") Found reference to API (Indicator: "TerminateProcess"; File: "argument_baby_1.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "argument_baby_1.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "argument_baby_1.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "argument_baby_1.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "argument_baby_1.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "argument_baby_1.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "argument_baby_1.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "argument_baby_1.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006072.00000002.140749.00DB2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006072.00000002.140749.00DB2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006072.00000002.140749.00DB2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006072.00000002.140749.00DB2000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00006072.00000002.140749.00DB2000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006072.00000002.140749.00DB2000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006072.00000002.140749.00DB2000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006072.00000002.140749.00DB2000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006072.00000002.140749.00DB2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006072.00000002.140749.00DB2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006072.00000002.140749.00DB2000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006072.00000002.140749.00DB2000.00000002.mdmp")29:T6e3,"argument_baby_1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "argument_baby_1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "argument_baby_1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "argument_baby_1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "argument_baby_1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "argument_baby_1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "argument_baby_1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "argument_baby_1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "argument_baby_1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "argument_baby_1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "argument_baby_1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "argument_baby_1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "argument_baby_1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")2a:Tae5,"argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "ARGUMENT_BABY_1.EXE"; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "argument_baby_1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")2b:T723,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp")2c:Tc0b4,iVBORw0KGgoAAAANSUhEUgAABLAAAAJYCAIAAAD9hIhNAACAAElEQVR4Xuy9faxtVXnvP3OkhhC0lhLrpWhPLSoitSi+IKJs8agIqBRRUVrdAiIiviEi8iaHAyIg8g4iKh4UfMGXWuttTOMLaYzXcJvGGGNIr7khjTGEmIY0N78QY/YPzoK5x/N95vyuOfdaa6619/588v1jzTGeMeaYc63DHJ/t7bxVVX0vZmqsRLQbpsWWGOHlMfuGnH56yK23hpx5ZkhV3RJzRMzPY34bc1/M/435Tcx/xPw05tcxcaqlKqS6J0ZOJFP9IkSnui1Ee+WK4nn3qUL2jnn3u8kc8q539chpp4W85z0h73tfyPvfH/LBD4bIv6uzzw4591yXc85x+djHQi64IGT79pBPfCLk8stDPvWpkKuvDrn22pAbbgj5zGdC5D8rn/tcyG23hdx+e8idd4Z85SshX/1qyNe+FvL1r4fI2Djzj2FDUwEAwDgQwnXOFoSwyJJ4GkJIWpKtzwQhRAhh3VIBAMA4EMJ1zhaEsMiSeBpCSFqSrc8EIUQIYd1SAQDAOBDCdc4WhLDIkngaQkhakq3PBCFECGHdUgEAwDgQwnXOFoSwyJJ4GkJIWpKtzwQhRAhh3VIBAMDs2Lo1pKpuLvPrX1dlqoNCJul97nNDeo195jNDqueHbLyxhx4a0mvsJL377x/S67w6dqjzqhBGxR03dgLuuCNENsFf+lLIzp0hX/yiyxe+sPZ8/vMhn/2syy23hNx8s4sIg0Ts4vrrQ667LuSaa0JEY664wuWyy0JEkKT3k58Mkd5LLgnZsSPk0ktD5ES9IlNdfHHIRReFfPzjIRdeGHL++S4ikzJWIieSVUlk7HnnhYgAi+J+9KMh0ttr7FlnhUzAOcceTcgmif76AQAqhHA9jEUIu58XIQxBCBFChLADedNMyEaN/voBACqEcD2MRQi7nxchDEEIEUKEsAN500zIRo3++gEAKoRwPYxFCLufFyEMQQgRQoSwA3nTTMhGjf76AQAqhHA9jEUIu58XIQxBCBFChLADedNMyEaN/voBACbmypjIFvfmzLvuCqmqn8VMD1mGrurVIVurEOHAmF7sHyNsteddiunFVjvzbjGLwt0xkd1jJmC33ULGsNXeSdmbylso5R2VPvK6y/e+N0RelSmR92qefHLI8nLIO94RcuKJIW99a8ib3xzyxjeGvOENIUcdFfKa14QccUTI4Yf3iIyVbNvWI7KqI48MOfrokGOOCZELfO1rQ1796hA57yteEfKyl4W89KUuhx3mIn86OuSQkIMPDvmbv3E56KCQ5z8/RHp9ca/k2crI3xH1z4qLyEULycr/qgiZehaHCV9LW77YtstUbS/CbWsH2HgghJ1BCHtwN0KIEDZHxkqy9ZkghCbe8bKqmeJeybOVyRKIEK6JvJUnZPKMZSRINdpd4Htr2iYcO9wXrHmqXJxbADYkCGFnEMIe3I0QIoTNkbGSbH0mCKGJd7ysaqa4V/JsZbIEIoRrIm/lCZk8YxE7MrJkukraJhw73BeUvb6yGlecWwA2JAhhZxDCHtyNECKEzZGxkmx9JgihiXe8rGqmuFfybGWyBCKEayJv5QmZPGMROxod5saSxvaysf5cHkpNTVtLiTSWh3lg2VJSDxnVlIcAGxKEsDMIYQ/uRggRwubIWEm2PhOE0MQ7XlY1U9wrebYyWQIRwjWRt/KETJ6xNJpSx8a6RT4/WhEP24pzQUa62oY3TiVjRzQ2AsyDrXYjOzeOienF9piIKt+CsDMmMmbN22I2PEfEDMVSTC8OPNDlOc/pERkru17ZuOct9bSSt+Pdt+YSucBnPzvkWc8KecYzQqRXXkF7wAEhMrM/kc9++4VIb568e/yJnv70Htm6NeRpTwvZd98e+Yu/CPmrvwrJ96eMfAv5928iYyX5XGXiTyVvTwkhQ2YsI4+qKdvbPvjDRyd6jMaCutG0l3Qc0tjeOG1jI8A82IoQLgI7EcLOHIEQrkbkCiFECBHCURBCQhYpYxnrVPlDfSg0ltW0FbS1l5ghghTI55rGRoB5sBUhXAR2IoSdOQIhXI3IFUKIECKEoyCEhCxSxiJqlFWq0bLyYc3Y9rZ52gZWqWvskLK9saaxEWAebEUIF4GdCGFnjkAIVyNyhRAihAjhKAghIYuUsbS51uizMau2XimrKQvaPo8+NFL2Ng6X9txoWgDmx1aEcBHYiRB25giEcDUiVwghQogQjoIQErJIGcvIqWpyb/lZauoWaaw/l3QZKC0lUll+zgMbCxp7AaCR+2MejLHsGyNstQK81fZO7w2Wk3F3zG9i/tUm8pQYYckqkL/P+9v3pg7H9hh5Xa38zCyPj1GWYyKiMZMkb3zLiFyJp73gBSEvelGIvHZS3mApvS9+ccgLXxgivZKXvGTtkWXIeSVSLJELfPnLQ+RtnxJ5Nai8OFQibyj1LyyVV5JKcX4bapkj4ltVl5Zc5HqlV95uKpf/yleGyBtZJXJF8kZWyeteFyI3R3r73Ku8PV0H+fa3Cdkw0cdiTxbHnUTq1sy05gHY2CCEhrsRws5sRwgRwuYghAjhgidtqQlZv9HHYh8QJ4BNC0JouBsh7Mx2hBAhbA5CiBAueNKWmpD1G30sdoP/GQ1gk4MQGu5GCDuzHSFECJuDECKEC560pSZk/UYfiwAAHUAIDXcjhJ3ZjhAihM1BCBHCBU/aUhOyfqOPRQAYmt1ilIV4R+X27SFJciSWLf6dnGIIkTH36siYeSGXIDfn3pifxkTG3Kud7t2nY+7VJO+JnSKXxswJ2UDL9vrww10OOyxEdureamQq8QfvLbLb9tt62bhLb5+Nu2aSeyV3o1fv7CJfmUQsXV7uKm+RlfR6RWd+wal52akk/51iRpHXmUrk3af77BOy995l8vaUkM0ZfTwBwGZhzMZ9G0K4yph7hRAWjLlXCGEBQogQ1skSiBC2JUsgQkjIZNHH08Iw+j8XHP1fDPJ5vp9hgzJm474NIVxlzL1CCAvG3CuEsAAhRAjrZAlECNuSJRAhJGSy6OMJADYLYzbu2xDCVcbcK4SwYMy9QggLEEKEsE6WQISwLVkCEUJCJos+ngBgszBm474NIVxlzL1CCAvG3CuEsAAhRAjrZAlECNuSJRAhJGSy6OMJAAAAhmCvvUL++I9DnvAElz32cNl9d5c/+qOB8rjHuQAAALSzYtFqAACA9QdCCAAA0IIqYESrm+hYX5bVlY2NAAAAUwUhBAAAaEGUTNDqJuoyX9/Y29gIAAAwVRBCAACAFqIAKlqdkJrRYZfGEY2NAAAAUwUhBAAAaKHUv4xWJ6SmPjQfShobAQAAAAAAYAhK/ctodUJq6sPGDyWmEQAAAAAAAIZAlEzQ6oTUlIcyQ+NsjY0AAAAAAAAwBKvy14RWJ6SmPjQfShobAQAAAAAAYAhK/ctodRN1WVmfGxtna2wEAAAAAACAISj1L6PVTeR6GTg6bJytsREAYD3xlKeEnHlmSFWdGhO47LKQW27pkQU5r6TaP0R7t4Zob4z2Pink5z8PKR9FmXj1s0Re7ykvHZX3l8q7T/feO2SffUKe+tSQrVtD/uqvQp71rJDnPCfkb/4m5HnPC3nBC0Je9KKQF7845NBDQ172spBXvCLkVa8Kee1rQ17/+pBjjw1505tC3vKWkBNPDFleDjn55JBTTw05/fSQM84I+cAHQj784ZCzzw756EdDzjsv5MILQy66KGT7dpeLLw7ZsSPk0ktDPvnJkCuuCPnUp0Kuuirk6qtDrr22R667zgU2NP8HFh79zgAAYIqIt8xLzOZ1XglCiBAihAhhQ2BDo/IBi4d+ZwAAMEXEW+YlZvM6rwQhRAgRQoSwIbChUfmAxUO/MwAAmCLiLfMSs3mdV4IQIoQIIULYENjQqHzA4qHfGQAATBHxlnmJ2bzOK0EIEUKEECFsCGxoVD5g8dDvDAAG59qYL4VsDVtk2cimXf72MrLbrA4KmeKmX08Ut+ZVdWUZ2dY+9FBIVd0aE++GclfMHSFbqpADYpZiIpdfHlJVO8scf3xVRr4UvRtbY+LdkP1VuhueMJUKUvUvZfKXaCJT6cyLKXVx7PXXh+iJdo+RaskNN4TcdFPIZz4Tku9mGSm++eYQP9VnP7v2fO5zIbfe6iJj81WYyFh/RRIp9pGxciflO+qV2X0p/j5L8v0x55WZc30Zf0X5VpvIvcrnMjPHXt2cAsCwhM0FAMwDhBAhRAh39cZfDkIYkp2hexDC7pndl+LvsyTfH3NemTnXl/FXlG+1idyrfC4zc+zVzSkADEvYXADAPEAIEUKEcFdv/OUghCHZGboHIeye2X0p/j5L8v0x55WZc30Zf0X5VpvIvcrnMjPHXt2cAsCwhM0FAMwDhBAhRAh39cZfDkIYkp2hexDC7pndl+LvsyTfH3NemTnXl/FXlG+1idyrfC4zc+zVzSkADEvYXADAPEAIEUKEcFdv/OUghCHZGboHIeye2X0p/j5L8v0x55WZc30Zf0X5VpvIvcrnMjPHXt2cAsCwhM0FAMyD6DwTeUsPB5AtsmrMgkidMNHN2dRSl76FcN7q8VWImJsvjn4oxeN+KlO7fBmr3+BBMfLztltVTd67d08vJfBjffLwMv6K8iWb4nxqswyZKgtGGfG0G28MkV6Rdq/03vC9W0rvJPG/Ol8svf7mSK+PzNxrKin2Fxijm1MAGJZyXwIAcwEhLIMQrtGI/PebvoVwXnU8hNBEJKdXvC/5ZN0yycPL+CvKl2yK86nNMmQque0SryLSixCam5PNzURm7jWVFPsLjNHNKQAMS7kvmQXlFkv7Im2Vbe0AGwaEsAxCuEYj8t9v+hbCedXxEEITkZxe8b7kk3XLJA8v468oX7Ipzqc2y5Cp5LZLvIpIL0Jobk42NxOZuddUUuwvMEY3pwAwLOW+ZBbUFjdW59oq29oBNgwIYRmEcI1G5L/f9C2E86rjIYQmIjm94n3JJ+uWSR5exl9RvmRTnE9tliFTyW2XeBWRXoTQ3JxsbiYyc6+ppNhfYIxuTgFgWMp9ydRpVLvujaYdYCOBEJZBCNdoRP77Td9COK86HkJoIpLTK96XfLJumeThZfwV5Us2xfnUZhkyldx2iVcR6UUIzc3J5mYiM/eaSor9Bcbo5hQAhqXcl0ydNp0zHzq2A2wktpfp9WZFcZ599w25996Qqvp5zBExkZUQOa/utmV7vSSeNqsLvO++kH4XWP1rGTnvmAusPhjjLvAPfwiRE/kLvP/+kJ4XeFkZOe+4C9wZM6sLfPDBkJ4XeFQZOe+4C4wnStvTEL817xWZeRJf8sV+Wy8Rfbr22pBPf9rlU59yufLKEPk1SK64IkTG5lN3j0wlJ/KRRcpUPjJVLihz1VUhcgnSK5Gp/JrlO5Kp5O9b11wTIr8NyXXXhUivtXTdnALAsOgDdqqstOic+dCxHWAj4XbbqzvcJuS5L7tthNBdIELoLnAnQrgahNAkSyBC2HaiXFBGxEwuIUtgGZnKrxkhBICEPmCnykq7zo0e2Y1d5WFbO8BGwu22H9vfNiPPfdltI4TuAhFCd4E7EcLVIIQmWQIRwrYT5YIyImZyCVkCy8hUfs0IIQAk9AE7VVZadM586NgOsJFwu+3VHW4T8tyX3TZC6C4QIXQXuBMhXA1CaJIlECFsO1EuKCNiJpeQJbCMTOXXjBACQEIfsNNmpUntujeadoANg9ttr+5wm5Dnvuy2EUJ3gQihu8CdCOFqEEKTLIEIYduJckEZETO5hCyBZWQqv2aEEAAS+oCdNuUDum6RgvqDVPp2gA3DrHbb6Y2OfXbbTwyR847bbd9lXxwaXiyZ3MO/oXSSmd9cZswV7e/enCkvtJSvTHrlW5BeMSLpFSGUXvFh6Z3ozwHVV8qMuVeHhGzfHnLPPSGXXRZSVb8sI3eyenKMclqMEL79paWqjBL3pv32tb0iJ5okeXJzolyw5mJ5saSfKstnGZFY0WN5YennPhfy+c+H+F5Jfhtq98iJpFcuoVdkZn9F0vuFL4R88YshO3eG3H67y5e/HCJjv/SlkDvuCPG9cqJYrJtTABgWfSwCwOA8qoIIIUIovQghQtiaPLk5US5YczFCWEZ6s+Z1j8zsr0h6EUIAmAx9LALA4DyqggghQii9CCFC2Jo8uTlRLlhzMUJYRnqz5nWPzOyvSHoRQgCYDH0sAsDgPKqCCCFCKL0IIULYmjy5OVEuWHMxQlhGerPmdY/M7K9IehFCAJgMfSwCwOA8qoIIIUIovQghQtiaPLk5US5YczFCWEZ6s+Z1j8zsr0h6EUIAmAx9LALAwOgmeI+YiDhA2l4LYbe9995VGT3vbjERMc+q+kEZcYCq+m2Zn/ykKvPwZDFC9JbnVyHKLTEBvcDdY3zxGBX5bpl0+UFi5SsT9Lz229cT6SK3m+iJdGxAi+2q/C9Hp7LfwjnnhCRWBW9X5I8FQviOxOkU2fXKflp227IXz85gkjWgjH9xqNiUqJdIrI+8SVIi77f0r53Mr/Q0Y+X9llKcX55pIlPJ+zylWP779YlPuFx6qcsll4Ts2BFy8cUhH/+4y/nnh1x4YcgFF4Scd16I9MpY+S/FRRe5SLGPXKAk15exi9TNKQAMiz4WAWBgdMdsN98IYQQhRAgRQoQQIXSupQYokWKfLIEIIcCGQB+LADAwumO2m2+EMIIQIoQIIUKIEDrXUgOUSLFPlkCEEGBDoI9FABgY3THbzTdCGEEIEUKEECFECJ1rqQFKpNgnSyBCCLAh0MciAAyM7pjt5hshjCCECCFCiBAihM611AAlUuyTJRAhBNgQ6GMRAAZmjz1Cqur+Mrqf3jsmsm1biKBT7RkTkUd5tSUmqqbObP1Bi60hyDJ0rL2Eqvp9jBDtYox5BruQy1eJrY6JiewVo9gbq99CQH9IT4uR61VOKbPXXlWZf//3kKq6Jybw+teHCDLz978fUi3FqNaeGrOjjOzM9W7YW6c7dYn8CqVXtrkSv/mWXr+9lt5LrJlIr0QU6JOfDBEFEpu68soQETPRxWybJjJWIk4rii96LK9CFbX24u2TJb9Mrz8WyDLyHwjMHwukVxbpe2WR/v2lt93m4sdK7OXr5hQAhkUfi8qKzaxYWWmevK0dYB2jO1eEsECWoWPtJSCECCFC2ByEsIz0+mSvK+MVSOIdT+KLZZG+VxbppS5LIEIIsBHRx6KSJXAiIfRGV/e2lbW1G0b//2Y1NvquskU+AEwT3bkihAWyDB1rLwEhRAgRwuYghGWk1yd7XRmvQBLveBJfLIv0vbJIL3VZAhFCgI2IPhaVLIFlZkWberW1G7L1mcPGz/kDwDTRnStCWCDL0LH2EhBChBAhbA5CWEZ6fbLXlfEKJPGOJ/HFskjfK4v0UpclECEE2IjoY1HJEljG0ehdYlxia6V6leQCqakbhbqrbZKSse1tBQAToTtXhLBAlqFj7SUghAghQtgchLCM9PpkryvjFUjiHU/ii2WRvlcW6aUuSyBCCLAR0ceiMhK/tjhEn0aHjXKVG0vNk8+NjfVnIQ+UzyVj29sKACZCdn1VdX3IPlVItRwTUH/Q/XT0liXZfAf23DMkEQQpFQenlV3fQw+FjP4Bd0QW8YtfhHi+852QSW5O8kPXK5efZo7L2M29sfNXvwp58pNDxlncA2X0p2LPq8XW4eWtqukbPD/kRVUZPZFdlSpf/NU95SlVmar6dojMbLequr32kalkL37zzSEyVorFaq6/PsT7khTLG0p9ZJESUS85kXia/PqlV8ZOErl8WaS/QPm65RuUiAJNIkhyXh/5qfgTyXtxpVjiL0Gm8jPLVP5tvXGsbk4BYFj0Eaus2Iyh3r+ZDyVtvbm9rUAw9TVlY1GyStskANMBIeyOLAIhRAgRQoTwkSCECCEATIA+YpUVmzHU+7f8YfT5sR3Caot8aGuvx9asVj+GNDbWVE2TC2MLACYCIeyOLAIhRAgRQoTwkSCECCEATIA+YpUVmzHU+7f8oST3Sllub5xHqHcgNVqxi7p9zQUAE4EQdkcWgRAihAghQvhIEEKEEAAmQB+xyorNeB7bA6weyofGxnKUfM6NZXuJNOZJ8mHj5/wBYJoghN2RRSCECCFCiBA+EoQQIQSACdBHrLJiM57H9gCrh9LV2Ft3tRVITd1Y9mpTy/yxZMyq6kaAqSE71/onOEJ2UOIPUqz76T4bd92pP7MqozNvce9s9Dv1MWu2r1HVYvvGzgcfDElv3QzIt6Ansquqqm/GLMf8cxm5/N13r8pUTwnR72hP91ZVf9tTr/VDe2MV/TGs3ZZ7/bHgqquqMlV1esytZeT7lehGVnaufl8rwiD7eHE8byaSbJsmsjXPJlNG/MH3ysx2W69j86nL+HuVpcjEj5V7JYuUXplKIsVyRf5byMs28SeSXrkiL2a+d+fOECn2Y3v9NmJ0cwoAw6LPagAYGNmbyq4XISzRYustCCFCiBA2R7bjvldm7rXpz6cu4+9VdiQTP1bulSxSemUqiRTLFflvIS/bxJ9IeuWKvLb5XoQQYFOiz2oAGBjZm8quFyEs0WLrLQghQogQNke2475XZu616c+nLuPvVXYkEz9W7pUsUnplKokUyxX5byEv28SfSHrliry2+V6EEGBTos9qABgY2ZvKrhchLNFi6y0IIUKIEDZHtuO+V2butenPpy7j71V2JBM/Vu6VLFJ6ZSqJFMsV+W8hL9vEn0h65Yq8tvlehBBgU6LPagAYGNmbyq4XISzRYustCCFCiBA2R7bjvldm7rXpz6cu4+9VdiQTP1bulSxSemUqiRTLFflvIS/bxJ9IeuWKvLb5XoQQYFOiz2oAGJi99w65++6QqtoZ898xQthtX3ZZVaaq7imjDmDtMb0K9ZSY38dE9gg57bQQYRJDqKory8imX+RKbvs4wo2tqh+UkfcdVtUvy+h9fnxMRIvHiNnapU6L7fs8vdJX1V1l7r23KiNfSpLna0Pk5qjD7yiz775VmeqgENnWfvCDIarWaXsaIntxbwh5ePfIiaRXttd9dttjduo+MlaUQHrzqU1krI9XkS9/OeSOO0LuvDPkK18J+epXQ772tZCvf71Heo29666Qb30r5JvfDPnGN0KkV8ZK/uEfQvyJpPi73w35x38MkXc3S7797RDpjSfSzSkADIs+9gFgYBDCEoQwFFupQwgRwtXk2cqIXOXhJl7MpDef2kTG+iCECCHAtFkp/n9O0L5Nhj72AWBgEMIShDAUW6lDCBHC1eTZyohc5eEmXsykN5/aRMb6IIQIIcC0QQhr9LEPAAODEJYghKHYSh1CiBCuJs9WRuQqDzfxYia9+dQmMtYHIUQIAaYNQlijj30AGBiEsAQhDMVW6hBChHA1ebYyIld5uIkXM+nNpzaRsT4IIUIIMG0Qwhp97APAwIio6J64OjsmbM3FeeQdlVV1Y8xvyujYJ8VUl8bIMsJU+qrM6tgyst/45S9Dkmr+SxlZ5K9+FSJ28aQnVWWEPfcMkTtZVT8LiXYhXHhhSHqtqBCUPl2C+36r6tQycjfkl3PKKSHpeoM9JqUPinvSSVUZ6R1ngPavA0+MiX8s8HdSJVbHCuEnKn36zlXZ5kr+6Z9cpFg20FLse31xr/hV+WIfGSu7/FxvIsIgKiKxOqFTSbIjGSMS9RJt8wYoEdUUERVrlV6RWMmXvhQiPizJw8vIMnq5dD5XmTxbmVism1MAGBZ5SiqlOufMj11/lW6grR1gcUEIEcK27xchLEEIe8Svyhf7yFiE0AQhNInFujkFgGGRp6SSJbCPEK5Bz/yQuretrK3d8Nj/o6eGRt9VtsgHgB4ghAhh2/eLEJYghD3iV+WLfWQsQmiCEJrEYt2cAsCwyFNSyRJYZn60qVdbuyFbnzls/Jw/APQAIUQI275fhLAEIewRvypf7CNjEUIThNAkFuvmFACGRZ6SSpbAMuMQUxqpV5s+1TVlS1lf9tZdbQVSUzcKdVfbJCVj29sKABwIIULY9v0ihCUIYY/4VfliHxmLEJoghCaxWDenADAs8pRUVmzGUZpSNi7RJ2nM9fKh7XNjY/1ZyAPlc8nY9rYCAI/fqQdB0j3xbu7lkOpae8co34sRwms2f/GLqky1JUTebioas2VLSFUdF7M9JiKvQu1zXjHe3/0uROziD38Ike9IvwWRnIh+C9UxZXQZ1baYE2LCzdFlxAsUxvnhz2OWjZgdc0xIIvxU0uW/uUzqXS4jr29NL4Z1NycVh5n1Zybb6165/fYQeRmmfyenf59nr9ds+hNJr5w3v/9zze8ClVXJifwiZazPzvga2fy9mMhY/w3mU5fJd6CM3El5Ie3NN/eIvNv2xhtDrrvO5dprQ665JkR6JXm2MvJPVCKLtNHNKQAMy67HdzsrNuNoM6Xcbj6UtPXm9rYCwdTXlI1FySptkwB0BCFECBHCUe8yQtgaLyr+RNKLEJbx32A+dZl8B8oghJ2jm1MAGJZdj+92VmzG0WZKuT1/GH1uU7IuEwqr1Y8hjY01VdPkwtgCAA9CiBAihKPeZYSwNV5U/ImkFyEs47/BfOoy+Q6UQQg7RzenADAsux7f7azYjKPNlHJ7/lCSe7tPaFhJaMUu6vY1FwB4EEKEECEc9S4jhK3xouJPJL0IYRn/DeZTl8l3oAxC2Dm6OQWAYdn1+G5nxWYcbaZUHoqJNQ7JjeUo+Zwby/YSacyT5MPGz/kDQC8QQoQQIRz1LiOErfGi4k8kvQhhGf8N5lOXyXegDELYObo5BYBh2fX4bmfFZhxtpiRa1WhZdVdjb93VViA1dWPZq00t88eSMauqGwG6knaup8X4be4HY3zxOTG+OO6YY666qiozRuqitmmi8VbVL8uo81gBlrFJcoKJ6dDq6piAvEb1oYdCzjwzZJxanxkjyK0O2rZtW1XGk1bluTJGuCXkyVWI8m9l9tqrKjOO82PCqs46qyrj2bEjpKq+FPNQyA03hMiuV3p9ZKcr+3jZ5d90k0vaNLvIiWRVslOXTb/8e5ZceaWLFF99dcinPx0ivX5VvliSXaWMl5x8M8vIl3LLLSHieJJe4u1z660uciJ/3l6LlF45rwiwFEuvmHaMbk4BYFj0IQoAA5NMDCFECOsghAhhtyCEJghhmV6LlF6EEGCDog9RABiYZGIIIUJYByFECLsFITRBCMv0WqT0IoQAGxR9iALAwCQTQwgRwjoIIULYLQihCUJYptcipRchBNig6EMUAAYmmRhCiBDWQQgRwm5BCE0QwjK9Fim9CCHABkUfogAwMPV7ih57W1F4SWN6OeT9ZURUqurImLDrlf2VWI0sQ1CLe3lM3Ljr6z2rU8vstltVRl7vqTwtRHb5EjmvymRcpLxHVK83vutVZr7vvpDk0p7w/VbVD8rILreq7ipz771VmbTmgP/l6LtenyRvKH0gJnyDScyWzStJ5Zfj3wSrq6qOjRFbjuwZU/0+JrJfzE772kl5saTsZWWsvNDyjjtCvvzlEF/8la+43HlnyFe/GiK9+U2bZWRVfs0ys0QWKavyvV/7Woj0fv3rLvn+lPGLlF6/Zin290p6JfIzk8h3lAvK+B+wRH7Aom0+3g/FlsUtZarYq5tTABgWfUoCwMCkbT1CWIAQIoQIYWPETERjpFdOJPEaI70ys0QW6eVKehHCMvId5YIy/gcsQQgBIKFPSQAYmLStRwgLEEKEECFsjJiJaIz0yokkXmOkV2aWyCK9XEkvQlhGvqNcUMb/gCUIIQAk9CkJAAOTtvUIYQFCiBAihI0RMxGNkV45kcRrjPTKzBJZpJcr6UUIy8h3lAvK+B+wBCEEgIQ+JQFgYNK2HiEsQAgRQoSwMWImojHSKyeSeI2RXplZIov0ciW9CGEZ+Y5yQRn/A5YghACQ0KckAAxO2HyrxoiJKXbsGKKZ9Nm4JxE9ISZs3JO3iGzYS3hijKCvu3TL6DXzf/1XiNyr7durMrIZE/NMr1G9yzievxtyJ4XvfKcqU70oJF3RtWX6fd37x1T3xAj1fXgkMtWDD4Y8bGYhB1QhSzFKOJFI7P33V2W02O9r5QWe8pJGGSs7Zr+f7lUsJ8rvtCwjlyDJ9SaTjJXIJUjEHyRyN8RqvLRLb3ak7unlaZNE1iz/lZFe61oa/6Xk+jJSLFP5n4o9kW5OAWBY9IkaeXjvZgIAU+EB4wAIodE2hLAEIYxBCNuT600mGSuRS5Bk/Sgjd8Mrn+/N9tU9CGEZmcr/VOyJdHMKAMOiT9RIlsAFEcLR/qex0XeVLfIBYF48YBwAITTahhCWIIQxCGF7cr3JJGMlcgmSrB9l5G545fO92b66ByEsI1P5n4o9kW5OAWBY9IkayRK4sEJoDhs/5w8A8+IB4wAIodE2hLAEIYxBCNuT600mGSuRS5Bk/Sgjd8Mrn+/N9tU9CGEZmcr/VOyJdHMKAMOiT9RIlsAyY1nZVVRvV6Qrt48+53ah7spjM2Pb2woABuMB4wAIodE2hLAEIYxBCNuT600mGSuRS5Bk/Sgjd8Mrn+/N9tU9CGEZmcr/VOyJdHMKAMOiT9RIqX85YxntUsrD3N72eXRYfy4p63OjMLa9rQBgIEa/+5rq4Q13mWg1VXVSGXlT6CQb6H33rcqIqOgil2TmsEjRCXknZ1XdGhM27kmQ3C5f3skp503eInfym2Uuuqgq82//FnLOOSGC3pzq7Jjwes/08s8H1myA115blZE9cDLe22LC3fjVr6oyfpHVPlVIdXVM4O67Q8Th9QWt9itLTvujEF3Vsnn3qQiw7np9ZPMt991bnN9PS69XIOnttUiJ2IVXETEi/17NO+M7Of0LS/1LR+W1otL7jW+EfPObId/61tQiM/vzSm+vK5K74ePvpMS/N1W+Xy/A0ivffh7eHt2cAsCwyFNSWEkSWGYsK7GoPuzbLpj6mrKxKFmlbRKAoSl/uI/8HBFChBAhbPrKEEJ3ol6LlGQJRAjb4pXP9/a6oixyJv5OShBCAEjIU1JYSRJYZiwrsag+XEP7CFMjtM1ZM7YAYCDq3/cIhBAhRAgbvzKE0J2o1yIlWQIRwrZ45fO9va4oi5yJv5MShBAAEvKUFFaSBJYZy0osqg/7tkujoBW7qNvXXAAwEPH3jBAihAhh81eGELoT9VqkJEsgQtgWr3y+t9cVZZEz8XdSghACQEKeksJI/NoylpVYVB+ONjONn0cfGg8bG7uMbfycPwDMh9G/gRqEECFECBu/MoTQnajXIiVZAhHCtnjl8729riiLnIm/kxKEEAAS8pQUVpIElhnLSiwqD8tdTWNBPmxsKRsb55SuskU+AMwHeWWlOI/sic88syojvTp19fOYZbNF7iWTJ50Uottr4fExuqoe7L9/iKAvw3xKiN7nLfL61l+WETHzXHppSOL/K1P/x2iESmz5t4CH86QQ1Scprn5fZpYnkp/omSFaHH+iT6vKyJeSft5yokCv4jEvd5VtrjciiaiX9zT/Gkbp9ZGxvXLzzS433RQi55XiG28MkT/S3HBDj8h5Zea8TpN8yWV6vTa2V7yWy+/Ka7n8JsWlRahKDXs4UizxUie98mv35/WRZdwZRFQ3pwAwLPrMBICBUVHRfS1CuApCaD0NIWwtRghDskGVQQjXHITQRJZxJ0IIsEDoMxMABkZFRfe1COEqCKH1NISwtRghDMkGVQYhXHMQQhNZxp0IIcACoc9MABgYFRXd1yKEqyCE1tMQwtZihDAkG1QZhHDNQQhNZBl3IoQAC4Q+MwFgYFRUdF+LEK6CEFpPQwhbixHCkGxQZRDCNQchNJFl3IkQAiwQ+swEgIHRvenjRZ+E4C2y6a8OqUKqsBdPr44Mb79UYYiGUFXHhcRFvvrVIcLVV4dU1ZEhu1UhEVmzvFVVLz+iUrdHTOTyy0PEiPbZJ0TOK8V77RXii/fYI8QXb9kS4our6qEy44ofLCPFVfVvZQ48sCrz+9+HyFi5dc9/fogUy4kOO6wq0+tEVXVfGSmWE8neVDey8lZGibwcUqaSYv++R9/rZ5bYzbdeoBTLpt8Lg49IjpdnSdatMmJxYq3eLSXXXRdyzTUuV10VcuWVIfLfkSuuCPnEJ3rkkktCduwIkb9CSWSs/N1FXql84YUhF1wQct55IeefH/Lxj4fIzNIrlxCjm1MAGBbZFAHA0CCEIRGEsAxC2P1ECCFCiBAihADQEdkUAcDQIIQhEYSwDELY/UQIIUKIECKEANAR2RQBwNAghCERhLAMQtj9RAghQogQIoQA0BHZFAHA0CCEIRGEsAxC2P1ECCFCiBAihADQEdkUAcDQHHNMSM9d78/LSPGhh1ZlRK78iarqyjLiDwccECJj9923KiOvney1jEmEMBH0WNRaLvDpTw+RE8kFHndciKBeGu9GItx2/95UKdb3xEZEy9/2tpBxhBPJ3aiqE2LcfZZbJ1P98z9XZeS88h09+GBIr5+Knkg20J/8ZIi8RbdXZCoxBNEJibiHj3jLtdeGiPNIr381qJ9KxvqpxMSkt9dYKfZX5C+/1xX5ZYiI9vJSuV4/Vnrlvamix+LS8ipU8XDpFfGWYv+i1D5/DtDNKQAMiz721xs/3oW29qRthrq9raBmKsuATQpCaJbRa5evd1ZxooIQWsKJ5G4ghC4IoZE66e01Vor9FfnL73VFfhlZAo3USeR6/VjpRQgBYDL0sZ8YqU6JVkTGFkyXXqdrKx7b3lZQ0qUGoAGE0Cyj1y5f76ziRAUhtIQTyd1ACF0QQiN10ttrrBT7K/KX3+uK/DKyBBqpk8j1+rHSixACwGToYz/R13P61k/IVE7XNglCCEOAEJpl9Nrl651VnKgghJZwIrkbCKELQmikTnp7jZVif0X+8ntdkV9GlkAjdRK5Xj9WehFCAJgMfewn2jxn1P7jx6gbc0vd3lYjjXV7WZAPc0sxwSPt5ee6oPxc4tvbCurGuktaAMaDEJpl9Nrl651VnKgghJZwIrkbCKELQmikTnp7jZVif0X+8ntdkV9GlkAjdRK5Xj9WehFCAJgMfewn2iRHjKj+LPW5rKz0n+uWur08zC3lYePn8kPfz42N9ee6pTwE6EjY9f7hD1UZ2cjqKzrj5lt227JjTlMdGxOmku11VT1QRt6NKb3iAGpEY/jnMrK7rqpflUlXFM6rvQdVIWOuN7yC9ayzqjJV9b0Y4cyYcHP0ba7VOWVkp5qmWv2d7ErkkJgnxyjxNZvVjpiwZvXSeHOq6ndlpLjXty/vL5VvX96VKH8NqZ5fhQhiy0sxdqs6Zj8tY2UTvHOnixTL2z7vsC87lVeSyntEJfIq1K9/PUSmkshYP9Vdd4V84xsufhn+evNKzKokud6MzQUmMlbuhvR+85sh3/52j3zrWyHS+w//4PKd74R897tTyz/9k8v3vhcSe3VzCgDDEp6YTYy0p6RulzLf7g/HtkvBiLZRbZ/zh77tbQWNhwAdCbt8hBAhRAgRQoRwzPXmlZhVSXK9GZsLTGQsQogQAqwTwhOziTbJaXOhtnZ/OLZdCka0jWr7nD/0bf9x4tHSWAbQi7DLRwgRQoQQIUQIx1xvXolZlSTXm7G5wETGIoQIIcA6ITwxm2iTnDYXamv3h23t9WcpGDF2lHzOH/q2S4HgewHaCLt8hBAhRAgRQoRwzPXmlZhVSXK9GZsLTGQsQogQAqwTwhOziTbJGetObYdl5djP+VCQSv+5/ND3c24s2+UzQC/CLh8hRAgRQoQQIRxzvXklZlWSXG/G5gITGYsQIoQA64TwxGxipEAldbuU1R9M2ahFaqSxbK97paWm7Br7WRpLfHtbQd04ai8PAdbMXWXuvbcqU1Xfjvl9GZGN3XYLqaqfxvxHjHWArTFecvaPWQrZf/+QZBfnhjxsm2Vk039gTLWtTL8TRT+stlQhT4qpTo35QZlLL63KCPJWVUFepKk3dveQ//7vED+VilmcStBvv9oZE++V8pUyF15YlamqY2KE5Rg50dkxv42Rfxrnl9G/Duxdhci+VnbMPv/4jy4y8//8nyGyY/bLyJOXyfv+MiIMfmbpzbOZmSXiLT55uJlK3FLkSnq9pkqvj4ydnT368/rIzFnyy+Q/H5SRv0rI3yy+9KWQ228P2Rn//GF7dXMKAMMSHsXzw9uU6c1iNhcWZBmwMUAIEUKEcBQ5EULYnqxqRtv8zNKbZzMze4vzycPNVKJACKFZVZZAhBAAIuFRPD+MTZkugA0JQogQIoSjyIkQwvZkVTPa5meW3jybmdlbnE8ebqYSBUIIzaqyBCKEABAJj+L50Wh9/M9usDlBCBFChHAUORFC2J6sakbb/MzSm2czM3uL88nDzVSiQAihWVWWQIQQACLhUQwACwBCiBAihKPIiRDC9mRVM9rmZ5bePJuZ2VucTx5uphIFQgjNqrIEIoQAEAmPYgAYnttuCxnzOsSIbJmuuiokbaB/E/OjmPB6z8m29R+MGWhbv5h38pZbqjWnqo6KkTv5s5jTYzyXh2wV4b83pE/v3XeHVNU3y2zbVpVJBihcGSMevjPmnjLyU5E37urMdqs6JvKzywWm+ItfdJFieZ1pntwkT25OJL2y6RcluCMKg0TsQl4cKsnKZPRJFCjrZZnssd0jeuxtWf47Ipoqq/LF3vF6Jd/MMnIi6ZXvSL5f+TH4X530xt+Vbk4BYFj08QsAAyObsQXRGIRwWncya173IIQI4WoQwjIIYffkm1kGIQSADkI4+j/kG/3f8vF5vp9hYyKbsQXRGIRwWncya173IIQI4WoQwjIIYffkm1kGIQSADkIIALNFNmMLojEI4bTuZNa87kEIEcLVIIRlEMLuyTezDEIIAAghwNyRzdiCaAxCOK07mTWvexBChHA1CGEZhLB78s0sgxACAEIIMHeuvjrkoYdCZF8ryL52332rMvfdF3LkkSHjuMu87FTffvkkeQnnGWXk1YmCXlH9btJR9oyJbzfVsQ+vpEz185BDqhBBzlttL6Ov6Hx8TOTyy0PkHaSXXVaVkTuZXu/5tZiwKjmvfEc61VaRujjVlvhW1WjavdR6+/aQPfYI0RMp98QEZGZRTdFF+bfw/e+HVE+LEecRP8wGZba5EpnK25Tok7cp6fVb816RC5zElmWs3Ge5fH8JMtZHziuRE8mNlZdwiiBN8vJPSRZXE7HHXGAiY0Vi/Ttm5T/fPv6tufa9uLo5BYBhkQeucvDBLgPy6H5vPbMBLgFmAkIYrgghRAgRwsYghN0j55XIiRBChBBg0yMPXCVLYE8hDLu1FjrWaNO0kVPUh23ta2CSsbBhQQjDFSGECCFC2BiEsHvkvBI5EUKIEAJseuSBq2QJ7C+E8kEo2x/d1DXR1j5F2k7R1r4GpjgVbBwQwnBFCCFCiBA2BiHsHjmvRE6EECKEAJseeeAqWQL7COEjO7T2w0YaaxrneXQH+FhLTVnW2C5dpsW0t42qC3J72QuwCkIYrgghRAgRwsYghN0j55XIiRBChBBg0yMPXCVL4GIIYdlSHk74efRBDk372M+jw/pzPgRQJZB3VO69d2VS7R5T3RYTtsg6VvVpVSwfjqwqvToyFO+2W1XmYcmN+XUZmVldq/pFTDAEuQSRZ1lVeuvm/THxVZk6Ntw61aeoE/4bHGMmtVWOIst4clVGXpUpf0qQ97Xq163SHt4iK6YtVyRrlj80jP6TV1NV54ao0guvjrk75OHfUhn9BvucSJy22hkim2CJbKBzQRm/cfevnZRecQ8xE4nXGOn1buk1VWxKIsUSOa8sUt6N6dXL30l/YyeZykdmzi/8NBeYv1PzDebZus8sU/n0+qlkMzeJlq6bUwAYFn1oClkCZymEbQV+nrbDRWtvPAQYoxOyrdddPkKIECKEXU6EEK55ly+9WQIRwjoIYfcghACLhD40hSyBMxNC0+vnCXuRXbSV1R8EKZDDabU3HgKM0QnZ1usuHyFECBHCLidCCNe8y5feLIEIYR2EsHsQQoBFQh+aQpbA2Qih6apSrz+saSubsH7N7Y2HAGN0Qrb1ustHCBFChLDLiRDCNe/ypTdLIEJYByHsHoQQYJHQh6aQJbCPEFYtmiRSJIeN+OGNvWV72+fRoXzo3t72efQhH0oXwCN4nZBtve7yEUKEECHsciKEcM27fOnNEogQ1kEIuwchBFgk9KEpZAnsL4TFPmG1sbFgRN1VUrbnmsbhZWPZLl25sT707WWXNNaf5VC6AHahSjDBrveJMdV9IXoi5wBV9Z2YYET6Bkt9dWRcc7UcE9Er6jO2ujXmlzFyCVJ8Zpn776/KyHmvv74qM0sh7CV14Yq0WIX/X8r8139VZcYRfpP67au29fkG9fLDIrdtq8r4qa69NiTZ8tfc+1plqyqSI7veXr2+2MePld684TbJ5yojDiCR4mx9xgClt9cFSvK5yuSLKuNX1Su9ppJiyRQXmS+5jPwY5KWyn/ucy2c/G/KZz4TcfHOI/HfzuutCYq9uTgFgWOSRurCIdHWhb/2sWcMlwOZA98QIYeex6ngIIUKIEHZIPleZ7CrGW7KNlPFW0+sCJflcZfJFlfGr6pVeU0mxZIqLzJdcRn4MCCEArB8hXAPYF6wTdE+MEHYeq46HECKECGGH5HOVya5ivCXbSBlvNb0uUJLPVSZfVBm/ql7pNZUUS6a4yHzJZeTHgBACAEIIMH90T4wQdh6rjocQIoQIYYfkc5XJrmK8JdtIGW81vS5Qks9VJl9UGb+qXuk1lRRLprjIfMll5MeAEALAhhZCgHWC7okRws5j1fEQQoQQIeyQfK4y2VWMt2QbKeOtptcFSvK5yuSLKuNX1Su9ppJiyRQXmS+5jPwYEEIAQAgB5o/aVODII0P8nnjHjhDPHnuEeCbabaswBKZ5gepL/11mzNitMdV/llEhjF+ZmNi994ZU1V1lxB5TcXC8pLg/KHPVVZVJVX07RC8wfEfqeHIn94ix39EYtrpl/O53VZlqKaY6u8xEv0m5Ipnr058OkTsrZ5LiSXLNNSGygbb76erGG11kpy77+JtuCrnhBheZWcbmU5eRNefJTfwl3HJLyK23hmSxKSNjxXmk1yuQj4yVRUo+//mQL3wh5LbbQnbuDJFemUoiQijxU3ldlCuyMqmbUwAYll1PaACYIwjhtC4QIUQIO/4mEcIyCCFC2BY/FUIIsFHY9YQGgDmCEE7rAhFChLDjbxIhLIMQIoRt8VMhhAAbhV1PaACYIwjhtC4QIUQIO/4mEcIyCCFC2BY/FUIIsFHY9YQGgDmCEE7rAhFChLDjbxIhLIMQIoRt8VMhhAAbhV1PaABYGHoJkqLvbHx1TNhP+7eMiqjcfXeIIGPvuy/k0ktdqn1s7OWLiY1xgOpHMeFdoNu3V2UuuyxEelUn7CIPPDBEZu51vSKiv/hFiEe+I1HNlcjDP8OYcCe1WOzxgJglkbrIXjERPdH+VYh+vztDei3DK4GP7IllEywzS/xYv5/2y5B9vOiExDuA9I6Uo06erYxMJWMl+W2o3XNHfJHm7be7yHn95eeLKuNvjuiTjPXfvny/0pu9ziTf6jKyKrl8icwsl+B7bXRzCgDDoo9F4aKLXAbk0f3AxIydZFonAlgjCGF3QUIIEUKEsHkZk1iNjPXOk2crI1PJWEnWvO65AyFsT77VZWRVcvkSmVkuwffa6OYUAIZFH4tClsCeQhie5k2UBW01VQeR60iXebrUAMwKhLC7ICGECCFC2LyMSaxGxnrnybOVkalkrCRrXvfcgRC2J9/qMrIquXyJzCyX4HttdHMKAMOij0UhS2B/IZQPQlu70LFsLF3m6VIDMCsQwu6ChBAihAhh8zImsRoZ650nz1ZGppKxkqx53XMHQtiefKvLyKrk8iUys1yC77XRzSkADIs+FoUsgX2E8JEnePuhaRRyzeoOoanRtJddjY11l7QADARC2F2QEEKEECFsXsYkViNjvfPk2crIVDJWkjWve+5ACNuTb3UZWZVcvkRmlkvwvTa6OQWAYdHHopAlcAZCGJ74TeR56pbyw1Q+1y3lIcAMEUOQjftuu4Wknbpgd/mHVCFV2E/vuWdVpqrujwkzV9V3Y46LuTsmnChZ3PdjfPF3Ynyx88NUvDPGF98SE4qr6t9CxEyqk2IC++wTUlX3xtgTHVqF9DvR5TH2RNVRMb1OdE5MONGhh1Zlkni7E1XVlWXSH1bs2OxXZi8u74qUyFgxQJkqbYtDejmAFMsy/MxyCVlcy/g3Z0pvftGoibyDVF79KpE3skr8m2DzO3nLXHmlyxVXhMh/vj/xiRDplbGf/GSIFMt5P/WpEFlzvgPmbsidlF4fOa9flYyV4vil6OYUAIZFH4tClsBpC2HJo7vWRJd52mr6tjceAswQ2QYghLYYIWw/EUKIENaRZfiZ5RKyBCKECOEocl6/KhmLEAIsMPpYFLIEzlIIq5aaLvO01Zh2obEMYObINgAhtMUIYfuJEEKEsI4sw88sl5AlECFECEeR8/pVyViEEGCB0ceikCVwAwlh2S74XoBpItsAhNAWI4TtJ0IIEcI6sgw/s1xClkCEECEcRc7rVyVjEUKABUYfi0KWwD5CWLUImPlcHpa0lZUf1vx5dNj4GWDmyDYAIbTFCGH7iRBChLCOLMPPLJeQJRAhRAhHkfP6VclYhBBggdHHopAlsL8Qrm5Hi8aipLlGaBvS2Gjay67GxlF7eQgwaybYyE4wVgzwoYdCyn8ej/yT0K35snsZ5hh+HhOUIF3CsjtRr1XtHrJ9gheHjmGKU8U1V9WvYgJbtoQMdt5+L0qNLv3gg1UZOe+OHSHKFM8rwpD3wWX8blt2vX7HLL0iDL0iM2eTKXP55SHS20tyZCpJXmeZvLAy+e6Vka8sF5TxM8uq5BJE2+RuSK+cqNfvSjxNxsqvzkud9PrIzHJen3wVZaTY/vh1cwoAw6LPzEXl0U3p7BnsRAA1a5e6ScYihAhhK33OO00xi+dFCHsEITTxM8uq5BIQQpN8FWWk2P74dXMKAMOiz0wAGJy1S90kYxFChLCVPuedppjF8yKEPYIQmviZZVVyCQihSb6KMlJsf/y6OQWAYdFnJgAMztqlbpKxCCFC2Eqf805TzOJ5EcIeQQhN/MyyKrkEhNAkX0UZKbY/ft2cAsCw6DMTAAZn7VI3yViEECFspc95pylm8bwIYY8ghCZ+ZlmVXAJCaJKvoowU2x+/bk4BYFj0mQkA8yYI0s9/XpX5wx9CRNtkq6Zvg1yqQhSKSygu2ejFslW1O1eN6IQYgrcLXyz/ni+5JOTSS0MuvjhE/uAhvfKCuAsuCDn//JBzzw0555yQs88O+chHQj784ZAPfSjk/e8POeOMEOk9/fSQ004Lec97Qt797pB3vStEegcrlsia/SXkgo1VrJtTABgWfSwCwLxBCCmuobhkZsVZAhFChHDqxZLsSOYScsHGKtbNKQAMiz4WAWDeIIQU11BcMrPiLIEIIUI49WJJdiRzCblgYxXr5hQAhkUfiwAwbxBCimsoLplZcZZAhBAhnHqxJDuSuYRcsLGKdXMKAMOij0UAmDcIIcU1FJfMrDhLIEKIEE69WJIdyVxCLthYxbo5BYBh0cciAAxOn50rxYGFKH7KU0Kq6ksx58Ys25dhPlRmt92qMtWTYnYLEQWo9oqpfl9G9t6JB0KeVoVU/1JGLl9eV3vffSHHHRdSVfeXOf74qoxcoPLEkKc9LUS4/voQPVHerbbvXLXXR270Bz4QIoIk+iRyJer1sY+FiMVJPv7xEPFDiaimf8uo+HB+EWUZeaGlfCuSG28M+cxnQm6+OUR6b721R77whZDPfz5EeiW33Rayc2fIF7/oIsV+rPTefnuILMOvSnrzRZWRu/HZz4bkm1lGvpSbbgq54YYyujkFgGHRp6bwv/+3y4CM/vcPbZ2ASWarx059VbA56eEeFEcWohghRAhbgxAihG2RYj9WehFCAJgq+tQUsgT2FMLH/p+yOXHqWKNNkzHJhOXYSeYBGNHDPSiOLEQxQogQtgYhRAjbIsV+rPQihAAwVfSpKWQJ7C+E8kGQ9o5lkzPJhAghTJce7kFxZCGKEUKEsDUIIULYFin2Y6UXIQSAqaJPTSFLYB8h7CJ7a6spaetqbC9b2j7nYmnPXeUhQF96uAfFkYUoRggRwtYghAhhW6TYj5VehBAApoo+NYUsgQsjhI2fV4uKw8aa/GH0uW1U4+e6pTwE6MmWGOX4EFECJezjzzyzKiOIP8g2r9oao0zvREvOtaZ4oqc/PUSQvag6Xrztegmw3ol70+raa0NEYyS+WF5YKvokvyRRrx07QkTqRPnED886K0TMUzRVJPbUU0NOOSXk5JND3vnOkLe/PeTv/z7kxBND3vKWkDe9KeSNbwx5wxtCjj7a5cgjQ7ZtczniiJDDDw956UtdXvzikIMPdjnooJADDwx51rNc5L9fT32qyz77hDz5ySF/+qchf/InIU94Qsjuu4c87nEh00M3pwAwLPpvUsgSOG0hrB5TrCxaNX6esaMaC0aNfqq2GfwhQE8QwjLK1E6EEEIrCCFCiBAihACbGP03KWQJnLYQTl5THq5EckFNWSCNJXW7lJlDgJ4ghGWUqZ0IIYRWEEKEECFECAE2MfpvUsgSuMBC2LG9bGwbIviytlEA3UAIyyhTOxFCCK0ghAghQogQAmxi9N+kkCWwjxBWLVbW9jkf1siQctq2U/ia/GH0WQ5ze1sNwFpBCMsoUzsRQgitIIQIIUKIEAJsYvTfpJAlsL8Q1pSNRUlzjSDD24aUjWVXLjafc7G0l11SBgAAAAA90M0pAAyL/ptcVEoNWxwHEzkEAAAAgH7o5hQAhkX/Ta4HcDAAAACADYJuTgFgWPTf5HoAIQQAAADYIOjmFACGRf9NAgAAAAAMhm5OAWBY9N8kAAAAAMBg6OYUAIZF/00CAAAAAAyGbk4BYFj03yQAAAAAwGDo5hQAhkX/TQIAAAAADIZuTgFgWPTfJAAAAADAYOjmFACGRf9NAgDAhuDNMYP1nhAj+LGT9B4fI/ixG53HPS7kj/4oZPfdQ/bYI2TPPUOe+MSQJz0pZK+9QvbeO+TP/ixkn31C/vzPQ5761JC/+IuQv/zLkKc/PeQZzwh51rNCnv3skAMOCPnrvw557nNDDjoo5HnP65GDDw554QtDDjkk5NBDQw47LOTww0Ne8YqQV76yR171qpDXvKZHXvvakKOP7pHXva6Mbk4BpsEPoTP61ICCH+9CW7vRceAkpwAAMHgFml0vQrh4IIQIYVsQQti4qPRAO/rUSIyMpaat/cctVtNY0Fa8BqY4VcZMbrpGtBXk9twCADA5XoFm14sQLh4IIULYFoQQNi4qPdCOPjUSoiv1YReNmWRsR6Y4VWaSydvG5vbcAgAwOV6BZteLEC4eCCFC2BaEEDYuKj3Qjj41EpNIXWPNjwvqlrq9PqwpD0c1dUt9WLY8WhoPRx+ksmbUIkj76LCuL3tHjTV1Y9mVK0ctdXt5CAAwOV6BZteLEC4eCCFC2BaEEDYuKj3Qjj41Em3q0sVh2mrynGVL7q0/lJ/lgz8sx8qhdNVIo5Q1Dm/7PDqUDyWNjbB58FtV3+t5fUyv3mNjevV6jovpxSRjZ7fm2fV6yfFX5Mf68/qZ/VjfO8mqZtb7hjf0yN/+bcgb39gjxx8/n/RaRq/iN70pJBeUyTeke447LqTXMvJsZeQLnSQys6xKLqHXFfm85S0hJ5zQI299a8jb3hYixf5EJ54YIjNL8ZvfXEY3pwAwLPpYTIzEpqat/cctStNYIMUdD6V9RFuxHLa1Nx6O8DVjZ+7YPqKxETYPXvl8r8crn+/1SuB7PXZrPoZJxs5uzbPr9frkr8iP9ef1M/uxvneSVc2sN1ufiXcAH9n0D5Zey+hVLGaSC8rkG9I9vfSp13mz1605MrOsKktg9yvy8Z7mgxACQDch1KZdtLUb2qSo42HjGduK5TC3C2XvCGlsO5ywfURjI2wevPL5Xo9XPt/rlcD3euzWfAyTjJ3dmmfX6/XJX5Ef68/rZ/Zjfe8kq5pZb7Y+E+8APrLpHyy9ltGrWMwkF5TJN6R7eulTr/Nmr1tzZGZZVZbA7lfk4z3NByEEgE0shOVhI37I2Jk7to9obITNg1c+3+vxyud7vRL4Xo/dmo9hkrGzW/Pser0++SvyY/15/cx+rO+dZFUz683WZ+IdwEc2/YOl1zJ6FYuZ5IIy+YZ0Ty996nXe7HVrjswsq8oS2P2KfLyn+SCEADBjIewoRebwx7to/Cwf8mFjfe4aHdafS0xNOXPb59EHOZT2xhbYbHjl870er3y+1yuB7/XYrfkYJhk7uzXPrtfrk78iP9af18/sx/reSVY1s95sfSbeAXxk0z9Yei2jV7GYSS4ok29I9/TSp17nzV635sjMsqosgd2vyMd7mg9CCACTCaGgFbtoLJCWsqtuqQvK3rK9S0vdXhbULWVlI2WXlElXSS4oD6Ws7IJNi998+16/vfbYLfKY807S689reW7MFNkvZor4mX3vumQ5Rli2vb+OuSdkqQqpHoj5ScxvYk6KOSsk77DL2I2sFssuX4Th2GNDspyUEUPwM4u1vv71IcccE3LUUSFHHhkib5Lcti1E3lF5xBEhS0su+RWX5nWXElmkvLJSLlBujnxH8g3K9+uNyOuTRARJ8nd/F/KOd4ScdFKPnHKKy6mnhpx2Wsi73+3ynveEvPe9Ie9/f8gHPxjygQ+E2F7dnALAsJRPYhDE3Lqwhvq+Q2Dj4fXJ9yKEU2J2YuZn9r3rkmWrfMu2FyFECFuCEJpkCUQIAaAP5ZMY1kZtdNgdrA2vT74XIZwSsxMzP7PvXZcsW+Vbtr0IIULYEoTQJEsgQggAfSifxLBmRiqIDcLa8PrkexHCKTE7MfMz+951ybJVvmXbixAihC1BCE2yBCKEANCH8kkMAHPB65PvRQinxOzEzM/se9cly1b5lm0vQogQtgQhNMkSiBACQB/KJzEALCA/ixFmt4E+JSZuoMcwrzWfGrMu1nxazLpY8+kxU1yz9Mordo8KWYqXIOk11RlnhLzvfSGy65Vt7plnhnz4wyFnnRVy9tkh55wT8rGPhZx3Xsj557tIsUwlJ5JlSD7ykZBcsOZiuRsSmconT949MpVfhvT67zevs/tUEvldWZvSn6ho2+mn94gYoPjhu94VIl76zneGvP3tIeLDUa11cwoAw/LoQxgAFhW/gZ7dph8hLJndmhFC02stbilegqTXVAih8aVcsOZiuRuSbFAmefLukan8MqTXf795nd2nkiCEADAgjz6E2yn/r+P4PN/PsDnxG+jZbfoRwpLZrRkhNL3W4pbiJUh6TYUQGl/KBWsulrshyQZlkifvHpnKL0N6/feb19l9KglCCAAD8uhDGAAWFb+Bnt2mHyEsmd2aEULTay1uKV6CpNdUCKHxpVyw5mK5G5JsUCZ58u6RqfwypNd/v3md3aeSIIQAMCCPPoQBYFHxG+jZbfoRwpLZrRkhNL3W4pbiJUh6TYUQGl/KBWsulrshyQZlkifvHpnKL0N6/feb19l9KglCCAAD8uhDGADmxpKN7mvPjbFbZNjgLNs3dr46pg9Lc/ohbYkZDHntpLzeUyLvApWXf8p7ROVlmPKqzFfFF2kuLYUcdljIS14S8sIXukjxIYeEvPSlIS97WYj0+sjML3pRyMEHhxx0UMhf/3XIAQeEPPOZIc94Rshf/mXIvvuG7LOPy5/9GVm06OYUAIZFH4uR+v+ArRGt3sSsrKxoE0BXlmwQQmhlGSGcDgghQkjmGt2cAsCw6GMxogoY0epEoyaVjSsFjY1ley5oa89dI3J7blkb05oHNiVLNgghtLKMEE4HhBAhJHONbk4BYFj0sRhRBYxodSK7WdmSu3x7Pmz7nA/bGnPL2pjWPLApWbJBCKGVZYRwOiCECCGZa3RzCgDDoo/FiCpgRKsTpf7lljaJyu1miOnK5JqyZbS2EUVJp/ayq62x7qobAXaxZIMQQivLCOF0QAgRQjLX6OYUAIZFH4sRVcCIVidqCzKHmdxuhpiuTK4ph7d9Hn2QQ1M/9jMArDsmkKt5sTQrqbvrrpD0N4vZYb+F58b0Im1Pp5Y//dOQP/kTlz/+45A99phanvCEkHxqswwfGfvkJ4f8j//h8ud/7vK0p7ls3Rry9KeH7LdfyLOe1SPPfnbIgQeGPPe5Ls97novosUSU/sUvDhHDz2ZuIn9ZOPzwkFe8okde/vIQ+RPGEUeEbNsW8upXh7zmNWV0cwoAw6KPxYgqYESrEyMFKqWoPBx9rikb68/SYrpGn/NsJWVBTd0lleVhzdj6ju0AsL6wKrKYLCGEnckiN60ghCZZAhFChBBgYaiq/1Nnwx/qYzGiChjR6kSpQ2PVyBR06RIa23OjrLCkrMntZUF5KMVl+2o1AKw3rIosJksIYWeyyE0rCKFJlkCEECEEWBiMPm28Q30sRlQBI1qdKHVorBqZgi5dQmN7bjQzj5D2tvq29pq2dgBYF1gVWUyWEMLOZJGbVhBCkyyBCCFCCLAwGH3aeIf6WIyoAka0OtFoQW3uNLY9H7Z9zodtjeVJG2eTxsb6ts+jQ/kAAOsRqyKLyRJC2JksctMKQmiSJRAhRAgBFgajTxvvUB+LEVXAiFYnGi1IfKmmsbFszwVt7blrRG4vW9qGl41l12r1Y725vWysPwMENt72eoZXtFuMsg6vCBaB1762R446KuR1rws55piQuOvVsb0ibyiV7bVsviWyU5fItl4iDiCvJD300BDxFh9xnhe8IOT5z3eRF5b695dKxPHk7abih/J2Ux//ZtReES99znNc/BVJes0s2X9/l3yuMlatfwgAc0UfiwAwMPOTjXWoTwghzIJsfSbiaQghQlgHITQZJ4Tmf7vgkMM1H0JH9LEIAAMzP9lYh/qEEMIsyNZnIp6GECKEdRBCE4SQw3kcQkf0sQgAAzM/2ViH+oQQwizI1mcinoYQIoR1EEIThJDDeRxCR/SxCAADMz/ZWIf6hBDCLMjWZyKehhAihHUQQhOEkMN5HEJH9LEIAOuJF8T0YcsWlzFyNYYJxvor8r0vilmQ3kNievUeGtOrd78Y4Ykxgr/Pj48RDovpx1dc9qlCVMv/I+bymDPKLC9XZVQn5PWPIiqiMYccEuJf8ChyJer1yleGiNSJW4qmHn10iGjqG94QctxxIccfH/KWt4SccELI294W8nd/F/L2t4fIjT7ppJBTTnF597tD3vvekPe9L+SDHwz58IdDzjkn5NxzXc47L+TCC0MuuqhHLr445JJLQi6/POSKK0I+9amQq64K+fSnQ665JuT660NuuCHkpptCPvOZkM9+NuTWW0M+97ke+fznu0c3pwAwLPo0BoD1hN+4W7IEIoQz6fXK53u98vne/RBChBAhRAgRQoB1hv/fPGd0qE9jAFhP+I27JUsgQjiTXq98vtcrn+/dDyFECBFChBAhBFhnGG2b3aE+jQFgPeE37pYsgQjhTHq98vler3y+dz+EECFECBFChBBgnWG0bXaH+jQGgPWE37hbsgQihDPp9crne73y+d79EEKEECFECBFCgHWG0bbZHerTGAAG5j//M6SqfhDjOSvmrph7Yn4bc23MpTGyn5ax98fcF/OvMf8eIxv3X8d8P0YuwV+RjP1NzAMxMpW/op/ErAsui7klZGsVIuwbo8i9ejDmyBj5fi1LMf34RYz8CCWnh3zhCyG33RbyxS+G7NzpImPTxjdEdtuSW24JkY27bOtvvDFElEAiY31EJ667LkRU5OqrQ8RbxGquvDLksstCduwIufRSFynevj1ExEwixSJ1F1wQIrr4sY+FiHmefXbIWWeFfOQjIR/9aIj0ylgx3jPPDHn/+0PEpX3OOCNEek87LcSP7ZNiMwwAc0CfqJFzjj3aRKunxMrKijYNyHzPDpsRhBAhnA2XIYTtQQg7ByFECOvMUgjN/3bB4WIewkZCn6iRLIG9hHAlUrYXVYrvHZFrcsvamNY8AF1BCBHC2XAZQtgehLBzEEKEsA5CyGFxCBsJfaJGsgT2FUJz2EaXslyTW9bGtOYB6ApCiBDOhssQwvYghJ2DECKEdRBCDotD2EjoEzWSJXAqQij/a+GIsqWxvSS3ywyNw7u0l11tjXVX3QiwdhBChHA2XIYQtgch7ByEECGsgxByWBzCRkKfqJEsgdMVwlKrGhvL9pLc2Di8cX45NPVjPwPMnqVJtsjLMT+NEU+LLE1yXlGRr8V8J2ZHjGVpk6/qezGWpcFWtZj3qs+qPvCBkA99KMTv4338xl3ejSnLkPhicYDTT3eRfby8sVM2675Yziu9Mvbd8cWhEpEN6T311JB3vSuk11TyOlN59+lgOfnkkPye1UWILHJm0c0pAAyLPhYjWQL7CmFJ2S4fSqSxrSZTd0lleVgztr5jO8CMWZpkA70c81OEcJ2vCiGczapErhBChHCAiBRlGVuEJHObUXRzCgDDoo/FSJbAvkLoPzfKVZuJ+cZyTqGsye1lQXkoxWX7ajXAzFmaZAO9HPNThHCdrwohnM2qRK4QQoRwgIgUZRlbhCRzm1F0cwoAw6KPxUiWwDULYXmYP5S0jfKNfs4qtbfVt7XXtLUDzIalSTbQyzE/RQjX+aoQwtmsSuQKIUQIB4hIUZaxRUgytxlFN6cAMCz6WIxkCZy6EDY2jj40HrY1Ns4p7WVjY33b59GhfAAYhKVJNtDLMT9FCNf5qhDC2axK5AohRAgHiEhRlrFFSDK3GUU3pwAwLPpYjGQJnEQI6xYRrTb1ajxsa2ycM09VN5Zdq9WP9eb2srH+DDANlhZyi7w02KqQnO6r4l51X1Wfe5W2pyHiHnnTPJfIqhYzedndk2dbc2Tm/BWXeec7Q8TipDcPLyPLEE3tpbi+2J8o/0WgjPh/r4jwS6/8dcBGN6cAMCz6WASAoVkabIu8/jfuS4OtinvVfVXr/17lrbzZ1md1mUuyBixg8rK7J8+25sjM+SsugxB2D0IIsFHQxyIADM3SYFvk9b9xXxpsVdyr7qta//cqb+XNtj6ry1ySNWABk5fdPXm2NUdmzl9xGYSwexBCgI2CPhYBYGiWBtsir/+N+9Jgq+JedV/V+r9XeStvtvVZXeaSrAELmLzs7smzrTkyc/6KyyCE3YMQAmwU9LEIAEOzNNgWef1v3JcGWxX3qvuq1v+9ylt5s63P6jKXZA1YwORld0+ebc2RmfNXXAYh7B6EEGCjoI9FABicI2Iiu8Uov4n5Vxvh1TG96HXe38b8LOb+GM9ga/5dzL0x/xHjsWue5vf7/2x+EuM5JqYXsuafxlwfs6OHTM5uVbI99bteea+mvJLUv0fUF8vrTKVXxsrM/kTyslNJfjlqmbPPDpFFylT+paPyZlR/+f68eZ0mfqyc6KMfDTnvPJePfSzk3HNDpNdfkf9SZOw554TImiW+WHrlvL1+hL44vzi3iG5OAWBY9JkJAIODECKEU/l+swQihDV2VQihSS+NQQgRwrbiJIEIIcDioM9MABgchBAhnMr3myUQIayxq0IITXppDEKIELYVJwlECAEWB31mAsDgIIQI4VS+3yyBCGGNXRVCaNJLYxBChLCtOEkgQgiwOOgzEwAGByFECKfy/WYJRAhr7KoQQpNeGoMQIoRtxUkCEUKAxUGfmQAwOLJF/l6PtyPObousr3BcjI27rmqwe/VgTJaxMlLsmWRVv4jJKylzSozn9TG96LWqU2M8M1uVaIzsVsVqxA/FHr1Myusfe+U97+kReZOkLMP39irOl2zSS7zz8GHiL3+Kyafuvoz88zCRN5TK+0t7RaaS5FfFdn5trG5OAWBY9JkZucii1YvKysqKNs2DBVkGLCDXI4QFvVY12L1CCLvTa1UIYedk6zMRf/B2Ib29ivMlmyCEZfKpuy8j/zxMEEIAGIc+MyOqgBGtbmHlMbq0141lV2NjSWNB/tCFXJxb1sa05oGNx/UIYUGvVQ12rxDC7vRaFULYOdn6TMQfvF1Ib6/ifMkmCGGZfOruy8g/DxOEEADGoc/MiCpgRKubKC2o72ffWOILfK+Qi3PL2pjWPLDxuB4hLOi1qsHuFULYnV6rQgg7J1ufifiDtwvp7VWcL9kEISyTT919GfnnYYIQAsA49JkZUQWMaHWiTYFye92Su9oaSxoLGudcKagbS3J7l+Fd2suutsa6q26EzcD1CGFBr1UNdq8Qwu70WhVC2DnZ+kzEH7xdSG+v4nzJJghhmXzq7svIPw8ThBAAxqHPzIgqYESrE21ik9vrltzV1ljSWJDnLF2rzbtyY+MQ+Tz6IIemfuxn2FTIFvm0GI/dIu8eo9gtsuaMGM9yTC9+NsE7SJfdeR8fo/wk5rcxnu0xvRABlhwZc1KMx65qS4ySV2JW1Us1FxLZnspGVrbXol6yY0473R45+eQQv48XQxB/yFZQJm/0y8gF+sv3kiMG6K1GrlfuhuSd7wx5xztC/v7vQ048MeRtbwt585tD3vSmEOn1OeGEkLe+NUR6ffFb3hIiq5JiiVyvn9mf6PjjXfIdKCNT2ejmFACGRR+LEVXAiFYn2vQmt4sU1ZjGksYC86HxsG7M1F1SWR7WjK3v2A6bB1Gv0xBChLBFvRDC2SBihhAihHWy55h4x8sSaIq9p0mxBCEEgJ7oYzGiChjR6kSb4eR2L0WNjSWNBXnOlcRq9WPkxrpFBxeVje1lQXkoxWX7ajVsJkS9TkMIEcIW9UIIZ4OIGUKIENbJnmPiHS9LoCn2nibFEoQQAHqij8WIKmBEqxNthpPbvRQ1NpY0FuQ5G8uEXDN2uLS31be117S1w4ZH1Os0hBAhbFEvhHA2iJghhAhhnew5Jt7xsgSaYu9pUixBCAGgJ/pYjKgCRrS6iVJy+n72jSWNBVnAVnaRC0py49jh0thY3/Z5dCgfYLMh6nUaQogQtqgXQjgbRMwQQoSwTvYcE+94WQJNsfc0KZYghADQE30sRlQBI1rdwsh/su00tueytsaSxoK6seytT9o4pGqaqsvwsrHsWq1+rDe3l431Z9hElL+GjFZHtDqi1RGtjlTPrEKE/WP6oGeKaHVEqyNaHdHqSHVAFSIcGKNYLZ+IY2MiSzHK7FZ1fExkaR2u6o1vDDnuuB7J++AyfrctUx17bMgxx4QcdVTIa17jIsVHHx3yutdNLW94Q4hckfeHbCPdI3dSTiS9MjbLmIlMJT8VuXwf+X6l92//NiT/0spIcT5XGfnK/A/pVa8K2bYtZGkp5BWvmFZ0cwoAw6KPRQAYGFWTiFZHtDqi1RGtjiCEAYQwMIF6LeaqEMI1R9xDrgghLIMQtkc3p7AOWXn4MftYOFx3h/pYBICBUTWJaHVEqyNaHdHqCEIYQAgDE6jXYq4KIVxzxD3kihDCMghhe34I6x8jGxwu/qE+FgFgYFRNIlod0eqIVke0OoIQBhDCwATqtZirQgjXHHEPuSKEsAxC2J4fwvrHyAaHi3+oj0UAGBhVk4hWR7Q6otURrY4ghAGEMDCBei3mqhDCNUfcQ64IISyDELbnh7D+MbLB4eIf6mMRAAZnIbfIrKpkaV6rOiEmsuRXtZi8OWawXnsn0/Y0ZGlpESOLPPxwl8MOC3npS6eWl7wk5MUvDnnhC0MOPtjlBS8IedGLQg45JOTQQ0PkAmeXl788RO6zfClHHDGryIle+coQsbjBIjIpqvna15r8EADmij4WAWBwZqcTiyk5rKo7VmOW/KoWE69ts+u1d1K215KlpUWMLDJLIEI4iyCEJpMJofnfLjjkcM2Hi4lf81wO9bEIAIMzO51YTMlhVd2xGrPkV7WYeG2bXa+9k7K9liwtLWJkkVkCEcJZBCE0QQg5XLzDxcSveS6H+lgEgMGZnU4spuSwqu5YjVnyq1pMvLbNrtfeSdleS5aWFjGyyCyBCOEsghCaIIQcLt7hYuLXPJdDfSwCwODMTicWU3JYVXesxiz5VS0mXttm12vvpGyvJUtLixhZZJZAhHAWQQhNEEIOF+9wMfFrnsuhPhYBYHD8RnaSXis5Y8ZO0uvx+uR77Vs3x/R6jovpxSRjZ7fm2fX635W/Ij/Wn9fP7Mfa3rQ9DZG3MvqXNMpYeb2nj3+Bp4+8dlJehukjr+gcLL2W0avYv4NUkm9I9/i3qvpl5NnKyBc6SWRmWVV+hWn3K/Lp83LXeqMMAHNBH4uRlf/lsh555PXyAzLw6WCd4uVqkl6/+fZjJ+n1eOXzvV4JfK/HCsMYJhk7uzXPrtf/rvwV+bH+vH5mP9b2ZglECAdIr2X0KhYzyQVl8g3pnl761Ou82evWHJlZVpUlsPsV+fQUQvO/XazTQ48fO7tDz8Yby2HHQ30sRrIErkEIV/8/+uqAlHUc1Z3GCXNjblkb05oHNjZeribp9ZtvP3aSXo9XPt/rlcD3eqwwjGGSsbNb8+x6/e/KX5Ef68/rZ/ZjbW+WQIRwgPRaRq9iMZNcUCbfkO7ppU+9zpu9bs2RmWVVWQK7X5EPQmjxY2d36Nl4YznseKiPxUiWwL5CWBpRFzvqUjMJjfPnxtyyNqY1D2xsvFxN0us3337sJL0er3y+1yuB7/VYYRjDJGNnt+bZ9frflb8iP9af18/sx9reLIEI4QDptYxexWImuaBMviHd00ufep03e92aIzPLqrIEdr8iH4TQ4sfO7tCz8cZy2PFQH4uRLIG9hDDrUN2yEsmNUt/YWxfk9rKxbJeatkYZkufp2F52tTXWXXUjbDa8XE3S6zfffuwkvR6vfL7XK4Hv9VhhGMMkY2e35tn1+t+VvyI/1p/Xz+zH2t4sgQjhAOm1jF7FYia5oEy+Id3TS596nTd73ZojM8uqsgR2vyIfhNDix87u0LPxxnLY8VAfi5EsgdMVwsbPow9yaOrLIV3mKdvbGhvnl8+jD3Jo6sd+hk3LJFvk2fX6zbfv9Vfkmd2qfK8/by9+FPNAzG9ifh0jYx+MuSfm/pj/G+NZkEXKVNIrY+VEHlnGb2PizLI9fetbQ972thAp9rtemerEE0Pe8Y6Q5eWQk08OOeWUkHe/O+S000Le+96QM84Ied/7XD7wAZcPfcjlzDNDzjor5CMfCTn77JCPfjREes85J0SKpffcc0POO8/l/PNDpPeCC0J6jfVTXXRRyMUXh2zfHiK9k+SSS0IuvTTksstCrrgi5KqrQj796ZBrrnG5+mqTHwLAXNFHaCRL4BSFcKbtQlt93Zipu6SyPKwZW9+xHTYnXp+8qMyu1+uT7/VX5JndqnyvP28vfrQYruVZkEXKVNIrYxFChBAhnDiLKoTmf7vYkIceP3Zehx4/dl6Hgi9ej4eCLzaH+giNZAlcR0K4EskFNbmxrBfKmtxeFpSHUly2r1bDZsXrkxeV2fV6ffK9/oo8s1uV7/Xn7cWPFsO1PAuySJlKemUsQogQIoQTByFcjEOPHzuvQ48fO69DwRevx0PBF5tDfYRGsgSuFyHs2N7W6Our1N5W39Ze09YOmwqvT15UZtfr9cn3+ivyzG5Vvteftxc/WgzX8izIImUq6ZWxCCFCiBBOHIRwMQ49fuy8Dj1+7LwOBV+8Hg8FX2wO9REayRLYSwirKDzyuZSlNnFqq+lSXzY2ttfkxsZzSXvZ2Fjf9nl0KB9gM+P1yYvK7Hq9Pvlef0We2a3K9/rz9uJHi+FangVZpEwlvTIWIUQIEcKJgxAuxqHHj53XocePndeh4IvX46Hgi82hPkIjWQL7CmH1mAuJ+dSN0iUtjV3SWH+Ww7K4bpf6tsbGeaSsbCy7Vqsf683tZWP9GaAR2df+/+3d/au1eV0v8I0eM8ywU2KWTEwiQgUiURQVNVDSA3iwqCTJmEyPJXaSMh9G07zVccZ71HEcn3v86RD90H9QP4QMcpCIfojIg8QhJIaIkPPzPueePffy+31/1/XZ61prr2uvtfbrxZtY34frWtda+96u6+2O5RN9/qXP3/T52z5f7BNn/s0+8UT/3OcrZff4UJ+/7PMXfT7f53V97u8TL+Gf+tTizYkX+FQx+Hr+oc8X+nypT/SlWlxG/byx+St94ocSl/HvfeKfSjxRXEbtul7CV/vEP+/4odT6U8XtaX0jO97ptnnssS4f/3iXT3yiShwbGfdvfmx9GY8/3uWTn5yROHaXjC+qTbyEWRl/TG2i1cz6cY/P1SZOFW3qkUe6PPxwlwcf7PL+93eJUher0fHiVFH5YrVOnHlWxrM1iZtaYGH5IbkURQg2pBC2iZegEG7ephTCVn+qugPUq5FZTSwyFrk24/7Nj60vI4rZ2PqKjL1u64wvqs1YtzbP+GNqoxBunrHmbZ7xbE3y5rT8U8bBDg9Tfc37G4Z682EOQ735MIeh2JwfkktRCGFDCmGbeAkK4eZtSiFs9aeqO0C9GpnVxCJjkWsz7t/82PoyopiNra/I2Ou2zvii2ox1a/OMP6Y2CuHmGWve5hnP1iTvW8s714MdHqb6mvc3DPXmwxyGevNhDkOxOT8kl6IQwoYUwjbxEhTCzduUQtjqT1V3gHo1MquJRcYi12bcv/mx9WVEMRtbX5Gx122d8UW1GevW5hl/TG0Uws0z1rzNM56tSd63lneuBzs8TPU1728Y6s2HOQz15sMchmJzfkgCB0YhbBMvQSHcvE0phK3+VHUHqFcjs5pYZCxybcb9mx9bX0YUs7H1FRl73dYZX1SbsW5tnvHH1EYh3Dxjzds849ma5H1reed6sMPDVF/z/oah3nyYw1BvPsxhKDbnhySwuL/vE/e10XmixcXd9qyvYYzb67itj7vtqBOxOVZrcc3xip7sE6vRH+IyYvO/9qld1MJVoplEyakvMo6Ny4hGFO9GbI5GVIuLrBP/rv5vn7iq+McQF/kffeLdiJcQx8Z7FcfGz7f2d33i2PEdaFLf9Q43r13i9vqhh7rEan0vHsfWq3XG5ypSv6J6c51Z72SdsWC0iYuM1ahPu6xGoonFV4PG94jOynves33i60wj8c2os74oNfLOd26f/oth874VWFZ+ogKLUwjbPFl2LYWwMPScKgphk7p7jOWkTVSRWcUsThXH1qt1xucqUr+ienOdWe9knThVJC4yVj8wp/LVqxGFcOsMhbD428WOw1BvvsJhqDcvNgz15sMchnrz6Q1DvXnzYX6iAotTCNs8WXYthbAw9JwqCmGTunuM5aRNVJFZxSxOFcfWq3XG5ypSv6J6c51Z72SdOFUkLjJWPzCn8tWrEYVw6yiE1zQM9ebDHIZ68+kNQ71582F+ogKLUwjbPFl2LYWwMPScKgphk7p7jOWkTVSRWcUsThXH1qt1xucqUr+ienOdWe9knThVJC4yVj8wp/LVqxGFcOsohNc0DPXmwxyGevPpDUO9efNhfqICi1MI2zxZdi2FsDD0nCoKYZO6e4zlpE1UkVnFLE4Vx9ardcbnKlK/onpznVnvZJ04VSQuMlY/MKfy1asRhXDrKITXNAz15sMchnrz6Q1DvXnzYX6iAour79R3aRdxbDxRHBtdK46tDXfYXeLWPF5CbTzb5meOd6MWXTrOXIsaExdZq2t5/LcD8SOL563Fu1En3sloy7XxbEXiiWYV4LiqHX6CDzzQZbx5nb6RzdU4VdxA16txqlnHjnf2RWYdOzaKNlFF3vveLrNW69TPW19zrMbLj8T7HKl/3PXmWYlTxb+68bmKjD/T4r2q37orPLb/CXZ3uMDi8mOxd/5Xf1Ukd5+oqf/JxKl5mCv6g0LYGs+2+Znj3ajtUCeymMVF1hTCNgphk1nHjjfcRWYdO97ot4liVle+erVO/bz1NcdqvPxIvM+R+sddb56VONUNKITF3y4OZxjqzbOGod68yzDUmw/k2FnDUG/eZRjqzbsMQ725HoZ2NT8We2MJnFsIzxu5tpk4cOvzrLSXtJKbGlOrU/MwV/QHhbA1nm3zM8e7UduhTmQxi4usKYRtFMIms44db7iLzDp2vNFvE8Wsrnz1ap36eetrjtV4+ZF4nyP1j7vePCtxKoXwMIah3jxrGOrNuwxDvflAjp01DPXmXYah3rzLMNSb62FoV/NjsTeWwFmFMCrTdg1qu6M2seGZp7ZNzcNc0R8UwtZ4ts3PHO9GbYc6kcUsLrKmELZRCJvMOna84S4y69jxRr9NFLO68tWrdernra85VuPlR+J9jtQ/7nrzrMSpFMLDGIZ686xhqDfvMgz15gM5dtYw1Jt3GYZ68y7DUG+uh6FdzY/F3lgCdymErdWf5sbS2E42u74+M26OyXZpNT8aV1dHtUvtZMyv3bOahA1Ff1AIW+PZNj9zvBu1HepEFrO4yJpC2EYhbDLr2PGGu8isY8cb/TZRzOrKV6/WqZ+3vuZYjZcfifc5Uv+4682zEqdSCA9jGOrNs4ah3rzLMNSbD+TYWcNQb95lGOrNuwxDvbkehnY1PxZ7Ywm8kkLYFqficTwY5y99fDFcPQ5TZ47h1MmnJlePYUNxX7tLu4jb6/jexa/2iSf6mz5/3yc2f7FPlNh4RbEap4rEF1rGarwbcc1xbDxvrP5jn1q8orppRxWJH0p9kfVbV/tq2S3jmv+jT/zXAfHzrcVPIRKvKJ7oKztU3Hjb68Q72X+rarSLurdEf4ib4Ng8fntkm/hSylu3qtRfaBmb69VdEpfxgfJbN+MbO+tjx28W3fxbRiOzjq0vI1Yj49mK1Fc169tcx29/LTIe3iYuI17geLbizONLLs7cJ29UgWXlB2xvLIGzCuHZ3YIUNSkqU9um2vm1k1ObL50fFUtnG5xwfLB2CJeKO+a6AtUUwqJrxapCqBAqhPNTl7pYjUpQHzt2lc3LRmTWsfVlxGpkPFuR+qrqrhUZu1mR8fA2cRnxAsezFWceX3Jx5j5/Pfwpox6GerPh5sNQb76uYag3X+Ew1JuvcBjqzVsP8wO2N5bAuYWw1TaoEBtaMTm1+dL50bj09Qt6ymoy9owPwtd3wwbijrmuQDWFsOhasaoQKoQK4fzUpS5WoxLUx45dZfOyEZl1bH0ZsRoZz1akvqq6a0XGblZkPLxNXEa8wPFsxZnHl1ycuU99qzoOQ73ZcPNhqDdf1zDUm69wGOrNVzgM9eath/kB2xtL4FUVwn7laWvnY3LqJJfOj+qdl55wfADbiTvmugLVFMKia8WqQqgQKoTzU5e6WI1KUB87dpXNy0Zk1rH1ZcRqZDxbkfqq6q4VGbtZkfHwNnEZ8QLHsxVnHl9yceY+9a3qOAz1ZsPNh6HefF3DUG++wmGoN1/hMNSbtx7mB2xvLIGzCmFRpdqltfPjg3F+6vHFg7XDVrGzOPn4RO1kOw8bijvmugLVFMKia8WqQqgQKoTzU5e6WI1KUB87dpXNy0Zk1rH1ZcRqZDxbkfqq6q4VGbtZkfHwNnEZ8QLHsxVnHl9yceY+9a3qOAz1ZsPNh6HefF3DUG++wmGoN1/hMNSbtx7mB2xvLIGzCuHZ3bIUlWmT+amZtUsxuXo8DlvjUnu21epqcrW0mm8fjxtgQ3/TJ27c/7P87sTIF/rMur2+wjI56yXEF2nGsbH5K31qUUXiVFHM4hVFnajFE8VLiDc2msm/9In3uRbXHF2rfidDXMZr+sRVRZmMJ4p3I543TvXFPvHzjfcqriryq33i2PL1xu1p9JZIXZDq1SvcXF/zcMNdbY72WKd+omgIY4VoM3aGNuP+Ng8/PCO3b2+fD3+4y7ih2ByJq6pXZ+Whh6qM+4uMb3WbsU+2iX8M8QONfzn9v+fuhhdYXH5IAovbpU1FFMJW3UwUwpZCON2XyhvZeatXuLm+5litN4+tr0j9RAphkbiqenVWxhJ4hIWw+NvF1Q5DvfkohqHevMsw1JuvcBjqzbOGrOSHJLC4XdpURCFs1c1EIWwphNN9qbyRnbd6hZvra47VevPY+orUT6QQFomrqldnZSyBCuH0MNSbj2IY6s27DEO9+QqHod48a8hKfkgCi9ulTUUUwlbdTBTClkI43ZfKG9l5q1e4ub7mWK03j62vSP1ECmGRuKp6dVbGEqgQTg9DvfkohqHevMsw1JuvcBjqzbOGrOSHJLC4XdpURCFs1c1EIWwphNN9qbyRnbd6hZvra47VevPY+orUT6QQFomrqldnZSyBCuH0MNSbj2IY6s27DEO9+QqHod48a8hKfkgCi9vfzXdUkTg2Ok+0i6XuxfNUV/jyoyDFajzv68rc3+eLfQ7k9cZlxOZYPb2X//d9ovCXrze6VlSg+GrQ+A7SK0x8Q2mk3jxrtc741EXqY8eTX0vGy24T3xNbZzy8OFWsxj+kuuFHm5rVtGcVwuilUXEfeaTLRz9a5WMf2zp5cwosKz+6gcXt7xZZIVQIV4nV03v5CuHGq3XGpy5SHzue/FoyXnabsfUVGQ8vThWrCuF08uYUWFZ+dAOL298tskKoEK4Sq6f38hXCjVfrjE9dpD52PPm1ZLzsNmPrKzIeXpwqVhXC6eTNKbCs/OgGFre/W2SFUCFcJVZP7+UrhBuv1hmfukh97Hjya8l42W3G1ldkPLw4VawqhNPJm1NgWfnRDSxuf7fICqFCuEqsnt7LVwg3Xq0zPnWR+tjx5NeS8bLbjK2vyHh4capYVQinkzenwLLyoxtY3NXdfH9jn7Mn+0Q//PM+sRrf9xjlKu7Uo0zGsfXm3n/pk5s/1CeuOTZHYYjN0S6+2ucTfRa7yGg1sTn+MURmXeT/7BMvPzb/RZ/4x/D+Ph/pE/9i61P1vqFP/kP6tz7RAOv/vuOzXeL2tL7N/fjHuzz2WJfHH+/yiU90idU6n/xkl1jd5cyRONWs1BcZ+dSnutSX8eijVeJtjx9K/Mji2Nh8hYmritRvXf1O1m9dnThznKrOpz/dpT5VbK5XP/OZNnlzCiwrP397Xy7lbmArCmHjkhqzS9eKzU8ohAqhQngncapZqS8yEg2hvoyxBCqEU29dnThznKrOcRbC+n9p4DCHod58XcNQb76uYag3H+Yw1Juvapifv72sgL3cXTo/v+S5pmx9IBwLhbBxSY3ZpWvF5icUQoVQIbyTONWs1BcZiYZQX8ZYAhXCqbeuTpw5TlVHIVxqGOrN1zUM9ebrGoZ682EOQ735qob5+dvLCtjL3aWte93WB8KxUAgbl9SYXbpWbH5CIVQIFcI7iVPNSn2RkWgI9WWMJVAhnHrr6sSZ41R1FMKlhqHefF3DUG++rmGoNx/mMNSbr2qYn7+9rIC93D3tvFFMtquxIZbglCiEjUtqzC5dKzY/oRAqhArhncSpZqW+yEg0hPoyxhKoEE69dXXizHGqOgrhUsNQb76uYag3X9cw1JsPcxjqzVc1zM/fXlbAXu4urS17ax9PPYBTFffiH+8Tt7m9vGOub+uf7PN3faK3ROLMcWvee06f3Byv6It94ppv93miz7/0iQ4QzxurUSfi9davKC7yL/tEqYvLiIIUL/8/+8QTxTVH8a6bWJyqd8k/pHhz4qcQm+urip/+k33iInf4R3hJH/58l/7edNaNbCY21zfQsbrLffxYA4pTxepY84rEqeqMV9Km7ktjoWoTHS86/Ec+UiXqYqzGqcYuWnTL+qp2qanx8uvnrVNfxvhWF297fVXxROW70d7+AsvLz9BeVsBe7i6NhXDtsHgApypucxXCNrcVwiZxzXX1UggVwolTxerY+orEqeqMV9Im6kQ80dhG2kQzibIxlkCFcJX6Msa3unjb66uKJyrfjb8u/3YxDkO9ebFhqDcfxTDUm49xGOrNRzEM9eZ2mJ+hvayAvdxdGhtgiKV2uHoMJylucxXCNrcVwiZxzXX1UggVwolTxerY+orEqeqMV9Im6kQ80dhG2kQzibIxlkCFcJX6Msa3unjb66uKJyrfjfpWdRyGevNiw1BvPophqDcf4zDUm49iGOrN7TA/Q3tZAXu5uxS9bqrmrebHB3Cq4jZXIWxzWyFsEtdcVy+FUCGcOFWsjq2vSJyqznglbaJOxBONbaRNNJMoG2MJVAhXqS9jfKuLt72+qnii8t2ob1XHYag3LzYM9eajGIZ68zEOQ735KIah3twO8zO0lxWwl7sHxR/6pv4MWDyAUxW3uQphm9sKYZO45rp6KYQK4cSpYnVsfUXiVHXGK2kTdSKeaGwjbaKZRNkYS6BCuEp9GeNbXbzt9VXFE5XvRn2rOg5DvXmxYag3H8Uw1JuPcRjqzUcxDPXmdpifob2sgL3cPYjKN5bAmGxXV8PYA6cnKkHcx0c/rNvFX/XpXXKL/KEdvhtzVmHoXdK1/rn8dtO4jD/vE80kzlxeVRbRP+7z2T6v71P/QDk8UQlu3+7yyCNd6sIQ98R1m4qCVN/lx+11fbddv6KHH+7yoQ91efDBLh/8YJf3v7/L+97X5b3v7fLud3d517u6vP3tXd761i6/+7tdfud3urz5zV1+67e6vPGNXd7whi7339/l136ty6/8SpdXv7rLL/5il1e9qssrX9nl536uy0//dJdXvKLLffd1+bEf6/JDP9Tl+7+/y8te1uV7vqfLS17S5d57u9xzT5cXvajLC17Q5b/+1y7PfW6XZz+7yzOf2aWUt7HAsvJ3Elhc3R8UQoWQPavrk0KoECqE+y+Exd8udhyGevNiw1BvXmzIjZW/k8Di6v6gECqE7FldnxRChVAhVAivehjqzYsNubHydxJYXN0fFEKFkD2r65NCqBAqhArhVQ9DvXmxITdW/k4Ci6v7g0KoELJndX1SCBVChVAhvOphqDcvNuTGyt9JAABYTN6cAsvK30kAAFhM3pwCy8rfSQAAWEzenALLyt9JAABYTN6cAsvK30kAAFhM3pwCy8rfSQAAWEzenALLyt/JXu7u5e4dnJ+f5xQAACcvbzCBZeXvZC9393L3Di4thJduAADg+OQNJrCs/J3s5e5e7t7BpX3v0g0AAByfvMEElpW/k73c3cvdpYtGd/6U1Uyr3RmT48zUJAAAxyRvMIFl5e9kL3f3cndpbZ1b+3i1px1Oza8dAgBwHPIGE1hW/k72cncvd5fqCjfV6KYKYahXAQA4UHmDCSwrfyd7ubuXu0t1A2yHd/5c2Bg3rGbGbQAAHJO8wQSWlb+Tvdzdy92l6GxTw7nza4cAAByHvMEElpW/k73c3cvdg7anjRWuLXtri9/UfAzbbQAAHJO8wQSWlb+Tvdzdy92DqG3NytMzrXH+4vE4Oc608wAHZPUfVWvl7qV86Utd3vGOLmff3+fs4T5s65nP7PIN39DlOc/ZV5773CrPe16X5z+/y3d8R5fv+q4uL36xyPp893d3ueeeLv2/q7zB5LT8GQcvP60AuEJZAXu5eykK4fVQCOXmRCHkriwfHJ78tALgCmUF7OXupSiE10MhlJsThZC7snxwePLTCoArlBWwl7uXohBeD4VQbk4UQu7K8sHhyU8rAK5QVsBe7l6KQng9FEK5OVEIuSvLB4cnP60A4GaJzrNLvv3bq0TXiiYWLe5Zz+oCp6u9MQWWl7+TAHCzjL1u64wlUCGEy7Q3psDy8ncSAG6WsddtnbEEKoRwmfbGFFhe/k4CwM0y9rqtM5ZAhRAu096YAsvL30kAuFnGXrd1xhKoEMJl2htTYHn5OwkAAIvJm1NgWfk72cvdvdw9xzV+3ToAAIcibzCBZeXvZC9393L3HJcWwks3AABw9PIGE1hW/k72cncvd89xad+7dAMAAEcvbzCBZeXvZC9393L3Zc57a+enZqYmAQA4YnmDCSwrfyd7ubuXu0ttkYvHX9/UDKfm1w4BADhKeYMJLCt/J3u5u5e7Sxs2uqlCGOpVAACOQ95gAsvK38le7u7l7lJRCC/+YLgybljNjNsAADhieYMJLCt/J3u5u5e7S1HhporfpfNrhwAAHKW8wQSWlb+Tvdzdy92Dtra1f9aLx1N7VvMxbLcBAHDE8gYTWFb+TvZydy93D8ZS1xrnLx6Pk+NMOw8AMzzjGV04es98ZpdnPavKs59d5TnPWSjPfW6Xb/7mKt/yLVW+9VsXyrd9W5cXvKDLC1/Y5UUvqnLPPW3u3ljCKbh1hPI/VAHgtCmEp0YhXCYKIWzgTr86P1tlyeHW8j9UAeC0KYSnRiFcJgohbOBOvypr2/6GW8v/UAWA06YQnhqFcJkohLCBO/2qrG37G24t/0MVAE6bQnhqFMJlohDCBu70q7K27W+4tfwPVYDRodxAf2Ofed7Xp/eMPofiPX3+uct9Z13O/lefr/b5Sp8H+ryuz/1d8on+d5848z/0+bs+/63PX/R5TZ/YHK/ob/t8sc8/9Ylr7l/+vfd2efGLu7zkJQeRl760y/d9X5eXv7zLD/5glx/5kS4/8RNdfuqnuvzMz3R55Su7vOpVXX7+57v80i91efWru7zmNV1e+9ou99/f5Q1v6PKmN3V585u7vOUtXd761i5ve1uXt7+9ywMPVHnPe6q8731dPvjBLg891OXDH+7yyCNdPvaxLo8+2uXjH+8Sq5HHHqvyiU90efzxKp/8ZJdPfarLZz7T5bOfrfL5zxfJm1NgWWcAl1IIr4lCqBDejUKoEJ50Iaz/7rG/4S7qM+9vuIv6zPsb7uLL519exXBPwzOASymE10QhVAjvRiFUCBXCPQx3UZ95f8Nd1Gfe33AXRY0xvKrhGcClFMJrohAqhHejECqECuEehruoz7y/4S7qM+9vuIuixhhe1fAM4FIK4TVRCBXCu1EIFUKFcA/DXdRn3t9wF/WZ9zfcRVFjDK9qeAZct6/1ibvevhJ851mXs3f0iWOjIXyhTzzvf/aJ++k4c9yp/2uft/Z5ok9cVdzWRyWIdhFPFFf1pT5xqq/0iYuMU/1qn74v3RcFKV5CXHO83n/rE6txGXHNT7WXDVvc2bu7PP+sS76EuKon+8RqXQhn/UP6qT7X9A/pc5/rEjey9V1vrNYZ75KLjIcX+fSnu4wbisRdft0B6koQlxGbY7XePOsiZ11zdJ4oSJGxUBWJ2jZrtW5idcbXuHnipzDrBzpeSZt4RXFsv3oLuFZnpdzdy93AVr6mEG55H59XpRC2UQg3/oekEBZ3+bEaiVPV/SFW682zLnLWNUdRGUugQrjhD3S8kjbxiuLYfvVW+bcLQ0PDfQ/PSrdKuRvYytcUwi3v4/OqFMI2CuHG/5AUwuIuP1Yjcaq6P8RqvXnWRc665igqYwlUCDf8gY5X0iZeURzbr94qb1UNDQ33PTwr3SrlbmArX1MIt7yPz6tSCNsohBv/Q1IIi7v8WI3Eqer+EKv15lkXOeuao6iMJVAh3PAHOl5Jm3hFcWy/equ8VTU0NNz38Kx0q5S7S+fn5xf/9+LB6vFquOEeOD1fUwi3vI/Pq1II2yiEG/9DUgiLu/xYjcSp6v4Qq/XmWRc565qjqIwlUCHc8Ac6XkmbeEVxbL96q7xVNTQ03PfwrHSrlLtLa7tfPB73tEureTgxcYu8v1bz3/vMKQyRfKIn+sRtfdSJHZ43LyOe6P/0icIQl/HFPnGqf+8TrSa+ObN/N76zL+3jZW+eLPzxip7sEz+U2Hy7T6w+2SfqUzTAOLZPvoRhQ5cH+kSp+0Sf+KH8Y5/+J5iXEa+o/xcbN7JjVylS3wRHu6hX6/4Q30L50Y92qVc/8pEu8f2WsTlWI7dvd4kz109UnypSb47V+ALPyMMPd3nwwS4f+lCX+GrQSJyqvqpYjWPjImNznfrYWJ11VeNzFYknqhOX0SdvMIFlnZVydy93l6LRrS14m+yB0xP38QrhxsknUgjbxObbCqFCuL6nKYQK4dQrqhNPVCcuo8+t8m8XhoaG+x6elW6VcndpbHcXfwBs5xVCbqa4jw1RoP0AABBASURBVFcIN04+kULYJjbfVggVwvU9TSFUCKdeUZ14ojpxGX1ulbeqhoaG+x6elW6VcnepaHerJYWQmynu4xXCjZNPpBC2ic23FUKFcH1PUwgVwqlXVCeeqE5cRp9b5a2qoaHhvodnpVul3D3Y8K9/RSGcWoJTEvfxCuHGySdSCNvE5tsKoUK4vqcphArh1CuqE09UJy6jz63yVtXQ0HDfw7PSrVLuHqxtfe1MW/kuZpr1p2diD5yeuEWO2/r4Ps+4Y643/1qXXYpKNpPjb2L5iuKdfGJfFTd+KHnmuIxoRF/qUz5vPlGcOX5GX6i+gTbe2NMTt6d1QRprT5soZpFxf5F43rgXr68qXkKkvqp6c6zGsbH50Ue71MdG4vVGb4kWF/ngB7u8//1d/v/tS5v3va/LH/5hl/e+t8sf/EGXd72ry9vf3uUd76jytrd1+f3f7xKrceb6id75zi4PPNDl3e/uEq/oPe+pUh9bJ47tkzeYwLLyYxFYnELYRiFsoxAuIspV9Ja6ekWiEUXG/UXieRVChXAqJ1EIi79dGBoe4PDE5McisDiFsI1C2EYhXESUq+gtdfWKRCOKjPuLxPMqhArhVBRCQ8PFhycmPxaBxSmEbRTCNgrhIqJcRW+pq1ckGlFk3F8knlchVAinohAaGi4+PDH5sQgsTiFsoxC2UQgXEeUqektdvSLRiCLj/iLxvAqhQjgVhdDQcPHhicmPReCY3NsnPKNPun9ved0x5PU7JL6vdX/5zTJvumF5874Sd8xxlx+JzfWx44Y2cR8/3ui3icIQp4qb7z/sW000oqhP9bdBRouL7z6NL0qtv6/1s5/t8rnPdfmjP+ryx39c5U/+pMuf/mmV2DyerUhcVSReUf0CP//5LvXrHZ+rSBw7vgNXlXii+o2NY8vNeXM6x+uBnZ0BR+xehXDrjDVv84zNbU8ZS6BCuIdEuRpL4OYdb9ZmhVAhnHq943MViWPHd+CqEk9Uv7FxbLk5S94cd25mn/Plr8fQ0HD+8Aw4YvcqhFtnrHmbZ2xue8pYAhXCPSTK1VgCN+94szYrhArh1Osdn6tIHDu+A1eVeKL6jY1jy81Z8uaob3MNDQ03GZ4BR+xehXDrjDVv84zNbU8ZS6BCuIdEuRpL4OYdb9ZmhVAhnHq943MViWPHd+CqEk9Uv7FxbLk5S94c9W2uoaHhJsMz4IjdqxBunbHmbZ6xue0pYwlUCPeQKFdjCdy8483arBAqhFOvd3yuInHs+A5cVeKJ6jc2ji03Z8mbo77NNTQ03GR4Bly34fa0yv+4prxlh/zuMeStV5e3nVziG1lPLnF7HTfukbjLr1vN/m7c/+zPqsTm8l48M152m3g3xsM3T1xVnV2OjYxX0iZeb/x8o/J95jNdogBHPa7z+OMzEj08VmedOU712GMzEv/tQHzH7JzcuTcFrk/emfZydy93X4Xz8/OcglM3tr4iY1VbJmPN2zxj+zrAjL1u64yF6tgzNKgTS915FMI2CqFCuKdCOP23C0NDw30P8860d2fztNx9FRRCbqCx9RUZq9oyGWve5hnb1wFm7HVbZyxUx56hQZ1Y6s6jELZRCBVChdDQ8OSGeWfau7N5Wu6+CgohN9DY+oqMVW2ZjDVv84zt6wAz9rqtMxaqY8/QoE4sdedRCNsohAqhQmhoeHLDvDPt3dk8LXeXLpre+VNWMyuxrdjQzreTcLzG1ldkrGrLZKx5m2dsXweYsddtnbFQHXuGBnViqTuPQthGIVQIFUJDw5Mb5p1p787mabm7FBWuHcbjtZNTjy8ewFEbbk8PMQ+I3M2756R3X5957t8h49fMNhluT7dPfCdn5CMf6RLf53n7dpf48s+HH76yPPTQjMRXktaJY+N54xXNyqxTzXonx8O33rzLF7TWiSb26KNd6n+EcVVxzfEje/DBLh/4QJdbt7rEl9nGV93GN+7Gd+r235qbN5jAss5KubuXu0tR3qaG44N6Hk7A2L4OMGMrkBubsfUV6d2nECqEW2XWqWa9k+PhW29WCHcphNN/uzA0NNz38Kx0Z/O03F0aC16IbasH9TycgLF9HWDGViA3NmPrK9K7TyFUCLfKrFPNeifHw7ferBAqhIaGxzk8K93ZPC13l6YKXpgqflPzcALG9nWAGVuB3NiMra9I7z6FUCHcKrNONeudHA/ferNCqBAaGh7n8Kx0Z/O03D1oy9tY8Nautg82eXzxAI7a2L4OMGMrkBubsfUV6d2nECqEW2XWqWa9k+PhW29WCBVCQ8PjHJ6V7myelrsHaytfO7PSTtYb2vl2Eo7XcHta5fVlxm8l3TxwU/3e73V5y1u6/PZvd3nTm7q88Y1dfuM3uvz6r3d57Wu7vOY1XX75l7v8wi90eeUru/zsz3Z5xSu6/ORPVrnvvi4//uNVfvRHu/zwD3f5gR/o8vKXd3nZy7p87/d2eelLu7z4xV3uuafLC1/Y5fnP7/K853X5pm/q8uxnd3nmM7twAPIGE1hW/k4CixtbX5GxBCqEsBuFsIhCyP7duSGd/tvFdQ7hZsjfSWBxY+srMpZAhRB2oxAWUQjZvzs3pHUxu64h3Az5Owksbmx9RcYSqBDCbhTCIgoh+3fnhrQuZtc1hJshfyeBxY2tr8hYAhVC2I1CWEQhZP/u3JDWxey6hnAz5O8kAAAsJm9OmZbvHQAAwFHL0sO0fO8AAACOWpYepuV7BwAAcNSy9DAt3zsAAICjlqWHafneAQAAAOzLeRnuOj9f/3ZMzQMAABy8os4US3ed93L5gMWVX8hNjanVqXkAAICDd1Fn1v5tcIOmE3XoGNvRhtc8tW1qHgAA4ODtrRCu/uw27ikm2/lxT/ug3Twe207GfBhX1x7YTsb82j2rSQAAgEN10VzOh6yWStF8VsO2FMXjiwft4002t8N2TwzX7on9IZamhlMnnJpcPQYAADhUF7XlfMhqqXTRfFba+WZX15ra+bWTU5svnS8m1+65UCydbfCk44O1QwAAgMNzUVvOh6yWSm3ticdhXGpnVo/b4dz5mAy5465xae2BsW2cj6NW8wAAAIfqoracD1ktlaL2rIab1KGpzVvPXzq5Vn22S590fAAAAHAkihZTLN1V1KR2aW1rWrs5Hl88KOanltrJdn40nq19vPaE8XicbOcBAAAO1XmZy4y1JwpS1KR2fu3k1PzF49Vku+dipjg25sO42h61Wl1NrpZW8+3jcQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMbOz86L5G4AAABORtH6iqWV8/PL91yJxZ4IAADgprhofWv/NqgQAgAAnLKrKoTnjXbY7myt5mOpnYylC+NRqxkAAABmuMJCOE62j9vyNvfxxXD1OIaxBAAAwEaWLISryV3m1w4BAACY7UgL4cXMhZgHAABgI8dbCFeKJQAAACYVra9YWlnb39Y+Pn/KrMcXDy4dxhIAAAAbGf82GH8nrK3tb2sfX5S9ldWGWGonmy1f31PMAAAAcIg0NwAAgBtKIQQAALihFEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADY2euf8+UiuXtn/tcIAQAADkXR+oqllfNeLg822bO5ONvVnhwAAODEXbS+tX8b3LAQFsPRpRtmudqzAQAA3Cz7K4SrPxvGZL2hnV87uZpfO1PsX20Y56cmAQAATtmeCmFbruLx2smpx/Fg8/lLH18M40E8BgAAOGW7F8JWO9/sWlO9Lt1QmNp8VfMAAAA3wu6FcOpxiD2rB/X8Sn+y9Zu3nr943J4ZAADg9F1hIWyHU81qasPU/NrJqc1bz186CQAAcIKK1lcsrUxVrPOnrJ0fNxSP48HUhhheesIYtvOxBwAA4GSNfxuMvxPWxvoUTaztY+3q1IZ2fmpytRQ720NWSzG5ehzDcTMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwDX4cpmrd35+nlOLOH9KzgIAANxgResrlp520bJWcnmdDbfNcuk5L90AAABwA120vrV/G9yoEBbDtTbZM9el57x0AwAAwA10lYUwZu7+4fCOtZMxv3ocw6lD2g3tg9i5GhYzAAAAN9C+CuFYwC59fPEghlP7W1Mb1p58kxMCAADcBHsshHudXzs5tbmdn9oDAABw0+yxEIbYEMO582snpza381N7AAAAbpo9FsJ+5WlTfWzu/NrJqc0KIQAAwKhofcXS04pydf6Ucamdj8cXD8b5tY9ba08yNb/JCQEAAG6C8W+D8XfCykWhWilW10628+3SxeNxfrUaVpOxWswXZwMAAOAQqXAAAAA3SPuHPoUQAADgZvH/4QkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABnZ18+/3KR3A0AAMDJKFpfsbSy+t+Lb/9X42PyQn/c09bOx+R4+NqZ8UFr7eRqPpbGmZXVfgAAgKN30frW/m1ww0K4+XA0tqytZ6YetNZOng3z9RAAAOBEHHghXD0eJ8eZtQ9aayfPpucv1KsAAADH6toL4er/jsNxqX08zqx90Fo7eTY9f6FeBQAAOFa7F8LWuBoz4WLDalsMx6WpybUPWmsnV/OxtJpcLcUMAADAKdi9EK59PDUTVhvaJjY+KOYvHo9La5967eRo6nkBAABOyhUWwkuHo7a/jV3uYrIVG1aPx6V2z8rayVFs2/AoAACAI1O0vmJppe5Ol1aptRumSl0xPy7VZw7jCYshAADAiRj/Nhh/J6yNZamdGVfD2g0Xk5sv3amDQw+cOjysXWqOeHopZgAAAAAAAAAAAABYq/3/ybyQOwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBLnJcBAADgZBWtr1hayf+x+cv+5+Yv3VCY9URnGzzXpRsAAABO2UUlWvu3wU3a0txONXd/K47d5VQXdj8DAADAEdtTIbyYj7/mrYbtzLitXSpm2uHqDDHZPogNq+FqBgAA4GZZdb/Iaqk21aaiaLU1bDV5MSyW2uE40x449XicjPnVJAAAwI1zUYnOh6yWahddq7Waj231fAxjfjXZauebXWtOcukGAACAm2jV/SKrpdpUp9qwg00N15527eTZMD+e5NINAAAAN9Gq+0VWS7WpTrVhBxsPv5gZ56cmz4b58bku3QAAAHATFZWoWFqZ6lQbdrDx8POnxOSFYr49//hcU086dUIAAIAb4bzMpS4KWGs1H9tWD4ptxeTZ9PxZfxntZDwY5+MQAAAArpOGBgAAcBNpgwAAADeO/+9NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABbz/wAZPP1OOuRCnQAAAABJRU5ErkJggg==1c:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$24"}}],["$","$L25",null,{"initialData":{"job_id":"67ef30fdee7849ab710a663c","environment_id":160,"environment_description":"Windows 10 64 bit","size":10240,"type":"PE32 executable (console) Intel 80386, for MS Windows","type_short":["peexe","executable"],"type_short_id":"exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"argument_baby_1.exe","md5":"71aa9bfa63b6f5262305030012cdd366","sha1":"4c864ffff0d5a921cf58c7c46015e459fbcd832e","sha256":"dc6267608ddfcc5c80571ccd46475a03fb667baf8620d0e91c93ccacacf97ef6","sha512":"712eee3db921047905352fbf69071f37fa7850273ad69530b21253aafeb6ab7bf1963b447ad1f848967f84aeff286569d2fb3288b2524c4a1a91629c46b984a2","ssdeep":"192:D4VBTZ/brLWJVTLjO2G+h7E5pz6XbmL+Y5:D4F/HyJhLj/7+9","imphash":"d03d8107f3c6ad0a9037b9bb38490944","entrypoint":"0x40144d","entrypoint_section":".text","image_base":"0x400000","subsystem":"Windows Cui","image_file_characteristics":["EXECUTABLE_IMAGE","32BIT_MACHINE"],"dll_characteristics":["DYNAMIC_BASE","NX_COMPAT","TERMINAL_SERVER_AWARE"],"major_os_version":"6","minor_os_version":"0","av_detect":null,"vx_family":null,"url_analysis":false,"analysis_start_time":"2025-04-04T01:08:14+00:00","threat_score":35,"interesting":false,"threat_level":1,"verdict":"suspicious","certificates":[],"is_certificates_valid":false,"certificates_validation_message":"No signature was present in the subject. (0x800b0100)","domains":[],"compromised_hosts":[],"hosts":[],"total_network_connections":0,"total_processes":1,"total_signatures":47,"extracted_files":[],"file_metadata":{"file_compositions":["1 .OBJ Files (COFF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 32216)","1 .BAS Files compiled with C2.EXE 5.0 (Visual Basic 6) (build: 32216)"],"imported_objects":["1 .OBJ Files (OMF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 31935)","12 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 31935)","19 .OBJ Files (OMF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 31935)","10 .LIB Files generated with LIB.EXE 9.00 (Visual Studio 2008) (build: 30729)"],"file_analysis":["File contains Visual Basic code","File appears to contain raw COFF/OMF content","File is the product of a small codebase (1 files)"],"total_file_compositions_imports":3},"processes":[{"uid":"00000000-00006072","parentuid":null,"name":"argument_baby_1.exe","normalized_path":"C:\\argument_baby_1.exe","command_line":null,"sha256":"dc6267608ddfcc5c80571ccd46475a03fb667baf8620d0e91c93ccacacf97ef6","av_label":null,"av_matched":null,"av_total":null,"pid":"6072","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","process_flags":[{"name":"Extracted Streams","data":null}]}],"mitre_attcks":[{"tactic":"Execution","technique":"Shared Modules","attck_id":"T1129","attck_id_wiki":"https://attack.mitre.org/techniques/T1129","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Loads modules at runtime","Calls an API typically used to load libraries","Loads the RPC (Remote Procedure Call) module DLL"],"parent":null},{"tactic":"Execution","technique":"Native API","attck_id":"T1106","attck_id_wiki":"https://attack.mitre.org/techniques/T1106","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Imports suspicious APIs"],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to execute Windows APIs","Calls an API typically used to retrieve function addresses"],"parent":null},{"tactic":"Persistence","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to access device drivers"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Privilege Escalation","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to access device drivers"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Privilege Escalation","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to check debugger is running (API string)","Contains ability to register a top-level exception handler (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Timestomp","attck_id":"T1070.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve file time (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Loads the Bcrypt module DLL","Matched Compiler/Packer signature (DIE)"],"parent":null},{"tactic":"Defense Evasion","technique":"Software Packing","attck_id":"T1027.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Matched Compiler/Packer signature"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Hidden Window","attck_id":"T1564.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to pass information to a window procedure (API string)"],"parent":{"technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564"}},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attck_id":"T1480","attck_id_wiki":"https://attack.mitre.org/techniques/T1480","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to use execution guardrails"],"parent":null},{"tactic":"Discovery","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to check debugger is running (API string)","Contains ability to register a top-level exception handler (API string)"],"parent":null},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/techniques/T1083","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Tries to access non-existent files (executable)","Touches files"],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/techniques/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Opens registry keys","Queries registry keys"],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/techniques/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Queries process information"],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to enumerate process and/or its information (API string)","Calls an API typically used for taking snapshot of the specified processes","Queries basic information of the specified process"],"parent":null},{"tactic":"Discovery","technique":"System Information Discovery","attck_id":"T1082","attck_id_wiki":"https://attack.mitre.org/techniques/T1082","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to read software policies","Contains ability to retrieve a module handle (API string)","Reads information about supported languages","Calls an API typically used to get system version information"],"parent":null},{"tactic":"Discovery","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"System Time Discovery","attck_id":"T1124","attck_id_wiki":"https://attack.mitre.org/techniques/T1124","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve machine time (API string)"],"parent":null},{"tactic":"Discovery","technique":"System Service Discovery","attck_id":"T1007","attck_id_wiki":"https://attack.mitre.org/techniques/T1007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries services related registry keys"],"parent":null},{"tactic":"Discovery","technique":"System Language Discovery","attck_id":"T1614.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Reads the windows installation language"],"parent":{"technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614"}},{"tactic":"Collection","technique":"Screen Capture","attck_id":"T1113","attck_id_wiki":"https://attack.mitre.org/techniques/T1113","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to capture screen (API string)"],"parent":null},{"tactic":"Command and Control","technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found potential URL in binary/memory"],"parent":null},{"tactic":"Command and Control","technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Making HTTPS connections using secure TLS/SSL version"],"parent":null},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attck_id":"T1029","attck_id_wiki":"https://attack.mitre.org/techniques/T1029","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform scheduled transfer (API string)"],"parent":null},{"tactic":"Impact","technique":"Service Stop","attck_id":"T1489","attck_id_wiki":"https://attack.mitre.org/techniques/T1489","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to terminate a process (API string)"],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-226","type":2,"relevance":1,"name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"argument_baby_1.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"argument_baby_1.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","description_v2":["Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"argument_baby_1.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"argument_baby_1.exe\")","Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"string-320","type":2,"relevance":1,"name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")","description_v2":["Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-183","type":2,"relevance":1,"name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"argument_baby_1.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"argument_baby_1.exe\")","description_v2":["Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"argument_baby_1.exe\")","Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"argument_baby_1.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"argument_baby_1.exe\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-148","type":2,"relevance":1,"name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"argument_baby_1.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"argument_baby_1.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"argument_baby_1.exe\")","description_v2":["Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"argument_baby_1.exe\")","Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"argument_baby_1.exe\")","Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"argument_baby_1.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"argument_baby_1.exe\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-721","type":2,"relevance":1,"name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")","description_v2":["Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-125","type":6,"relevance":3,"name":"Calls an API typically used to get system version information","description":"$26","description_v2":["\"argument_baby_1.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000001800000051bd754e338e4b73e8056f00687d367790f56f00d0bb4b73bdd9573dfeffffffacf46f0052734a7350f46f000000e47548f56f006b734a73e0df267708000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000d8f46f00000000000800000000000000000000000000000000000000000000000000e47539bd754e0000000018f56f006992d076ffffffff34000000d8f46f0008000000000000000000e47548f56f002794d076e0f46f000b0000000000000030f56f00 (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006072)"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000001800000051bd754e338e4b73e8056f00687d367790f56f00d0bb4b73bdd9573dfeffffffacf46f0052734a7350f46f000000e47548f56f006b734a73e0df267708000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000d8f46f00000000000800000000000000000000000000000000000000000000000000e47539bd754e0000000018f56f006992d076ffffffff34000000d8f46f0008000000000000000000e47548f56f002794d076e0f46f000b0000000000000030f56f00 (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006072)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-365","type":2,"relevance":1,"name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"argument_baby_1.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","description_v2":["Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"argument_baby_1.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1029","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1029","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-78","type":3,"relevance":1,"name":"Contains ability to read software policies","description":"\"argument_baby_1.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","description_v2":["\"argument_baby_1.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-249","type":2,"relevance":1,"name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"argument_baby_1.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","description_v2":["Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"argument_baby_1.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-247","type":2,"relevance":1,"name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"argument_baby_1.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","description_v2":["Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"argument_baby_1.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-175","type":6,"relevance":1,"name":"Calls an API typically used to load libraries","description":"\"argument_baby_1.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006072)\n \"argument_baby_1.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006072)\n \"argument_baby_1.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006072)\n \"argument_baby_1.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006072)","description_v2":["\"argument_baby_1.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006072)"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006072)"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-176","type":6,"relevance":1,"name":"Calls an API typically used to retrieve function addresses","description":"$27","description_v2":["\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00006072)","\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00006072)"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00006072)"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00006072)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-7","type":2,"relevance":1,"name":"Contains PDB pathways","description":"\"C:\\Users\\HTB\\Desktop\\argument\\Release\\argument.pdb\"","description_v2":["\"C:\\Users\\HTB\\Desktop\\argument\\Release\\argument.pdb\""],"description_v3":[{"type":"text","value":"\"%USERPROFILE%\\Desktop\\argument\\Release\\argument.pdb\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-101","type":2,"relevance":1,"name":"Contains ability to execute Windows APIs","description":"$28","description_v2":["Found reference to API (Indicator: \"GetCurrentProcessId\"; File: \"argument_baby_1.exe\")","Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; File: \"argument_baby_1.exe\")","Found reference to API (Indicator: \"GetModuleHandleW\"; File: \"argument_baby_1.exe\")","Found reference to API (Indicator: \"QueryPerformanceCounter\"; File: \"argument_baby_1.exe\")","Found reference to API (Indicator: \"TerminateProcess\"; File: \"argument_baby_1.exe\")","Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"argument_baby_1.exe\")","Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; File: \"argument_baby_1.exe\")","Found reference to API (Indicator: \"IsDebuggerPresent\"; File: \"argument_baby_1.exe\")","Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; File: \"argument_baby_1.exe\")","Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"argument_baby_1.exe\")","Found reference to API (Indicator: \"InitializeSListHead\"; File: \"argument_baby_1.exe\")","Found reference to API (Indicator: \"UnhandledExceptionFilter\"; File: \"argument_baby_1.exe\")","Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeSListHead\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","Found reference to API (Indicator: \"IsDebuggerPresent\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","Found reference to API (Indicator: \"UnhandledExceptionFilter\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessId\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleW\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceCounter\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsDebuggerPresent\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSListHead\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhandledExceptionFilter\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSListHead\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsDebuggerPresent\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhandledExceptionFilter\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-154","type":0,"relevance":0,"name":"File contains dynamic base/NX flags","description":"\"argument_baby_1.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","description_v2":["\"argument_baby_1.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-7","type":6,"relevance":1,"name":"Loads modules at runtime","description":"\"argument_baby_1.exe\" loaded module \"KERNEL32\" at base 775e0000\n \"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 76c00000\n \"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 76c00000\n \"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 76c00000\n \"argument_baby_1.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 75db0000\n \"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 76c00000\n \"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 76c00000\n \"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 76c00000\n \"argument_baby_1.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 73420000","description_v2":["\"argument_baby_1.exe\" loaded module \"KERNEL32\" at base 775e0000","\"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 76c00000","\"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 76c00000","\"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 76c00000","\"argument_baby_1.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 75db0000","\"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 76c00000","\"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 76c00000","\"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 76c00000","\"argument_baby_1.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 73420000"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" loaded module \"KERNEL32\" at base 775e0000"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 76c00000"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 76c00000"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 76c00000"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 75db0000"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 76c00000"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 76c00000"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 76c00000"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 73420000"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-9","type":10,"relevance":0,"name":"Loads the Bcrypt module DLL","description":"\"argument_baby_1.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75E70000","description_v2":["\"argument_baby_1.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75E70000"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75E70000"}],"origin":"Loaded Module","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-10","type":10,"relevance":0,"name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"argument_baby_1.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77BB0000","description_v2":["\"argument_baby_1.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77BB0000"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77BB0000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-157","type":0,"relevance":0,"name":"Matched Compiler/Packer signature (DIE)","description":"\"argument_baby_1.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"argument_baby_1.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"argument_baby_1.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","description_v2":["\"argument_baby_1.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"","\"argument_baby_1.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"","\"argument_baby_1.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\""],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-146","type":0,"relevance":0,"name":"PE file contains Debug data directory","description":"\"argument_baby_1.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","description_v2":["\"argument_baby_1.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\""],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-80","type":0,"relevance":1,"name":"PE file contains executable sections","description":"\"argument_baby_1.exe\" has an executable section named \".text\"","description_v2":["\"argument_baby_1.exe\" has an executable section named \".text\""],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" has an executable section named \".text\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-95","type":0,"relevance":0,"name":"PE file contains writable sections","description":"\"argument_baby_1.exe\" has an writable section named \".data\"","description_v2":["\"argument_baby_1.exe\" has an writable section named \".data\""],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" has an writable section named \".data\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-96","type":0,"relevance":0,"name":"PE file entrypoint instructions","description":"\"argument_baby_1.exe\" file has an entrypoint instructions - \"call\t0x4016f5,jmp\t0x4012cb,push\tebp,mov\tebp, esp,mov\teax, dword ptr [ebp + 8],push\tesi,mov\tecx, dword ptr [eax + 0x3c],add\tecx, eax,movzx\teax, word ptr [ecx + 0x14],lea\tedx, [ecx + 0x18],add\tedx, eax,movzx\teax, word ptr [ecx + 6],imul\tesi, eax, 0x28,add\tesi, edx,cmp\tedx, esi,je\t0x401492,mov\tecx, dword ptr [ebp + 0xc],cmp\tecx, dword ptr [edx + 0xc],jb\t0x40148b,mov\teax, dword ptr [edx + 8],add\teax, dword ptr [edx + 0xc],cmp\tecx, eax,jb\t0x401497,add\tedx, 0x28,cmp\tedx, esi,jne\t0x40147c,xor\teax, eax,pop\tesi,pop\tebp,ret\t,mov\teax, edx,jmp\t0x401494,push\tesi,call\t0x401c28,test\teax, eax,je\t0x4014c5,mov\teax, dword ptr fs:[0x18],mov\tesi, 0x403024,\"","description_v2":["\"argument_baby_1.exe\" file has an entrypoint instructions - \"call\t0x4016f5,jmp\t0x4012cb,push\tebp,mov\tebp, esp,mov\teax, dword ptr [ebp + 8],push\tesi,mov\tecx, dword ptr [eax + 0x3c],add\tecx, eax,movzx\teax, word ptr [ecx + 0x14],lea\tedx, [ecx + 0x18],add\tedx, eax,movzx\teax, word ptr [ecx + 6],imul\tesi, eax, 0x28,add\tesi, edx,cmp\tedx, esi,je\t0x401492,mov\tecx, dword ptr [ebp + 0xc],cmp\tecx, dword ptr [edx + 0xc],jb\t0x40148b,mov\teax, dword ptr [edx + 8],add\teax, dword ptr [edx + 0xc],cmp\tecx, eax,jb\t0x401497,add\tedx, 0x28,cmp\tedx, esi,jne\t0x40147c,xor\teax, eax,pop\tesi,pop\tebp,ret\t,mov\teax, edx,jmp\t0x401494,push\tesi,call\t0x401c28,test\teax, eax,je\t0x4014c5,mov\teax, dword ptr fs:[0x18],mov\tesi, 0x403024,\""],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" file has an entrypoint instructions - \"call\t0x4016f5,jmp\t0x4012cb,push\tebp,mov\tebp, esp,mov\teax, dword ptr [ebp + 8],push\tesi,mov\tecx, dword ptr [eax + 0x3c],add\tecx, eax,movzx\teax, word ptr [ecx + 0x14],lea\tedx, [ecx + 0x18],add\tedx, eax,movzx\teax, word ptr [ecx + 6],imul\tesi, eax, 0x28,add\tesi, edx,cmp\tedx, esi,je\t0x401492,mov\tecx, dword ptr [ebp + 0xc],cmp\tecx, dword ptr [edx + 0xc],jb\t0x40148b,mov\teax, dword ptr [edx + 8],add\teax, dword ptr [edx + 0xc],cmp\tecx, eax,jb\t0x401497,add\tedx, 0x28,cmp\tedx, esi,jne\t0x40147c,xor\teax, eax,pop\tesi,pop\tebp,ret\t,mov\teax, edx,jmp\t0x401494,push\tesi,call\t0x401c28,test\teax, eax,je\t0x4014c5,mov\teax, dword ptr fs:[0x18],mov\tesi, 0x403024,\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"\"argument_baby_1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","description_v2":["\"argument_baby_1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-153","type":0,"relevance":0,"name":"Uses 32 bit executable PE","description":"\"argument_baby_1.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","description_v2":["\"argument_baby_1.exe\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-177","type":3,"relevance":1,"name":"Opens registry keys","description":"$29","description_v2":["\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\CONHOST.EXE\"; Key: \"\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\BAM\"; Key: \"\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SHELL FOLDERS\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\CONHOST.EXE\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\BAM\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SHELL FOLDERS\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-235","type":6,"relevance":1,"name":"Queries basic information of the specified process","description":"\"argument_baby_1.exe\" queries basic process information of the \"C:\\argument_baby_1.exe\" (UID: 6072)","description_v2":["\"argument_baby_1.exe\" queries basic process information of the \"C:\\argument_baby_1.exe\" (UID: 6072)"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" queries basic process information of the \"C:\\argument_baby_1.exe\" (UID: 6072)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-172","type":3,"relevance":1,"name":"Queries registry keys","description":"$2a","description_v2":["\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RESOURCEPOLICIES\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"ARGUMENT_BABY_1.EXE\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"LONGPATHSENABLED\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"LOGFLAGS\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"SHOWDEBUGINFO\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SHELL FOLDERS\"; Key: \"CACHE\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"TYPE\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"ALTERNATECODEPAGE\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"PREFERREDUILANGUAGES\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\"; Key: \"MACHINEPREFERREDUILANGUAGES\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"SAFEDLLSEARCHMODE\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"ENABLED\"; Value: \"\")","\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"FIPSALGORITHMPOLICY\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RESOURCEPOLICIES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"ARGUMENT_BABY_1.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"LONGPATHSENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"LOGFLAGS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"SHOWDEBUGINFO\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SHELL FOLDERS\"; Key: \"CACHE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"TYPE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"ALTERNATECODEPAGE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"PREFERREDUILANGUAGES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\"; Key: \"MACHINEPREFERREDUILANGUAGES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"SAFEDLLSEARCHMODE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"ENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"FIPSALGORITHMPOLICY\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"summary-29","type":15,"relevance":1,"name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)","description_v2":["The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)"],"description_v3":[{"type":"text","value":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)"}],"origin":"Indicator Combinations","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-263","type":6,"relevance":1,"name":"Touches files","description":"\"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"argument_baby_1.exe\" trying to touch file \"C:\\argument_baby_1.exe\"\n \"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"argument_baby_1.exe\" trying to touch file \"C:\\VCRUNTIME140.DLL\"\n \"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\vcruntime140.dll\"\n \"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"","description_v2":["\"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"","\"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"","\"argument_baby_1.exe\" trying to touch file \"C:\\argument_baby_1.exe\"","\"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"","\"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"","\"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"","\"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"","\"argument_baby_1.exe\" trying to touch file \"C:\\VCRUNTIME140.DLL\"","\"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\vcruntime140.dll\"","\"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\""],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" trying to touch file \"%WINDIR%\\System32\\WOW64LOG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\""},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" trying to touch file \"C:\\argument_baby_1.exe\""},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\""},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\""},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" trying to touch file \"C:\\VCRUNTIME140.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\vcruntime140.dll\""},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-126","type":6,"relevance":3,"name":"Tries to access non-existent files (executable)","description":"\"argument_baby_1.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"argument_baby_1.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.DLL\"\n \"argument_baby_1.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"argument_baby_1.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"","description_v2":["\"argument_baby_1.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"","\"argument_baby_1.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.DLL\"","\"argument_baby_1.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"","\"argument_baby_1.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\""],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" trying to access non-existent file \"%WINDIR%\\System32\\WOW64LOG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":3,"name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","description_v2":["Pattern match: \"http://www.w3.org/2001/xmlschema-instance\""],"description_v3":[{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/xmlschema-instance\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-55","type":7,"relevance":1,"name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: ce5f3254611a8c095a3d821d44539877\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","description_v2":["Observed JA3 fingerprint: ce5f3254611a8c095a3d821d44539877","Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad"],"description_v3":[{"type":"text","value":"Observed JA3 fingerprint: ce5f3254611a8c095a3d821d44539877"},{"type":"linebreak"},{"type":"text","value":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e"},{"type":"linebreak"},{"type":"text","value":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad"}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-54","type":7,"relevance":1,"name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","description_v2":["Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]"],"description_v3":[{"type":"text","value":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]"}],"origin":"Network Traffic","attck_id":"T1573","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-103","type":6,"relevance":3,"name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"argument_baby_1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","description_v2":["\"argument_baby_1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-78","type":2,"relevance":1,"name":"Contains ability to capture screen (API string)","description":"$2b","description_v2":["Found reference to API \"\" (Indicator: \"GetDC\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"GetDC\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateDC\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateDC\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"BitBlt\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"\" (Indicator: \"GetDC\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"GetDC\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateDC\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateDC\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"BitBlt\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1113","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1113","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-85","type":2,"relevance":1,"name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"argument_baby_1.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"argument_baby_1.exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"argument_baby_1.exe\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","description_v2":["Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"argument_baby_1.exe\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"argument_baby_1.exe\")","Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"argument_baby_1.exe\")","Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-427","type":2,"relevance":1,"name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"argument_baby_1.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","description_v2":["Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"argument_baby_1.exe\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-474","type":2,"relevance":1,"name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\argument_baby_1.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")","description_v2":["Found string \"\\Device\\HarddiskVolume2\\argument_baby_1.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Z:\\argument_baby_1.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006072.00000000.136908.00900000.00000004.mdmp, 00000000-00006072.00000002.140749.00900000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-316","type":2,"relevance":1,"name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"argument_baby_1.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")","description_v2":["Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"argument_baby_1.exe\")","Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"argument_baby_1.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006072.00000002.140749.00DB2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-173","type":3,"relevance":1,"name":"Queries services related registry keys","description":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","description_v2":["\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"static-18","type":0,"relevance":10,"name":"Matched Compiler/Packer signature","description":"\"argument_baby_1.exe\" was detected as \"VC8 -> Microsoft Corporation\"","description_v2":["\"argument_baby_1.exe\" was detected as \"VC8 -> Microsoft Corporation\""],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" was detected as \"VC8 -> Microsoft Corporation\""}],"origin":"Static Parser","attck_id":"T1027.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"registry-26","type":3,"relevance":2,"name":"Reads the windows installation language","description":"\"argument_baby_1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","description_v2":["\"argument_baby_1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")"}],"origin":"Registry Access","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Detection/Stealthyness","identifier":"api-9","type":6,"relevance":4,"name":"Queries process information","description":"\"argument_baby_1.exe\" queried SystemProcessInformation at 00000000-00006072-00000C14-1148509353 [PID: 6072]\n \"argument_baby_1.exe\" queried SystemProcessInformation at 00000000-00006072-00000C14-1148518366 [PID: 6072]\n \"argument_baby_1.exe\" queried SystemProcessInformation at 00000000-00006072-00000C14-1148821269 [PID: 6072]\n \"argument_baby_1.exe\" queried SystemProcessInformation at 00000000-00006072-00000C14-1148830559 [PID: 6072]","description_v2":["\"argument_baby_1.exe\" queried SystemProcessInformation at 00000000-00006072-00000C14-1148509353 [PID: 6072]","\"argument_baby_1.exe\" queried SystemProcessInformation at 00000000-00006072-00000C14-1148518366 [PID: 6072]","\"argument_baby_1.exe\" queried SystemProcessInformation at 00000000-00006072-00000C14-1148821269 [PID: 6072]","\"argument_baby_1.exe\" queried SystemProcessInformation at 00000000-00006072-00000C14-1148830559 [PID: 6072]"],"description_v3":[{"type":"text","value":"\"argument_baby_1.exe\" queried SystemProcessInformation at 00000000-00006072-00000C14-1148509353 [PID: 6072]"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" queried SystemProcessInformation at 00000000-00006072-00000C14-1148518366 [PID: 6072]"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" queried SystemProcessInformation at 00000000-00006072-00000C14-1148821269 [PID: 6072]"},{"type":"linebreak"},{"type":"text","value":"\"argument_baby_1.exe\" queried SystemProcessInformation at 00000000-00006072-00000C14-1148830559 [PID: 6072]"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-1","type":0,"relevance":1,"name":"Imports suspicious APIs","description":"GetModuleHandleW\n TerminateProcess\n IsDebuggerPresent\n UnhandledExceptionFilter","description_v2":["GetModuleHandleW","TerminateProcess","IsDebuggerPresent","UnhandledExceptionFilter"],"description_v3":[{"type":"text","value":"GetModuleHandleW"},{"type":"linebreak"},{"type":"text","value":"TerminateProcess"},{"type":"linebreak"},{"type":"text","value":"IsDebuggerPresent"},{"type":"linebreak"},{"type":"text","value":"UnhandledExceptionFilter"}],"origin":"Static Parser","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":true,"allow_sample_tampering":true,"network_mode":"default","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":180,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":"Windows 10","windows_version_edition":"Professional","windows_version_service_pack":null,"windows_version_version":"10.0 (build 16299)","windows_version_bitness":"64","custom_date_time":null,"sandbox_version":"12.1.1","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[],"icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","visualization":"$2c","classification":["32.2% (.EXE) Win64 Executable (generic)","20.1% (.DLL) Win32 Dynamic Link Library (generic)","15.4% (.EXE) Win16 NE executable (generic)","13.7% (.EXE) Win32 Executable (generic)","6.2% (.EXE) OS/2 Executable (generic)"],"dns_requests":[],"contacted_hosts":[],"contacted_countries":{"countries":[],"coordinates":[]},"port_infos":[],"extracted_strings":{"all":[{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"JWQgKyAlZCArICVkICsgJWQgKyAlZCA9ICVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcY29uaG9zdC5leGU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYQ0FB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUFB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUFD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSVo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUFo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHN4ZGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHZvbHRtZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHp6emRiZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCcxODFFMVYxYzF0MQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"MTYyOTAuMTUz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"MTcwMDI4MTUzNA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"MUAyWDJUNlg2dDZ4Ng==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"NTE1QDVXNV01YzVpNW81dTV7NQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"NTY2QzZrNn02","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"NjE3OjdON1Q3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"OUA6RTpZOmM6bDo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyY7YjtsO3U7fjs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCw8NjxJPFI8XTxkPHc8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"PD94bWwgdmVyc2lvbj0nMS4wJyBlbmNvZGluZz0nVVRGLTgnIHN0YW5kYWxvbmU9J3llcyc/Pjxhc3NlbWJseSB4bWxucz0ndXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEnIG1hbmlmZXN0VmVyc2lvbj0nMS4wJz4gIDx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4gICAgPHNlY3VyaXR5PiAgICAgIDxyZXF1ZXN0ZWRQcml2aWxlZ2VzPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSdhc0ludm9rZXInIHVpQWNjZXNzPSdmYWxzZScgLz4gICAgICA8L3JlcXVlc3RlZFByaXZpbGVnZXM+ICAgIDwvc2VjdXJpdHk+ICA8L3RydXN0SW5mbz48L2Fzc2VtYmx5Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSA9MD1APVA9WT1mPWw9cj14PX49","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19hY3J0X2lvYl9mdW5j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19jdXJyZW50X2V4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19jdXJyZW50X2V4Y2VwdGlvbl9jb250ZXh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19fYXJnYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19fYXJndg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19jb21tb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXR1c2VybWF0aGVycg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zdGRpb19jb21tb25fdmZwcmludGY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zdGRpb19jb21tb25fdmZzY2FuZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2NvbmZpZ3RocmVhZGxvY2FsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2NvbmZpZ3VyZV9uYXJyb3dfYXJndg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2NvbnRyb2xmcF9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2NydF9hdGV4aXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2V4Y2VwdF9oYW5kbGVyNF9jb21tb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2dldF9pbml0aWFsX25hcnJvd19lbnZpcm9ubWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2luaXRpYWxpemVfbmFycm93X2Vudmlyb25tZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2luaXRpYWxpemVfb25leGl0X3RhYmxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2luaXR0ZXJt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2luaXR0ZXJtX2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3JlZ2lzdGVyX29uZXhpdF9mdW5jdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3JlZ2lzdGVyX3RocmVhZF9sb2NhbF9leGVfYXRleGl0X2NhbGxiYWNr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3NlaF9maWx0ZXJfZXhl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3NldF9hcHBfdHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3NldF9mbW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3NldF9uZXdfbW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWdncmVzc2l2ZU1UQVRlc3Rpbmc=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJuYXRlQ29kZVBhZ2U=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jcnQtaGVhcC1sMS0xLTAuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jcnQtbG9jYWxlLWwxLTEtMC5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jcnQtbWF0aC1sMS0xLTAuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jcnQtcnVudGltZS1sMS0xLTAuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jcnQtc3RkaW8tbDEtMS0wLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXJlRmlsZUFwaXNBTlNJ","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnRfYmFieV8x","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnRfYmFieV8xLmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxEZXNrdG9wXGFyZ3VtZW50XFJlbGVhc2VcYXJndW1lbnQucGRi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhcmd1bWVudF9iYWJ5Xy5leGU=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sVGltZXI=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV2FpdA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV29yaw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDbGFzc09iamVjdA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRFeFc=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlRXhX","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlVw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU3ltYm9saWNMaW5rVw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXIgTnVtYmVyIDEgOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXIgTnVtYmVyIDIgOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXIgTnVtYmVyIDMgOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXIgTnVtYmVyIDQgOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXIgTnVtYmVyIDUgOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzU2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hQcm9jZXNzV3JpdGVCdWZmZXJz","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnlXaGVuQ2FsbGJhY2tSZXR1cm5z","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3Nvck51bWJlcg==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50NjQ=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkV4","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNMaXN0SGVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNSV0xvY2s=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VFeGVjdXRlT25jZQ==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExhbmd1YWdlRmFsbGJhY2s=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNEZWJ1Z2dlclByZXNlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNQcm9jZXNzb3JGZWF0dXJlUHJlc2VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdFeA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ1BhdGhzRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TURNRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb3J0","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"bnRkbGwuZGxs","type":"Unicode","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUNvdW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVjeWNsZUJpbg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2VQb2xpY2llcw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsR2V0VmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0RlYnVnSW5mbw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZUNT","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZVNSVw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VibWl0VGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGVybWluYXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ5QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"VkNSVU5USU1FMTQwLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclRocmVhZHBvb2xUaW1lckNhbGxiYWNrcw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUFsbENvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null}],"interesting":[{"value":"JVdJTkRJUiVcU3lzdGVtMzJcY29uaG9zdC5leGU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OUA6RTpZOmM6bDo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"PD94bWwgdmVyc2lvbj0nMS4wJyBlbmNvZGluZz0nVVRGLTgnIHN0YW5kYWxvbmU9J3llcyc/Pjxhc3NlbWJseSB4bWxucz0ndXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEnIG1hbmlmZXN0VmVyc2lvbj0nMS4wJz4gIDx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4gICAgPHNlY3VyaXR5PiAgICAgIDxyZXF1ZXN0ZWRQcml2aWxlZ2VzPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSdhc0ludm9rZXInIHVpQWNjZXNzPSdmYWxzZScgLz4gICAgICA8L3JlcXVlc3RlZFByaXZpbGVnZXM+ICAgIDwvc2VjdXJpdHk+ICA8L3RydXN0SW5mbz48L2Fzc2VtYmx5Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19jb21tb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zdGRpb19jb21tb25fdmZwcmludGY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zdGRpb19jb21tb25fdmZzY2FuZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2NvbmZpZ3RocmVhZGxvY2FsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2V4Y2VwdF9oYW5kbGVyNF9jb21tb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2dldF9pbml0aWFsX25hcnJvd19lbnZpcm9ubWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3JlZ2lzdGVyX29uZXhpdF9mdW5jdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3JlZ2lzdGVyX3RocmVhZF9sb2NhbF9leGVfYXRleGl0X2NhbGxiYWNr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3NlaF9maWx0ZXJfZXhl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jcnQtaGVhcC1sMS0xLTAuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jcnQtbG9jYWxlLWwxLTEtMC5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jcnQtbWF0aC1sMS0xLTAuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jcnQtcnVudGltZS1sMS0xLTAuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jcnQtc3RkaW8tbDEtMS0wLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnRfYmFieV8xLmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxEZXNrdG9wXGFyZ3VtZW50XFJlbGVhc2VcYXJndW1lbnQucGRi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhcmd1bWVudF9iYWJ5Xy5leGU=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDbGFzc09iamVjdA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hQcm9jZXNzV3JpdGVCdWZmZXJz","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3Nvck51bWJlcg==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50NjQ=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNMaXN0SGVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VFeGVjdXRlT25jZQ==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExhbmd1YWdlRmFsbGJhY2s=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNEZWJ1Z2dlclByZXNlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNQcm9jZXNzb3JGZWF0dXJlUHJlc2VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUNvdW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVjeWNsZUJpbg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"UnRsR2V0VmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0RlYnVnSW5mbw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null}],"targets":[{"name":"argument_baby_1.exe","strings":[{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"JWQgKyAlZCArICVkICsgJWQgKyAlZCA9ICVk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYQ0FB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUFB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUFD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSVo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUFo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHN4ZGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHZvbHRtZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHp6emRiZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCcxODFFMVYxYzF0MQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"MUAyWDJUNlg2dDZ4Ng==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"NTE1QDVXNV01YzVpNW81dTV7NQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"NTY2QzZrNn02","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"NjE3OjdON1Q3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"OUA6RTpZOmM6bDo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyY7YjtsO3U7fjs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCw8NjxJPFI8XTxkPHc8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"PD94bWwgdmVyc2lvbj0nMS4wJyBlbmNvZGluZz0nVVRGLTgnIHN0YW5kYWxvbmU9J3llcyc/Pjxhc3NlbWJseSB4bWxucz0ndXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEnIG1hbmlmZXN0VmVyc2lvbj0nMS4wJz4gIDx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4gICAgPHNlY3VyaXR5PiAgICAgIDxyZXF1ZXN0ZWRQcml2aWxlZ2VzPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSdhc0ludm9rZXInIHVpQWNjZXNzPSdmYWxzZScgLz4gICAgICA8L3JlcXVlc3RlZFByaXZpbGVnZXM+ICAgIDwvc2VjdXJpdHk+ICA8L3RydXN0SW5mbz48L2Fzc2VtYmx5Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSA9MD1APVA9WT1mPWw9cj14PX49","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19hY3J0X2lvYl9mdW5j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19jdXJyZW50X2V4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19jdXJyZW50X2V4Y2VwdGlvbl9jb250ZXh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19fYXJnYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19fYXJndg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19jb21tb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXR1c2VybWF0aGVycg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zdGRpb19jb21tb25fdmZwcmludGY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zdGRpb19jb21tb25fdmZzY2FuZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2NvbmZpZ3RocmVhZGxvY2FsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2NvbmZpZ3VyZV9uYXJyb3dfYXJndg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2NvbnRyb2xmcF9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2NydF9hdGV4aXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2V4Y2VwdF9oYW5kbGVyNF9jb21tb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2dldF9pbml0aWFsX25hcnJvd19lbnZpcm9ubWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2luaXRpYWxpemVfbmFycm93X2Vudmlyb25tZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2luaXRpYWxpemVfb25leGl0X3RhYmxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2luaXR0ZXJt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2luaXR0ZXJtX2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3JlZ2lzdGVyX29uZXhpdF9mdW5jdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3JlZ2lzdGVyX3RocmVhZF9sb2NhbF9leGVfYXRleGl0X2NhbGxiYWNr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3NlaF9maWx0ZXJfZXhl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3NldF9hcHBfdHlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3NldF9mbW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3NldF9uZXdfbW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jcnQtaGVhcC1sMS0xLTAuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jcnQtbG9jYWxlLWwxLTEtMC5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jcnQtbWF0aC1sMS0xLTAuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jcnQtcnVudGltZS1sMS0xLTAuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jcnQtc3RkaW8tbDEtMS0wLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxEZXNrdG9wXGFyZ3VtZW50XFJlbGVhc2VcYXJndW1lbnQucGRi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXIgTnVtYmVyIDEgOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXIgTnVtYmVyIDIgOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXIgTnVtYmVyIDMgOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXIgTnVtYmVyIDQgOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXIgTnVtYmVyIDUgOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNMaXN0SGVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNEZWJ1Z2dlclByZXNlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNQcm9jZXNzb3JGZWF0dXJlUHJlc2VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUNvdW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"dGVybWluYXRl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null},{"value":"VkNSVU5USU1FMTQwLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"argument_baby_1.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"argument_baby_1.exe:6072","strings":[{"value":"JVdJTkRJUiVcU3lzdGVtMzJcY29uaG9zdC5leGU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWdncmVzc2l2ZU1UQVRlc3Rpbmc=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJuYXRlQ29kZVBhZ2U=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXJlRmlsZUFwaXNBTlNJ","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnRfYmFieV8x","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnRfYmFieV8xLmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sVGltZXI=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV2FpdA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV29yaw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDbGFzc09iamVjdA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRFeFc=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlRXhX","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlVw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU3ltYm9saWNMaW5rVw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzU2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hQcm9jZXNzV3JpdGVCdWZmZXJz","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnlXaGVuQ2FsbGJhY2tSZXR1cm5z","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3Nvck51bWJlcg==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50NjQ=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkV4","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNSV0xvY2s=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VFeGVjdXRlT25jZQ==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExhbmd1YWdlRmFsbGJhY2s=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdFeA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ1BhdGhzRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TURNRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bnRkbGwuZGxs","type":"Unicode","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2VQb2xpY2llcw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsR2V0VmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0RlYnVnSW5mbw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZUNT","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZVNSVw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VibWl0VGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ5QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclRocmVhZHBvb2xUaW1lckNhbGxiYWNrcw==","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUFsbENvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"argument_baby_1.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"screen_2.png","strings":[{"value":"MTYyOTAuMTUz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"MTcwMDI4MTUzNA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhcmd1bWVudF9iYWJ5Xy5leGU=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb3J0","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"UmVjeWNsZUJpbg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null}]}],"image":[]},"http_requests":[],"ftp_requests":[],"irc_requests":[],"strings_resources":["%USERPROFILE%\\Desktop\\argument\\Release\\argument.pdb"],"tags_details":[],"sample_flags":[],"suricata_alerts":[],"version_info":[],"apk_info":null,"apps_info":[{"name":"Access","product":"Microsoft Office 2010","version":"14.0.6024.1000"},{"name":"Acrobat Reader","product":"Adobe Reader","version":"11.0.20.17"},{"name":"Chrome","product":"Google Chrome","version":"122.0.6261.112"},{"name":"Excel","product":"Microsoft Office 2010","version":"14.0.6024.1000"},{"name":"Firefox","product":null,"version":null},{"name":"Flash","product":"Shockwave Flash","version":"32,0,0,114"},{"name":"Hancom Office Hancell","product":null,"version":null},{"name":"Internet Explorer","product":"Internet Explorer","version":"11.00.16299.15"},{"name":"Java","product":"Java(TM) Platform SE 8","version":"8.0.1610.12"},{"name":"OneNote","product":"Microsoft OneNote","version":"14.0.6022.1000"},{"name":"PowerPoint","product":"Microsoft Office 2010","version":"14.0.6009.1000"},{"name":"Word","product":"Microsoft Office 2010","version":"14.0.6024.1000"}],"architecture":"32 Bit","document":{"author":null,"creator":null,"producer":null,"title":null,"subject":null,"pages":0},"packer":"VC8 -> Microsoft Corporation","file_imports":[{"module":"api-ms-win-crt-heap-l1-1-0.dll","functions":["_set_new_mode"]},{"module":"api-ms-win-crt-locale-l1-1-0.dll","functions":["_configthreadlocale"]},{"module":"api-ms-win-crt-math-l1-1-0.dll","functions":["__setusermatherr"]},{"module":"api-ms-win-crt-runtime-l1-1-0.dll","functions":["__p___argc","__p___argv","_c_exit","_cexit","_configure_narrow_argv","_controlfp_s","_crt_atexit","_exit","_get_initial_narrow_environment","_initialize_narrow_environment","_initialize_onexit_table","_initterm","_initterm_e","_register_onexit_function","_register_thread_local_exe_atexit_callback","_seh_filter_exe","_set_app_type","exit","terminate"]},{"module":"api-ms-win-crt-stdio-l1-1-0.dll","functions":["__acrt_iob_func","__p__commode","__stdio_common_vfprintf","__stdio_common_vfscanf","_set_fmode"]},{"module":"KERNEL32.dll","functions":["GetCurrentProcess","GetCurrentProcessId","GetCurrentThreadId","GetModuleHandleW","GetSystemTimeAsFileTime","InitializeSListHead","IsDebuggerPresent","IsProcessorFeaturePresent","QueryPerformanceCounter","SetUnhandledExceptionFilter","TerminateProcess","UnhandledExceptionFilter"]},{"module":"VCRUNTIME140.dll","functions":["__current_exception","__current_exception_context","_except_handler4_common","memset"]}],"osint_tags":[],"osint_references":[],"memory_forensics":[],"language":"ENGLISH","authentihash":"52f0828a747c46e939b74c1579d3ea8b2d528eee28a12d9d86d51557e2761879","entrypoint_bytes":null,"pdb_timestamp":"2023-03-23T04:27:54+00:00","pdb_pathway":"C:\\Users\\HTB\\Desktop\\argument\\Release\\argument.pdb","pdb_guid":"64F90DA66D6C44ECAC36BCAF88F12E5E","file_sections":[{"name":".text","entropy":5.922193970290865,"virtual_address":"0x1000","virtual_size":"0xe84","raw_size":"0x1000","md5":"b6c0a2e43de54729383cfb8f5d88ed3f","characteristics":["IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_MEM_READ"]},{"name":".rdata","entropy":4.235338008090314,"virtual_address":"0x2000","virtual_size":"0xc24","raw_size":"0xe00","md5":"9842a728b2d3f65d5d3b98af22fa4ddd","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"]},{"name":".data","entropy":0.2804011676589459,"virtual_address":"0x3000","virtual_size":"0x398","raw_size":"0x200","md5":"7eadccff87a6df151b99f54d40061d02","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ","IMAGE_SCN_MEM_WRITE"]},{"name":".rsrc","entropy":4.701503258251789,"virtual_address":"0x4000","virtual_size":"0x1e0","raw_size":"0x200","md5":"8d096de51d16180d98ba04bad2632f19","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"]},{"name":".reloc","entropy":5.148511498022342,"virtual_address":"0x5000","virtual_size":"0x174","raw_size":"0x200","md5":"162ea0ae9265fe75996834ce1ffdba51","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_DISCARDABLE","IMAGE_SCN_MEM_READ"]}],"file_exports":[],"error":null,"yara_hits":[],"intelligence_mitre_mappings":[],"entrypoint_preview_count":39,"entrypoint_preview_instructions":["call 0x4016f5","jmp 0x4012cb","push ebp","mov ebp, esp","mov eax, dword ptr [ebp + 8]","push esi","mov ecx, dword ptr [eax + 0x3c]","add ecx, eax","movzx eax, word ptr [ecx + 0x14]","lea edx, [ecx + 0x18]","add edx, eax","movzx eax, word ptr [ecx + 6]","imul esi, eax"," eax, 0x28","add esi, edx","cmp edx, esi","je 0x401492","mov ecx, dword ptr [ebp + 0xc]","cmp ecx, dword ptr [edx + 0xc]","jb 0x40148b","mov eax, dword ptr [edx + 8]","add eax, dword ptr [edx + 0xc]","cmp ecx, eax","jb 0x401497","add edx, 0x28","cmp edx, esi","jne 0x40147c","xor eax, eax","pop esi","pop ebp","ret ","mov eax, edx","jmp 0x401494","push esi","call 0x401c28","test eax, eax","je 0x4014c5","mov eax, dword ptr fs:[0x18]","mov esi, 0x403024"],"file_resources":[{"name":"RT_MANIFEST","rva":"0x4060","size":"0x17d","type":"XML 1.0 document, ASCII text, with CRLF line terminators","language":"english"}],"file_permissions":[],"file_activities":[],"file_receivers":[],"file_data_directories":[{"name":"IMAGE_DIRECTORY_ENTRY_EXPORT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_IMPORT","virtual_address":"0x267c","virtual_size":"0xa0","is_in_section":".rdata"},{"name":"IMAGE_DIRECTORY_ENTRY_RESOURCE","virtual_address":"0x4000","virtual_size":"0x1e0","is_in_section":".rsrc"},{"name":"IMAGE_DIRECTORY_ENTRY_EXCEPTION","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_SECURITY","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_BASERELOC","virtual_address":"0x5000","virtual_size":"0x174","is_in_section":".reloc"},{"name":"IMAGE_DIRECTORY_ENTRY_DEBUG","virtual_address":"0x2260","virtual_size":"0x70","is_in_section":".rdata"},{"name":"IMAGE_DIRECTORY_ENTRY_COPYRIGHT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_GLOBALPTR","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_TLS","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG","virtual_address":"0x21a0","virtual_size":"0x40","is_in_section":".rdata"},{"name":"IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_IAT","virtual_address":"0x2000","virtual_size":"0xc8","is_in_section":".rdata"},{"name":"IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_RESERVED","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null}],"elf_headers":[],"elf_static_symbols":null,"vba_macros":[],"verdict_source":null,"user_comments":[],"email_headers":null,"classification_tags":[],"tags":[],"submissions":[{"submission_id":"6861eacb37f6ceb79d0aba30","filename":"argument_baby_1.exe","url":null,"created_at":"2025-06-30T01:39:23+00:00"},{"submission_id":"683c88b4417c93954c03bd7b","filename":"argument_baby_1.exe","url":null,"created_at":"2025-06-01T17:07:00+00:00"},{"submission_id":"681b848da9568380f207d434","filename":"argument_baby_1.exe","url":null,"created_at":"2025-05-07T16:04:29+00:00"},{"submission_id":"67ff9cfd6726ca53110a16b5","filename":"argument_baby_1.exe","url":null,"created_at":"2025-04-16T12:05:17+00:00"},{"submission_id":"67fd4403f327bfba7300b9ff","filename":"argument_baby_1.exe","url":null,"created_at":"2025-04-14T17:21:07+00:00"},{"submission_id":"67f401482dc8b952dc06b358","filename":"argument_baby_1.exe","url":null,"created_at":"2025-04-07T16:46:00+00:00"},{"submission_id":"67ef30fdee7849ab710a663d","filename":"argument_baby_1.exe","url":null,"created_at":"2025-04-04T01:08:13+00:00"}],"crowdstrike_ai":{"executable_process_memory_analysis":[],"analysis_related_urls":[]},"warnings":["Not all sources for indicator ID \"registry-177\" are available in the report","Not all sources for indicator ID \"api-235\" are available in the report","Not all sources for indicator ID \"registry-172\" are available in the report","Not all sources for indicator ID \"api-263\" are available in the report"],"report_related_files":{"report_json":{"file_name":"report.json","download_url":"/bff/report/67ef30fdee7849ab710a663c/download/files/report_json","file_size":185796},"memory_strings":{"file_name":"mstrings.zip","download_url":"/bff/report/67ef30fdee7849ab710a663c/download/files/memory_strings","file_size":925},"certificate":null,"network_pcap":{"file_name":"network.pcap","download_url":"/bff/report/67ef30fdee7849ab710a663c/download/files/network_pcap","file_size":43135},"memory_dumps":{"file_name":"memory_dumps_all.zip","download_url":"/bff/report/67ef30fdee7849ab710a663c/download/files/memory_dumps","file_size":233684}},"system_resource_monitor":{"cpu_usage":[{"x":0,"y":14.0989},{"x":1,"y":6.32841},{"x":2,"y":7.25431},{"x":3,"y":7.73457},{"x":4,"y":6.01584},{"x":5,"y":7.89086},{"x":6,"y":6.64078},{"x":7,"y":5.93769},{"x":8,"y":7.81295},{"x":9,"y":6.17218},{"x":10,"y":7.81264}],"memory_usage":[{"x":0,"y":15.8204},{"x":1,"y":15.8533},{"x":2,"y":15.7771},{"x":3,"y":15.753},{"x":4,"y":15.7282},{"x":5,"y":15.6102},{"x":6,"y":15.6159},{"x":7,"y":15.6066},{"x":8,"y":15.6104},{"x":9,"y":15.6077},{"x":10,"y":15.5531}],"disk_read":[{"x":0,"y":598320},{"x":1,"y":3276.77},{"x":2,"y":4907.53},{"x":3,"y":0},{"x":4,"y":409.603},{"x":5,"y":217240},{"x":6,"y":3686.38},{"x":7,"y":0},{"x":8,"y":0},{"x":9,"y":0},{"x":10,"y":18841.7}],"disk_write":[{"x":0,"y":3516820},{"x":1,"y":194661},{"x":2,"y":315411},{"x":3,"y":449483},{"x":4,"y":118785},{"x":5,"y":110182},{"x":6,"y":319282},{"x":7,"y":126923},{"x":8,"y":22783.9},{"x":9,"y":33484.5},{"x":10,"y":73984.2}],"network_packets":[{"x":0,"y":1.08615},{"x":1,"y":1.09999},{"x":2,"y":0},{"x":3,"y":0.0999997},{"x":4,"y":0},{"x":5,"y":0},{"x":6,"y":0},{"x":7,"y":0.0999988},{"x":8,"y":0},{"x":9,"y":0},{"x":10,"y":0.200001}],"page_file":[{"x":0,"y":794550000},{"x":1,"y":798884000},{"x":2,"y":792465000},{"x":3,"y":790462000},{"x":4,"y":789451000},{"x":5,"y":778670000},{"x":6,"y":778559000},{"x":7,"y":778277000},{"x":8,"y":778478000},{"x":9,"y":778310000},{"x":10,"y":772432000}]},"external_reports":null,"available_buttons":{"report_false_positive":true},"hashes_to_context_check":["dc6267608ddfcc5c80571ccd46475a03fb667baf8620d0e91c93ccacacf97ef6"]}}]]}] 1f:null 23:[["$","title","0",{"children":"Suspicious — Falcon Sandbox Report 67ef30fdee78… — Score 35/100 — Sample dc6267608ddf… | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sandbox report 67ef30fdee78…. Threat score 35/100. 0 malicious and 2 suspicious behavioral indicators across 47 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/dc6267608ddfcc5c80571ccd46475a03fb667baf8620d0e91c93ccacacf97ef6/67ef30fdee7849ab710a663c"}],["$","meta","4",{"property":"og:title","content":"Suspicious — Falcon Sandbox Report 67ef30fdee78… — Score 35/100 — Sample dc6267608ddf… | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sandbox report 67ef30fdee78…. Threat score 35/100. 0 malicious and 2 suspicious behavioral indicators across 47 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/dc6267608ddfcc5c80571ccd46475a03fb667baf8620d0e91c93ccacacf97ef6/67ef30fdee7849ab710a663c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious — Falcon Sandbox Report 67ef30fdee78… — Score 35/100 — Sample dc6267608ddf… | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sandbox report 67ef30fdee78…. Threat score 35/100. 0 malicious and 2 suspicious behavioral indicators across 47 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]